6.0
高危
该样本未表现出任何异常！
重新分析
更多

718f531d7a3c91b778ed9e3781275e8b98a6fb624a25709e05f2c798b273564c

b49341a2075363c69f87fe2dc98ff52c.exe

分析耗时

109s

最近分析

文件大小

1.6MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1620985520.39025
IsDebuggerPresent
failed 0 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name GIF
行为判定
动态指标
Performs some HTTP requests (1 个事件)
request GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Allocates read-write-execute memory (usually to unpack itself) (9 个事件)
Time & API Arguments Status Return Repeated
1620985520.29725
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74601000
success 0 0
1620985532.67225
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74f91000
success 0 0
1620985532.71825
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x742a1000
success 0 0
1620985532.84325
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74821000
success 0 0
1620985533.12525
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x747c1000
success 0 0
1620985533.12525
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x747b1000
success 0 0
1620985533.12525
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74791000
success 0 0
1620985543.07825
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74741000
success 0 0
1621013064.36727
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004280000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1620985520.12525
GetDiskFreeSpaceExW
root_path: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\
free_bytes_available: 19606556672
total_number_of_free_bytes: 19606556672
total_number_of_bytes: 34252779520
success 1 0
Creates executable files on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_is6D2D\isscript.msi
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_is6D2D\SoundFont Engine Patch.msi
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.187958066143551 section {'size_of_data': '0x0000c000', 'virtual_address': '0x0002d000', 'entropy': 7.187958066143551, 'name': '.rsrc', 'virtual_size': '0x0000b918'} description A section with a high entropy has been found
entropy 0.23076923076923078 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 个事件)
Time & API Arguments Status Return Repeated
1620985533.17225
LookupPrivilegeValueW
system_name:
privilege_name: SeShutdownPrivilege
success 1 0
1620985533.79725
LookupPrivilegeValueW
system_name:
privilege_name: SeCreateTokenPrivilege
success 1 0
1620985533.79725
LookupPrivilegeValueW
system_name:
privilege_name: SeAssignPrimaryTokenPrivilege
success 1 0
1620985533.81225
LookupPrivilegeValueW
system_name:
privilege_name: SeMachineAccountPrivilege
success 1 0
1620985533.81225
LookupPrivilegeValueW
system_name:
privilege_name: SeTcbPrivilege
success 1 0
1620985533.81225
LookupPrivilegeValueW
system_name:
privilege_name: SeSecurityPrivilege
success 1 0
1620985533.81225
LookupPrivilegeValueW
system_name:
privilege_name: SeTakeOwnershipPrivilege
success 1 0
1620985533.81225
LookupPrivilegeValueW
system_name:
privilege_name: SeLoadDriverPrivilege
success 1 0
1620985533.81225
LookupPrivilegeValueW
system_name:
privilege_name: SeBackupPrivilege
success 1 0
1620985533.81225
LookupPrivilegeValueW
system_name:
privilege_name: SeRestorePrivilege
success 1 0
1620985533.81225
LookupPrivilegeValueW
system_name:
privilege_name: SeShutdownPrivilege
success 1 0
1620985533.81225
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1620985533.82825
LookupPrivilegeValueW
system_name:
privilege_name: SeRemoteShutdownPrivilege
success 1 0
1620985533.82825
LookupPrivilegeValueW
system_name:
privilege_name: SeEnableDelegationPrivilege
success 1 0
1620985533.82825
LookupPrivilegeValueW
system_name:
privilege_name: SeManageVolumePrivilege
success 1 0
1620985533.82825
LookupPrivilegeValueW
system_name:
privilege_name: SeCreateGlobalPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (4 个事件)
host 113.108.239.161
host 113.108.239.162
host 172.217.24.14
host 203.208.40.41
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1621013023.22727
SetWindowsHookExW
thread_identifier: 0
callback_function: 0x00000000ff35ae10
module_address: 0x00000000ff2b0000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 131517 0
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 203.208.40.41:443
dead_host 192.168.56.101:49182
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2002-06-25 02:22:31

Imports

Library VERSION.dll:
• 0x420400 VerQueryValueA
• 0x420404 GetFileVersionInfoA
• 0x42040c VerLanguageNameA
Library SHELL32.dll:
• 0x4202e0 SHGetMalloc
• 0x4202e8 SHBrowseForFolderA
Library COMCTL32.dll:
• 0x42004c
Library KERNEL32.dll:
• 0x4200b0 lstrcatA
• 0x4200b4 WriteFile
• 0x4200b8 CreateEventA
• 0x4200bc CompareStringW
• 0x4200c0 GetVersionExA
• 0x4200c4 Sleep
• 0x4200c8 CompareStringA
• 0x4200cc SetFileTime
• 0x4200d8 SetFilePointer
• 0x4200dc GetProcAddress
• 0x4200e0 LoadLibraryA
• 0x4200e4 MapViewOfFile
• 0x4200e8 UnmapViewOfFile
• 0x4200ec CreateFileMappingA
• 0x4200f0 LockResource
• 0x4200f4 SetFileAttributesA
• 0x4200f8 FreeLibrary
• 0x4200fc FindResourceA
• 0x420100 CreateProcessA
• 0x420104 GetModuleFileNameA
• 0x420108 lstrcmpA
• 0x420110 GlobalHandle
• 0x420114 SetLastError
• 0x42011c DeleteFileA
• 0x420120 lstrlenW
• 0x420124 WaitForSingleObject
• 0x420128 GetSystemInfo
• 0x42012c IsValidCodePage
• 0x420130 FlushFileBuffers
• 0x420134 LocalFree
• 0x420138 FormatMessageA
• 0x42013c GetDiskFreeSpaceA
• 0x420140 _lclose
• 0x420144 OpenFile
• 0x420148 GetDriveTypeA
• 0x42014c CreateDirectoryA
• 0x420150 GetFileAttributesA
• 0x420154 RemoveDirectoryA
• 0x420158 GetExitCodeProcess
• 0x42015c GetCurrentProcess
• 0x420160 GetCurrentThread
• 0x420164 GetLocaleInfoA
• 0x420168 lstrcpyA
• 0x420170 lstrlenA
• 0x420174 CreateFileA
• 0x420178 GetFileSize
• 0x42017c GlobalAlloc
• 0x420180 CloseHandle
• 0x420184 GlobalLock
• 0x420188 ReadFile
• 0x42018c GlobalUnlock
• 0x420190 GlobalFree
• 0x420194 GetLastError
• 0x420198 WideCharToMultiByte
• 0x42019c CopyFileA
• 0x4201a0 MultiByteToWideChar
• 0x4201a4 CreateThread
• 0x4201a8 GetExitCodeThread
• 0x4201ac GetTickCount
• 0x4201b0 lstrcmpiA
• 0x4201bc GetTempPathA
• 0x4201c0 SetErrorMode
• 0x4201c8 GetTempFileNameA
• 0x4201d4 MoveFileA
• 0x4201d8 LoadResource
• 0x4201dc SizeofResource
• 0x4201e0 SetHandleCount
• 0x4201e4 RaiseException
• 0x4201f8 GetOEMCP
• 0x420200 GetStdHandle
• 0x420204 GetACP
• 0x420208 GetCPInfo
• 0x420218 IsBadWritePtr
• 0x42021c VirtualAlloc
• 0x420220 VirtualFree
• 0x420224 HeapCreate
• 0x420228 HeapDestroy
• 0x420230 TlsGetValue
• 0x420234 TlsAlloc
• 0x420238 TlsSetValue
• 0x42023c GetCurrentThreadId
• 0x420240 HeapSize
• 0x420244 HeapReAlloc
• 0x420250 GetVersion
• 0x420254 GetCommandLineA
• 0x420258 GetStartupInfoA
• 0x42025c GetModuleHandleA
• 0x420260 TerminateProcess
• 0x420264 ExitProcess
• 0x420268 SetStdHandle
• 0x42026c HeapAlloc
• 0x420270 HeapFree
• 0x420274 RtlUnwind
• 0x420280 ResetEvent
• 0x420284 SetEvent
• 0x420288 lstrcpynA
• 0x42028c SearchPathA
• 0x420290 FindFirstFileA
• 0x420294 VirtualProtect
• 0x420298 VirtualQuery
• 0x42029c FindClose
• 0x4202a0 IsBadReadPtr
• 0x4202a4 GetStringTypeA
• 0x4202a8 GetStringTypeW
• 0x4202ac LCMapStringW
• 0x4202b0 LCMapStringA
• 0x4202b4 IsBadCodePtr
• 0x4202b8 GetFileType
Library USER32.dll:
• 0x4202f0 MessageBoxA
• 0x4202f4 ReleaseDC
• 0x4202f8 GetDC
• 0x4202fc DispatchMessageA
• 0x420300 TranslateMessage
• 0x420304 GetMessageA
• 0x420308 CreateWindowExA
• 0x42030c RegisterClassA
• 0x420310 LoadCursorA
• 0x420314 LoadIconA
• 0x420318 SetTimer
• 0x42031c PostQuitMessage
• 0x420320 KillTimer
• 0x420324 PostMessageA
• 0x420328 DefWindowProcA
• 0x42032c PeekMessageA
• 0x420334 wsprintfA
• 0x420338 GetDesktopWindow
• 0x42033c DialogBoxParamA
• 0x420340 ShowWindow
• 0x420344 GetDlgItem
• 0x420348 EndDialog
• 0x42034c GetWindowDC
• 0x420350 SetWindowPos
• 0x420354 ClientToScreen
• 0x420358 GetClientRect
• 0x42035c SetWindowLongA
• 0x420360 EndPaint
• 0x420364 BeginPaint
• 0x420368 GetWindowLongA
• 0x42036c WaitForInputIdle
• 0x420370 CreateDialogParamA
• 0x420374 CharNextA
• 0x420378 SendDlgItemMessageA
• 0x42037c ExitWindowsEx
• 0x420380 CharPrevA
• 0x420384 LoadStringA
• 0x420388 wvsprintfA
• 0x42038c GetClassInfoA
• 0x420390 UpdateWindow
• 0x420394 SetCursor
• 0x420398 GetDlgItemTextA
• 0x42039c EnableWindow
• 0x4203a0 GetParent
• 0x4203a8 GetWindowTextA
• 0x4203ac MoveWindow
• 0x4203b0 GetWindowPlacement
• 0x4203b4 DrawIcon
• 0x4203b8 GetDlgCtrlID
• 0x4203bc SetWindowTextA
• 0x4203c0 FillRect
• 0x4203c4 GetSysColor
• 0x4203c8 GetSysColorBrush
• 0x4203cc IsDialogMessageA
• 0x4203d0 SendMessageA
• 0x4203d4 GetWindowRect
• 0x4203d8 FindWindowA
• 0x4203dc IntersectRect
• 0x4203e0 SubtractRect
• 0x4203e4 IsWindow
• 0x4203e8 DestroyWindow
• 0x4203ec SetRect
• 0x4203f0 GetSystemMetrics
• 0x4203f4 DestroyIcon
• 0x4203f8 CharLowerBuffA
Library GDI32.dll:
• 0x420054 RealizePalette
• 0x420058 GetDeviceCaps
• 0x42005c CreatePalette
• 0x420064 GetStockObject
• 0x420068 DeleteObject
• 0x42006c DeleteDC
• 0x420070 BitBlt
• 0x420074 SelectObject
• 0x420078 CreateCompatibleDC
• 0x42007c CreateSolidBrush
• 0x420080 CreateFontIndirectA
• 0x420084 GetObjectA
• 0x420088 SetTextColor
• 0x42008c SetBkMode
• 0x420090 GetTextExtentPointA
• 0x420098 CreateDIBitmap
• 0x42009c SelectPalette
Library ADVAPI32.dll:
• 0x420000 EqualSid
• 0x420004 RegQueryValueA
• 0x420008 RegOpenKeyA
• 0x42000c RegCloseKey
• 0x420010 RegQueryValueExA
• 0x420014 OpenThreadToken
• 0x420018 GetTokenInformation
• 0x420020 RegCreateKeyExA
• 0x420024 FreeSid
• 0x420028 RegOpenKeyExA
• 0x42002c RegDeleteValueA
• 0x420030 RegSetValueExA
• 0x420034 RegEnumValueA
• 0x420038 RegDeleteKeyA
• 0x420044 OpenProcessToken
Library ole32.dll:
• 0x420414 CreateItemMoniker
• 0x420418 CoCreateGuid
• 0x42041c StringFromCLSID
• 0x420420 StgIsStorageFile
• 0x420424 StgOpenStorage
• 0x420428 CoTaskMemFree
• 0x42042c CoCreateInstance
• 0x420430 CoUninitialize
• 0x420434 CoInitialize
Library OLEAUT32.dll:
• 0x4202c0 SysReAllocStringLen
• 0x4202c4 SysFreeString
• 0x4202c8 SysAllocString
• 0x4202cc SysAllocStringLen
• 0x4202d0 SysStringLen
• 0x4202d4 VariantClear
• 0x4202d8 VariantChangeType

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49178 14.215.89.35 www.download.windowsupdate.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702

HTTP & HTTPS Requests

URI Data
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT
If-None-Match: "0d8f4f3f6fd71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.