SmartHawk

1.0

低危

该样本未表现出任何异常！

ecb676975de64a20d97af03f17d0f33d400981bd426e0f446d9a473ec3ce45fe

b09f858c822bd1278f6eb9513101edee.exe

分析耗时

23s

最近分析

文件大小

901.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

This executable has a PDB path (1 个事件)

pdb_path

C:\buildslave\unity\build\artifacts\UnityCrashHandler\release_win32\UnityCrashHandler32.pdb

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

AFX_DIALOG_LAYOUT

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-18 10:39:09

Imports

Library USER32.dll:

• 0x46c2c0 SetWindowPos

• 0x46c2c4 OffsetRect

• 0x46c2c8 UnionRect

• 0x46c2cc AdjustWindowRect

• 0x46c2d0 SetWindowTextW

• 0x46c2d4 SetForegroundWindow

• 0x46c2d8 SendDlgItemMessageA

• 0x46c2dc SendMessageW

• 0x46c2e0 DialogBoxParamA

• 0x46c2e4 GetDlgItem

• 0x46c2e8 InflateRect

• 0x46c2ec GetWindowLongA

• 0x46c2f0 GetIconInfo

• 0x46c2f4 LoadImageA

• 0x46c2f8 CreateIconFromResourceEx

• 0x46c2fc LookupIconIdFromDirectoryEx

• 0x46c300 EndDialog

Library KERNEL32.dll:

• 0x46c014 VirtualProtect

• 0x46c018 GetVersionExW

• 0x46c01c UnregisterWait

• 0x46c020 RegisterWaitForSingleObject

• 0x46c024 SetThreadAffinityMask

• 0x46c028 GetProcessAffinityMask

• 0x46c02c GetNumaHighestNodeNumber

• 0x46c030 DeleteTimerQueueTimer

• 0x46c034 ChangeTimerQueueTimer

• 0x46c038 CreateTimerQueueTimer

• 0x46c03c GetLogicalProcessorInformation

• 0x46c040 SignalObjectAndWait

• 0x46c044 CreateTimerQueue

• 0x46c048 WriteConsoleW

• 0x46c04c GetProcessHeap

• 0x46c050 FreeEnvironmentStringsW

• 0x46c054 GetEnvironmentStringsW

• 0x46c058 GetCommandLineA

• 0x46c05c GetOEMCP

• 0x46c060 GetACP

• 0x46c064 IsValidCodePage

• 0x46c068 FindFirstFileExW

• 0x46c06c HeapQueryInformation

• 0x46c070 HeapSize

• 0x46c074 HeapReAlloc

• 0x46c078 EnumSystemLocalesW

• 0x46c07c GetUserDefaultLCID

• 0x46c080 IsValidLocale

• 0x46c084 HeapFree

• 0x46c088 HeapAlloc

• 0x46c08c FreeLibraryAndExitThread

• 0x46c090 GetModuleFileNameW

• 0x46c094 CloseHandle

• 0x46c098 RaiseException

• 0x46c09c GetCurrentThread

• 0x46c0a0 OpenThread

• 0x46c0a4 GetThreadTimes

• 0x46c0a8 EnterCriticalSection

• 0x46c0ac LeaveCriticalSection

• 0x46c0b0 InitializeCriticalSectionAndSpinCount

• 0x46c0b4 TryEnterCriticalSection

• 0x46c0b8 DeleteCriticalSection

• 0x46c0bc WaitForSingleObjectEx

• 0x46c0c0 SwitchToThread

• 0x46c0c4 CreateThread

• 0x46c0c8 GetCurrentThreadId

• 0x46c0cc SetThreadPriority

• 0x46c0d0 GetThreadPriority

• 0x46c0d4 VerSetConditionMask

• 0x46c0d8 FreeLibrary

• 0x46c0dc GetModuleFileNameA

• 0x46c0e0 GetModuleHandleW

• 0x46c0e4 GetProcAddress

• 0x46c0e8 LoadLibraryA

• 0x46c0ec MultiByteToWideChar

• 0x46c0f0 WideCharToMultiByte

• 0x46c0f4 GetEnvironmentVariableA

• 0x46c0f8 GetCurrentDirectoryA

• 0x46c0fc GetFileAttributesA

• 0x46c100 OutputDebugStringA

• 0x46c104 GetLastError

• 0x46c108 SetLastError

• 0x46c10c WaitForSingleObject

• 0x46c110 CreateEventW

• 0x46c114 GetCurrentProcess

• 0x46c118 GetCurrentProcessId

• 0x46c11c SuspendThread

• 0x46c120 ResumeThread

• 0x46c124 GetThreadContext

• 0x46c128 ReadProcessMemory

• 0x46c12c LocalFree

• 0x46c130 VerifyVersionInfoW

• 0x46c134 CreateToolhelp32Snapshot

• 0x46c138 Thread32First

• 0x46c13c Thread32Next

• 0x46c140 SetEvent

• 0x46c144 WaitForMultipleObjectsEx

• 0x46c148 Sleep

• 0x46c14c TerminateProcess

• 0x46c150 GetExitCodeProcess

• 0x46c154 CreateProcessW

• 0x46c158 GetProcessId

• 0x46c15c GetThreadId

• 0x46c160 OpenProcess

• 0x46c164 GetStdHandle

• 0x46c168 CreateFileW

• 0x46c16c DeleteFileW

• 0x46c170 GetDiskFreeSpaceExW

• 0x46c174 GetFileAttributesW

• 0x46c178 GetFileSize

• 0x46c17c ReadFile

• 0x46c180 GetTempPathW

• 0x46c184 GetSystemTime

• 0x46c188 GetSystemTimeAsFileTime

• 0x46c18c CopyFileExW

• 0x46c190 AllocConsole

• 0x46c194 SetErrorMode

• 0x46c198 GetCommandLineW

• 0x46c19c FileTimeToLocalFileTime

• 0x46c1a0 FindClose

• 0x46c1a4 FindFirstFileW

• 0x46c1a8 FindNextFileW

• 0x46c1ac FlushFileBuffers

• 0x46c1b0 GetFileTime

• 0x46c1b4 WriteFile

• 0x46c1b8 InitializeCriticalSection

• 0x46c1bc CreateEventA

• 0x46c1c0 TerminateThread

• 0x46c1c4 GetExitCodeThread

• 0x46c1c8 GlobalMemoryStatusEx

• 0x46c1cc GetSystemInfo

• 0x46c1d0 GetModuleHandleA

• 0x46c1d4 LoadLibraryExW

• 0x46c1d8 LoadResource

• 0x46c1dc LockResource

• 0x46c1e0 SizeofResource

• 0x46c1e4 LoadLibraryW

• 0x46c1e8 FileTimeToDosDateTime

• 0x46c1ec lstrlenA

• 0x46c1f0 FindResourceA

• 0x46c1f4 EnumResourceNamesA

• 0x46c1f8 IsDebuggerPresent

• 0x46c1fc QueryPerformanceCounter

• 0x46c200 QueryPerformanceFrequency

• 0x46c204 ReleaseSemaphore

• 0x46c208 TlsAlloc

• 0x46c20c TlsFree

• 0x46c210 VirtualAlloc

• 0x46c214 VirtualFree

• 0x46c218 VirtualQuery

• 0x46c21c SetFilePointerEx

• 0x46c220 GetConsoleCP

• 0x46c224 GetConsoleMode

• 0x46c228 SetConsoleCtrlHandler

• 0x46c22c GetFileType

• 0x46c230 SetStdHandle

• 0x46c234 GetModuleHandleExW

• 0x46c238 ExitProcess

• 0x46c23c InterlockedFlushSList

• 0x46c240 InterlockedPushEntrySList

• 0x46c244 RtlUnwind

• 0x46c248 InterlockedPopEntrySList

• 0x46c24c QueryDepthSList

• 0x46c250 UnregisterWaitEx

• 0x46c254 GetLocaleInfoW

• 0x46c258 LCMapStringW

• 0x46c25c CompareStringW

• 0x46c260 GetTickCount

• 0x46c264 TlsSetValue

• 0x46c268 TlsGetValue

• 0x46c26c DecodePointer

• 0x46c270 EncodePointer

• 0x46c274 FormatMessageW

• 0x46c278 VirtualQueryEx

• 0x46c27c GetCPInfo

• 0x46c280 DuplicateHandle

• 0x46c284 GetStringTypeW

• 0x46c288 InitializeSListHead

• 0x46c28c GetStartupInfoW

• 0x46c290 SetUnhandledExceptionFilter

• 0x46c294 UnhandledExceptionFilter

• 0x46c298 IsProcessorFeaturePresent

• 0x46c29c ResetEvent

Library SHELL32.dll:

• 0x46c2b4 CommandLineToArgvW

• 0x46c2b8 SHCreateDirectoryExW

Library ole32.dll:

• 0x46c344 CoInitializeEx

• 0x46c348 CoTaskMemFree

• 0x46c34c CoCreateGuid

Library PSAPI.DLL:

• 0x46c2a4 GetModuleFileNameExW

• 0x46c2a8 GetProcessMemoryInfo

• 0x46c2ac GetPerformanceInfo

Library ADVAPI32.dll:

• 0x46c000 GetUserNameW

• 0x46c004 GetUserNameA

Library WININET.dll:

• 0x46c324 InternetOpenA

• 0x46c328 HttpSendRequestA

• 0x46c32c HttpOpenRequestA

• 0x46c330 InternetConnectA

• 0x46c334 InternetCrackUrlA

• 0x46c338 HttpQueryInfoA

• 0x46c33c InternetCloseHandle

Library GDI32.dll:

• 0x46c00c GetObjectA

Library VERSION.dll:

• 0x46c308 GetFileVersionInfoSizeW

• 0x46c30c GetFileVersionInfoSizeA

• 0x46c310 GetFileVersionInfoW

• 0x46c314 VerQueryValueA

• 0x46c318 VerQueryValueW

• 0x46c31c GetFileVersionInfoA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51966	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62319	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.