4.8
中危
1 个模型检测该样本为恶意！
重新分析
更多

de0d2b805c9abb1d19f223acf3f34b7681f4bd695a9dccce7eddbf8def2321b4

e52de8afb560f9cd47ad1f409c8cd704.exe

分析耗时

72s

最近分析

文件大小

1.1MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20200710 6.0.6.653
Alibaba 20190527 0.3.0.5
Avast 20200710 18.4.3895.0
Tencent 20200710 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200710 2013.8.14.323
CrowdStrike 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619959577.522751
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (3 个事件)
Time & API Arguments Status Return Repeated
1619959551.116499
IsDebuggerPresent
failed 0 0
1619959552.710751
IsDebuggerPresent
failed 0 0
1619959552.710751
IsDebuggerPresent
failed 0 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
This executable is signed
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619959552.725751
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .sxdata
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619959580.350751
__exception__
stacktrace: 
0x7ff00293940
0x7ff00293714
0x7ff00293524
0x7ff002933c5
0x7ff00292fc0
0x7ff00292aab
CoUninitializeEE+0x3d374 CreateAssemblyNameObject-0x2d7dc clr+0x410b4 @ 0x7fef1ba10b4
CoUninitializeEE+0x3d489 CreateAssemblyNameObject-0x2d6c7 clr+0x411c9 @ 0x7fef1ba11c9
CoUninitializeEE+0x3d505 CreateAssemblyNameObject-0x2d64b clr+0x41245 @ 0x7fef1ba1245
ClrCreateManagedInstance+0x68fd MetaDataGetDispenser-0x6837 clr+0x141675 @ 0x7fef1ca1675
ClrCreateManagedInstance+0x6a34 MetaDataGetDispenser-0x6700 clr+0x1417ac @ 0x7fef1ca17ac
ClrCreateManagedInstance+0x67ea MetaDataGetDispenser-0x694a clr+0x141562 @ 0x7fef1ca1562
ClrCreateManagedInstance+0x905e MetaDataGetDispenser-0x40d6 clr+0x143dd6 @ 0x7fef1ca3dd6
ClrCreateManagedInstance+0x8f7b MetaDataGetDispenser-0x41b9 clr+0x143cf3 @ 0x7fef1ca3cf3
_CorExeMain+0x15 NGenCreateNGenWorker-0x17623 clr+0x1c7365 @ 0x7fef1d27365
_CorExeMain+0x49 CreateConfigStream-0x307 mscoreei+0x3309 @ 0x7fef4133309
_CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef41c5b21
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x77a4652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x77b7c521

registers.r14: 0
registers.r9: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 8791801562616
registers.rbx: 0
registers.rdi: 0
registers.r11: 0
registers.r8: 0
registers.rdx: 8
registers.rbp: 0
registers.r15: 0
registers.r12: 0
registers.rsp: 2358960
registers.rax: 0
registers.r13: 0
exception.instruction_r: 49 8b 03 48 8b 50 40 49 8b cb ff 12 48 89 45 10
exception.instruction: mov rax, qword ptr [r11]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7ff00293940
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (50 out of 212 个事件)
Time & API Arguments Status Return Repeated
1619959551.319499
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f01000
success 0 0
1619959552.053751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 2031616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00000000008d0000
success 0 0
1619959552.053751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000000a40000
success 0 0
1619959552.428751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 2555904
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x0000000000f60000
success 0 0
1619959552.428751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000001150000
success 0 0
1619959552.460751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b61000
success 0 0
1619959552.460751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b61000
success 0 0
1619959552.491751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef21e0000
success 0 0
1619959552.694751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x0000000000de0000
success 0 0
1619959552.710751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000000ed0000
success 0 0
1619959552.710751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b62000
success 0 0
1619959552.710751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b62000
success 0 0
1619959552.710751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b62000
success 0 0
1619959552.710751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b62000
success 0 0
1619959552.710751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b62000
success 0 0
1619959552.710751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b63000
success 0 0
1619959552.710751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b63000
success 0 0
1619959552.710751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b63000
success 0 0
1619959552.710751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b63000
success 0 0
1619959552.710751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b63000
success 0 0
1619959552.725751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b63000
success 0 0
1619959552.725751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b63000
success 0 0
1619959552.725751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b61000
success 0 0
1619959552.725751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b62000
success 0 0
1619959552.725751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b62000
success 0 0
1619959552.725751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b62000
success 0 0
1619959552.725751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b62000
success 0 0
1619959552.725751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1b62000
success 0 0
1619959553.288751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00022000
success 0 0
1619959553.319751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00012000
success 0 0
1619959553.647751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x000007fffff00000
success 0 0
1619959553.647751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007fffff00000
success 0 0
1619959553.647751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007fffff00000
success 0 0
1619959553.647751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007fffff10000
success 0 0
1619959553.647751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x000007ffffef0000
success 0 0
1619959553.647751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ffffef0000
success 0 0
1619959553.663751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff0001a000
success 0 0
1619959553.757751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00023000
success 0 0
1619959553.757751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000cc000
success 0 0
1619959553.757751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000f6000
success 0 0
1619959553.757751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000d0000
success 0 0
1619959554.507751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00024000
success 0 0
1619959555.022751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff0001b000
success 0 0
1619959555.038751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff0002c000
success 0 0
1619959555.866751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00025000
success 0 0
1619959555.866751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00027000
success 0 0
1619959556.132751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00029000
success 0 0
1619959556.382751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00170000
success 0 0
1619959556.397751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00171000
success 0 0
1619959557.085751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00172000
success 0 0
Creates executable files on the filesystem (9 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS71B0.tmp\com.mobile.legends.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS71B0.tmp\emulator-check.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS71B0.tmp\Newtonsoft.Json.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS71B0.tmp\Interop.IWshRuntimeLibrary.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS71B0.tmp\havdetectiontool\havtoollauncher.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS71B0.tmp\ResumeService.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS71B0.tmp\havdetectiontool\sources\i386\havtool.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS71B0.tmp\haxm_check.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS71B0.tmp\havdetectiontool\sources\amd64\havtool.exe
File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)
Webroot W32.Adware.Gen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2010-11-19 00:27:35

Imports

Library OLEAUT32.dll:
• 0x41b190 VariantClear
• 0x41b194 SysAllocString
Library USER32.dll:
• 0x41b1a4 SendMessageA
• 0x41b1a8 SetTimer
• 0x41b1ac DialogBoxParamW
• 0x41b1b0 DialogBoxParamA
• 0x41b1b4 SetWindowLongA
• 0x41b1b8 GetWindowLongA
• 0x41b1bc SetWindowTextW
• 0x41b1c0 LoadIconA
• 0x41b1c4 LoadStringW
• 0x41b1c8 LoadStringA
• 0x41b1cc CharUpperW
• 0x41b1d0 CharUpperA
• 0x41b1d4 DestroyWindow
• 0x41b1d8 EndDialog
• 0x41b1dc PostMessageA
• 0x41b1e0 ShowWindow
• 0x41b1e4 MessageBoxW
• 0x41b1e8 GetDlgItem
• 0x41b1ec KillTimer
• 0x41b1f0 SetWindowTextA
Library SHELL32.dll:
• 0x41b19c ShellExecuteExA
Library KERNEL32.dll:
• 0x41b000 GetStringTypeW
• 0x41b004 GetStringTypeA
• 0x41b008 LCMapStringW
• 0x41b00c LCMapStringA
• 0x41b018 GetProcAddress
• 0x41b01c GetOEMCP
• 0x41b020 GetACP
• 0x41b024 GetCPInfo
• 0x41b028 IsBadCodePtr
• 0x41b02c IsBadReadPtr
• 0x41b030 GetFileType
• 0x41b034 SetHandleCount
• 0x41b04c HeapSize
• 0x41b050 GetCurrentProcess
• 0x41b054 TerminateProcess
• 0x41b058 IsBadWritePtr
• 0x41b05c HeapCreate
• 0x41b060 HeapDestroy
• 0x41b06c TlsAlloc
• 0x41b070 ExitProcess
• 0x41b074 GetVersion
• 0x41b078 GetCommandLineA
• 0x41b07c GetStartupInfoA
• 0x41b080 GetModuleHandleA
• 0x41b084 WaitForSingleObject
• 0x41b088 CloseHandle
• 0x41b08c CreateProcessA
• 0x41b094 GetCommandLineW
• 0x41b098 GetVersionExA
• 0x41b0a8 MultiByteToWideChar
• 0x41b0ac WideCharToMultiByte
• 0x41b0b0 GetLastError
• 0x41b0b4 LoadLibraryA
• 0x41b0b8 AreFileApisANSI
• 0x41b0bc GetModuleFileNameA
• 0x41b0c0 GetModuleFileNameW
• 0x41b0c4 LocalFree
• 0x41b0c8 FormatMessageA
• 0x41b0cc FormatMessageW
• 0x41b0d4 SetFileTime
• 0x41b0d8 CreateFileW
• 0x41b0dc SetLastError
• 0x41b0e0 SetFileAttributesA
• 0x41b0e4 RemoveDirectoryA
• 0x41b0e8 SetFileAttributesW
• 0x41b0ec RemoveDirectoryW
• 0x41b0f0 CreateDirectoryA
• 0x41b0f4 CreateDirectoryW
• 0x41b0f8 DeleteFileA
• 0x41b0fc DeleteFileW
• 0x41b100 lstrlenA
• 0x41b104 GetFullPathNameA
• 0x41b108 GetFullPathNameW
• 0x41b110 GetTempPathA
• 0x41b114 GetTempFileNameA
• 0x41b118 FindClose
• 0x41b11c FindFirstFileA
• 0x41b120 FindFirstFileW
• 0x41b124 FindNextFileA
• 0x41b128 CreateFileA
• 0x41b12c GetFileSize
• 0x41b130 SetFilePointer
• 0x41b134 ReadFile
• 0x41b138 WriteFile
• 0x41b13c SetEndOfFile
• 0x41b140 GetStdHandle
• 0x41b148 Sleep
• 0x41b14c VirtualAlloc
• 0x41b150 VirtualFree
• 0x41b154 CreateEventA
• 0x41b158 SetEvent
• 0x41b15c ResetEvent
• 0x41b164 RtlUnwind
• 0x41b168 RaiseException
• 0x41b16c HeapAlloc
• 0x41b170 HeapFree
• 0x41b174 HeapReAlloc
• 0x41b178 CreateThread
• 0x41b17c GetCurrentThreadId
• 0x41b180 TlsSetValue
• 0x41b184 TlsGetValue
• 0x41b188 ExitThread

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49236 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.