SmartHawk

2.6

中危

2 个模型检测该样本为恶意！

fa1f31bb9bb90c8377df1b7c3043be4b8cc80621beea576068e36a2491b69068

db7d1fe0335de87563d32eb4b493ef6d.exe

分析耗时

77s

最近分析

文件大小

1.1MB

静态报毒动态报毒 MULDROP SCORE UNSAFE

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba		20190527	0.3.0.5
Tencent		20200907	1.0.0.1
Baidu		20190318	1.0.0.2
Kingsoft		20200907	2013.8.14.323
McAfee		20200906	6.0.6.653
CrowdStrike		20190702	1.0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619948419.188205 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.itext

Foreign language identified in PE resource (6 个事件)

name

RT_ICON

language

LANG_ENGLISH

offset

0x000167c4

filetype

data

sublanguage

SUBLANG_ENGLISH_AUS

size

0x000010a8

name

RT_ICON

language

LANG_ENGLISH

offset

0x000167c4

filetype

data

sublanguage

SUBLANG_ENGLISH_AUS

size

0x000010a8

name

RT_ICON

language

LANG_ENGLISH

offset

0x000167c4

filetype

data

sublanguage

SUBLANG_ENGLISH_AUS

size

0x000010a8

name

RT_ICON

language

LANG_ENGLISH

offset

0x000167c4

filetype

data

sublanguage

SUBLANG_ENGLISH_AUS

size

0x000010a8

name

RT_GROUP_ICON

language

LANG_ENGLISH

offset

0x00017f18

filetype

data

sublanguage

SUBLANG_ENGLISH_AUS

size

0x0000003e

name

RT_MANIFEST

language

LANG_ENGLISH

offset

0x00017f58

filetype

XML 1.0 document, ASCII text, with CRLF line terminators

sublanguage

SUBLANG_ENGLISH_AUS

size

0x00000206

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 个事件)

VBA32	Trojan.MulDrop
eGambit	Unsafe.AI_Score_93%

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Generates some ICMP traffic

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2008-04-15 04:41:14

Imports

Library advapi32.dll:

• 0x411270 RegQueryValueExA

• 0x411274 RegOpenKeyExA

• 0x411278 RegCloseKey

Library user32.dll:

• 0x411280 GetKeyboardType

• 0x411284 DestroyWindow

• 0x411288 MessageBoxA

Library kernel32.dll:

• 0x411290 GetACP

• 0x411294 Sleep

• 0x411298 VirtualFree

• 0x41129c VirtualAlloc

• 0x4112a0 GetCurrentThreadId

• 0x4112a4 VirtualQuery

• 0x4112a8 SetCurrentDirectoryA

• 0x4112ac GetStartupInfoA

• 0x4112b0 GetLastError

• 0x4112b4 GetCommandLineA

• 0x4112b8 FreeLibrary

• 0x4112bc ExitProcess

• 0x4112c0 WriteFile

• 0x4112c4 UnhandledExceptionFilter

• 0x4112c8 RtlUnwind

• 0x4112cc RaiseException

• 0x4112d0 GetStdHandle

Library kernel32.dll:

• 0x4112d8 TlsSetValue

• 0x4112dc TlsGetValue

• 0x4112e0 LocalAlloc

• 0x4112e4 GetModuleHandleA

Library user32.dll:

• 0x4112ec TranslateMessage

• 0x4112f0 ShowWindow

• 0x4112f4 SetWindowTextA

• 0x4112f8 SetWindowPlacement

• 0x4112fc SetTimer

• 0x411300 SetFocus

• 0x411304 SetDlgItemTextA

• 0x411308 SendMessageA

• 0x41130c SendDlgItemMessageA

• 0x411310 PostMessageA

• 0x411314 PeekMessageA

• 0x411318 OemToCharA

• 0x41131c MessageBoxA

• 0x411320 LoadIconA

• 0x411324 KillTimer

• 0x411328 IsWindowVisible

• 0x41132c IsWindow

• 0x411330 IsDlgButtonChecked

• 0x411334 GetWindowTextLengthA

• 0x411338 GetWindowPlacement

• 0x41133c GetDlgItemTextA

• 0x411340 GetDlgItem

• 0x411344 GetDialogBaseUnits

• 0x411348 GetClassNameA

• 0x41134c EnumChildWindows

• 0x411350 EndDialog

• 0x411354 EnableWindow

• 0x411358 DispatchMessageA

• 0x41135c DialogBoxParamA

• 0x411360 DestroyWindow

• 0x411364 CheckRadioButton

Library kernel32.dll:

• 0x41136c lstrcmpiA

• 0x411370 WriteFile

• 0x411374 WinExec

• 0x411378 SetFileTime

• 0x41137c SetFilePointer

• 0x411380 SetEnvironmentVariableA

• 0x411384 ReadFile

• 0x411388 MulDiv

• 0x41138c LocalFileTimeToFileTime

• 0x411390 GetVolumeInformationA

• 0x411394 GetVersionExA

• 0x411398 GetTickCount

• 0x41139c GetTempFileNameA

• 0x4113a0 GetShortPathNameA

• 0x4113a4 GetModuleFileNameA

• 0x4113a8 GetFullPathNameA

• 0x4113ac GetFileSize

• 0x4113b0 GetFileAttributesA

• 0x4113b4 GetDriveTypeA

• 0x4113b8 GetCurrentDirectoryA

• 0x4113bc FreeLibrary

• 0x4113c0 ExpandEnvironmentStringsA

• 0x4113c4 DosDateTimeToFileTime

• 0x4113c8 DeleteFileA

• 0x4113cc CreateFileA

• 0x4113d0 CreateDirectoryA

• 0x4113d4 CloseHandle

• 0x4113d8 Beep

Library advapi32.dll:

• 0x4113e0 RegSetValueExA

• 0x4113e4 RegQueryValueExA

• 0x4113e8 RegOpenKeyA

• 0x4113ec RegCreateKeyA

• 0x4113f0 RegCloseKey

Library shell32.dll:

• 0x4113f8 SHGetFileInfoA

• 0x4113fc ShellExecuteA

• 0x411400 SHGetMalloc

• 0x411404 SHGetPathFromIDListA

• 0x411408 SHBrowseForFolderA

Library comctl32.dll:

• 0x411410 InitCommonControls

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.