SmartHawk

3.6

中危

1 个模型检测该样本为恶意！

重新分析

下载样本

3ecb2628ac45e660eee8a379dc7fbfc9e60d61eb6084a0a89ddecf2f84615340

b96872e27d5eb015feaa881f0aee24d9.exe

分析耗时

81s

查杀引擎	查杀时间	查杀版本
McAfee	20200304	6.0.6.653
Alibaba	20190527	0.3.0.5
CrowdStrike	20190702	1.0
Baidu	20190318	1.0.0.2
Avast	20200307	18.4.3895.0
Kingsoft	20200307	2013.8.14.323
Tencent	20200307	1.0.0.1

Time & API	Arguments	Status	Return	Repeated
1620985511.821307 IsDebuggerPresent		failed	0	0

Time & API	Arguments	Status	Return	Repeated
1620985512.493307 GlobalMemoryStatusEx		success	1	0

Time & API	Arguments	Status	Return	Repeated
1620985515.446307 RegSetValueExA	key_handle: 0x00000368 value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2019-10-21 06:59:54

Imports

Library COMCTL32.dll:

• 0x51d000

• 0x51d004 ImageList_ReplaceIcon

• 0x51d008 ImageList_Draw

• 0x51d00c ImageList_Create

• 0x51d010 ImageList_Destroy

• 0x51d014 _TrackMouseEvent

• 0x51d018 ImageList_GetIconSize

Library SHLWAPI.dll:

• 0x51d3ac PathFileExistsW

• 0x51d3b0 UrlIsW

Library VERSION.dll:

• 0x51d50c VerQueryValueW

• 0x51d510 GetFileVersionInfoW

• 0x51d514 GetFileVersionInfoSizeW

Library CRYPT32.dll:

• 0x51d028 CryptBinaryToStringA

Library KERNEL32.dll:

• 0x51d0a8 GlobalUnlock

• 0x51d0ac lstrlenA

• 0x51d0b0 lstrcmpA

• 0x51d0b4 CreateDirectoryW

• 0x51d0b8 ReadFile

• 0x51d0bc GetFullPathNameW

• 0x51d0c0 lstrlenW

• 0x51d0c4 WriteFile

• 0x51d0c8 LockFile

• 0x51d0cc SetFilePointer

• 0x51d0d0 SetEndOfFile

• 0x51d0d4 GetTempPathW

• 0x51d0d8 CreateFileW

• 0x51d0dc UnlockFile

• 0x51d0e0 lstrcmpW

• 0x51d0e4 FlushFileBuffers

• 0x51d0e8 MulDiv

• 0x51d0ec GetExitCodeProcess

• 0x51d0f0 CreateMutexW

• 0x51d0f4 ReleaseMutex

• 0x51d0f8 TlsAlloc

• 0x51d0fc GlobalFlags

• 0x51d100 GlobalFree

• 0x51d104 WideCharToMultiByte

• 0x51d108 TlsFree

• 0x51d10c MoveFileW

• 0x51d110 VirtualQuery

• 0x51d114 DeleteFileW

• 0x51d118 GetModuleFileNameW

• 0x51d11c GetUserDefaultUILanguage

• 0x51d120 GetVersion

• 0x51d124 AreFileApisANSI

• 0x51d128 TryEnterCriticalSection

• 0x51d12c HeapCreate

• 0x51d130 HeapFree

• 0x51d134 InterlockedCompareExchange

• 0x51d138 GetDiskFreeSpaceW

• 0x51d13c OutputDebugStringA

• 0x51d140 GetFullPathNameA

• 0x51d144 UnlockFileEx

• 0x51d148 GetFileAttributesW

• 0x51d14c GetVersionExW

• 0x51d150 UnmapViewOfFile

• 0x51d154 HeapValidate

• 0x51d158 HeapSize

• 0x51d15c Sleep

• 0x51d160 GetTempPathA

• 0x51d164 GetDiskFreeSpaceA

• 0x51d168 GetFileAttributesA

• 0x51d16c GetFileAttributesExW

• 0x51d170 FlushViewOfFile

• 0x51d174 CreateFileA

• 0x51d178 LoadLibraryA

• 0x51d17c WaitForSingleObjectEx

• 0x51d180 GetVersionExA

• 0x51d184 DeleteFileA

• 0x51d188 HeapReAlloc

• 0x51d18c GetSystemInfo

• 0x51d190 HeapAlloc

• 0x51d194 HeapCompact

• 0x51d198 HeapDestroy

• 0x51d19c CreateFileMappingA

• 0x51d1a0 LocalFree

• 0x51d1a4 LockFileEx

• 0x51d1a8 GetFileSize

• 0x51d1ac GetCurrentProcessId

• 0x51d1b0 GetProcessHeap

• 0x51d1b4 SystemTimeToFileTime

• 0x51d1b8 GetSystemTimeAsFileTime

• 0x51d1bc GetSystemTime

• 0x51d1c0 FormatMessageA

• 0x51d1c4 CreateFileMappingW

• 0x51d1c8 MapViewOfFile

• 0x51d1cc QueryPerformanceCounter

• 0x51d1d0 GetTickCount

• 0x51d1d4 GlobalAlloc

• 0x51d1d8 GetCurrentDirectoryW

• 0x51d1dc IsValidCodePage

• 0x51d1e0 FindNextFileA

• 0x51d1e4 FindFirstFileExA

• 0x51d1e8 FindClose

• 0x51d1ec ReadConsoleW

• 0x51d1f0 WriteConsoleW

• 0x51d1f4 SetStdHandle

• 0x51d1f8 EnumSystemLocalesW

• 0x51d1fc GetUserDefaultLCID

• 0x51d200 IsValidLocale

• 0x51d204 GetTimeFormatW

• 0x51d208 GetDateFormatW

• 0x51d20c GetACP

• 0x51d210 GetStdHandle

• 0x51d214 GetModuleFileNameA

• 0x51d218 ExitProcess

• 0x51d21c SetFilePointerEx

• 0x51d220 GetFileType

• 0x51d224 GetConsoleMode

• 0x51d228 GetConsoleCP

• 0x51d22c GetModuleHandleExW

• 0x51d230 ExitThread

• 0x51d234 GetTimeZoneInformation

• 0x51d238 RaiseException

• 0x51d23c RtlUnwind

• 0x51d240 CreateTimerQueue

• 0x51d244 UnregisterWaitEx

• 0x51d248 QueryDepthSList

• 0x51d24c InterlockedFlushSList

• 0x51d250 InterlockedPushEntrySList

• 0x51d254 InterlockedPopEntrySList

• 0x51d258 ReleaseSemaphore

• 0x51d25c DuplicateHandle

• 0x51d260 VirtualFree

• 0x51d264 VirtualProtect

• 0x51d268 VirtualAlloc

• 0x51d26c LoadLibraryExW

• 0x51d270 GetModuleHandleA

• 0x51d274 FreeLibraryAndExitThread

• 0x51d278 GetThreadTimes

• 0x51d27c GetCurrentThread

• 0x51d280 UnregisterWait

• 0x51d284 RegisterWaitForSingleObject

• 0x51d288 SetThreadAffinityMask

• 0x51d28c GetProcessAffinityMask

• 0x51d290 GetNumaHighestNodeNumber

• 0x51d294 DeleteTimerQueueTimer

• 0x51d298 ChangeTimerQueueTimer

• 0x51d29c CreateTimerQueueTimer

• 0x51d2a0 GetLogicalProcessorInformation

• 0x51d2a4 GetThreadPriority

• 0x51d2a8 SetThreadPriority

• 0x51d2ac CreateThread

• 0x51d2b0 SignalObjectAndWait

• 0x51d2b4 InitializeSListHead

• 0x51d2b8 GetStartupInfoW

• 0x51d2bc IsDebuggerPresent

• 0x51d2c0 IsProcessorFeaturePresent

• 0x51d2c4 TerminateProcess

• 0x51d2c8 GetCurrentProcess

• 0x51d2cc SetUnhandledExceptionFilter

• 0x51d2d0 UnhandledExceptionFilter

• 0x51d2d4 ResetEvent

• 0x51d2d8 SetEvent

• 0x51d2dc GetCPInfo

• 0x51d2e0 GetLocaleInfoW

• 0x51d2e4 LCMapStringW

• 0x51d2e8 CompareStringW

• 0x51d2ec DecodePointer

• 0x51d2f0 EncodePointer

• 0x51d2f4 GetModuleHandleW

• 0x51d2f8 SwitchToThread

• 0x51d2fc CreateEventW

• 0x51d300 InitializeCriticalSectionAndSpinCount

• 0x51d304 SetLastError

• 0x51d308 GetStringTypeW

• 0x51d30c FreeLibrary

• 0x51d310 GetProcAddress

• 0x51d314 GlobalLock

• 0x51d318 FindResourceW

• 0x51d31c LoadLibraryW

• 0x51d320 InterlockedIncrement

• 0x51d324 TlsGetValue

• 0x51d328 DeleteCriticalSection

• 0x51d32c CloseHandle

• 0x51d330 TerminateThread

• 0x51d334 OutputDebugStringW

• 0x51d338 GetLastError

• 0x51d33c FormatMessageW

• 0x51d340 MultiByteToWideChar

• 0x51d344 ResumeThread

• 0x51d348 SuspendThread

• 0x51d34c GetCurrentThreadId

• 0x51d350 WaitForSingleObject

• 0x51d354 InitializeCriticalSection

• 0x51d358 LeaveCriticalSection

• 0x51d35c InterlockedDecrement

• 0x51d360 lstrcpynW

• 0x51d364 EnterCriticalSection

• 0x51d368 TlsSetValue

• 0x51d36c GetOEMCP

• 0x51d370 GetCommandLineA

• 0x51d374 GetCommandLineW

• 0x51d378 GetEnvironmentStringsW

• 0x51d37c FreeEnvironmentStringsW

• 0x51d380 SetEnvironmentVariableA

• 0x51d384 LocalFileTimeToFileTime

Library USER32.dll:

• 0x51d3b8 RegisterWindowMessageW

• 0x51d3bc GetParent

• 0x51d3c0 TranslateMessage

• 0x51d3c4 TranslateAcceleratorW

• 0x51d3c8 PeekMessageW

• 0x51d3cc GetMenuItemCount

• 0x51d3d0 InflateRect

• 0x51d3d4 UpdateWindow

• 0x51d3d8 LockWindowUpdate

• 0x51d3dc GetWindowLongW

• 0x51d3e0 DispatchMessageW

• 0x51d3e4 IsWindow

• 0x51d3e8 SendMessageW

• 0x51d3ec GetMessageW

• 0x51d3f0 EndPaint

• 0x51d3f4 ScreenToClient

• 0x51d3f8 CreatePopupMenu

• 0x51d3fc GetAsyncKeyState

• 0x51d400 OffsetRect

• 0x51d404 IsMenu

• 0x51d408 GetDlgCtrlID

• 0x51d40c ClientToScreen

• 0x51d410 IsChild

• 0x51d414 MapWindowPoints

• 0x51d418 SendDlgItemMessageW

• 0x51d41c GetSysColor

• 0x51d420 DestroyMenu

• 0x51d424 IsRectEmpty

• 0x51d428 SetCapture

• 0x51d42c TrackPopupMenuEx

• 0x51d430 RemoveMenu

• 0x51d434 CheckMenuItem

• 0x51d438 AppendMenuW

• 0x51d43c DrawTextW

• 0x51d440 PtInRect

• 0x51d444 ReleaseCapture

• 0x51d448 GetCursorPos

• 0x51d44c InvalidateRect

• 0x51d450 GetWindowPlacement

• 0x51d454 SetWindowPlacement

• 0x51d458 EnableWindow

• 0x51d45c RedrawWindow

• 0x51d460 SetCursor

• 0x51d464 UnregisterClassW

• 0x51d468 CopyRect

• 0x51d46c GetClientRect

• 0x51d470 SetRect

• 0x51d474 CreateDialogParamW

• 0x51d478 DefWindowProcW

• 0x51d47c LoadMenuW

• 0x51d480 CallWindowProcW

• 0x51d484 PostMessageW

• 0x51d488 GetWindowRect

• 0x51d48c DestroyWindow

• 0x51d490 GetDC

• 0x51d494 SetWindowPos

• 0x51d498 MessageBoxW

• 0x51d49c CreateWindowExW

• 0x51d4a0 CallNextHookEx

• 0x51d4a4 EndDialog

• 0x51d4a8 GetSystemMetrics

• 0x51d4ac SetWindowTextW

• 0x51d4b0 ShowWindow

• 0x51d4b4 GetClassInfoW

• 0x51d4b8 IsDialogMessageW

• 0x51d4bc WindowFromDC

• 0x51d4c0 RegisterClassW

• 0x51d4c4 DialogBoxIndirectParamW

• 0x51d4c8 UnhookWindowsHookEx

• 0x51d4cc IntersectRect

• 0x51d4d0 SetFocus

• 0x51d4d4 GetUpdateRect

• 0x51d4d8 LoadCursorW

• 0x51d4dc SetWindowsHookExW

• 0x51d4e0 SetWindowLongW

• 0x51d4e4 GetDlgItem

• 0x51d4e8 PostQuitMessage

• 0x51d4ec GetDesktopWindow

• 0x51d4f0 CreateDialogIndirectParamW

• 0x51d4f4 SystemParametersInfoW

• 0x51d4f8 DialogBoxParamW

• 0x51d4fc LoadImageW

• 0x51d500 ReleaseDC

• 0x51d504 BeginPaint

Library GDI32.dll:

• 0x51d030 CreatePen

• 0x51d034 LineTo

• 0x51d038 GetTextExtentPoint32W

• 0x51d03c CreateRectRgn

• 0x51d040 CreateRectRgnIndirect

• 0x51d044 Rectangle

• 0x51d048 SelectClipRgn

• 0x51d04c MoveToEx

• 0x51d050 PaintRgn

• 0x51d054 CreateFontIndirectW

• 0x51d058 CombineRgn

• 0x51d05c RoundRect

• 0x51d060 ExtTextOutW

• 0x51d064 SetLayout

• 0x51d068 CreateFontW

• 0x51d06c GetDeviceCaps

• 0x51d070 GetObjectW

• 0x51d074 CreateSolidBrush

• 0x51d078 SaveDC

• 0x51d07c GetStockObject

• 0x51d080 DeleteDC

• 0x51d084 RestoreDC

• 0x51d088 DeleteObject

• 0x51d08c CreateCompatibleBitmap

• 0x51d090 BitBlt

• 0x51d094 StretchBlt

• 0x51d098 CreateCompatibleDC

• 0x51d09c SetBkColor

• 0x51d0a0 SelectObject

Library COMDLG32.dll:

• 0x51d020 GetFileTitleW

Library SHELL32.dll:

• 0x51d3a0 ShellExecuteExW

• 0x51d3a4 ShellExecuteW

Library ole32.dll:

• 0x51d528 CLSIDFromString

• 0x51d52c OleInitialize

• 0x51d530 CoCreateInstance

• 0x51d534 CoCreateGuid

• 0x51d538 CoUninitialize

• 0x51d53c OleUninitialize

• 0x51d540 CoInitialize

• 0x51d544 CreateStreamOnHGlobal

Library OLEAUT32.dll:

• 0x51d38c SysAllocString

• 0x51d390 SafeArrayCreateVector

• 0x51d394 VariantClear

• 0x51d398 OleLoadPicture

Library WININET.dll:

• 0x51d51c DeleteUrlCacheEntryW

• 0x51d520 InternetCheckConnectionW

Library urlmon.dll:

• 0x51d54c URLDownloadToFileW

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
www.google.com	A 31.13.66.1	31.13.66.1
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.