3.2
中危
1 个模型检测该样本为恶意！
重新分析
更多

b52ed5e6ce283a8d34e4108d8f9a2d954eaabe0bea22f920e4663b1b450f11a6

ca55fc82970b5366909f617dfd76d43e.exe

分析耗时

87s

最近分析

文件大小

2.4MB
静态报毒 动态报毒 BSCOPE SOFTCNAPP
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20210110 6.0.6.653
Baidu 20190318 1.0.0.2
Alibaba 20190527 0.3.0.5
Kingsoft 20210110 2017.9.26.565
Tencent 20210110 1.0.0.1
Avast 20210110 21.1.5827.0
CrowdStrike 20190702 1.0
静态指标
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path D:\work\project\GTarcade\client\desktop\client\Gtarcade\Bin\release\GTarcade.pdb
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)
section .gfids
section LogShare
行为判定
动态指标
Foreign language identified in PE resource (15 个事件)
name RT_ICON language LANG_CHINESE offset 0x0025ab78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0025ab78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0025ab78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0025ab78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0025ab78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0025ab78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0025ab78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0025ab78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0025ab78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0025ab78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_MENU language LANG_CHINESE offset 0x0025b078 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000050
name RT_DIALOG language LANG_CHINESE offset 0x0025b0d8 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000118
name RT_STRING language LANG_CHINESE offset 0x0025b1f0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000040
name RT_ACCELERATOR language LANG_CHINESE offset 0x0025b0c8 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000010
name RT_GROUP_ICON language LANG_CHINESE offset 0x0025afe0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000092
File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)
VBA32 BScope.Adware.Softcnapp
The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)
entropy 7.447375162469099 section {'size_of_data': '0x00057600', 'virtual_address': '0x00204000', 'entropy': 7.447375162469099, 'name': '.rsrc', 'virtual_size': '0x000574b0'} description A section with a high entropy has been found
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-25 20:26:01

Imports

Library KERNEL32.dll:
• 0x5985e8 TlsAlloc
• 0x5985ec TlsGetValue
• 0x5985f0 TlsSetValue
• 0x5985f4 TlsFree
• 0x5985f8 EncodePointer
• 0x5985fc LCMapStringW
• 0x598600 GetLocaleInfoW
• 0x598604 GetCPInfo
• 0x598608 LocalFree
• 0x59860c CompareStringW
• 0x598610 FormatMessageA
• 0x598614 SleepEx
• 0x598618 VerSetConditionMask
• 0x598620 LoadLibraryW
• 0x598624 VerifyVersionInfoW
• 0x59862c MoveFileExA
• 0x598638 GetFileType
• 0x598644 GetCurrentProcess
• 0x59864c IsDebuggerPresent
• 0x598650 InitializeSListHead
• 0x598654 OutputDebugStringW
• 0x598658 RtlCaptureContext
• 0x59865c GetProcessId
• 0x598660 VirtualQueryEx
• 0x598668 TransactNamedPipe
• 0x59866c WaitNamedPipeW
• 0x598670 RtlUnwind
• 0x598680 ExitThread
• 0x598688 GetModuleHandleExW
• 0x59868c MoveFileExW
• 0x598690 SetFilePointerEx
• 0x598694 ExitProcess
• 0x598698 GetConsoleMode
• 0x59869c ReadConsoleW
• 0x5986a0 GetConsoleCP
• 0x5986ac GetFullPathNameW
• 0x5986b0 IsValidLocale
• 0x5986b4 GetUserDefaultLCID
• 0x5986b8 EnumSystemLocalesW
• 0x5986bc FlushFileBuffers
• 0x5986c0 FindFirstFileExW
• 0x5986c4 IsValidCodePage
• 0x5986c8 GetACP
• 0x5986cc GetOEMCP
• 0x5986d0 GetCommandLineA
• 0x5986e0 WriteConsoleW
• 0x5986e4 GetSystemTime
• 0x5986e8 GetTickCount64
• 0x5986ec FreeResource
• 0x5986f4 CreateFileMappingW
• 0x5986f8 OpenEventW
• 0x5986fc UnmapViewOfFile
• 0x598700 OpenMutexW
• 0x598704 MapViewOfFile
• 0x598708 OpenFileMappingW
• 0x59870c ReleaseMutex
• 0x598710 CreateMutexW
• 0x598714 CreateThread
• 0x598718 GetCommandLineW
• 0x59871c CreateRemoteThread
• 0x598720 WriteProcessMemory
• 0x598724 VirtualAllocEx
• 0x59872c FreeLibrary
• 0x598730 GetStringTypeW
• 0x598734 GetProcAddress
• 0x598738 SetEndOfFile
• 0x59873c MultiByteToWideChar
• 0x598740 GetFullPathNameA
• 0x598744 SetStdHandle
• 0x598748 GetStdHandle
• 0x59874c PeekNamedPipe
• 0x598754 CreateTimerQueue
• 0x598758 DeleteTimerQueueEx
• 0x598760 CreateProcessW
• 0x598764 GetStartupInfoW
• 0x598768 CreatePipe
• 0x59876c TerminateThread
• 0x598770 SetEvent
• 0x598774 ResetEvent
• 0x598778 CreateEventW
• 0x59877c GetExitCodeThread
• 0x598780 GlobalAddAtomW
• 0x598784 SetLastError
• 0x598788 lstrcpynW
• 0x59878c GetLocalTime
• 0x598790 GetCurrentProcessId
• 0x5987a4 CreateDirectoryA
• 0x5987a8 GetModuleFileNameA
• 0x5987ac Sleep
• 0x5987b0 GetTickCount
• 0x5987b8 CreateSemaphoreW
• 0x5987bc ReleaseSemaphore
• 0x5987c0 GetCurrentThreadId
• 0x5987d0 GetModuleHandleW
• 0x5987d4 OutputDebugStringA
• 0x5987e0 TerminateProcess
• 0x5987e4 OpenProcess
• 0x5987e8 Process32NextW
• 0x5987ec Process32FirstW
• 0x5987f4 GetExitCodeProcess
• 0x5987f8 lstrlenW
• 0x5987fc GetVersionExW
• 0x598800 GetNativeSystemInfo
• 0x598804 GetFileAttributesW
• 0x598808 GetDiskFreeSpaceExW
• 0x59880c GetDriveTypeW
• 0x598814 GetFileSizeEx
• 0x598818 RemoveDirectoryW
• 0x59881c FindNextFileW
• 0x598820 FindClose
• 0x598824 CreateDirectoryW
• 0x598828 WriteFile
• 0x59882c SetFilePointer
• 0x598830 GetTempPathW
• 0x598834 GetProcessHeap
• 0x598838 HeapSize
• 0x59883c HeapReAlloc
• 0x598840 HeapFree
• 0x598844 HeapAlloc
• 0x598848 HeapDestroy
• 0x59884c ReadFile
• 0x598850 GetFileSize
• 0x598854 GetModuleFileNameW
• 0x598858 WaitForSingleObject
• 0x59885c FindFirstFileW
• 0x598860 SetFileAttributesW
• 0x598868 DeleteFileW
• 0x59886c CreateFileW
• 0x598870 CloseHandle
• 0x598874 GetSystemDirectoryW
• 0x598878 DecodePointer
• 0x59887c FindResourceExW
• 0x598880 FindResourceW
• 0x598884 SizeofResource
• 0x598888 LockResource
• 0x59888c LoadResource
• 0x598898 GetLastError
• 0x59889c RaiseException
• 0x5988a0 WideCharToMultiByte
• 0x5988a4 LoadLibraryExW
Library USER32.dll:
• 0x598904 GetWindowTextW
• 0x598908 EnumWindows
• 0x59890c GetParent
• 0x598910 LoadIconW
• 0x598914 GetDC
• 0x598918 SetPropW
• 0x59891c GetClassInfoExW
• 0x598920 GetPropW
• 0x598924 SetWindowTextW
• 0x598928 SendMessageW
• 0x59892c SetForegroundWindow
• 0x598930 PostQuitMessage
• 0x598934 SetFocus
• 0x598938 RegisterHotKey
• 0x59893c UnregisterHotKey
• 0x598940 FlashWindow
• 0x598944 IsWindowEnabled
• 0x598948 ClientToScreen
• 0x59894c IsWindowVisible
• 0x598950 EnableWindow
• 0x598954 UnhookWindowsHookEx
• 0x598958 SetWindowsHookExW
• 0x59895c CallNextHookEx
• 0x598960 FlashWindowEx
• 0x598964 GetActiveWindow
• 0x598968 GetSystemMetrics
• 0x59896c GetClassNameW
• 0x598970 InvalidateRect
• 0x598978 ShowWindow
• 0x598980 PostMessageW
• 0x598984 GetDlgItem
• 0x598988 GetWindowLongW
• 0x59898c IsIconic
• 0x598990 BringWindowToTop
• 0x598994 SetWindowPos
• 0x598998 IsWindow
• 0x59899c RegisterClassExW
• 0x5989a0 CreateWindowExW
• 0x5989a4 DestroyWindow
• 0x5989a8 DefWindowProcW
• 0x5989ac GetDesktopWindow
• 0x5989b4 KillTimer
• 0x5989b8 SetTimer
• 0x5989bc LoadCursorW
• 0x5989c0 BeginPaint
• 0x5989c4 EndPaint
• 0x5989c8 SetMenu
• 0x5989cc SetParent
• 0x5989d0 GetClientRect
• 0x5989d4 BeginDeferWindowPos
• 0x5989d8 DeferWindowPos
• 0x5989dc EndDeferWindowPos
• 0x5989e0 GetWindowRect
• 0x5989e4 SetWindowLongW
• 0x5989e8 GetCursorPos
• 0x5989ec MoveWindow
Library GDI32.dll:
• 0x5985c4 CreateSolidBrush
Library COMDLG32.dll:
• 0x59802c GetOpenFileNameW
Library ADVAPI32.dll:
• 0x598000 RegCreateKeyExW
• 0x598004 RegDeleteValueW
• 0x598008 SystemFunction036
• 0x59800c RegCreateKeyW
• 0x598010 RegSetValueExW
• 0x598014 RegQueryValueExW
• 0x598018 RegCloseKey
• 0x59801c RegOpenKeyExW
Library SHELL32.dll:
• 0x5988b4 SHGetFolderPathW
• 0x5988b8 ShellExecuteW
• 0x5988bc Shell_NotifyIconW
• 0x5988c0 SHBrowseForFolderW
• 0x5988c8 CommandLineToArgvW
• 0x5988cc ShellExecuteA
• 0x5988d0 SHFileOperationW
• 0x5988d4 ShellExecuteExW
Library ole32.dll:
• 0x598e50 CoInitialize
• 0x598e54 CoCreateInstance
• 0x598e58 CoCreateGuid
• 0x598e5c CoUninitialize
• 0x598e60 OleInitialize
• 0x598e64 OleUninitialize
Library OLEAUT32.dll:
• 0x5988ac VariantClear
Library COMCTL32.dll:
• 0x598024 _TrackMouseEvent
Library gdiplus.dll:
• 0x598abc GdipCreateMatrix2
• 0x598ac0 GdipDisposeImage
• 0x598ac4 GdipGetImageWidth
• 0x598ac8 GdipGetImageHeight
• 0x598ad4 GdipDeleteGraphics
• 0x598ad8 GdipCreateFromHDC
• 0x598ae0 GdipCreatePath
• 0x598ae4 GdipDeletePath
• 0x598ae8 GdipAddPathEllipseI
• 0x598aec GdipCreateTexture
• 0x598af0 GdipDeleteBrush
• 0x598af8 GdipDeleteMatrix
• 0x598afc GdipFillPath
• 0x598b04 GdipDrawImageRectI
Library WINMM.dll:
• 0x5989f4 timeSetEvent
Library WS2_32.dll:
• 0x598a44 sendto
• 0x598a48 recvfrom
• 0x598a4c freeaddrinfo
• 0x598a50 getaddrinfo
• 0x598a54 select
• 0x598a58 __WSAFDIsSet
• 0x598a5c ioctlsocket
• 0x598a60 listen
• 0x598a64 htonl
• 0x598a68 accept
• 0x598a6c WSACleanup
• 0x598a70 WSAStartup
• 0x598a74 WSAIoctl
• 0x598a78 WSASetLastError
• 0x598a7c setsockopt
• 0x598a80 ntohs
• 0x598a84 htons
• 0x598a88 getsockopt
• 0x598a8c getsockname
• 0x598a90 getpeername
• 0x598a94 connect
• 0x598a98 bind
• 0x598a9c WSAGetLastError
• 0x598aa0 send
• 0x598aa4 gethostname
• 0x598aa8 socket
• 0x598aac shutdown
• 0x598ab0 closesocket
• 0x598ab4 recv
Library DuiLib.dll:
Library IPC.dll:
Library libcrypto-1_1.dll:
• 0x598b14 GENERAL_NAMES_free
• 0x598b18 X509V3_EXT_print
• 0x598b1c X509_check_issued
• 0x598b20 ERR_get_error
• 0x598b24 ERR_peek_error
• 0x598b28 ERR_clear_error
• 0x598b2c ERR_error_string_n
• 0x598b30 PKCS12_free
• 0x598b34 PKCS12_PBE_add
• 0x598b38 PKCS12_parse
• 0x598b3c d2i_PKCS12_bio
• 0x598b48 OCSP_resp_count
• 0x598b4c OCSP_resp_get0
• 0x598b54 OCSP_check_validity
• 0x598b58 OCSP_BASICRESP_free
• 0x598b5c OCSP_RESPONSE_free
• 0x598b60 d2i_OCSP_RESPONSE
• 0x598b68 OPENSSL_sk_num
• 0x598b6c OCSP_crl_reason_str
• 0x598b70 OCSP_basic_verify
• 0x598b74 UI_get0_user_data
• 0x598b78 UI_OpenSSL
• 0x598b7c UI_create_method
• 0x598b80 UI_destroy_method
• 0x598ba4 UI_get_string_type
• 0x598ba8 UI_get_input_flags
• 0x598bac UI_set_result
• 0x598bb0 ENGINE_get_first
• 0x598bb4 ENGINE_get_next
• 0x598bb8 ENGINE_by_id
• 0x598bc0 ENGINE_ctrl
• 0x598bc4 ENGINE_ctrl_cmd
• 0x598bc8 ENGINE_free
• 0x598bcc ENGINE_get_id
• 0x598bd0 ENGINE_init
• 0x598bd4 ENGINE_finish
• 0x598bdc ENGINE_set_default
• 0x598be0 MD5_Init
• 0x598be4 MD5_Update
• 0x598be8 MD5_Final
• 0x598bec DES_ecb_encrypt
• 0x598bf0 DES_set_odd_parity
• 0x598bf4 DES_set_key
• 0x598bf8 SHA256_Init
• 0x598bfc SHA256_Update
• 0x598c00 SHA256_Final
• 0x598c04 OPENSSL_sk_value
• 0x598c08 MD4_Init
• 0x598c0c MD4_Update
• 0x598c10 MD4_Final
• 0x598c14 OPENSSL_sk_pop_free
• 0x598c18 OPENSSL_sk_pop
• 0x598c1c OpenSSL_version_num
• 0x598c24 CRYPTO_malloc
• 0x598c28 CRYPTO_free
• 0x598c2c BIO_s_file
• 0x598c30 BIO_new
• 0x598c34 BIO_free
• 0x598c38 BIO_puts
• 0x598c3c BIO_ctrl
• 0x598c40 BIO_s_mem
• 0x598c44 BIO_printf
• 0x598c48 BN_num_bits
• 0x598c4c RAND_status
• 0x598c50 RAND_file_name
• 0x598c54 RAND_load_file
• 0x598c58 RAND_add
• 0x598c5c RAND_bytes
• 0x598c60 BN_print
• 0x598c64 ASN1_STRING_length
• 0x598c68 ASN1_STRING_type
• 0x598c70 i2a_ASN1_OBJECT
• 0x598c74 i2t_ASN1_OBJECT
• 0x598c78 ASN1_STRING_to_UTF8
• 0x598c7c ASN1_TIME_print
• 0x598c80 ASN1_STRING_print
• 0x598c84 EVP_MD_CTX_new
• 0x598c88 EVP_MD_CTX_free
• 0x598c8c EVP_DigestInit_ex
• 0x598c94 EVP_DigestUpdate
• 0x598c98 EVP_DigestFinal_ex
• 0x598c9c EVP_md5
• 0x598ca0 EVP_sha256
• 0x598ca4 EVP_PKEY_id
• 0x598ca8 EVP_PKEY_get0_RSA
• 0x598cac EVP_PKEY_get1_RSA
• 0x598cb0 EVP_PKEY_get0_DSA
• 0x598cb4 EVP_PKEY_get0_DH
• 0x598cb8 EVP_PKEY_free
• 0x598cc0 RSA_get0_key
• 0x598cc4 RSA_free
• 0x598cc8 RSA_flags
• 0x598ccc DH_get0_pqg
• 0x598cd0 PEM_write_bio_X509
• 0x598cd4 PEM_read_bio_X509
• 0x598ce4 X509_get_ext_d2i
• 0x598cec X509_NAME_get_entry
• 0x598cf4 X509_NAME_print_ex
• 0x598cf8 X509_get_pubkey
• 0x598d04 X509_get0_notAfter
• 0x598d08 X509_get0_notBefore
• 0x598d18 X509_get_version
• 0x598d1c X509_get0_signature
• 0x598d20 X509_free
• 0x598d24 i2d_X509_PUBKEY
• 0x598d2c X509_load_crl_file
• 0x598d30 X509_LOOKUP_file
• 0x598d3c DSA_get0_key
• 0x598d40 DSA_get0_pqg
• 0x598d44 DH_get0_key
Library libssl-1_1.dll:
• 0x598d4c SSL_CTX_set_options
• 0x598d68 BIO_f_ssl
• 0x598d70 SSL_CTX_new
• 0x598d74 SSL_CTX_free
• 0x598d80 SSL_CIPHER_get_name
• 0x598d84 SSL_pending
• 0x598d88 SSL_set_bio
• 0x598d98 SSL_get_certificate
• 0x598d9c SSL_get_privatekey
• 0x598da0 SSL_get_shutdown
• 0x598da4 SSL_version
• 0x598db0 SSL_set_ex_data
• 0x598db4 SSL_get_ex_data
• 0x598dc0 SSL_SESSION_free
• 0x598dc4 SSL_set_session
• 0x598dd0 SSL_CTX_set_verify
• 0x598de8 SSL_new
• 0x598dec SSL_free
• 0x598df0 SSL_connect
• 0x598e00 SSL_shutdown
• 0x598e04 TLS_client_method
• 0x598e08 SSL_get_error
• 0x598e0c SSL_CTX_ctrl
• 0x598e10 SSL_ctrl
• 0x598e14 SSL_write
• 0x598e18 SSL_set_fd
• 0x598e1c SSL_read
Library SHLWAPI.dll:
• 0x5988e4 PathRemoveFileSpecW
• 0x5988e8 StrCpyW
• 0x5988ec wnsprintfW
• 0x5988f0 PathAddBackslashW
• 0x5988f4 PathUnquoteSpacesW
• 0x5988f8 PathFileExistsW
• 0x5988fc PathIsDirectoryW
Library log4cplus.dll:
Library IPHLPAPI.DLL:
• 0x5985e0 GetAdaptersInfo
Library WLDAP32.dll:
• 0x5989fc
• 0x598a00
• 0x598a04
• 0x598a08
• 0x598a0c
• 0x598a10
• 0x598a14
• 0x598a18
• 0x598a1c
• 0x598a20
• 0x598a24
• 0x598a28
• 0x598a2c
• 0x598a30
• 0x598a34
• 0x598a38
• 0x598a3c

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 53658 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.