分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-shaapp02-1 | 2022-07-04 13:06:30 | 2022-07-04 13:08:35 | 125 秒 |
魔盾分数
3.43
可疑的
文件详细信息
| 文件名 | peview.exe |
|---|---|
| 文件大小 | 86872 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 0ce169355d7167fc45efcd57ccf57bf5 |
| SHA1 | 0d2bd770abfa8508a06cc73bded1c6d3177bb753 |
| SHA256 | 9600d724fdf20914709aef13b8c1bb70171ef7edc23e15ca770e591efb4b43c4 |
| SHA512 | df4a7e4865ee427202f9e1018b213743040915b7e6bf5531fdc8319d22b938fbc221e1a6a179fcc63a8146c63759b9c90c4c070ccb8c57a1a685412db58f4471 |
| CRC32 | 69062DA5 |
| Ssdeep | 1536:cqAMydn1hfq3H6+KWW4JnEd1soxEGNM2hAZI7hMq33ELlzzk1/:onn1hC3a+KFEEd1somGW0j7hMqnERP+ |
| Yara | 登录查看Yara规则 |
| 找不到该样本 提交漏报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x00431730 |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x0001f346 |
| 最低操作系统版本要求 | 5.1 |
| 编译时间 | 2015-05-18 20:59:32 |
| 载入哈希 | 10403c5e339c0bdade6ddc29c3c44867 |
版本信息
| LegalCopyright | |
|---|---|
| InternalName | |
| FileVersion | |
| CompanyName | |
| ProductName | |
| ProductVersion | |
| FileDescription | |
| OriginalFilename | |
| Translation |
PEiD 规则
| [u'UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser'] |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x0001f000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| UPX1 | 0x00020000 | 0x00012000 | 0x00011a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 7.91 |
| .rsrc | 0x00032000 | 0x00002000 | 0x00001600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.43 |
覆盖
| 偏移量 | 0x00013400 |
| 大小 | 0x00001f58 |
导入
库: COMCTL32.dll:
• 0x4332a8 PropertySheetW
库: COMDLG32.dll:
• 0x4332b0 GetOpenFileNameW
库: GDI32.dll:
• 0x4332b8 SelectObject
库: KERNEL32.DLL:
• 0x4332c0 LoadLibraryA
• 0x4332c4 ExitProcess
• 0x4332c8 GetProcAddress
• 0x4332cc VirtualProtect
库: ntdll.dll:
• 0x4332d4 NtClose
库: ole32.dll:
• 0x4332dc CoTaskMemFree
库: SHELL32.dll:
• 0x4332e4 SHGetFileInfoW
库: USER32.dll:
• 0x4332ec GetPropW
库: VERSION.dll:
• 0x4332f4 VerQueryValueW
.rsrc
)'\!\`
1xV4
bxVQ*`
Rkt2"
)"!)6kl"
2,f-d
n][W1
MM/dd/yGd
`h`Ppx
+,g:g
'Y2@W'
#U/C`
~Hr,g:
Hr,g:
^Hr,g:
Hr,gW[&{2N:
</assembly>
COMCTL32.dll
COMDLG32.dll
GDI32.dll
KERNEL32.DLL
ntdll.dll
ole32.dll
SHELL32.dll
USER32.dll
VERSION.dll
PropertySheetW
GetOpenFileNameW
SelectObject
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
NtClose
CoTaskMemFree
SHGetFileInfoW
GetPropW
VerQueryValueW
270949
270949
Segoe UI
Static
Static
Static
Static
SysListView32
Static
Static
SysLink
Segoe UI
SysListView32
Segoe UI
SysListView32
Segoe UI
SysListView32
Segoe UI
Static
Static
Segoe UI
SysListView32
VS_VERSION_INFO
StringFileInfo
080404b0
CompanyName
FileDescription
PE Viewer
FileVersion
2.35.0.5898
InternalName
peview
LegalCopyright
Licensed under the GNU GPL, v3.
OriginalFilename
peview.exe
ProductName
Process Hacker
ProductVersion
2.35.0.5898
VarFileInfo
Translation
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49160 | 23.223.199.177 | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 63246 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49160 | 23.223.199.177 | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 63246 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip | GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 17.519 seconds )
- 10.548 Suricata
- 3.684 BehaviorAnalysis
- 1.143 NetworkAnalysis
- 1.013 VirusTotal
- 0.541 Static
- 0.303 peid
- 0.263 TargetInfo
- 0.011 AnalysisInfo
- 0.011 Strings
- 0.002 Memory
Signatures ( 3.54 seconds )
- 1.313 md_url_bl
- 0.495 antiav_detectreg
- 0.187 api_spamming
- 0.171 infostealer_ftp
- 0.152 stealth_timeout
- 0.145 stealth_decoy_document
- 0.123 antianalysis_detectreg
- 0.097 infostealer_im
- 0.055 antivm_generic_scsi
- 0.055 infostealer_mail
- 0.038 mimics_filetime
- 0.034 reads_self
- 0.032 antivm_generic_disk
- 0.032 virus
- 0.03 stealth_file
- 0.027 bootkit
- 0.026 anormaly_invoke_kills
- 0.026 darkcomet_regkeys
- 0.025 kibex_behavior
- 0.025 antivm_xen_keys
- 0.024 antivm_parallels_keys
- 0.023 antivm_generic_services
- 0.021 geodo_banking_trojan
- 0.021 recon_fingerprint
- 0.02 hancitor_behavior
- 0.019 betabot_behavior
- 0.017 antivm_generic_diskreg
- 0.014 antisandbox_productid
- 0.012 shifu_behavior
- 0.012 antiav_detectfile
- 0.011 maldun_anomaly_massive_file_ops
- 0.011 kovter_behavior
- 0.009 antiemu_wine_func
- 0.009 infostealer_browser_password
- 0.009 antivm_vbox_keys
- 0.009 antivm_vmware_keys
- 0.008 injection_createremotethread
- 0.008 ransomeware_modifies_desktop_wallpaper
- 0.008 bypass_firewall
- 0.008 antivm_xen_keys
- 0.008 antivm_hyperv_keys
- 0.008 antivm_vbox_acpi
- 0.008 antivm_vpc_keys
- 0.008 maldun_anomaly_invoke_vb_vba
- 0.008 md_domain_bl
- 0.008 packer_armadillo_regkey
- 0.007 anomaly_persistence_autorun
- 0.007 antivm_generic_bios
- 0.007 antivm_generic_cpu
- 0.007 antivm_generic_system
- 0.007 infostealer_bitcoin
- 0.007 recon_programs
- 0.006 antidbg_windows
- 0.005 maldun_malicious_write_executeable_under_temp_to_regrun
- 0.005 maldun_anomaly_write_exe_and_obsfucate_extension
- 0.005 injection_runpe
- 0.004 antivm_vbox_libs
- 0.004 rat_luminosity
- 0.004 maldun_anomaly_write_exe_and_dll_under_winroot_run
- 0.004 antivm_vbox_files
- 0.004 ransomware_extensions
- 0.004 ransomware_files
- 0.003 maldun_anomaly_terminated_process
- 0.003 network_http
- 0.002 tinba_behavior
- 0.002 antiav_avast_libs
- 0.002 infostealer_browser
- 0.002 injection_explorer
- 0.002 antisandbox_sunbelt_libs
- 0.002 exec_crash
- 0.002 h1n1_behavior
- 0.002 disables_browser_warn
- 0.001 hawkeye_behavior
- 0.001 network_tor
- 0.001 rat_nanocore
- 0.001 antivm_vmware_libs
- 0.001 antivm_vbox_window
- 0.001 antisandbox_sboxie_libs
- 0.001 antiav_bitdefender_libs
- 0.001 vawtrak_behavior
- 0.001 cerber_behavior
- 0.001 antisandbox_script_timer
- 0.001 antianalysis_detectfile
- 0.001 antidbg_devices
- 0.001 antiemu_wine_reg
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_security
- 0.001 modify_proxy
- 0.001 maldun_malicious_drop_executable_file_to_temp_folder
- 0.001 md_bad_drop
- 0.001 network_cnc_http
- 0.001 rat_pcclient
- 0.001 stealth_modify_uac_prompt
Reporting ( 0.625 seconds )
- 0.587 ReportHTMLSummary
- 0.038 Malheur
| Task ID | 697847 |
|---|---|
| Mongo ID | 62c275f5dc327b97d305053c |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号