3.2
中危

e5fb7d684c70ca1c189faf61a231d20e0bf69aa57aa287f56dcabed4ad1aeaf9

b57338e4527bc96df42ff54c73d1a2aa.exe

分析耗时

79s

最近分析

文件大小

6.3MB
静态报毒 动态报毒 FILEREPMALWARE
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20200818 6.0.6.653
CrowdStrike 20190702 1.0
Alibaba 20190527 0.3.0.5
Avast Win32:Evo-gen [Susp] 20200818 18.4.3895.0
Baidu 20190318 1.0.0.2
Kingsoft 20200818 2013.8.14.323
Tencent 20200818 1.0.0.1
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1620996621.86325
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x10004000
success 0 0
Foreign language identified in PE resource (1 个事件)
name RT_VERSION language LANG_CHINESE offset 0x00191130 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000002dc
Creates executable files on the filesystem (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsm62BD.tmp\SetupHelper.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsm62BD.tmp\System.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsm62BD.tmp\InstallOptions.dll
Drops an executable to the user AppData folder (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsm62BD.tmp\SetupHelper.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsm62BD.tmp\System.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsm62BD.tmp\InstallOptions.dll
File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 个事件)
Avast Win32:Evo-gen [Susp]
AVG FileRepMalware
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2009-09-09 21:23:14

Imports

Library KERNEL32.dll:
0x408060 SetFileTime
0x408064 CompareFileTime
0x408068 SearchPathW
0x40806c GetShortPathNameW
0x408070 GetFullPathNameW
0x408074 MoveFileW
0x40807c GetFileAttributesW
0x408080 GetLastError
0x408084 CreateDirectoryW
0x408088 SetFileAttributesW
0x40808c Sleep
0x408090 GetTickCount
0x408094 GetFileSize
0x408098 GetModuleFileNameW
0x40809c GetCurrentProcess
0x4080a0 CopyFileW
0x4080a4 ExitProcess
0x4080ac GetTempPathW
0x4080b0 GetCommandLineW
0x4080b4 SetErrorMode
0x4080b8 lstrcpynA
0x4080bc CloseHandle
0x4080c0 lstrcpynW
0x4080c4 GetDiskFreeSpaceW
0x4080c8 GlobalUnlock
0x4080cc GlobalLock
0x4080d0 CreateThread
0x4080d4 LoadLibraryW
0x4080d8 CreateProcessW
0x4080dc lstrcmpiA
0x4080e0 CreateFileW
0x4080e4 GetTempFileNameW
0x4080e8 lstrcatW
0x4080ec GetProcAddress
0x4080f0 LoadLibraryA
0x4080f4 GetModuleHandleA
0x4080f8 OpenProcess
0x4080fc lstrcpyW
0x408100 GetVersionExW
0x408104 GetSystemDirectoryW
0x408108 GetVersion
0x40810c lstrcpyA
0x408110 RemoveDirectoryW
0x408114 lstrcmpiW
0x408118 lstrcmpW
0x408120 GlobalAlloc
0x408124 WaitForSingleObject
0x408128 GetExitCodeProcess
0x40812c GlobalFree
0x408130 GetModuleHandleW
0x408134 LoadLibraryExW
0x408138 FreeLibrary
0x408144 WideCharToMultiByte
0x408148 MulDiv
0x40814c lstrlenA
0x408150 WriteFile
0x408154 ReadFile
0x408158 MultiByteToWideChar
0x40815c SetFilePointer
0x408160 FindClose
0x408164 FindNextFileW
0x408168 FindFirstFileW
0x40816c DeleteFileW
0x408170 lstrlenW
Library USER32.dll:
0x408194 ScreenToClient
0x408198 GetMessagePos
0x40819c CallWindowProcW
0x4081a0 IsWindowVisible
0x4081a4 LoadBitmapW
0x4081a8 CloseClipboard
0x4081ac SetClipboardData
0x4081b0 EmptyClipboard
0x4081b4 OpenClipboard
0x4081b8 TrackPopupMenu
0x4081bc GetWindowRect
0x4081c0 AppendMenuW
0x4081c4 CreatePopupMenu
0x4081c8 GetSystemMetrics
0x4081cc EndDialog
0x4081d0 EnableMenuItem
0x4081d4 GetSystemMenu
0x4081d8 SetClassLongW
0x4081dc IsWindowEnabled
0x4081e0 SetWindowPos
0x4081e4 DialogBoxParamW
0x4081e8 CheckDlgButton
0x4081ec CreateWindowExW
0x4081f4 RegisterClassW
0x4081f8 SetDlgItemTextW
0x4081fc GetDlgItemTextW
0x408200 MessageBoxIndirectW
0x408204 CharNextA
0x408208 CharUpperW
0x40820c CharPrevW
0x408210 DispatchMessageW
0x408214 PeekMessageW
0x408218 wsprintfA
0x40821c DestroyWindow
0x408220 CreateDialogParamW
0x408224 SetTimer
0x408228 SetWindowTextW
0x40822c PostQuitMessage
0x408230 SetForegroundWindow
0x408234 ShowWindow
0x408238 wsprintfW
0x40823c SendMessageTimeoutW
0x408240 LoadCursorW
0x408244 SetCursor
0x408248 GetWindowLongW
0x40824c GetSysColor
0x408250 CharNextW
0x408254 GetClassInfoW
0x408258 ExitWindowsEx
0x40825c FindWindowExW
0x408260 GetDlgItem
0x408264 SetWindowLongW
0x408268 LoadImageW
0x40826c GetDC
0x408270 EnableWindow
0x408274 InvalidateRect
0x408278 SendMessageW
0x40827c DefWindowProcW
0x408280 BeginPaint
0x408284 GetClientRect
0x408288 FillRect
0x40828c DrawTextW
0x408290 EndPaint
0x408294 IsWindow
Library GDI32.dll:
0x40803c SetBkColor
0x408040 GetDeviceCaps
0x408044 DeleteObject
0x408048 CreateBrushIndirect
0x40804c CreateFontIndirectW
0x408050 SetBkMode
0x408054 SetTextColor
0x408058 SelectObject
Library SHELL32.dll:
0x408178 SHBrowseForFolderW
0x408180 SHGetFileInfoW
0x408184 ShellExecuteW
0x408188 SHFileOperationW
Library ADVAPI32.dll:
0x408000 RegEnumKeyW
0x408004 RegOpenKeyExW
0x408008 RegCloseKey
0x40800c RegDeleteKeyW
0x408010 RegDeleteValueW
0x408014 RegCreateKeyExW
0x408018 RegSetValueExW
0x40801c RegQueryValueExW
0x408020 RegEnumValueW
Library COMCTL32.dll:
0x408028 ImageList_AddMasked
0x40802c ImageList_Destroy
0x408030
0x408034 ImageList_Create
Library ole32.dll:
0x4082ac CoTaskMemFree
0x4082b0 OleInitialize
0x4082b4 OleUninitialize
0x4082b8 CoCreateInstance
Library VERSION.dll:
0x4082a0 GetFileVersionInfoW
0x4082a4 VerQueryValueW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51964 239.255.255.250 3702
192.168.56.101 57875 239.255.255.250 3702
192.168.56.101 57877 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.