SmartHawk

3.2

中危

1 个模型检测该样本为恶意！

重新分析

下载样本

889e1880b50099332523f8cbdd1c385303711c604af725c8051549e90484b957

b538ba9ebd14ce7fffc2d3e3cd6a28a1.exe

分析耗时

90s

最近分析

文件大小

873.0KB

静态报毒动态报毒 HIGH SCORE

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀时间	查杀版本
McAfee	20190323	6.0.6.653
Alibaba	20190306	0.2.0.3
Baidu	20190318	1.0.0.2
Avast	20190323	18.4.3895.0
Tencent	20190323	1.0.0.1
Kingsoft	20190323	2013.8.14.323
CrowdStrike	20190212	1.0

Checks if process is being debugged by a debugger (11 个事件)

Time & API	Arguments	Status	Return	Repeated
1619860693.608612 IsDebuggerPresent		failed	0	0
1619860693.623612 IsDebuggerPresent		failed	0	0
1619860701.311612 IsDebuggerPresent		failed	0	0
1619860703.404612 IsDebuggerPresent		failed	0	0
1619860707.108612 IsDebuggerPresent		failed	0	0
1619860708.826612 IsDebuggerPresent		failed	0	0
1619860713.264612 IsDebuggerPresent		failed	0	0
1619860713.389612 IsDebuggerPresent		failed	0	0
1619860725.170612 IsDebuggerPresent		failed	0	0
1619860725.186612 IsDebuggerPresent		failed	0	0
1619860726.373612 IsDebuggerPresent		failed	0	0

Uses Windows APIs to generate a cryptographic key (50 out of 71 个事件)

Time & API	Arguments	Status	Return
1619860695.170612 CryptExportKey	crypto_handle: 0x00000000003b6ab0 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860695.889612 CryptExportKey	crypto_handle: 0x00000000003b6c00 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860696.717612 CryptExportKey	crypto_handle: 0x00000000003b6d50 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860696.733612 CryptExportKey	crypto_handle: 0x00000000003b6d50 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860696.748612 CryptExportKey	crypto_handle: 0x00000000003b6d50 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860696.795612 CryptExportKey	crypto_handle: 0x00000000003b6d50 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860696.873612 CryptExportKey	crypto_handle: 0x00000000003b6d50 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860697.029612 CryptExportKey	crypto_handle: 0x00000000003b6dc0 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860697.045612 CryptExportKey	crypto_handle: 0x00000000003b6dc0 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860697.061612 CryptExportKey	crypto_handle: 0x00000000003b6dc0 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860697.639612 CryptExportKey	crypto_handle: 0x000000001b3bc660 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860699.139612 CryptExportKey	crypto_handle: 0x000000001b3bc890 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860699.217612 CryptExportKey	crypto_handle: 0x000000001b3bc890 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860699.248612 CryptExportKey	crypto_handle: 0x000000001b3bc890 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860699.279612 CryptExportKey	crypto_handle: 0x000000001b3bc890 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860699.326612 CryptExportKey	crypto_handle: 0x000000001b3bc890 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860709.467612 CryptExportKey	crypto_handle: 0x000000001b3bcdd0 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860715.748612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.014612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.045612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.076612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.108612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.201612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.217612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.248612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.576612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.592612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.608612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.639612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.967612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.983612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860716.998612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860717.014612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860717.389612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860717.389612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860717.404612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860717.451612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860717.686612 CryptExportKey	crypto_handle: 0x000000001b431210 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.045612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.045612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.076612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.311612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.326612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.342612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.373612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.576612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.592612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.608612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.623612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619860720.983612 CryptExportKey	crypto_handle: 0x000000001b431440 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 个事件)

pdb_path

D:\metin2\metin2-project\Tools\Patcher\Patcher\obj\Release\Patcher.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619860693.764612 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1474 个事件)

Time & API	Arguments	Status
1619860692.045612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x0000000000840000	success
1619860692.045612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00000000009c0000	success
1619860692.764612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00000000022f0000	success
1619860692.764612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000002330000	success
1619860692.858612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a51000	success
1619860692.858612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a51000	success
1619860692.920612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef20d0000	success
1619860693.608612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00000000023b0000	success
1619860693.608612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00000000024c0000	success
1619860693.670612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a52000	success
1619860693.670612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a52000	success
1619860693.670612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a52000	success
1619860693.686612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a52000	success
1619860693.686612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a52000	success
1619860693.686612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a53000	success
1619860693.686612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a53000	success
1619860693.686612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a53000	success
1619860693.701612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a53000	success
1619860693.701612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a53000	success
1619860693.701612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a53000	success
1619860693.701612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a53000	success
1619860693.701612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a51000	success
1619860693.717612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a52000	success
1619860693.717612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a52000	success
1619860693.717612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a52000	success
1619860693.717612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a52000	success
1619860693.733612 NtProtectVirtualMemory	process_identifier: 360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a52000	success
1619860694.233612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00052000	success
1619860694.264612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00042000	success
1619860694.467612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x000007fffff00000	success
1619860694.467612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007fffff00000	success
1619860694.467612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007fffff00000	success
1619860694.467612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007fffff10000	success
1619860694.467612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x000007ffffef0000	success
1619860694.467612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ffffef0000	success
1619860694.467612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff0004a000	success
1619860694.514612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00053000	success
1619860694.514612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff000fc000	success
1619860694.529612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00126000	success
1619860694.529612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00100000	success
1619860694.795612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00054000	success
1619860694.842612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff0004b000	success
1619860695.326612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00055000	success
1619860695.326612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff001f0000	success
1619860695.561612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff001f6000	success
1619860696.014612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff001f7000	success
1619860696.014612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff001f9000	success
1619860696.061612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff001fa000	success
1619860696.170612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff0005c000	success
1619860696.483612 NtAllocateVirtualMemory	process_identifier: 360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff001fb000	success

File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)

Trapmine

malicious.high.ml.score

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619860742.873612 GetAdaptersAddresses	flags: 15 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.759620802407188

section

{'size_of_data': '0x000b3e00', 'virtual_address': '0x00002000', 'entropy': 7.759620802407188, 'name': '.text', 'virtual_size': '0x000b3cc0'}

description

A section with a high entropy has been found

entropy

0.8246418338108883

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2017-10-01 06:36:42

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
patcher.last-world.cz
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.160.110
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.