SmartHawk

2.6

中危

33 个模型检测该样本为恶意！

重新分析

下载样本

2b1f2b9f189cc6212bb031bf06bf716efc723bac9c3918ee92dd51a635d36d0c

c647af7dff4c847f09857dff4d229c7b.exe

分析耗时

82s

最近分析

文件大小

545.5KB

静态报毒动态报毒 APPLICUNWNT@#1IUXNKY73Y1TV BROWSERMODIFIER ELDORADO ELEX FILEREPMALWARE FRAUDTOOL GENASA GENCIRC LJBCX MALICIOUS MUTABAHA R002C0PJQ20 SKVQHCHBD9M UNSAFE XEELYAK YET ANOTHER CLEANER 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	PUP-GJL	20201029	6.0.6.653
Alibaba	AdWare:Win32/Generic.1c2f18a5	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast		20201029	18.4.3895.0
Kingsoft		20201029	2013.8.14.323
Tencent	Malware.Win32.Gencirc.114ca2fb	20201029	1.0.0.1
CrowdStrike		20190702	1.0

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

D:\Build\isafe\branches\RF6.3\bin\iSafeVirusScanner.pdb

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

TEXTINCLUDE

Foreign language identified in PE resource (11 个事件)

name

TEXTINCLUDE

language

LANG_CHINESE

offset

0x0007c298

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000003

name

TEXTINCLUDE

language

LANG_CHINESE

offset

0x0007c298

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000003

name

TEXTINCLUDE

language

LANG_CHINESE

offset

0x0007c298

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000003

name

RT_ICON

language

LANG_CHINESE

offset

0x0007bd28

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x0007bd28

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x0007bd28

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x0007bd28

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x0007bd28

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x0007bd28

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x0007c190

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000005a

name

RT_VERSION

language

LANG_CHINESE

offset

0x0007c2a0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000434

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 个事件)

FireEye	Generic.mg.c647af7dff4c847f
McAfee	PUP-GJL
Cylance	Unsafe
Zillya	Adware.ELEX.Win32.21
K7AntiVirus	Adware ( 0055ae221 )
Alibaba	AdWare:Win32/Generic.1c2f18a5
K7GW	Adware ( 0055ae221 )
Invincea	Yet Another Cleaner (PUA)
Cyren	W32/Trojan.FKY.gen!Eldorado
APEX	Malicious
Kaspersky	not-a-virus:HEUR:AdWare.Win32.ELEX.gen
SUPERAntiSpyware	PUP.YAC/Variant
Comodo	ApplicUnwnt@#1iuxnky73y1tv
F-Secure	Adware.ADWARE/Elex.ljbcx
DrWeb	Adware.Mutabaha.546
TrendMicro	TROJ_GEN.R002C0PJQ20
McAfee-GW-Edition	PUP-GJL
Sophos	Yet Another Cleaner (PUA)
Jiangmin	AdWare.ELEX.adz
Webroot	W32.Adware.Elex
Avira	ADWARE/Elex.ljbcx
Gridinsoft	Adware.ELEX.dd!c
Microsoft	BrowserModifier:Win32/Xeelyak
ZoneAlarm	not-a-virus:HEUR:AdWare.Win32.ELEX.gen
GData	Win32.Application.Elex.O
VBA32	Adware.Elex
Malwarebytes	FraudTool.YAC
ESET-NOD32	a variant of Win32/Adware.ELEX.TN.gen
TrendMicro-HouseCall	TROJ_GEN.R002C0PJQ20
Tencent	Malware.Win32.Gencirc.114ca2fb
Yandex	Trojan.GenAsa!SkVqHchBD9M
AVG	FileRepMalware
Panda	PUP/YAC

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-03-30 18:31:48

Imports

Library isafepxy.dll:

• 0x443448 ISAFE_InitProgramLogEx

• 0x44344c ISAFE_CloseProgramLog

• 0x443450 ISAFE_WriteProgramLogNoMask

Library isaferpt.dll:

• 0x443458 IReportStart

• 0x44345c IReportEnd

Library iImportLib.dll:

• 0x44342c ?ClearExceptionLog@exception@elex@@YA_NXZ

• 0x443430 ?InitialExceptionLog@exception@elex@@YA_NIPB_W00P6GXPA_W@Z@Z

• 0x443434 ??1CWow64Helper@elex@@QAE@XZ

• 0x443438 ??0CWow64Helper@elex@@QAE@XZ

• 0x44343c ?getProgramRunDir@filepath@elex@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

• 0x443440 ?GetRegInstallPath@func@elex@@YAHPA_WK@Z

Library KERNEL32.dll:

• 0x443054 CloseHandle

• 0x443058 GetLastError

• 0x44305c CreateFileA

• 0x443060 ReleaseMutex

• 0x443064 FormatMessageA

• 0x443068 WaitForSingleObject

• 0x44306c GetTickCount

• 0x443070 GetSystemInfo

• 0x443074 ReleaseSemaphore

• 0x443078 CreateSemaphoreA

• 0x44307c CreateMutexA

• 0x443080 GetProcessTimes

• 0x443084 UnmapViewOfFile

• 0x443088 CreateFileMappingA

• 0x44308c OpenFileMappingA

• 0x443090 MapViewOfFileEx

• 0x443094 GetCurrentProcessId

• 0x443098 GetModuleHandleW

• 0x44309c LoadLibraryW

• 0x4430a0 LoadLibraryExW

• 0x4430a4 FreeLibrary

• 0x4430a8 SetEvent

• 0x4430ac lstrcpyW

• 0x4430b0 EnterCriticalSection

• 0x4430b4 LeaveCriticalSection

• 0x4430b8 CreateEventW

• 0x4430bc InitializeCriticalSection

• 0x4430c0 LocalAlloc

• 0x4430c4 GetProcessHeap

• 0x4430c8 HeapFree

• 0x4430cc DeleteCriticalSection

• 0x4430d0 HeapAlloc

• 0x4430d4 CreateEventA

• 0x4430d8 GetCurrentThreadId

• 0x4430dc GetProcAddress

• 0x4430e0 GetModuleHandleA

• 0x4430e4 SwitchToThread

• 0x4430e8 Sleep

• 0x4430ec GetCurrentProcess

• 0x4430f0 LocalFree

• 0x4430f4 AreFileApisANSI

• 0x4430f8 SystemTimeToFileTime

• 0x4430fc CreateWaitableTimerA

• 0x443100 GetSystemTimeAsFileTime

• 0x443104 OpenEventA

• 0x443108 WaitForMultipleObjects

• 0x44310c ResetEvent

• 0x443110 SetWaitableTimer

• 0x443114 ResumeThread

• 0x443118 TlsAlloc

• 0x44311c TlsGetValue

• 0x443120 DuplicateHandle

• 0x443124 TlsFree

• 0x443128 MultiByteToWideChar

• 0x44312c WideCharToMultiByte

• 0x443130 EncodePointer

• 0x443134 DecodePointer

• 0x443138 IsDebuggerPresent

• 0x44313c IsProcessorFeaturePresent

• 0x443140 QueryPerformanceCounter

• 0x443144 GetVersion

• 0x443148 OpenProcess

• 0x44314c CreateThread

• 0x443150 SetThreadPriority

• 0x443154 TerminateThread

• 0x443158 GetExitCodeThread

• 0x44315c SetLastError

• 0x443160 WriteFile

• 0x443164 ReadFile

• 0x443168 CreatePipe

• 0x44316c MapViewOfFile

• 0x443170 lstrcpyA

• 0x443174 lstrcatA

• 0x443178 lstrlenA

• 0x44317c CreateSemaphoreW

• 0x443180 CreateFileMappingW

• 0x443184 LoadLibraryA

• 0x443188 GetVersionExW

• 0x44318c VirtualQuery

• 0x443190 TlsSetValue

• 0x443194 ReadProcessMemory

• 0x443198 GetModuleFileNameA

• 0x44319c GetModuleFileNameW

• 0x4431a0 CreateFileW

• 0x4431a4 VirtualProtect

• 0x4431a8 VirtualAllocEx

• 0x4431ac VirtualFreeEx

• 0x4431b0 VirtualProtectEx

• 0x4431b4 VirtualQueryEx

• 0x4431b8 CreateRemoteThread

• 0x4431bc GetCurrentThread

• 0x4431c0 WriteProcessMemory

• 0x4431c4 InterlockedIncrement

• 0x4431c8 FlushInstructionCache

• 0x4431cc VirtualFree

• 0x4431d0 ExitThread

• 0x4431d4 lstrlenW

• 0x4431d8 GetWindowsDirectoryW

• 0x4431dc VirtualAlloc

• 0x4431e0 CreateMutexW

• 0x4431e4 OpenMutexW

• 0x4431e8 OpenEventW

• 0x4431ec OpenFileMappingW

• 0x4431f0 GetThreadContext

Library ADVAPI32.dll:

• 0x443000 GetTokenInformation

• 0x443004 RegOpenKeyExA

• 0x443008 RegCloseKey

• 0x44300c RegQueryValueExA

• 0x443010 OpenEventLogA

• 0x443014 CloseEventLog

• 0x443018 ReadEventLogA

• 0x44301c AdjustTokenPrivileges

• 0x443020 LookupPrivilegeValueW

• 0x443024 OpenProcessToken

• 0x443028 GetSecurityDescriptorSacl

• 0x44302c ConvertStringSecurityDescriptorToSecurityDescriptorW

• 0x443030 GetLengthSid

• 0x443034 SetEntriesInAclW

• 0x443038 AllocateAndInitializeSid

• 0x44303c SetSecurityDescriptorSacl

• 0x443040 SetSecurityDescriptorDacl

• 0x443044 InitializeSecurityDescriptor

• 0x443048 FreeSid

• 0x44304c GetKernelObjectSecurity

Library SHELL32.dll:

• 0x443400 CommandLineToArgvW

Library MSVCP110.dll:

• 0x4431f8 ?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEXXZ

• 0x4431fc ?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ

• 0x443200 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ

• 0x443204 ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

• 0x443208 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ

• 0x44320c ?_Winerror_map@std@@YAPBDH@Z

• 0x443210 ??_7codecvt_base@std@@6B@

• 0x443214 ?id@?$codecvt@_WDH@std@@2V0locale@2@A

• 0x443218 ??_7?$codecvt@_WDH@std@@6B@

• 0x44321c ??_7_Facet_base@std@@6B@

• 0x443220 ?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z

• 0x443224 ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x443228 ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

• 0x44322c ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ

• 0x443230 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z

• 0x443234 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

• 0x443238 ?_BADOFF@std@@3_JB

• 0x44323c ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z

• 0x443240 ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z

• 0x443244 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x443248 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x44324c ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z

• 0x443250 ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ

• 0x443254 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

• 0x443258 ?uncaught_exception@std@@YA_NXZ

• 0x44325c ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ

• 0x443260 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ

• 0x443264 ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ

• 0x443268 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

• 0x44326c ?_Syserror_map@std@@YAPBDH@Z

• 0x443270 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x443274 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z

• 0x443278 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z

• 0x44327c ?_Xout_of_range@std@@YAXPBD@Z

• 0x443280 ?_Xbad_alloc@std@@YAXXZ

• 0x443284 ?_Xlength_error@std@@YAXPBD@Z

• 0x443288 ??0_Lockit@std@@QAE@H@Z

• 0x44328c ??1_Lockit@std@@QAE@XZ

• 0x443290 ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z

• 0x443294 ??Bid@locale@std@@QAEIXZ

• 0x443298 ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z

• 0x44329c ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z

• 0x4432a0 ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z

• 0x4432a4 ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

• 0x4432a8 ??0?$codecvt@_WDH@std@@QAE@I@Z

• 0x4432ac ?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x4432b0 ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ

• 0x4432b4 ?_Incref@facet@locale@std@@UAEXXZ

• 0x4432b8 ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ

• 0x4432bc ??_7facet@locale@std@@6B@

Library MSVCR110.dll:

• 0x4432c4 _controlfp_s

• 0x4432c8 _invoke_watson

• 0x4432cc __crtSetUnhandledExceptionFilter

• 0x4432d0 _except_handler4_common

• 0x4432d4 __crtTerminateProcess

• 0x4432d8 __crtUnhandledException

• 0x4432dc _crt_debugger_hook

• 0x4432e0 _commode

• 0x4432e4 _fmode

• 0x4432e8 _wcmdln

• 0x4432ec _initterm

• 0x4432f0 _initterm_e

• 0x4432f4 __setusermatherr

• 0x4432f8 _configthreadlocale

• 0x4432fc _cexit

• 0x443300 _exit

• 0x443304 exit

• 0x443308 __set_app_type

• 0x44330c __wgetmainargs

• 0x443310 _amsg_exit

• 0x443314 __crtGetShowWindowMode

• 0x443318 _XcptFilter

• 0x44331c ?terminate@@YAXXZ

• 0x443320 _onexit

• 0x443324 __dllonexit

• 0x443328 _calloc_crt

• 0x44332c _unlock

• 0x443330 _lock

• 0x443334 ??1type_info@@UAE@XZ

• 0x443338 ??1bad_cast@std@@UAE@XZ

• 0x44333c ??0bad_cast@std@@QAE@ABV01@@Z

• 0x443340 ??0bad_cast@std@@QAE@PBD@Z

• 0x443344 strerror

• 0x443348 memcpy

• 0x44334c __CxxFrameHandler3

• 0x443350 _CxxThrowException

• 0x443354 _beginthreadex

• 0x443358 _gmtime64

• 0x44335c strtol

• 0x443360 ??0exception@std@@QAE@ABQBDH@Z

• 0x443364 __RTDynamicCast

• 0x443368 sprintf_s

• 0x44336c wcscpy_s

• 0x443370 malloc

• 0x443374 realloc

• 0x443378 free

• 0x44337c sprintf

• 0x443380 ??0exception@std@@QAE@XZ

• 0x443384 ??0exception@std@@QAE@ABQBD@Z

• 0x443388 ??1exception@std@@UAE@XZ

• 0x44338c ?what@exception@std@@UBEPBDXZ

• 0x443390 ??0exception@std@@QAE@ABV01@@Z

• 0x443394 _stricmp

• 0x443398 strcpy

• 0x44339c memset

• 0x4433a0 _except_handler3

• 0x4433a4 ?name@type_info@@QBEPBDPAU__type_info_node@@@Z

• 0x4433a8 _purecall

• 0x4433ac memmove

• 0x4433b0 ??2@YAPAXI@Z

• 0x4433b4 ??3@YAXPAX@Z

• 0x4433b8 wcscpy

• 0x4433bc strcmp

• 0x4433c0 strlen

• 0x4433c4 wcslen

• 0x4433c8 _wcsicmp

• 0x4433cc memcmp

• 0x4433d0 vsprintf_s

• 0x4433d4 iswspace

• 0x4433d8 wcschr

• 0x4433dc wcscmp

• 0x4433e0 wcsncpy

• 0x4433e4 wcsstr

• 0x4433e8 _wcslwr

• 0x4433ec vswprintf_s

• 0x4433f0 _local_unwind2

• 0x4433f4 ??_V@YAXPAX@Z

• 0x4433f8 strcpy_s

Library USER32.dll:

• 0x443408 CloseDesktop

• 0x44340c OpenInputDesktop

• 0x443410 GetUserObjectInformationA

• 0x443414 PeekMessageW

• 0x443418 DispatchMessageW

• 0x44341c TranslateMessage

• 0x443420 MsgWaitForMultipleObjects

• 0x443424 GetThreadDesktop

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.