SmartHawk

4.2

中危

该样本未表现出任何异常！

重新分析

下载样本

d63292762a58c4f918343e34611715172a0ac01eda7858fc39927318eb355814

d4212f53a08e528dabe3442e1b8cb971.exe

分析耗时

77s

最近分析

文件大小

420.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910869.531727 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619910854.297727 CryptGenKey	crypto_handle: 0x008e4dc0 algorithm_identifier: 0x0000660e () provider_handle: 0x008e43d8 flags: 1 key: fÌp½"¬þ â&ìJã	success	1
1619910869.547727 CryptExportKey	crypto_handle: 0x008e4dc0 crypto_export_handle: 0x008e44a0 buffer: f¤«R%Í´âÇùÄà§®Þ«O¬^% «Úüæ»ã¡!\|¤ö`úßéâNf: ÿUhBs5 Ví÷pT Ü1P]7õþUVý¬ºÍç³êüÍ×ÇÒyI blob_type: 1 flags: 64	success	1
1619910904.766727 CryptExportKey	crypto_handle: 0x008e4dc0 crypto_export_handle: 0x008e44a0 buffer: f¤v¤ËÁÈ¬Wó;a'jzD8¾H ~ðïò]ø<¦yÃMîýµé«û»ì$UÜ±hËãÒ²ÈE_´akÊ¹ÕßúgÞC14æ¨ÛÔí blob_type: 1 flags: 64	success	1

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910853.922727 NtAllocateVirtualMemory	process_identifier: 368 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01eb0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910870.047727 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

d4212f53a08e528dabe3442e1b8cb971.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910869.719727 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	71.197.211.156
host	87.118.70.45

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619910872.641727 RegSetValueExA	key_handle: 0x000003c4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619910872.641727 RegSetValueExA	key_handle: 0x000003c4 value: °`*?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619910872.641727 RegSetValueExA	key_handle: 0x000003c4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619910872.641727 RegSetValueExW	key_handle: 0x000003c4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619910872.641727 RegSetValueExA	key_handle: 0x000003dc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619910872.641727 RegSetValueExA	key_handle: 0x000003dc value: °`*?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619910872.641727 RegSetValueExA	key_handle: 0x000003dc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619910872.672727 RegSetValueExW	key_handle: 0x000003c0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

71.197.211.156:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-26 17:00:32

Imports

Library KERNEL32.dll:

• 0x4300f0 SetErrorMode

• 0x4300f4 RtlUnwind

• 0x4300f8 HeapAlloc

• 0x4300fc HeapFree

• 0x430100 HeapReAlloc

• 0x430104 VirtualAlloc

• 0x430108 GetCommandLineA

• 0x43010c GetProcessHeap

• 0x430110 GetStartupInfoA

• 0x430114 RaiseException

• 0x430118 ExitThread

• 0x43011c CreateThread

• 0x430120 HeapSize

• 0x430124 TerminateProcess

• 0x430128 UnhandledExceptionFilter

• 0x43012c SetUnhandledExceptionFilter

• 0x430130 IsDebuggerPresent

• 0x430134 GetACP

• 0x430138 VirtualFree

• 0x43013c HeapDestroy

• 0x430140 HeapCreate

• 0x430144 GetStdHandle

• 0x430148 LCMapStringA

• 0x43014c LCMapStringW

• 0x430150 FreeEnvironmentStringsA

• 0x430154 GetEnvironmentStrings

• 0x430158 FreeEnvironmentStringsW

• 0x43015c GetEnvironmentStringsW

• 0x430160 SetHandleCount

• 0x430164 GetFileType

• 0x430168 QueryPerformanceCounter

• 0x43016c GetTickCount

• 0x430170 GetSystemTimeAsFileTime

• 0x430174 GetConsoleCP

• 0x430178 GetConsoleMode

• 0x43017c GetStringTypeA

• 0x430180 GetStringTypeW

• 0x430184 SetStdHandle

• 0x430188 WriteConsoleA

• 0x43018c GetConsoleOutputCP

• 0x430190 WriteConsoleW

• 0x430194 FlushFileBuffers

• 0x430198 SetFilePointer

• 0x43019c WriteFile

• 0x4301a0 ReadFile

• 0x4301a4 WritePrivateProfileStringA

• 0x4301a8 GetThreadLocale

• 0x4301ac GetOEMCP

• 0x4301b0 GetCPInfo

• 0x4301b4 GlobalFlags

• 0x4301b8 TlsFree

• 0x4301bc DeleteCriticalSection

• 0x4301c0 LocalReAlloc

• 0x4301c4 TlsSetValue

• 0x4301c8 TlsAlloc

• 0x4301cc InitializeCriticalSection

• 0x4301d0 GlobalHandle

• 0x4301d4 GlobalReAlloc

• 0x4301d8 EnterCriticalSection

• 0x4301dc TlsGetValue

• 0x4301e0 LeaveCriticalSection

• 0x4301e4 LocalAlloc

• 0x4301e8 InterlockedIncrement

• 0x4301ec GetCurrentProcessId

• 0x4301f0 SuspendThread

• 0x4301f4 ResumeThread

• 0x4301f8 SetThreadPriority

• 0x4301fc GetCurrentThread

• 0x430200 ConvertDefaultLocale

• 0x430204 GetModuleFileNameA

• 0x430208 EnumResourceLanguagesA

• 0x43020c GetLocaleInfoA

• 0x430210 lstrcmpA

• 0x430214 InterlockedDecrement

• 0x430218 GetModuleFileNameW

• 0x43021c FreeResource

• 0x430220 GlobalGetAtomNameA

• 0x430224 GlobalAddAtomA

• 0x430228 GlobalFindAtomA

• 0x43022c GlobalDeleteAtom

• 0x430230 lstrcmpW

• 0x430234 GetVersionExA

• 0x430238 GetModuleHandleA

• 0x43023c GetProcAddress

• 0x430240 GlobalFree

• 0x430244 FormatMessageA

• 0x430248 LocalFree

• 0x43024c MulDiv

• 0x430250 ExitProcess

• 0x430254 IsBadWritePtr

• 0x430258 CreateEventA

• 0x43025c SetEvent

• 0x430260 ReleaseMutex

• 0x430264 WaitForSingleObject

• 0x430268 CreateFileA

• 0x43026c CreateFileMappingA

• 0x430270 MapViewOfFile

• 0x430274 UnmapViewOfFile

• 0x430278 CloseHandle

• 0x43027c FlushViewOfFile

• 0x430280 GetWindowsDirectoryA

• 0x430284 LoadLibraryA

• 0x430288 FreeLibrary

• 0x43028c WinExec

• 0x430290 lstrlenA

• 0x430294 CompareStringA

• 0x430298 GetVersion

• 0x43029c MultiByteToWideChar

• 0x4302a0 InterlockedExchange

• 0x4302a4 CreateMutexA

• 0x4302a8 SetLastError

• 0x4302ac GetCurrentThreadId

• 0x4302b0 GetCurrentProcess

• 0x4302b4 GetLastError

• 0x4302b8 GetEnvironmentVariableA

• 0x4302bc Sleep

• 0x4302c0 GlobalAlloc

• 0x4302c4 GlobalLock

• 0x4302c8 GlobalUnlock

• 0x4302cc WideCharToMultiByte

• 0x4302d0 FindResourceA

• 0x4302d4 LoadResource

• 0x4302d8 LockResource

• 0x4302dc SizeofResource

Library USER32.dll:

• 0x430308 GetWindowThreadProcessId

• 0x43030c GetSysColorBrush

• 0x430310 UnregisterClassA

• 0x430314 GetNextDlgTabItem

• 0x430318 EndDialog

• 0x43031c IsWindowEnabled

• 0x430320 MoveWindow

• 0x430324 SetWindowTextA

• 0x430328 IsDialogMessageA

• 0x43032c SetMenuItemBitmaps

• 0x430330 GetMenuCheckMarkDimensions

• 0x430334 LoadBitmapA

• 0x430338 ModifyMenuA

• 0x43033c EnableMenuItem

• 0x430340 CheckMenuItem

• 0x430344 SendDlgItemMessageA

• 0x430348 WinHelpA

• 0x43034c GetCapture

• 0x430350 SetWindowsHookExA

• 0x430354 CallNextHookEx

• 0x430358 GetClassLongA

• 0x43035c GetClassNameA

• 0x430360 SetPropA

• 0x430364 GetPropA

• 0x430368 RemovePropA

• 0x43036c GetFocus

• 0x430370 SetFocus

• 0x430374 GetWindowTextLengthA

• 0x430378 GetWindowTextA

• 0x43037c GetForegroundWindow

• 0x430380 GetLastActivePopup

• 0x430384 SetActiveWindow

• 0x430388 DispatchMessageA

• 0x43038c GetDlgItem

• 0x430390 GetTopWindow

• 0x430394 UnhookWindowsHookEx

• 0x430398 GetMessageTime

• 0x43039c PeekMessageA

• 0x4303a0 MapWindowPoints

• 0x4303a4 GetKeyState

• 0x4303a8 SetForegroundWindow

• 0x4303ac IsWindowVisible

• 0x4303b0 UpdateWindow

• 0x4303b4 GetMenu

• 0x4303b8 PostMessageA

• 0x4303bc MessageBoxA

• 0x4303c0 GetClassInfoExA

• 0x4303c4 GetClassInfoA

• 0x4303c8 RegisterClassA

• 0x4303cc AdjustWindowRectEx

• 0x4303d0 CopyRect

• 0x4303d4 GetDlgCtrlID

• 0x4303d8 DefWindowProcA

• 0x4303dc CallWindowProcA

• 0x4303e0 GetWindowLongA

• 0x4303e4 SetWindowPos

• 0x4303e8 SystemParametersInfoA

• 0x4303ec GetWindowPlacement

• 0x4303f0 GetWindow

• 0x4303f4 EndPaint

• 0x4303f8 BeginPaint

• 0x4303fc ClientToScreen

• 0x430400 GetMenuState

• 0x430404 GetMenuItemID

• 0x430408 GetMenuItemCount

• 0x43040c GetClientRect

• 0x430410 InvalidateRect

• 0x430414 EnableWindow

• 0x430418 TabbedTextOutA

• 0x43041c DrawTextA

• 0x430420 DrawTextExA

• 0x430424 LoadIconA

• 0x430428 IsIconic

• 0x43042c GetSystemMenu

• 0x430430 AppendMenuA

• 0x430434 DrawIcon

• 0x430438 ShowWindow

• 0x43043c CreateWindowExA

• 0x430440 InSendMessage

• 0x430444 GetSystemMetrics

• 0x430448 LoadMenuA

• 0x43044c GetSubMenu

• 0x430450 DrawFocusRect

• 0x430454 RegisterWindowMessageA

• 0x430458 SetWindowLongA

• 0x43045c CopyIcon

• 0x430460 GetMessageA

• 0x430464 TranslateMessage

• 0x430468 ValidateRect

• 0x43046c PostQuitMessage

• 0x430470 DestroyMenu

• 0x430474 GetCursorPos

• 0x430478 WindowFromPoint

• 0x43047c GetDesktopWindow

• 0x430480 GetActiveWindow

• 0x430484 DestroyWindow

• 0x430488 CreateDialogIndirectParamA

• 0x43048c GrayStringA

• 0x430490 GetSysColor

• 0x430494 CloseClipboard

• 0x430498 OpenClipboard

• 0x43049c SetClipboardData

• 0x4304a0 EmptyClipboard

• 0x4304a4 SendMessageA

• 0x4304a8 IsWindow

• 0x4304ac wsprintfA

• 0x4304b0 GetUserObjectInformationA

• 0x4304b4 GetThreadDesktop

• 0x4304b8 SetCursor

• 0x4304bc PtInRect

• 0x4304c0 DestroyCursor

• 0x4304c4 MessageBeep

• 0x4304c8 GetMessagePos

• 0x4304cc LoadCursorA

• 0x4304d0 GetParent

• 0x4304d4 KillTimer

• 0x4304d8 SetTimer

• 0x4304dc RedrawWindow

• 0x4304e0 ReleaseDC

• 0x4304e4 GetDC

• 0x4304e8 ScreenToClient

• 0x4304ec GetWindowRect

• 0x4304f0 InflateRect

• 0x4304f4 TrackPopupMenu

Library GDI32.dll:

• 0x430034 SelectObject

• 0x430038 SetViewportOrgEx

• 0x43003c OffsetViewportOrgEx

• 0x430040 SetViewportExtEx

• 0x430044 ScaleViewportExtEx

• 0x430048 SetWindowOrgEx

• 0x43004c SetWindowExtEx

• 0x430050 ScaleWindowExtEx

• 0x430054 DeleteDC

• 0x430058 CreateBitmap

• 0x43005c SelectClipRgn

• 0x430060 DeleteObject

• 0x430064 GetClipBox

• 0x430068 SetTextAlign

• 0x43006c MoveToEx

• 0x430070 LineTo

• 0x430074 CreatePen

• 0x430078 SetMapMode

• 0x43007c SetTextColor

• 0x430080 SetBkMode

• 0x430084 SetBkColor

• 0x430088 RestoreDC

• 0x43008c SaveDC

• 0x430090 GetDeviceCaps

• 0x430094 GetCharWidthA

• 0x430098 GetTextExtentPoint32A

• 0x43009c GetStockObject

• 0x4300a0 GetObjectA

• 0x4300a4 CreateFontIndirectA

• 0x4300a8 Escape

• 0x4300ac ExtTextOutA

• 0x4300b0 TextOutA

• 0x4300b4 RectVisible

• 0x4300b8 PtVisible

• 0x4300bc GetTextMetricsA

• 0x4300c0 BitBlt

• 0x4300c4 Polygon

• 0x4300c8 LPtoDP

• 0x4300cc DPtoLP

• 0x4300d0 GetMapMode

• 0x4300d4 GetBkColor

• 0x4300d8 CreateCompatibleDC

• 0x4300dc CreatePolygonRgn

• 0x4300e0 CreateCompatibleBitmap

• 0x4300e4 CreateFontA

• 0x4300e8 CreateSolidBrush

Library WINSPOOL.DRV:

• 0x4304fc ClosePrinter

• 0x430500 DocumentPropertiesA

• 0x430504 OpenPrinterA

Library ADVAPI32.dll:

• 0x430000 RegSetValueExA

• 0x430004 RegCreateKeyExA

• 0x430008 RegEnumKeyA

• 0x43000c RegDeleteKeyA

• 0x430010 RegQueryValueExA

• 0x430014 RegOpenKeyA

• 0x430018 RegOpenKeyExA

• 0x43001c RegQueryValueA

• 0x430020 RegCloseKey

• 0x430024 OpenProcessToken

• 0x430028 GetTokenInformation

• 0x43002c GetUserNameA

Library SHELL32.dll:

• 0x4302f4 ShellExecuteA

Library SHLWAPI.dll:

• 0x4302fc PathFindFileNameA

• 0x430300 PathFindExtensionA

Library OLEAUT32.dll:

• 0x4302e4 VariantClear

• 0x4302e8 VariantChangeType

• 0x4302ec VariantInit

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.