分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-shaapp02-1 | 2024-04-22 19:50:08 | 2024-04-22 19:50:58 | 50 秒 |
魔盾分数
10.0
危险的
文件详细信息
| 文件名 | SD1.4.0.566_x86_x64_CNREG.exe |
|---|---|
| 文件大小 | 4290379 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive |
| MD5 | d00c68b17b7874b6ed8c817b5331a83a |
| SHA1 | 5b7030ccd4d2d5ec37178914a79db0aab875bcda |
| SHA256 | dc11169096666906a47ab9e751e093b1a74f6f5c592c456644b528602537dd28 |
| SHA512 | 2ec4e4adadb255f94fc2743f34664ddc76c5bd7ea1146db258f90d43958570221e593618498fbbe8aaa358d0f051830b38287aaf7cbda9a7fb6888e0d58c5250 |
| CRC32 | 0209ED02 |
| Ssdeep | 98304:mrqpLEBbyLIGDEW3OaV3N4WpgjKKgoqkhq8h2o:mrwuk3Vp2vPhr |
| Yara | 登录查看Yara规则 |
| 找不到该样本 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x00403291 |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x00418d99 |
| 最低操作系统版本要求 | 4.0 |
| 编译时间 | 2009-06-19 05:33:27 |
| 载入哈希 | 099c0646ea7282d232219f8807883be0 |
版本信息
| LegalCopyright | |
|---|---|
| InternalName | |
| FileVersion | |
| CompanyName | |
| ProductName | |
| ProductVersion | |
| FileDescription | |
| Translation |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x00005bc0 | 0x00005c00 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.48 |
| .rdata | 0x00007000 | 0x00001190 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.18 |
| .data | 0x00009000 | 0x0001af78 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.72 |
| .ndata | 0x00024000 | 0x00009000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .rsrc | 0x0002d000 | 0x000082d8 | 0x00008400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.37 |
覆盖
| 偏移量 | 0x000352d8 |
| 大小 | 0x003e2473 |
导入
库: KERNEL32.dll:
• 0x407060 CompareFileTime
• 0x407064 SearchPathA
• 0x407068 GetShortPathNameA
• 0x40706c GetFullPathNameA
• 0x407070 MoveFileA
• 0x407074 SetCurrentDirectoryA
• 0x407078 GetFileAttributesA
• 0x40707c GetLastError
• 0x407080 CreateDirectoryA
• 0x407084 SetFileAttributesA
• 0x407088 Sleep
• 0x40708c GetTickCount
• 0x407090 CreateFileA
• 0x407094 GetFileSize
• 0x407098 GetModuleFileNameA
• 0x40709c GetCurrentProcess
• 0x4070a0 CopyFileA
• 0x4070a4 ExitProcess
• 0x4070a8 SetFileTime
• 0x4070ac GetTempPathA
• 0x4070b0 GetCommandLineA
• 0x4070b4 SetErrorMode
• 0x4070b8 LoadLibraryA
• 0x4070bc lstrcpynA
• 0x4070c0 GetDiskFreeSpaceA
• 0x4070c4 GlobalUnlock
• 0x4070c8 GlobalLock
• 0x4070cc CreateThread
• 0x4070d0 CreateProcessA
• 0x4070d4 RemoveDirectoryA
• 0x4070d8 GetTempFileNameA
• 0x4070dc lstrlenA
• 0x4070e0 lstrcatA
• 0x4070e4 GetSystemDirectoryA
• 0x4070e8 GetVersion
• 0x4070ec CloseHandle
• 0x4070f0 lstrcmpiA
• 0x4070f4 lstrcmpA
• 0x4070f8 ExpandEnvironmentStringsA
• 0x4070fc GlobalFree
• 0x407100 GlobalAlloc
• 0x407104 WaitForSingleObject
• 0x407108 GetExitCodeProcess
• 0x40710c GetModuleHandleA
• 0x407110 LoadLibraryExA
• 0x407114 GetProcAddress
• 0x407118 FreeLibrary
• 0x40711c MultiByteToWideChar
• 0x407120 WritePrivateProfileStringA
• 0x407124 GetPrivateProfileStringA
• 0x407128 WriteFile
• 0x40712c ReadFile
• 0x407130 MulDiv
• 0x407134 SetFilePointer
• 0x407138 FindClose
• 0x40713c FindNextFileA
• 0x407140 FindFirstFileA
• 0x407144 DeleteFileA
• 0x407148 GetWindowsDirectoryA
库: USER32.dll:
• 0x40716c EndDialog
• 0x407170 ScreenToClient
• 0x407174 GetWindowRect
• 0x407178 EnableMenuItem
• 0x40717c GetSystemMenu
• 0x407180 SetClassLongA
• 0x407184 IsWindowEnabled
• 0x407188 SetWindowPos
• 0x40718c GetSysColor
• 0x407190 GetWindowLongA
• 0x407194 SetCursor
• 0x407198 LoadCursorA
• 0x40719c CheckDlgButton
• 0x4071a0 GetMessagePos
• 0x4071a4 LoadBitmapA
• 0x4071a8 CallWindowProcA
• 0x4071ac IsWindowVisible
• 0x4071b0 CloseClipboard
• 0x4071b4 SetClipboardData
• 0x4071b8 EmptyClipboard
• 0x4071bc RegisterClassA
• 0x4071c0 TrackPopupMenu
• 0x4071c4 AppendMenuA
• 0x4071c8 CreatePopupMenu
• 0x4071cc GetSystemMetrics
• 0x4071d0 SetDlgItemTextA
• 0x4071d4 GetDlgItemTextA
• 0x4071d8 MessageBoxIndirectA
• 0x4071dc CharPrevA
• 0x4071e0 DispatchMessageA
• 0x4071e4 PeekMessageA
• 0x4071e8 DestroyWindow
• 0x4071ec CreateDialogParamA
• 0x4071f0 SetTimer
• 0x4071f4 SetWindowTextA
• 0x4071f8 PostQuitMessage
• 0x4071fc SetForegroundWindow
• 0x407200 wsprintfA
• 0x407204 SendMessageTimeoutA
• 0x407208 FindWindowExA
• 0x40720c SystemParametersInfoA
• 0x407210 CreateWindowExA
• 0x407214 GetClassInfoA
• 0x407218 DialogBoxParamA
• 0x40721c CharNextA
• 0x407220 OpenClipboard
• 0x407224 ExitWindowsEx
• 0x407228 IsWindow
• 0x40722c GetDlgItem
• 0x407230 SetWindowLongA
• 0x407234 LoadImageA
• 0x407238 GetDC
• 0x40723c EnableWindow
• 0x407240 InvalidateRect
• 0x407244 SendMessageA
• 0x407248 DefWindowProcA
• 0x40724c BeginPaint
• 0x407250 GetClientRect
• 0x407254 FillRect
• 0x407258 DrawTextA
• 0x40725c EndPaint
• 0x407260 ShowWindow
库: GDI32.dll:
• 0x40703c SetBkColor
• 0x407040 GetDeviceCaps
• 0x407044 DeleteObject
• 0x407048 CreateBrushIndirect
• 0x40704c CreateFontIndirectA
• 0x407050 SetBkMode
• 0x407054 SetTextColor
• 0x407058 SelectObject
库: SHELL32.dll:
• 0x407150 SHGetPathFromIDListA
• 0x407154 SHBrowseForFolderA
• 0x407158 SHGetFileInfoA
• 0x40715c ShellExecuteA
• 0x407160 SHFileOperationA
• 0x407164 SHGetSpecialFolderLocation
库: ADVAPI32.dll:
• 0x407000 RegQueryValueExA
• 0x407004 RegSetValueExA
• 0x407008 RegEnumKeyA
• 0x40700c RegEnumValueA
• 0x407010 RegOpenKeyExA
• 0x407014 RegDeleteKeyA
• 0x407018 RegDeleteValueA
• 0x40701c RegCloseKey
• 0x407020 RegCreateKeyExA
库: COMCTL32.dll:
• 0x407028 ImageList_AddMasked
• 0x40702c ImageList_Destroy
• 0x407030 None
• 0x407034 ImageList_Create
库: ole32.dll:
• 0x407278 CoTaskMemFree
• 0x40727c OleInitialize
• 0x407280 OleUninitialize
• 0x407284 CoCreateInstance
库: VERSION.dll:
• 0x407268 GetFileVersionInfoSizeA
• 0x40726c GetFileVersionInfoA
• 0x407270 VerQueryValueA
.text
`.rdata
@.data
.ndata
.rsrc
Phts@
v95DpA
9-L6B
9-L6B
9-L6B
9-X6B
Ph}P@
RichEdit
RichEdit20A
RichEd32
RichEd20
.DEFAULT\Control Panel\International
Control Panel\Desktop\ResourceLocale
Software\Microsoft\Windows\CurrentVersion
\Microsoft\Internet Explorer\Quick Launch
MulDiv
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
ReadFile
WriteFile
GetPrivateProfileStringA
WritePrivateProfileStringA
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
lstrcmpA
lstrcmpiA
CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
KERNEL32.dll
EndPaint
DrawTextA
FillRect
GetClientRect
BeginPaint
DefWindowProcA
SendMessageA
InvalidateRect
EnableWindow
GetDC
LoadImageA
SetWindowLongA
GetDlgItem
IsWindow
FindWindowExA
SendMessageTimeoutA
wsprintfA
ShowWindow
SetForegroundWindow
PostQuitMessage
SetWindowTextA
SetTimer
CreateDialogParamA
DestroyWindow
ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
USER32.dll
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
GDI32.dll
SHFileOperationA
ShellExecuteA
SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHELL32.dll
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
ADVAPI32.dll
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
COMCTL32.dll
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
ole32.dll
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VERSION.dll
verifying installer: %d%%
unpacking data: %d%%
... %d%%
http://nsis.sf.net/NSIS_Error
Error writing temporary file. Make sure your temp folder is valid.
Error launching installer
SeShutdownPrivilege
~nsu.tmp
\Temp
NSIS Error
%u.%u%s%s
SHGetFolderPathA
SHFOLDER
SHAutoComplete
SHLWAPI
GetUserDefaultUILanguage
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyExA
ADVAPI32
MoveFileExA
GetDiskFreeSpaceExA
KERNEL32
*?|<>/":
55555555555555555555555"T
>>>?>>>>>?>?>>>>>>>>>>>>
||C)**
XJ,,,,
EE/////
dFFEFFFFF
}XRRRRRRRRR
;nnnqnnqonnoonnnnqqoq
dFDdFDdFDdFDdFDdFD
FDdFDFDFDFDdFDDDDD
EEEQVSFEEEEEE)
488888889;9;8
l|l|l|l|l|l|p
tedtedted`
DDDDDD
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
5Q--N
25=/w
;umkP
RGoe2
msctls_progress32
SysListView32
Please wait while Setup is loading...
VS_VERSION_INFO
StringFileInfo
080403a8
CompanyName
shadowdefender.com
FileDescription
FileVersion
1.4.0.566
InternalName
Shadow Defender
LegalCopyright
shadowdefender.com
ProductName
Shadow Defender
ProductVersion
1.4.0.566
VarFileInfo
Translation
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49160 | 104.114.76.144 | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 63246 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49160 | 104.114.76.144 | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 63246 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip | GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 30.879 seconds )
- 12.096 Suricata
- 7.737 Static
- 5.07 NetworkAnalysis
- 3.352 VirusTotal
- 1.246 BehaviorAnalysis
- 0.987 TargetInfo
- 0.36 peid
- 0.011 Strings
- 0.01 AnalysisInfo
- 0.008 config_decoder
- 0.002 Memory
Signatures ( 2.115 seconds )
- 1.321 proprietary_url_bl
- 0.115 antiav_detectreg
- 0.07 api_spamming
- 0.056 stealth_timeout
- 0.055 stealth_decoy_document
- 0.042 infostealer_ftp
- 0.027 stealth_file
- 0.027 antianalysis_detectreg
- 0.024 infostealer_im
- 0.023 reads_self
- 0.02 mimics_filetime
- 0.018 virus
- 0.017 bootkit
- 0.015 antivm_generic_scsi
- 0.014 antivm_generic_disk
- 0.014 infostealer_mail
- 0.012 infostealer_browser
- 0.009 anomaly_persistence_autorun
- 0.009 antiav_detectfile
- 0.008 antivm_generic_services
- 0.008 geodo_banking_trojan
- 0.008 proprietary_domain_bl
- 0.007 ipc_namedpipe
- 0.007 anormaly_invoke_kills
- 0.007 hancitor_behavior
- 0.007 antivm_xen_keys
- 0.007 infostealer_bitcoin
- 0.006 kibex_behavior
- 0.006 infostealer_browser_password
- 0.006 antivm_parallels_keys
- 0.006 darkcomet_regkeys
- 0.006 ransomware_extensions
- 0.005 proprietary_anomaly_write_exe_and_obsfucate_extension
- 0.005 proprietary_malicious_write_executeable_under_temp_to_regrun
- 0.005 betabot_behavior
- 0.005 securityxploded_modules
- 0.005 ransomware_files
- 0.005 recon_fingerprint
- 0.004 injection_createremotethread
- 0.004 proprietary_anomaly_massive_file_ops
- 0.004 ransomware_message
- 0.004 sets_autoconfig_url
- 0.004 antivm_generic_diskreg
- 0.004 antivm_vbox_files
- 0.003 shifu_behavior
- 0.003 antidbg_windows
- 0.003 antisandbox_productid
- 0.003 disables_browser_warn
- 0.003 network_http
- 0.002 tinba_behavior
- 0.002 antiemu_wine_func
- 0.002 antivm_vbox_libs
- 0.002 rat_nanocore
- 0.002 disables_spdy
- 0.002 disables_wfp
- 0.002 injection_runpe
- 0.002 kovter_behavior
- 0.002 bypass_firewall
- 0.002 antivm_xen_keys
- 0.002 antivm_hyperv_keys
- 0.002 antivm_vbox_acpi
- 0.002 antivm_vbox_keys
- 0.002 antivm_vmware_keys
- 0.002 antivm_vpc_keys
- 0.002 browser_security
- 0.002 proprietary_anomaly_invoke_vb_vba
- 0.002 packer_armadillo_regkey
- 0.001 proprietary_anomaly_terminated_process
- 0.001 network_tor
- 0.001 antiav_avast_libs
- 0.001 proprietary_anomaly_write_exe_and_dll_under_winroot_run
- 0.001 office_dl_write_exe
- 0.001 office_write_exe
- 0.001 dridex_behavior
- 0.001 rat_luminosity
- 0.001 anomaly_persistence_bootexecute
- 0.001 injection_explorer
- 0.001 antisandbox_sunbelt_libs
- 0.001 antisandbox_sboxie_libs
- 0.001 antiav_bitdefender_libs
- 0.001 ransomeware_modifies_desktop_wallpaper
- 0.001 exec_crash
- 0.001 vawtrak_behavior
- 0.001 cerber_behavior
- 0.001 antidbg_devices
- 0.001 antivm_generic_bios
- 0.001 antivm_generic_cpu
- 0.001 antivm_generic_system
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_addon
- 0.001 modify_proxy
- 0.001 disables_system_restore
- 0.001 disables_windows_defender
- 0.001 proprietary_malicious_drop_executable_file_to_temp_folder
- 0.001 proprietary_bad_drop
- 0.001 network_cnc_http
- 0.001 rat_pcclient
- 0.001 recon_programs
- 0.001 stealth_modify_uac_prompt
Reporting ( 0.482 seconds )
- 0.463 ReportHTMLSummary
- 0.019 Malheur
| Task ID | 744217 |
|---|---|
| Mongo ID | 66264f57dc327b2e00ad99f1 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号