8.4
高危
该样本未表现出任何异常！
重新分析
更多

b9bef42b8bed3f8a8090b1682db0e39a0a57f099641524323389b1f3c52ab475

d0222f1fd0b034841ceab1c3a241ceaf.exe

分析耗时

106s

最近分析

文件大小

283.2KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Command line console output was observed (9 个事件)
Time & API Arguments Status Return Repeated
1620922512.160124
WriteConsoleW
buffer: 硅摹 颇老俊 鞘夸茄 包府磊 鼻茄阑 犬牢 吝涝聪促. 
console_handle: 0x0000000000000007
success 1 0
1620922515.050124
WriteConsoleW
buffer: Intro - 硅摹 颇老 家俺 
console_handle: 0x0000000000000007
success 1 0
1620922515.347124
WriteConsoleW
buffer: 捞 硅摹 颇老篮 疙飞屈 焊救 昏力 蜡瓶府萍牢 SDelete 蜡瓶府萍甫 焊促
console_handle: 0x0000000000000007
success 1 0
1620922515.410124
WriteConsoleW
buffer: 颊奖霸 劝侩且 荐 乐档废 付快胶 坷弗率 滚瓢 努腐 皋春俊(牧咆胶飘 皋春)
console_handle: 0x0000000000000007
success 1 0
1620922515.425124
WriteConsoleW
buffer: 殿废且 荐 乐档废 档客林绰 硅摹 颇老 涝聪促.
console_handle: 0x0000000000000007
success 1 0
1620922515.550124
WriteConsoleW
buffer: 焊促 磊技茄 郴侩篮 酒贰狼 臂阑 曼绊窍矫辨 官而聪促.
console_handle: 0x0000000000000007
success 1 0
1620922515.847124
WriteConsoleW
buffer: http://CAppleBlog.co.kr/564
console_handle: 0x0000000000000007
success 1 0
1620922515.910124
WriteConsoleW
buffer: 力累 : 某敲 喉肺弊 - 某敲(CApple)
console_handle: 0x0000000000000007
success 1 0
1620922516.113124
WriteConsoleW
buffer: 请按任意键继续. . .
console_handle: 0x0000000000000007
success 1 0
This executable has a PDB path (1 个事件)
pdb_path d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (26 个事件)
Time & API Arguments Status Return Repeated
1620922485.221499
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75121000
success 0 0
1620922485.424499
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75101000
success 0 0
1620922487.206499
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74f81000
success 0 0
1620922487.378499
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74811000
success 0 0
1620922487.378499
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76881000
success 0 0
1620922488.003499
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75a11000
success 0 0
1620922488.003499
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x766c1000
success 0 0
1620922488.003499
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77691000
success 0 0
1620922489.018374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x747b1000
success 0 0
1620922489.034374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75101000
success 0 0
1620922489.174374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75c41000
success 0 0
1620922489.174374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76121000
success 0 0
1620922489.190374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74721000
success 0 0
1620922489.268374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x746d1000
success 0 0
1620922489.331374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x746b1000
success 0 0
1620922489.331374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74621000
success 0 0
1620922489.659374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74f81000
success 0 0
1620922489.690374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75391000
success 0 0
1620922490.112374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77711000
success 0 0
1620922490.112374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76241000
success 0 0
1620922490.393374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75a11000
success 0 0
1620922490.393374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x766c1000
success 0 0
1620922490.393374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77691000
success 0 0
1620922490.471374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74811000
success 0 0
1620922490.471374
NtProtectVirtualMemory
process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76881000
success 0 0
1620922558.643499
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004130000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates executable files on the filesystem (7 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX3\Resource\sdelete.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\Install.vbs
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\SDeleteContextMenuX86.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\Install.cmd
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX3\Resource\SDeleteReg.cmd
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\SDeleteContextMenuX64.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX3\SDeleteContextMenu.cmd
Creates a shortcut to an executable file (1 个事件)
file C:\Users\Public\Desktop\Google Chrome.lnk
Creates a suspicious process (2 个事件)
cmdline bcdedit
cmdline C:\Windows\system32\cmd.exe /c ver
Drops a binary and executes it (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\Install.vbs
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\SDeleteContextMenuX64.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX3\SDeleteContextMenu.cmd
Drops an executable to the user AppData folder (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX3\Resource\sdelete.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\SDeleteContextMenuX86.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX3\Resource\SDelete.icl
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1620922493.346374
ShellExecuteExW
parameters:
filepath: .\Install.cmd
filepath_r: .\Install.cmd
show_type: 0
success 1 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
One or more non-safelisted processes were created (2 个事件)
parent_process wscript.exe martian_process .\Install.cmd
parent_process wscript.exe martian_process "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\Install.cmd"
Resumed a suspended thread in a remote process potentially indicative of process injection (4 个事件)
Process injection Process 2080 resumed a thread in remote process 2544
Process injection Process 2260 resumed a thread in remote process 1940
Time & API Arguments Status Return Repeated
1620922488.643499
NtResumeThread
thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 2544
success 0 0
1620922501.112999
NtResumeThread
thread_handle: 0x0000001c
suspend_count: 0
process_identifier: 1940
success 0 0
The process wscript.exe wrote an executable file to disk (1 个事件)
file C:\Windows\SysWOW64\wscript.exe
Uses Sysinternals tools in order to add additional command line functionality (3 个事件)
cmdline "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\RarSFX3\SDeleteContextMenu.cmd"
cmdline C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX3\SDeleteContextMenu.cmd
cmdline SDeleteContextMenuX64.exe
Generates some ICMP traffic
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 216.58.200.46:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-02-17 22:55:21

Imports

Library COMCTL32.dll:
Library SHLWAPI.dll:
• 0x4131bc SHAutoComplete
Library KERNEL32.dll:
• 0x413068 DeleteFileW
• 0x41306c DeleteFileA
• 0x413070 CreateDirectoryA
• 0x413074 CreateDirectoryW
• 0x413078 FindClose
• 0x41307c FindNextFileA
• 0x413080 FindFirstFileA
• 0x413084 FindNextFileW
• 0x413088 FindFirstFileW
• 0x41308c GetTickCount
• 0x413090 WideCharToMultiByte
• 0x413094 GlobalAlloc
• 0x413098 GetVersionExW
• 0x41309c GetFullPathNameA
• 0x4130a0 GetFullPathNameW
• 0x4130a4 MultiByteToWideChar
• 0x4130a8 GetModuleFileNameW
• 0x4130ac FindResourceW
• 0x4130b0 GetModuleHandleW
• 0x4130b4 HeapAlloc
• 0x4130b8 GetProcessHeap
• 0x4130bc HeapFree
• 0x4130c0 HeapReAlloc
• 0x4130c4 CompareStringA
• 0x4130c8 ExitProcess
• 0x4130cc GetLocaleInfoW
• 0x4130d0 SetFileAttributesW
• 0x4130d8 GetDateFormatW
• 0x4130dc GetTimeFormatW
• 0x4130ec WaitForSingleObject
• 0x4130f0 Sleep
• 0x4130f4 GetExitCodeProcess
• 0x4130f8 GetTempPathW
• 0x4130fc MoveFileExW
• 0x413100 UnmapViewOfFile
• 0x413104 MapViewOfFile
• 0x413108 GetCommandLineW
• 0x41310c CreateFileMappingW
• 0x413114 OpenFileMappingW
• 0x413118 GetProcAddress
• 0x413124 GetSystemTime
• 0x413128 CompareStringW
• 0x41312c IsDBCSLeadByte
• 0x413130 GetCPInfo
• 0x413138 LoadLibraryW
• 0x41313c FreeLibrary
• 0x413140 SetFileAttributesA
• 0x413144 GetFileAttributesW
• 0x413148 GetFileAttributesA
• 0x41314c WriteFile
• 0x413150 GetStdHandle
• 0x413154 ReadFile
• 0x413158 CreateFileW
• 0x413160 CreateFileA
• 0x413164 GetFileType
• 0x413168 SetEndOfFile
• 0x41316c SetFilePointer
• 0x413170 MoveFileW
• 0x413174 SetFileTime
• 0x413178 GetCurrentProcess
• 0x41317c CloseHandle
• 0x413180 SetLastError
• 0x413184 GetLastError
• 0x413188 GetNumberFormatW
Library USER32.dll:
• 0x4131c4 wvsprintfA
• 0x4131c8 wvsprintfW
• 0x4131cc ReleaseDC
• 0x4131d0 GetDC
• 0x4131d4 SendMessageW
• 0x4131d8 SetDlgItemTextW
• 0x4131dc SetFocus
• 0x4131e0 EndDialog
• 0x4131e4 DestroyIcon
• 0x4131e8 SendDlgItemMessageW
• 0x4131ec GetDlgItemTextW
• 0x4131f0 GetClassNameW
• 0x4131f4 DialogBoxParamW
• 0x4131f8 IsWindowVisible
• 0x4131fc WaitForInputIdle
• 0x413200 SetForegroundWindow
• 0x413204 GetSysColor
• 0x413208 PostMessageW
• 0x41320c LoadBitmapW
• 0x413210 LoadIconW
• 0x413214 CharToOemA
• 0x413218 OemToCharA
• 0x41321c MapWindowPoints
• 0x413220 CreateWindowExW
• 0x413224 SetWindowTextW
• 0x413228 UpdateWindow
• 0x41322c LoadCursorW
• 0x413230 RegisterClassExW
• 0x413234 SetWindowLongW
• 0x413238 GetWindowLongW
• 0x41323c DefWindowProcW
• 0x413240 PeekMessageW
• 0x413244 GetMessageW
• 0x413248 TranslateMessage
• 0x41324c DispatchMessageW
• 0x413250 DestroyWindow
• 0x413254 CopyRect
• 0x413258 IsWindow
• 0x41325c CharToOemBuffW
• 0x413260 MessageBoxW
• 0x413264 ShowWindow
• 0x413268 GetDlgItem
• 0x41326c EnableWindow
• 0x413270 OemToCharBuffA
• 0x413274 CharUpperA
• 0x413278 CharToOemBuffA
• 0x41327c LoadStringW
• 0x413280 SetWindowPos
• 0x413284 GetWindowTextW
• 0x413288 GetSystemMetrics
• 0x41328c GetWindow
• 0x413290 CharUpperW
• 0x413294 GetWindowRect
• 0x413298 FindWindowExW
• 0x41329c GetParent
• 0x4132a0 GetClientRect
Library GDI32.dll:
• 0x413044 GetDeviceCaps
• 0x413048 GetObjectW
• 0x413050 SelectObject
• 0x413054 StretchBlt
• 0x413058 CreateCompatibleDC
• 0x41305c DeleteObject
• 0x413060 DeleteDC
Library COMDLG32.dll:
• 0x413034 GetOpenFileNameW
• 0x41303c GetSaveFileNameW
Library ADVAPI32.dll:
• 0x413000 RegOpenKeyExW
• 0x413008 RegQueryValueExW
• 0x41300c RegCreateKeyExW
• 0x413010 RegSetValueExW
• 0x413014 RegCloseKey
• 0x413018 SetFileSecurityW
• 0x41301c SetFileSecurityA
• 0x413020 OpenProcessToken
Library SHELL32.dll:
• 0x413198 SHChangeNotify
• 0x41319c ShellExecuteExW
• 0x4131a0 SHFileOperationW
• 0x4131a4 SHGetFileInfoW
• 0x4131ac SHGetMalloc
• 0x4131b0 SHBrowseForFolderW
Library ole32.dll:
• 0x4132a8 OleUninitialize
• 0x4132ac OleInitialize
• 0x4132b0 CoCreateInstance
• 0x4132b8 CLSIDFromString
Library OLEAUT32.dll:
• 0x413190 VariantInit

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49206 203.208.41.98 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.