SmartHawk

3.8

中危

30 个模型检测该样本为恶意！

重新分析

下载样本

5b96f45e379a375d929c3dfe00448d500d5d82c5f17dc99a1e671170406e6d06

dc4550a9ff538dcac5fca96b12c8ee2a.exe

分析耗时

86s

最近分析

文件大小

775.0KB

静态报毒动态报毒 ALEXPROTECT ARMOR ARTEMIS BADFILE CONFIDENCE DELF ELDORADO GAMANIA HACKTOOL HIGH CONFIDENCE HOSTER LE6I LLAC MALICIOUS PACKER MALICIOUS PE PLOCK QVM19 SWIZZOR TIGGRE UNSAFE WSJT XPACK ~D001@1QM878 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	HackTool:Win32/Packer.c145d917	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast		20190604	18.4.3895.0
Tencent	Win32.Trojan.Xed.Wsjt	20190604	1.0.0.1
Kingsoft		20190604	2013.8.14.323
McAfee	Artemis!DC4550A9FF53	20190604	6.0.6.653
CrowdStrike	win/malicious_confidence_60% (D)	20190212	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

The executable uses a known packer (1 个事件)

packer

PE-Armor 0.46 -> Hying

One or more processes crashed (50 out of 81 个事件)

Time & API	Arguments	Status
1621009570.372125 __exception__	stacktrace: registers.esp: 1638272 registers.edi: 0 registers.eax: 5980508 registers.ebp: 5967872 registers.edx: 3211264 registers.ebx: 5968290 registers.esi: 0 registers.ecx: 4101701632 exception.instruction_r: ad cd 20 e8 03 00 00 00 c7 84 00 58 eb 01 e9 83 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x31003b	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3211345 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 3211293 exception.instruction_r: ad cd 20 b9 04 00 00 00 e8 1f 00 00 00 eb fa e8 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310087	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3211465 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: ad cd 20 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3100ee	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3211531 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310148	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 0 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3211553 exception.instruction_r: ad cd 20 33 f6 e8 10 00 00 00 8b 64 24 08 64 8f exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3101be	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3211680 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 3211680 exception.instruction_r: ad cd 20 e8 16 00 00 00 8b 5c 24 0c 8b a3 c4 00 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3101e6	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3211720 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 e8 05 00 00 00 0f 01 eb 05 e8 eb fb 00 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310215	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 0 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3211758 exception.instruction_r: ad cd 20 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x31024e	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3211883 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 e8 05 00 00 00 0f 01 eb 05 e8 eb fb 00 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310297	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 0 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3211888 exception.instruction_r: ad cd 20 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3102d0	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3211954 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 3211954 exception.instruction_r: ad cd 20 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310330	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3212109 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 b9 04 00 00 00 e8 1f 00 00 00 eb fa e8 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310379	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3212358 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 0 exception.instruction_r: ad cd 20 b9 04 00 00 00 e8 1f 00 00 00 eb fa e8 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x31046b	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3212461 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: ad cd 20 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3104d2	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3212622 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 33 f6 e8 10 00 00 00 8b 64 24 08 64 8f exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x31059c	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 0 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3212661 exception.instruction_r: ad cd 20 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3105c4	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3212828 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: ad cd 20 e8 08 00 00 00 0f 01 83 c0 0f 50 c3 ff exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310641	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3212890 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310697	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3213021 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310709	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 0 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3213026 exception.instruction_r: ad cd 20 e8 03 00 00 00 c7 84 00 58 eb 01 e9 83 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310747	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3213149 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 3213097 exception.instruction_r: ad cd 20 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310793	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3213251 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x3107ef	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3213427 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 0 exception.instruction_r: ad cd 20 33 f6 e8 10 00 00 00 8b 64 24 08 64 8f exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310898	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3213434 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 3213434 exception.instruction_r: ad cd 20 e8 03 00 00 00 c7 84 00 58 eb 01 e9 83 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3108c0	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3213526 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 3213474 exception.instruction_r: ad cd 20 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3108fb	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3213614 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x31096b	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 0 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3213636 exception.instruction_r: ad cd 20 e8 03 00 00 00 c7 84 00 58 eb 01 e9 83 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3109bf	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3213781 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 33 f6 e8 10 00 00 00 8b 64 24 08 64 8f exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310a01	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 0 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3213786 exception.instruction_r: ad cd 20 e8 05 00 00 00 0f 01 eb 05 e8 eb fb 00 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310a29	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3213835 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310a69	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3214061 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310b19	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 0 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3214066 exception.instruction_r: ad cd 20 e8 03 00 00 00 c7 84 00 58 eb 01 e9 83 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310b57	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3214189 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 b9 04 00 00 00 e8 1f 00 00 00 eb fa e8 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310b99	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3214328 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310c24	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3214401 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3214333 exception.instruction_r: ad cd 20 b9 04 00 00 00 e8 1f 00 00 00 eb fa e8 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310c66	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3214504 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: ad cd 20 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310ccd	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3214629 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310d51	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 0 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3214634 exception.instruction_r: ad cd 20 e8 16 00 00 00 8b 5c 24 0c 8b a3 c4 00 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310d8f	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3214705 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310dbe	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3214833 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3214743 exception.instruction_r: ad cd 20 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310e38	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3214874 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310e7d	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3215002 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 b9 04 00 00 00 e8 1f 00 00 00 eb fa e8 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310eed	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3215154 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 b9 04 00 00 00 e8 1f 00 00 00 eb fa e8 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x310f5e	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3215264 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 0 exception.instruction_r: ad cd 20 33 f6 e8 10 00 00 00 8b 64 24 08 64 8f exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310fc5	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3215271 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 3215271 exception.instruction_r: ad cd 20 e8 05 00 00 00 0f 01 eb 05 e8 eb fb 00 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x310fed	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3215311 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x31103e	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3215477 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 e8 05 00 00 00 0f 01 eb 05 e8 eb fb 00 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x3110a1	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 0 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 1637148 registers.esi: 0 registers.ecx: 3215482 exception.instruction_r: ad cd 20 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3110da	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3215607 registers.ebp: 1636532 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 3215548 exception.instruction_r: ad cd 20 eb 01 0f 31 f0 eb 0c 33 c8 eb 03 eb 09 exception.instruction: lodsd eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x31113e	success
1621009570.372125 __exception__	stacktrace: 0x2b0023 registers.esp: 1638272 registers.edi: 0 registers.eax: 3215722 registers.ebp: 1636532 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f1 e9 e8 07 00 00 00 c7 83 83 c0 13 eb 0b 58 exception.instruction: div ecx exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x311196	success

Performs some HTTP requests (4 个事件)

request	GET http://ip.aliyun.com/service/getIpInfo.php?ip=myip
request	GET http://ip.taobao.com/service/getIpInfo.php?ip=myip
request	GET http://www.ip138.com/ips1388.asp
request	GET http://opendata.baidu.com/api.php?resource_id=6006&format=json&query=ip

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621009571.340125 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a0000	success	0	0

Foreign language identified in PE resource (14 个事件)

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0019aa14

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e8

name

RT_ICON

language

LANG_CHINESE

offset

0x0019aafc

filetype

dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00004228

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x001aff64

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000014

name

RT_MANIFEST

language

LANG_CHINESE

offset

0x001aff78

filetype

XML 1.0 document, ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000035d

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.925895133363245

section

{'size_of_data': '0x000a7800', 'virtual_address': '0x00001000', 'entropy': 7.925895133363245, 'name': '', 'virtual_size': '0x00197000'}

description

A section with a high entropy has been found

entropy

7.63833880952574

section

{'size_of_data': '0x00001c00', 'virtual_address': '0x001b1000', 'entropy': 7.63833880952574, 'name': '', 'virtual_size': '0x00002000'}

description

A section with a high entropy has been found

entropy

0.8746770025839793

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (2 个事件)

host	165.193.93.104
host	172.217.24.14

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 个事件)

FireEye	Generic.mg.dc4550a9ff538dca
Cylance	Unsafe
Alibaba	HackTool:Win32/Packer.c145d917
Invincea	heuristic
Cyren	W32/Heuristic-162!Eldorado
Symantec	Infostealer.Gamania
TotalDefense	Win32/AlexProtect!packed
ClamAV	Win.Trojan.Packed-126
AegisLab	Trojan.Win32.Llac.le6i
Tencent	Win32.Trojan.Xed.Wsjt
Comodo	TrojWare.Win32.Swizzor.~d001@1qm878
TrendMicro	Mal_Xed-8
McAfee-GW-Edition	BehavesLike.Win32.BadFile.bc
Sophos	Mal/Packer
SentinelOne	DFI - Malicious PE
F-Prot	W32/Heuristic-162!Eldorado
Avira	TR/Crypt.XPACK.Gen
Microsoft	Trojan:Win32/Tiggre!plock
Endgame	malicious (high confidence)
Acronis	suspicious
McAfee	Artemis!DC4550A9FF53
VBA32	Win32.Trojan.Hoster.Heur
ESET-NOD32	a variant of Win32/HackTool.Delf.NDZ
TrendMicro-HouseCall	Mal_Xed-8
Yandex	Packed/PE-Armor
Ikarus	Trojan.Win32.Swizzor
Cybereason	malicious.6f19e7
Panda	Malicious Packer
CrowdStrike	win/malicious_confidence_60% (D)
Qihoo-360	HEUR/QVM19.1.8CA5.Malware.Gen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library KERNEL32.dll:

• 0x5b102d GetProcAddress

• 0x5b1031 GetModuleHandleA

• 0x5b1035 LoadLibraryA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
ip.taobao.com	A 203.119.175.227 CNAME na61-na62.wagbridge.alibaba.taobao.com CNAME na61-na62.wagbridge.alibaba.taobao.com.gds.alibabadns.com	203.119.175.227
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
ip.aliyun.com	A 139.196.1.144 A 106.15.25.132 A 139.224.172.121	139.196.1.144
opendata.baidu.com	A 14.215.178.31 CNAME open.a.shifen.com A 14.215.178.33	14.215.178.31
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142	172.217.27.142
www.ip138.com	CNAME www.ip138.com.lxdns.com A 120.39.212.79	120.39.212.79
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
165.193.93.104	80	192.168.56.101	49183
192.168.56.101	49175	106.15.25.132 ip.aliyun.com	80
192.168.56.101	49177	120.39.212.79 www.ip138.com	80
192.168.56.101	49179	14.215.178.31 opendata.baidu.com	80
192.168.56.101	49176	203.119.175.227 ip.taobao.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://opendata.baidu.com/api.php?resource_id=6006&format=json&query=ip	GET /api.php?resource_id=6006&format=json&query=ip HTTP/1.1 Host: opendata.baidu.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8 User-Agent: Mozilla/5.0 (compatible;) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.221
http://ip.taobao.com/service/getIpInfo.php?ip=myip	GET /service/getIpInfo.php?ip=myip HTTP/1.1 Host: ip.taobao.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8 User-Agent: Mozilla/5.0 (compatible;) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.221
http://ip.aliyun.com/service/getIpInfo.php?ip=myip	GET /service/getIpInfo.php?ip=myip HTTP/1.1 Host: ip.aliyun.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8 User-Agent: Mozilla/5.0 (compatible;) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.221
http://www.ip138.com/ips1388.asp	GET /ips1388.asp HTTP/1.1 Host: www.ip138.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8 Referer: http://www.ip138.com User-Agent: Mozilla/5.0 (compatible;) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.221

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.