魔盾安全分析报告

分析类型	开始时间	结束时间	持续时间	分析引擎版本
FILE	2024-03-27 14:33:31	2024-03-27 14:35:49	138 秒	1.4-Maldun

虚拟机机器名	标签	虚拟机管理	开机时间	关机时间
win7-sp1-x64-shaapp02-1	win7-sp1-x64-shaapp02-1	KVM	2024-03-27 14:33:34	2024-03-27 14:35:52

魔盾分数
1.4 正常的

文件详细信息

文件名	YOMIPAPAmonitor.exe
文件大小	92160 字节
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
CRC32	9E9B897D
MD5	25a6fdda5e3f0c7ca91be1090997d9cc
SHA1	19e0dd4f8e6b631ad4a223d767be726b0284f21f
SHA256	d7b14a634313a0aacbc543c68538da9762902314be1bfecc2070c9214b03ea25
SHA512	7625c8a252880b3ee32f9230e85a868655053b7269afddeb6881b44ca9d73d599b415eca42e17d2222e71866f93850f0084b024d4fceeaea1840a679d1e01fd9
Ssdeep	1536:7QxhttG9OcKGZDujOW87DW0YeFQTO2hQu62MxqtwoFdouEvmXnYXG1sWsbcdaZZB:7QxhG9OXGZD0OW8hQTO2hQu7MxUw1uE9
PEiD	无匹配
Yara	DebuggerTiming__PerformanceCounter () anti_dbg (Detected self protection if being debugged) win_mutex (Create or check mutex) create_process (Detection function for creating a new process) win_files_operation (Affect private profile) Maldun_Anomoly_Combined_Activities_7 (Spotted potential malicious behaviors from a small size target, like process manipultion, privilege, token and files) IsPE32 (Detected a 32bit PE sample) IsWindowsGUI (Detected a Windows GUI sample) HasDebugData (Detected Debug Data) HasRichSignature (Detected Rich Signature) with_urls (Detected the presence of an or several urls)
VirusTotal	VirusTotal查询失败

特征

专有的Yara规则检测结果 - 安全告警

Critical: Spotted potential malicious behaviors from a small size target, like process manipultion, privilege, token and files

运行截图

网络分析

TCP连接

IP地址	端口
23.206.229.110	80

UDP连接

IP地址	端口
192.168.122.1	53

HTTP请求

URL	HTTP数据
http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip	GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: / If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache

静态分析

PE 信息

初始地址	0x00400000
入口地址	0x00401f04
声明校验值	0x00000000
实际校验值	0x00024e20
最低操作系统版本要求	6.0
PDB路径	E:\work\PCworks\donglemonitor\Release\YOMIPAPAmonitor.pdb
编译时间	2020-12-30 15:35:21
载入哈希	79c9f037f5da57435230c2fa35020e73

版本信息

LegalCopyright:	Copyright \xa9 2016
InternalName:	YOMIPAPAmonitor.exe
FileVersion:	1.0.2.3
SpecialBuild:	2016.11.03
PrivateBuild:	2016.11.03
Comments:	YOMIPAPA\u4f20\u5c4f\u52a9\u624b
ProductName:	YOMIPAPAmonitor
ProductVersion:	1.0.2.1
FileDescription:	YOMIPAPAmonitor
OriginalFilename:	YOMIPAPAmonitor.exe
Translation:	0x0804 0x04b0

PE数据组成

名称	虚拟地址	虚拟大小	原始数据大小	特征	熵(Entropy)
.text	0x00001000	0x0000c18f	0x0000c200	IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ	6.62
.rdata	0x0000e000	0x00006256	0x00006400	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	4.88
.data	0x00015000	0x00001dc8	0x00000a00	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	1.81
.rsrc	0x00017000	0x00002208	0x00002400	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	3.34
.reloc	0x0001a000	0x00000ecc	0x00001000	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ	6.34

导入

库 KERNEL32.dll:

• 0x40e010 - Module32FirstW

• 0x40e014 - CreateFileW

• 0x40e018 - Sleep

• 0x40e01c - GetVolumeInformationW

• 0x40e020 - CreateMutexW

• 0x40e024 - GetLastError

• 0x40e028 - GetLongPathNameW

• 0x40e02c - Process32NextW

• 0x40e030 - FindClose

• 0x40e034 - CopyFileW

• 0x40e038 - OutputDebugStringW

• 0x40e03c - CreateProcessW

• 0x40e040 - GetFileAttributesW

• 0x40e044 - CreateDirectoryW

• 0x40e048 - WriteConsoleW

• 0x40e04c - FindFirstFileW

• 0x40e050 - CloseHandle

• 0x40e054 - SetFilePointerEx

• 0x40e058 - Process32FirstW

• 0x40e05c - GetConsoleMode

• 0x40e060 - GetConsoleOutputCP

• 0x40e064 - FlushFileBuffers

• 0x40e068 - HeapReAlloc

• 0x40e06c - HeapSize

• 0x40e070 - GetProcessHeap

• 0x40e074 - LCMapStringW

• 0x40e078 - GetStringTypeW

• 0x40e07c - GetFileType

• 0x40e080 - SetStdHandle

• 0x40e084 - FreeEnvironmentStringsW

• 0x40e088 - GetEnvironmentStringsW

• 0x40e08c - WideCharToMultiByte

• 0x40e090 - CreateToolhelp32Snapshot

• 0x40e094 - MultiByteToWideChar

• 0x40e098 - GetCommandLineW

• 0x40e09c - GetCommandLineA

• 0x40e0a0 - GetCPInfo

• 0x40e0a4 - GetOEMCP

• 0x40e0a8 - GetACP

• 0x40e0ac - UnhandledExceptionFilter

• 0x40e0b0 - SetUnhandledExceptionFilter

• 0x40e0b4 - GetCurrentProcess

• 0x40e0b8 - TerminateProcess

• 0x40e0bc - IsProcessorFeaturePresent

• 0x40e0c0 - QueryPerformanceCounter

• 0x40e0c4 - GetCurrentProcessId

• 0x40e0c8 - GetCurrentThreadId

• 0x40e0cc - GetSystemTimeAsFileTime

• 0x40e0d0 - InitializeSListHead

• 0x40e0d4 - IsDebuggerPresent

• 0x40e0d8 - GetStartupInfoW

• 0x40e0dc - GetModuleHandleW

• 0x40e0e0 - RtlUnwind

• 0x40e0e4 - SetLastError

• 0x40e0e8 - EnterCriticalSection

• 0x40e0ec - LeaveCriticalSection

• 0x40e0f0 - DeleteCriticalSection

• 0x40e0f4 - InitializeCriticalSectionAndSpinCount

• 0x40e0f8 - TlsAlloc

• 0x40e0fc - TlsGetValue

• 0x40e100 - TlsSetValue

• 0x40e104 - TlsFree

• 0x40e108 - FreeLibrary

• 0x40e10c - GetProcAddress

• 0x40e110 - LoadLibraryExW

• 0x40e114 - RaiseException

• 0x40e118 - GetStdHandle

• 0x40e11c - WriteFile

• 0x40e120 - GetModuleFileNameW

• 0x40e124 - ExitProcess

• 0x40e128 - GetModuleHandleExW

• 0x40e12c - HeapAlloc

• 0x40e130 - HeapFree

• 0x40e134 - FindFirstFileExW

• 0x40e138 - FindNextFileW

• 0x40e13c - IsValidCodePage

• 0x40e140 - DecodePointer

库 HID.DLL:

• 0x40e008 - HidD_GetAttributes

库 SETUPAPI.dll:

• 0x40e148 - SetupDiGetClassDevsW

• 0x40e14c - SetupDiDestroyDeviceInfoList

• 0x40e150 - SetupDiGetDeviceInterfaceDetailW

• 0x40e154 - SetupDiEnumDeviceInterfaces

库 USER32.dll:

• 0x40e168 - BeginPaint

• 0x40e16c - DefWindowProcW

• 0x40e170 - DestroyWindow

• 0x40e174 - DialogBoxParamW

• 0x40e178 - RegisterDeviceNotificationW

• 0x40e17c - EndPaint

• 0x40e180 - RegisterClassExW

• 0x40e184 - PostQuitMessage

• 0x40e188 - LoadIconW

• 0x40e18c - UnregisterDeviceNotification

• 0x40e190 - DispatchMessageW

• 0x40e194 - TranslateMessage

• 0x40e198 - TranslateAcceleratorW

• 0x40e19c - GetMessageW

• 0x40e1a0 - LoadAcceleratorsW

• 0x40e1a4 - LoadStringW

• 0x40e1a8 - PostMessageW

• 0x40e1ac - EndDialog

• 0x40e1b0 - LoadCursorW

• 0x40e1b4 - CreateWindowExW

库 ADVAPI32.dll:

• 0x40e000 - GetUserNameW

库 SHELL32.dll:

• 0x40e15c - SHGetPathFromIDListW

• 0x40e160 - SHGetSpecialFolderLocation

库 WTSAPI32.dll:

• 0x40e1bc - WTSUnRegisterSessionNotification

• 0x40e1c0 - WTSRegisterSessionNotification

投放文件

无信息

行为分析

互斥量(Mutexes)

testYOMIPAPADevice

执行的命令 无信息

创建的服务 无信息

启动的服务 无信息

进程

YOMIPAPAmonitor.exe PID: 2604, 上一级进程 PID: 2276

访问的文件

读取的文件 无信息

修改的文件 无信息

删除的文件 无信息

注册表键 无信息

读取的注册表键 无信息

修改的注册表键 无信息

删除的注册表键 无信息

API解析

kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.FlsAlloc
kernel32.dll.FlsSetValue
kernel32.dll.FlsGetValue
kernel32.dll.LCMapStringEx
cfgmgr32.dll.CMP_RegisterNotification
cfgmgr32.dll.CM_MapCrToWin32Err
user32.dll.IsWindow
user32.dll.GetWindowThreadProcessId
winsta.dll.WinStationRegisterConsoleNotification
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
advapi32.dll.CreateWellKnownSid
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingSetAuthInfoExW
sechost.dll.LookupAccountNameLocalW
rpcrt4.dll.RpcAsyncInitializeHandle
rpcrt4.dll.NdrClientCall2
rpcrt4.dll.NdrAsyncClientCall