2.8
中危
1 个模型检测该样本为恶意！
重新分析
更多

2242dd8828e1f9bf1d2c63b509165b5d284ef5ffe5188b7a0ca5a6f185b721fb

c9f3683ca41d8488f8110ff474ccad31.exe

分析耗时

76s

最近分析

文件大小

713.0KB
静态报毒 动态报毒 DJCY KATUSHA
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20201027 6.0.6.653
Baidu 20190318 1.0.0.2
Alibaba 20190527 0.3.0.5
Tencent 20201027 1.0.0.1
Kingsoft 20201027 2013.8.14.323
Avast 20201027 18.4.3895.0
CrowdStrike 20190702 1.0
静态指标
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path E:\B\T\6492cc0c-b0af-48b0-a59a-524d985a8234\build\Win32\Release\UIHost.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620897721.760662
GlobalMemoryStatusEx
success 1 0
行为判定
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Attempts to identify installed AV products by installation directory (4 个事件)
file C:\ProgramData\McAfee\WebAdvisor\c9f3683ca41d8488f8110ff474ccad31.exe\log_00200057003F001D0006003E004B001500410033000000070025.txt
file C:\ProgramData\McAfee\WebAdvisor
file C:\ProgramData\McAfee\WebAdvisor\c9f3683ca41d8488f8110ff474ccad31.exe
file C:\ProgramData\McAfee
Attempts to identify installed AV products by registry key (2 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
registry HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor\UIHost
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-24 23:12:47

Imports

Library CRYPT32.dll:
• 0x483040 CryptMsgGetParam
• 0x483044 CryptMsgClose
• 0x483048 CryptQueryObject
• 0x483050 CertGetNameStringW
• 0x483060 CryptDecodeObject
• 0x483068 CertCloseStore
Library KERNEL32.dll:
• 0x483070 K32EnumProcesses
• 0x483078 TerminateProcess
• 0x48307c GetCurrentProcess
• 0x483080 FindClose
• 0x483084 GetModuleFileNameW
• 0x483088 GetFileAttributesW
• 0x48308c FindNextFileW
• 0x483090 CreateDirectoryW
• 0x483094 OpenProcess
• 0x483098 OutputDebugStringW
• 0x48309c WideCharToMultiByte
• 0x4830a0 MultiByteToWideChar
• 0x4830a4 GetCurrentThreadId
• 0x4830a8 GetProcAddress
• 0x4830ac GetModuleHandleW
• 0x4830b0 LoadLibraryExW
• 0x4830b4 LocalAlloc
• 0x4830b8 lstrlenW
• 0x4830bc VerSetConditionMask
• 0x4830cc VerifyVersionInfoW
• 0x4830d0 WriteConsoleW
• 0x4830d4 ReadConsoleW
• 0x4830d8 SetStdHandle
• 0x4830e8 GetCommandLineW
• 0x4830ec GetCommandLineA
• 0x4830f0 GetOEMCP
• 0x4830f4 GetACP
• 0x4830f8 IsValidCodePage
• 0x4830fc ReadFile
• 0x483100 GetCurrentProcessId
• 0x483108 LocalFree
• 0x48310c FreeLibrary
• 0x483110 CreateEventW
• 0x483114 GetProcessHeap
• 0x483118 HeapSize
• 0x48311c HeapReAlloc
• 0x483120 HeapFree
• 0x483124 HeapAlloc
• 0x483128 SetEvent
• 0x48312c DecodePointer
• 0x483138 GetLastError
• 0x48313c RaiseException
• 0x483140 CloseHandle
• 0x483144 MoveFileExW
• 0x483148 GetConsoleMode
• 0x48314c GetConsoleCP
• 0x483150 FlushFileBuffers
• 0x483154 GetFileSizeEx
• 0x48315c GetFileType
• 0x483160 EnumSystemLocalesW
• 0x483164 GetUserDefaultLCID
• 0x483168 IsValidLocale
• 0x48316c GetTimeFormatW
• 0x483170 GetDateFormatW
• 0x483174 GetSystemInfo
• 0x483178 VirtualProtect
• 0x48317c VirtualQuery
• 0x483180 LoadLibraryExA
• 0x483188 Sleep
• 0x48318c SwitchToThread
• 0x483190 FormatMessageA
• 0x483194 GetStringTypeW
• 0x4831a4 InitOnceComplete
• 0x4831a8 CreateFileW
• 0x4831ac DeleteFileW
• 0x4831b0 FindFirstFileExW
• 0x4831bc RemoveDirectoryW
• 0x4831c0 SetEndOfFile
• 0x4831c4 SetFilePointerEx
• 0x4831c8 AreFileApisANSI
• 0x4831cc SetLastError
• 0x4831d4 EncodePointer
• 0x4831d8 TlsAlloc
• 0x4831dc TlsGetValue
• 0x4831e0 TlsSetValue
• 0x4831e4 TlsFree
• 0x4831ec GetTickCount
• 0x4831f0 CompareStringW
• 0x4831f4 LCMapStringW
• 0x4831f8 GetLocaleInfoW
• 0x4831fc GetCPInfo
• 0x483200 IsDebuggerPresent
• 0x483204 ResetEvent
• 0x483214 GetStartupInfoW
• 0x483218 InitializeSListHead
• 0x48321c CreateTimerQueue
• 0x483220 SignalObjectAndWait
• 0x483224 CreateThread
• 0x483228 SetThreadPriority
• 0x48322c GetThreadPriority
• 0x483250 UnregisterWait
• 0x483254 GetCurrentThread
• 0x483258 GetThreadTimes
• 0x483260 GetModuleHandleA
• 0x483264 GetVersionExW
• 0x483268 VirtualAlloc
• 0x48326c VirtualFree
• 0x483270 DuplicateHandle
• 0x483274 ReleaseSemaphore
• 0x483284 QueryDepthSList
• 0x483288 UnregisterWaitEx
• 0x48328c LoadLibraryW
• 0x483290 RtlUnwind
• 0x483294 ExitThread
• 0x483298 GetModuleHandleExW
• 0x48329c ExitProcess
• 0x4832a0 GetStdHandle
• 0x4832a4 WriteFile
Library USER32.dll:
• 0x4832cc DispatchMessageW
• 0x4832d0 TranslateMessage
• 0x4832d4 PeekMessageW
Library ADVAPI32.dll:
• 0x483000 RegDeleteKeyW
• 0x483008 RegOpenKeyExW
• 0x48300c RegCloseKey
• 0x483010 RegEnumKeyExW
• 0x483018 RegSetValueExW
• 0x48301c RegSetKeySecurity
• 0x483020 RegGetKeySecurity
• 0x483024 RegFlushKey
• 0x483028 RegDeleteValueW
• 0x48302c RegCreateKeyExW
• 0x483030 FreeSid
• 0x483034 RegQueryValueExW
Library SHELL32.dll:
Library ole32.dll:
• 0x4832dc CLSIDFromString
• 0x4832e0 CoTaskMemFree
• 0x4832e4 StringFromGUID2
Library SHLWAPI.dll:
• 0x4832b8 SHDeleteKeyW
• 0x4832bc StrRChrW
• 0x4832c0 PathFileExistsW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 50005 239.255.255.250 3702
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.