比较分析...

分析任务

分析类型 虚拟机标签 开始时间 结束时间 持续时间
文件 (Windows) win7-sp1-x64-shaapp03-1 2024-04-19 19:49:31 2024-04-19 19:51:41 130 秒

魔盾分数

1.925

正常的

文件详细信息

文件名 artifact.exe
文件大小 14336 字节
文件类型 PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 a7fcd0b15a080167c4c2f05063802a6e
SHA1 c761d68786ff15b6e991770a8c9aee778dd011e9
SHA256 9f6ae95b5540d0d6c60e942fa68dee44b2781c58da3f21321f18b8384ab41084
SHA512 64644039b3c20b861a3186e320e3a0a14119e65c5e37e0aa108515b13e833ef227379d757bb3d7cbf5cb2e37731b37cb846264677f464e5152621b25a71045c3
CRC32 0E2891E1
Ssdeep 192:AaH+DgGK83SxHn2OQ/dmBI4KBfTgir+xzPDbqUqV/Qjo7AGa:A2+kGKqbOCdWIVBff+xzPnfCXAn
Yara 登录查看Yara规则
找不到该样本 提交漏报
登录查看威胁特征

运行截图

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

摘要

登录查看详细行为信息

PE 信息

初始地址 0x00400000
入口地址 0x004014b0
声明校验值 0x0000db21
实际校验值 0x0000db21
最低操作系统版本要求 4.0
编译时间 2020-06-09 08:17:15
载入哈希 dc25ee78e2ef4d36faa0badf1e7461c9

PE 数据组成

名称 虚拟地址 虚拟大小 原始数据大小 特征 熵(Entropy)
.text 0x00001000 0x00001d44 0x00001e00 IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES 5.87
.data 0x00003000 0x00000424 0x00000600 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 5.45
.rdata 0x00004000 0x000002f4 0x00000400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES 4.37
.bss 0x00005000 0x0000045c 0x00000000 IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES 0.00
.idata 0x00006000 0x000006ec 0x00000800 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 4.20
.CRT 0x00007000 0x00000034 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 0.25
.tls 0x00008000 0x00000020 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 0.22

导入

库: KERNEL32.dll:
• 0x406138 CloseHandle
• 0x40613c ConnectNamedPipe
• 0x406140 CreateFileA
• 0x406144 CreateNamedPipeA
• 0x406148 CreateThread
• 0x406154 FreeLibrary
• 0x406158 GetCurrentProcess
• 0x40615c GetCurrentProcessId
• 0x406160 GetCurrentThreadId
• 0x406164 GetLastError
• 0x406168 GetModuleHandleA
• 0x40616c GetProcAddress
• 0x406170 GetStartupInfoA
• 0x406178 GetTickCount
• 0x406184 LoadLibraryA
• 0x406188 LoadLibraryW
• 0x406190 ReadFile
• 0x406198 Sleep
• 0x40619c TerminateProcess
• 0x4061a0 TlsGetValue
• 0x4061a8 VirtualAlloc
• 0x4061ac VirtualProtect
• 0x4061b0 VirtualQuery
• 0x4061b4 WriteFile
库: msvcrt.dll:
• 0x4061bc __dllonexit
• 0x4061c0 __getmainargs
• 0x4061c4 __initenv
• 0x4061c8 __lconv_init
• 0x4061cc __set_app_type
• 0x4061d0 __setusermatherr
• 0x4061d4 _acmdln
• 0x4061d8 _amsg_exit
• 0x4061dc _cexit
• 0x4061e0 _fmode
• 0x4061e4 _initterm
• 0x4061e8 _iob
• 0x4061ec _lock
• 0x4061f0 _onexit
• 0x4061f4 _unlock
• 0x4061f8 _winmajor
• 0x4061fc abort
• 0x406200 calloc
• 0x406204 exit
• 0x406208 fprintf
• 0x40620c free
• 0x406210 fwrite
• 0x406214 malloc
• 0x406218 memcpy
• 0x40621c signal
• 0x406220 sprintf
• 0x406224 strlen
• 0x406228 strncmp
• 0x40622c vfprintf
.text
P`.data
.rdata
0@.bss
.idata
;5XP@
_set_invalid_parameter_handler
libgcj-12.dll
_Jv_RegisterClasses
%c%c%c%c%c%c%c%c%cMSSE-%d-server
mingwm10.dll
__mingwthr_remove_key_dtor
__mingwthr_key_dtor
Unknown error
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
The result is too small to be represented (UNDERFLOW)
Total loss of significance (TLOSS)
Partial loss of significance (PLOSS)
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
CloseHandle
ConnectNamedPipe
CreateFileA
CreateNamedPipeA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
QueryPerformanceCounter
ReadFile
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_lock
_onexit
_unlock
_winmajor
abort
calloc
fprintf
fwrite
malloc
memcpy
signal
sprintf
strlen
strncmp
vfprintf
KERNEL32.dll
msvcrt.dll
msvcrt.dll
没有防病毒引擎扫描信息!

进程树

artifact.exe, PID: 2584, 上一级进程 PID: 2184
下载PCAP包

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49160 104.114.76.194 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 59401 192.168.122.1 53

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49160 104.114.76.194 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 59401 192.168.122.1 53

HTTP 请求

URI HTTP数据
URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip 
GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1
Accept: */*
If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT
User-Agent: IPM
Host: acroipm.adobe.com
Connection: Keep-Alive
Cache-Control: no-cache

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

No TLS

Suricata HTTP

No Suricata HTTP

未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
HTML 总结报告
(需15-60分钟同步)		 下载

Processing ( 21.993 seconds )

  • 11.105 Suricata
  • 6.251 VirusTotal
  • 3.261 NetworkAnalysis
  • 0.396 Static
  • 0.369 peid
  • 0.285 TargetInfo
  • 0.261 AnalysisInfo
  • 0.061 BehaviorAnalysis
  • 0.002 Memory
  • 0.002 Strings

Signatures ( 1.487 seconds )

  • 1.398 proprietary_url_bl
  • 0.011 antiav_detectreg
  • 0.008 proprietary_domain_bl
  • 0.005 anomaly_persistence_autorun
  • 0.005 antiav_detectfile
  • 0.005 infostealer_ftp
  • 0.005 ransomware_files
  • 0.004 geodo_banking_trojan
  • 0.004 ransomware_extensions
  • 0.003 api_spamming
  • 0.003 infostealer_bitcoin
  • 0.003 infostealer_mail
  • 0.003 infostealer_im
  • 0.003 network_http
  • 0.002 tinba_behavior
  • 0.002 stealth_decoy_document
  • 0.002 proprietary_anomaly_massive_file_ops
  • 0.002 stealth_timeout
  • 0.002 antianalysis_detectreg
  • 0.002 antivm_vbox_files
  • 0.002 disables_browser_warn
  • 0.001 rat_nanocore
  • 0.001 antisandbox_sleep
  • 0.001 betabot_behavior
  • 0.001 cerber_behavior
  • 0.001 antivm_parallels_keys
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 browser_security
  • 0.001 modify_proxy
  • 0.001 proprietary_malicious_drop_executable_file_to_temp_folder
  • 0.001 proprietary_bad_drop
  • 0.001 network_cnc_http
  • 0.001 stealth_modify_uac_prompt

Reporting ( 0.629 seconds )

  • 0.568 ReportHTMLSummary
  • 0.061 Malheur
Task ID 744125
Mongo ID 66225af27e769a7c1b16ec5d
Cuckoo release 1.4-Maldun