SmartHawk

4.0

中危

2 个模型检测该样本为恶意！

重新分析

下载样本

f54010fcc63758ab32d1d600ab0a889fc39a3bd32c806993d4c5fba4c12d6c14

f00b17d9d66c94a5aa3aa088e6f823e0.exe

分析耗时

32s

最近分析

文件大小

3.9MB

静态报毒动态报毒 INVALIDSIG

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀时间	查杀版本
Alibaba	20190527	0.3.0.5
CrowdStrike	20190702	1.0
Avast	20210109	21.1.5827.0
Tencent	20210110	1.0.0.1
Baidu	20190318	1.0.0.2
Kingsoft	20210110	2017.9.26.565
McAfee	20210110	6.0.6.653

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620813112.695626 IsDebuggerPresent		failed	0	0
1620813113.55475 IsDebuggerPresent		failed	0	0

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

C:\f\save\bin\client\master\five\release\dbg\CitizenFX_SubProcess_game.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (7 个事件)

section	.cdummy
section	_RDATA
section	.cld
section	.clr
section	.zdata
section	.unwind
section	.rd_pef

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620813121.210626 __exception__	stacktrace: 0x334d60 0x2a2e0a 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 registers.r14: 0 registers.r9: 0 registers.rcx: 240 registers.rsi: -1 registers.r10: 0 registers.rbx: 240 registers.rdi: 9 registers.r11: 1245072 registers.r8: 2009563532 registers.rdx: -1 registers.rbp: 1241888 registers.r15: 0 registers.r12: 5470650440 registers.rsp: 1241752 registers.rax: 2764288 registers.r13: 3358156 exception.instruction_r: e0 73 35 00 00 00 00 00 20 4d 33 00 00 00 00 00 exception.instruction: loopne 0x334dd5 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x334d60	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620813120.914626 NtProtectVirtualMemory	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x0000000077a49000	success	0	0

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 个事件)

eGambit	PE.Heur.InvalidSig
Gridinsoft	Trojan.Heur!.00242033

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.000949119962207

section

{'size_of_data': '0x00107b68', 'virtual_address': '0x06400000', 'entropy': 7.000949119962207, 'name': '.rd_pef', 'virtual_size': '0x00108000'}

description

A section with a high entropy has been found

entropy

0.2639508072217438

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\cache\subprocess\FiveM_DumpServer

Installs an hook procedure to monitor for mouse events (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620813121.023626 SetWindowsHookExW	thread_identifier: 0 callback_function: 0x000007fef31820f0 module_address: 0x000007fef3170000 hook_identifier: 14 (WH_MOUSE_LL)	success	262585	0

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-29 15:49:33

Imports

Library KERNEL32.dll:

• 0x14612e028 CreateFileW

• 0x14612e030 GetFileAttributesW

• 0x14612e038 GetFileAttributesExW

• 0x14612e040 GetLastError

• 0x14612e048 AddVectoredExceptionHandler

• 0x14612e050 GetCurrentProcessId

• 0x14612e058 ExitProcess

• 0x14612e060 GetStartupInfoW

• 0x14612e068 CreateFileMappingW

• 0x14612e070 MapViewOfFile

• 0x14612e078 GetModuleHandleW

• 0x14612e080 LoadLibraryA

• 0x14612e088 K32EnumProcessModules

• 0x14612e090 CreateDirectoryW

• 0x14612e098 ReleaseSRWLockExclusive

• 0x14612e0a0 AcquireSRWLockExclusive

• 0x14612e0a8 WakeAllConditionVariable

• 0x14612e0b0 SleepConditionVariableSRW

• 0x14612e0b8 CreateMutexW

• 0x14612e0c0 OpenMutexW

• 0x14612e0c8 CreateThread

• 0x14612e0d0 GetCurrentThread

• 0x14612e0d8 GetCurrentThreadId

• 0x14612e0e0 GetSystemTime

• 0x14612e0e8 GetTickCount64

• 0x14612e0f0 GetModuleFileNameW

• 0x14612e0f8 LocalFree

• 0x14612e100 SystemTimeToFileTime

• 0x14612e108 VerSetConditionMask

• 0x14612e110 CloseHandle

• 0x14612e118 OpenThread

• 0x14612e120 SuspendThread

• 0x14612e128 ResumeThread

• 0x14612e130 LoadLibraryW

• 0x14612e138 SetThreadContext

• 0x14612e140 VirtualProtect

• 0x14612e148 VerifyVersionInfoW

• 0x14612e150 RtlAddFunctionTable

• 0x14612e158 GetModuleFileNameA

• 0x14612e160 GetPrivateProfileStringW

• 0x14612e168 WritePrivateProfileStringW

• 0x14612e170 DeleteFileW

• 0x14612e178 GetFullPathNameW

• 0x14612e180 CreateProcessW

• 0x14612e188 CopyFileW

• 0x14612e190 GetEnvironmentVariableW

• 0x14612e198 SetEnvironmentVariableW

• 0x14612e1a0 SetCurrentDirectoryW

• 0x14612e1a8 SetEvent

• 0x14612e1b0 WaitForSingleObject

• 0x14612e1b8 CreateEventW

• 0x14612e1c0 GetExitCodeProcess

• 0x14612e1c8 OpenProcess

• 0x14612e1d0 GetSystemDirectoryW

• 0x14612e1d8 IsProcessInJob

• 0x14612e1e0 CreateJobObjectW

• 0x14612e1e8 AssignProcessToJobObject

• 0x14612e1f0 SetInformationJobObject

• 0x14612e1f8 GetPrivateProfileIntW

• 0x14612e200 SetDllDirectoryW

• 0x14612e208 HeapSize

• 0x14612e210 GetProcessHeap

• 0x14612e218 FreeEnvironmentStringsW

• 0x14612e220 GetEnvironmentStringsW

• 0x14612e228 GetCommandLineA

• 0x14612e230 GetOEMCP

• 0x14612e238 GetACP

• 0x14612e240 HeapReAlloc

• 0x14612e248 GetProcAddress

• 0x14612e250 TerminateProcess

• 0x14612e258 GetCurrentProcess

• 0x14612e260 IsDebuggerPresent

• 0x14612e268 GetCommandLineW

• 0x14612e270 GetThreadContext

• 0x14612e278 GetTimeZoneInformation

• 0x14612e280 FlushFileBuffers

• 0x14612e288 SetStdHandle

• 0x14612e290 EnumSystemLocalesW

• 0x14612e298 GetUserDefaultLCID

• 0x14612e2a0 IsValidLocale

• 0x14612e2a8 GetFileSizeEx

• 0x14612e2b0 GetConsoleCP

• 0x14612e2b8 HeapAlloc

• 0x14612e2c0 ReadConsoleW

• 0x14612e2c8 GetConsoleMode

• 0x14612e2d0 HeapFree

• 0x14612e2d8 FileTimeToSystemTime

• 0x14612e2e0 SystemTimeToTzSpecificLocalTime

• 0x14612e2e8 PeekNamedPipe

• 0x14612e2f0 GetDriveTypeW

• 0x14612e2f8 ExitThread

• 0x14612e300 MultiByteToWideChar

• 0x14612e308 WideCharToMultiByte

• 0x14612e310 OutputDebugStringA

• 0x14612e318 InitializeCriticalSectionAndSpinCount

• 0x14612e320 WriteFile

• 0x14612e328 SetNamedPipeHandleState

• 0x14612e330 TransactNamedPipe

• 0x14612e338 WaitNamedPipeW

• 0x14612e340 ResetEvent

• 0x14612e348 WaitForMultipleObjects

• 0x14612e350 SetUnhandledExceptionFilter

• 0x14612e358 InitializeCriticalSection

• 0x14612e360 EnterCriticalSection

• 0x14612e368 LeaveCriticalSection

• 0x14612e370 DeleteCriticalSection

• 0x14612e378 ReleaseSemaphore

• 0x14612e380 CreateSemaphoreW

• 0x14612e388 GetProcessId

• 0x14612e390 VirtualQueryEx

• 0x14612e398 FreeLibrary

• 0x14612e3a0 FormatMessageA

• 0x14612e3a8 CreateEventA

• 0x14612e3b0 WaitForSingleObjectEx

• 0x14612e3b8 FoldStringW

• 0x14612e3c0 LCMapStringW

• 0x14612e3c8 CompareStringW

• 0x14612e3d0 GetDateFormatW

• 0x14612e3d8 GetTimeFormatW

• 0x14612e3e0 GetLocaleInfoW

• 0x14612e3e8 GetCurrencyFormatW

• 0x14612e3f0 GetLocaleInfoA

• 0x14612e3f8 EnumSystemLocalesA

• 0x14612e400 IsValidCodePage

• 0x14612e408 IsDBCSLeadByteEx

• 0x14612e410 GetCurrentDirectoryW

• 0x14612e418 FindClose

• 0x14612e420 FindFirstFileExW

• 0x14612e428 FindNextFileW

• 0x14612e430 GetFileInformationByHandle

• 0x14612e438 RemoveDirectoryW

• 0x14612e440 SetEndOfFile

• 0x14612e448 SetFilePointerEx

• 0x14612e450 AreFileApisANSI

• 0x14612e458 SetLastError

• 0x14612e460 MoveFileExW

• 0x14612e468 SwitchToThread

• 0x14612e470 GetExitCodeThread

• 0x14612e478 GetStringTypeW

• 0x14612e480 EncodePointer

• 0x14612e488 DecodePointer

• 0x14612e490 TlsAlloc

• 0x14612e498 TlsGetValue

• 0x14612e4a0 TlsSetValue

• 0x14612e4a8 TlsFree

• 0x14612e4b0 GetSystemTimeAsFileTime

• 0x14612e4b8 QueryPerformanceCounter

• 0x14612e4c0 GetCPInfo

• 0x14612e4c8 UnhandledExceptionFilter

• 0x14612e4d0 IsProcessorFeaturePresent

• 0x14612e4d8 InitializeSListHead

• 0x14612e4e0 RaiseException

• 0x14612e4e8 GetSystemInfo

• 0x14612e4f0 VirtualQuery

• 0x14612e4f8 LoadLibraryExA

• 0x14612e500 OutputDebugStringW

• 0x14612e508 GetThreadTimes

• 0x14612e510 FreeLibraryAndExitThread

• 0x14612e518 LoadLibraryExW

• 0x14612e520 RtlPcToFileHeader

• 0x14612e528 RtlUnwindEx

• 0x14612e530 GetStdHandle

• 0x14612e538 GetFileType

• 0x14612e540 GetModuleHandleExW

• 0x14612e548 WriteConsoleW

• 0x14612e550 ReadFile

• 0x14612e558 RtlUnwind

Library USER32.dll:

• 0x14612e598 FindWindowW

• 0x14612e5a0 TranslateMessage

• 0x14612e5a8 MessageBoxW

• 0x14612e5b0 DispatchMessageW

• 0x14612e5b8 PeekMessageW

• 0x14612e5c0 MsgWaitForMultipleObjects

Library ADVAPI32.dll:

• 0x14612e000 GetTokenInformation

• 0x14612e008 OpenProcessToken

• 0x14612e010 RegGetValueW

• 0x14612e018 RegSetKeyValueW

Library SHELL32.dll:

• 0x14612e568 CommandLineToArgvW

• 0x14612e570 SHCreateItemFromParsingName

• 0x14612e578 SetCurrentProcessExplicitAppUserModelID

• 0x14612e580 SHSetLocalizedName

• 0x14612e588

Library ntdll.dll:

• 0x14612e5f0 RtlVirtualUnwind

• 0x14612e5f8 RtlLookupFunctionEntry

• 0x14612e600 RtlCaptureContext

Library VERSION.dll:

• 0x14612e5d0 GetFileVersionInfoW

• 0x14612e5d8 VerQueryValueW

• 0x14612e5e0 GetFileVersionInfoSizeW

Exports

Ordinal	Address	Name
2	0x14610c064	AmdPowerXpressRequestHighPerformance
3	0x1461973c0	AsyncTrace
4	0x1461b8e30	BeforeTerminateHandler
1	0x1461883c0	DllCanUnloadNow
5	0x14610c060	NvOptimusEnablement
6	0x1461b8e70	RemoteExceptionFunc
7	0x146227f38	free
8	0x146227f4c	malloc
9	0x14623e788	realloc

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.