分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-hpdapp01-1 | 2019-11-09 22:57:15 | 2019-11-09 22:59:35 | 140 秒 |
魔盾分数
6.65
危险的
文件详细信息
| 文件名 | smzz.exe |
|---|---|
| 文件大小 | 4313904 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 0d7b1fe28e1be419a7c42232b679795b |
| SHA1 | 59bf7c603e0b9af3045f7a8a790071b5bdfd64b4 |
| SHA256 | bec3266e76b7f9b208935f1934bc6f14c7b0cf61302a9e6eaaeb3ed3ab5ee5db |
| SHA512 | 80f8819ed7f5dfee0bb5b57c1a11e8807bc04d50b64675b90bf101ed2756cc4512b1fc661b2ea6ee93a969517c7fddc66d95c49f67aa9bf876ac312cd2c230cd |
| CRC32 | 5CA3E97C |
| Ssdeep | 98304:25ViW0WTWnxhxY0T769Zs9pX2o31ZC3hTvOU3kSqu:60D3mC71vX2o31Zsh6u7qu |
| Yara | 登录查看Yara规则 |
| 样本下载 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x00be155c |
| 声明校验值 | 0x0042bd46 |
| 实际校验值 | 0x0042bd46 |
| 最低操作系统版本要求 | 4.0 |
| 编译时间 | 2019-11-09 21:45:49 |
| 载入哈希 | 91de9443c52b13d81c6c88f1fc933378 |
微软证书验证 (Sign Tool)
| SHA1 | 时间戳 | 有效性 | 错误 |
|---|---|---|---|
| 395c699fd2df36362e1f9c72d0b70d6bbadd9ac6 | Sat Nov 09 21:44:29 2019 | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. |
| 证书链 | Certificate Chain 1 |
| 发行给 | |
| 发行人 | |
| 有效期 | Wed Jan 01 000000 2025 |
| SHA1 哈希 | 6c9d3886ad8cad257c35dfbc31073cfed947d50f |
| 证书链 | Timestamp Chain 1 |
| 发行给 | DigiCert Assured ID Root CA |
| 发行人 | DigiCert Assured ID Root CA |
| 有效期 | Mon Nov 10 080000 2031 |
| SHA1 哈希 | 0563b8630d62d75abbc8ab1e4bdfb5a899b24d43 |
| 证书链 | Timestamp Chain 2 |
| 发行给 | DigiCert Assured ID CA-1 |
| 发行人 | DigiCert Assured ID Root CA |
| 有效期 | Wed Nov 10 080000 2021 |
| SHA1 哈希 | 19a09b5a36f4dd99727df783c17a51231a56c117 |
| 证书链 | Timestamp Chain 3 |
| 发行给 | DigiCert Timestamp Responder |
| 发行人 | DigiCert Assured ID CA-1 |
| 有效期 | Tue Oct 22 080000 2024 |
| SHA1 哈希 | 614d271d9102e30169822487fde5de00a352b01d |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x00018d36 | 0x00000000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 0.00 |
| .rdata | 0x0001a000 | 0x000040d6 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 0.00 |
| .data | 0x0001f000 | 0x003b8f5e | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .vmp0 | 0x003d8000 | 0x00004060 | 0x00000000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 0.00 |
| .vmp1 | 0x003dd000 | 0x004197b1 | 0x0041a000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 7.80 |
| .reloc | 0x007f7000 | 0x00000088 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 0.28 |
导入
库: WINMM.dll:
• 0x7dd000 PlaySoundA
库: KERNEL32.dll:
• 0x7dd008 LocalFree
• 0x7dd00c FlushFileBuffers
• 0x7dd010 lstrcpynA
• 0x7dd014 LocalAlloc
• 0x7dd018 InitializeCriticalSection
• 0x7dd01c TlsAlloc
• 0x7dd020 DeleteCriticalSection
• 0x7dd024 GlobalHandle
• 0x7dd028 TlsFree
• 0x7dd02c LeaveCriticalSection
• 0x7dd030 GlobalReAlloc
• 0x7dd034 EnterCriticalSection
• 0x7dd038 TlsSetValue
• 0x7dd03c LocalReAlloc
• 0x7dd040 TlsGetValue
• 0x7dd044 GlobalFlags
• 0x7dd048 WritePrivateProfileStringA
• 0x7dd04c GlobalFindAtomA
• 0x7dd050 GlobalAddAtomA
• 0x7dd054 GlobalGetAtomNameA
• 0x7dd058 GetProcessVersion
• 0x7dd05c SetErrorMode
• 0x7dd060 GetCPInfo
• 0x7dd064 GetOEMCP
• 0x7dd068 GetStartupInfoA
• 0x7dd06c RtlUnwind
• 0x7dd070 RaiseException
• 0x7dd074 HeapSize
• 0x7dd078 GetACP
• 0x7dd07c UnhandledExceptionFilter
• 0x7dd080 FreeEnvironmentStringsA
• 0x7dd084 FreeEnvironmentStringsW
• 0x7dd088 GetEnvironmentStrings
• 0x7dd08c GetEnvironmentStringsW
• 0x7dd090 SetHandleCount
• 0x7dd094 GetStdHandle
• 0x7dd098 GetFileType
• 0x7dd09c GetEnvironmentVariableA
• 0x7dd0a0 HeapDestroy
• 0x7dd0a4 HeapCreate
• 0x7dd0a8 VirtualFree
• 0x7dd0ac VirtualAlloc
• 0x7dd0b0 IsBadWritePtr
• 0x7dd0b4 LCMapStringA
• 0x7dd0b8 LCMapStringW
• 0x7dd0bc SetUnhandledExceptionFilter
• 0x7dd0c0 GetStringTypeA
• 0x7dd0c4 GetStringTypeW
• 0x7dd0c8 SetStdHandle
• 0x7dd0cc IsBadCodePtr
• 0x7dd0d0 InterlockedExchange
• 0x7dd0d4 CreateEventA
• 0x7dd0d8 CreateToolhelp32Snapshot
• 0x7dd0dc Process32First
• 0x7dd0e0 Process32Next
• 0x7dd0e4 OpenProcess
• 0x7dd0e8 CloseHandle
• 0x7dd0ec lstrcpyn
• 0x7dd0f0 RtlMoveMemory
• 0x7dd0f4 QueryDosDeviceA
• 0x7dd0f8 GetProcessHeap
• 0x7dd0fc GetModuleHandleA
• 0x7dd100 ExitProcess
• 0x7dd104 HeapAlloc
• 0x7dd108 HeapReAlloc
• 0x7dd10c HeapFree
• 0x7dd110 IsBadReadPtr
• 0x7dd114 ReadFile
• 0x7dd118 GetFileSize
• 0x7dd11c CreateFileA
• 0x7dd120 MoveFileA
• 0x7dd124 WriteFile
• 0x7dd128 CopyFileA
• 0x7dd12c DeleteFileA
• 0x7dd130 GetCommandLineA
• 0x7dd134 GetModuleFileNameA
• 0x7dd138 FreeLibrary
• 0x7dd13c GetProcAddress
• 0x7dd140 LoadLibraryA
• 0x7dd144 GetTickCount
• 0x7dd148 GlobalFree
• 0x7dd14c GlobalUnlock
• 0x7dd150 GlobalLock
• 0x7dd154 SetFilePointer
• 0x7dd158 GetLastError
• 0x7dd15c GetCurrentProcess
• 0x7dd160 GetVersionExA
• 0x7dd164 TerminateProcess
• 0x7dd168 Sleep
• 0x7dd16c lstrcpyA
• 0x7dd170 lstrlenA
• 0x7dd174 MultiByteToWideChar
• 0x7dd178 GlobalAlloc
• 0x7dd17c SetLastError
• 0x7dd180 lstrcatA
• 0x7dd184 GetVersion
• 0x7dd188 GetCurrentThreadId
• 0x7dd18c GetCurrentThread
• 0x7dd190 lstrcmpiA
• 0x7dd194 lstrcmpA
• 0x7dd198 GlobalDeleteAtom
• 0x7dd19c InterlockedIncrement
• 0x7dd1a0 InterlockedDecrement
• 0x7dd1a4 WideCharToMultiByte
• 0x7dd1a8 OpenEventA
库: USER32.dll:
• 0x7dd1b0 GetMenuItemID
• 0x7dd1b4 GetSubMenu
• 0x7dd1b8 GetMenu
• 0x7dd1bc RegisterClassA
• 0x7dd1c0 GetClassInfoA
• 0x7dd1c4 WinHelpA
• 0x7dd1c8 GetCapture
• 0x7dd1cc GetTopWindow
• 0x7dd1d0 CopyRect
• 0x7dd1d4 GetClientRect
• 0x7dd1d8 AdjustWindowRectEx
• 0x7dd1dc GetSysColor
• 0x7dd1e0 MapWindowPoints
• 0x7dd1e4 LoadIconA
• 0x7dd1e8 LoadCursorA
• 0x7dd1ec GetSysColorBrush
• 0x7dd1f0 LoadStringA
• 0x7dd1f4 DestroyMenu
• 0x7dd1f8 CreateWindowExA
• 0x7dd1fc GetMenuItemCount
• 0x7dd200 SetWindowTextA
• 0x7dd204 GetDlgCtrlID
• 0x7dd208 RemovePropA
• 0x7dd20c DestroyWindow
• 0x7dd210 UnhookWindowsHookEx
• 0x7dd214 GrayStringA
• 0x7dd218 DrawTextA
• 0x7dd21c TabbedTextOutA
• 0x7dd220 ClientToScreen
• 0x7dd224 DefWindowProcA
• 0x7dd228 GetMessageTime
• 0x7dd22c GetMessagePos
• 0x7dd230 GetForegroundWindow
• 0x7dd234 SetForegroundWindow
• 0x7dd238 RegisterWindowMessageA
• 0x7dd23c UnregisterClassA
• 0x7dd240 GetClassLongA
• 0x7dd244 SetPropA
• 0x7dd248 GetPropA
• 0x7dd24c CallWindowProcA
• 0x7dd250 IsIconic
• 0x7dd254 GetWindowPlacement
• 0x7dd258 SetFocus
• 0x7dd25c SetWindowPos
• 0x7dd260 LoadBitmapA
• 0x7dd264 GetMenuState
• 0x7dd268 ModifyMenuA
• 0x7dd26c SetMenuItemBitmaps
• 0x7dd270 CheckMenuItem
• 0x7dd274 EnableMenuItem
• 0x7dd278 GetFocus
• 0x7dd27c GetNextDlgTabItem
• 0x7dd280 GetActiveWindow
• 0x7dd284 GetKeyState
• 0x7dd288 CallNextHookEx
• 0x7dd28c ValidateRect
• 0x7dd290 SetWindowsHookExA
• 0x7dd294 GetLastActivePopup
• 0x7dd298 IsWindowEnabled
• 0x7dd29c EnableWindow
• 0x7dd2a0 SetCursor
• 0x7dd2a4 PostMessageA
• 0x7dd2a8 PostQuitMessage
• 0x7dd2ac GetParent
• 0x7dd2b0 GetWindow
• 0x7dd2b4 IsWindowVisible
• 0x7dd2b8 GetWindowLongA
• 0x7dd2bc GetWindowTextA
• 0x7dd2c0 PeekMessageA
• 0x7dd2c4 GetMessageA
• 0x7dd2c8 TranslateMessage
• 0x7dd2cc DispatchMessageA
• 0x7dd2d0 wsprintfA
• 0x7dd2d4 MessageBoxA
• 0x7dd2d8 FindWindowA
• 0x7dd2dc GetCursorPos
• 0x7dd2e0 SetWindowLongA
• 0x7dd2e4 GetDlgItem
• 0x7dd2e8 ShowWindow
• 0x7dd2ec SystemParametersInfoA
• 0x7dd2f0 GetDC
• 0x7dd2f4 ReleaseDC
• 0x7dd2f8 GetClassNameA
• 0x7dd2fc SendMessageA
• 0x7dd300 GetWindowRect
• 0x7dd304 GetSystemMetrics
• 0x7dd308 PtInRect
• 0x7dd30c GetMenuCheckMarkDimensions
库: GDI32.dll:
• 0x7dd314 RestoreDC
• 0x7dd318 SaveDC
• 0x7dd31c CreateBitmap
• 0x7dd320 SetBkColor
• 0x7dd324 GetObjectA
• 0x7dd328 GetStockObject
• 0x7dd32c Escape
• 0x7dd330 ExtTextOutA
• 0x7dd334 TextOutA
• 0x7dd338 SelectObject
• 0x7dd33c DeleteDC
• 0x7dd340 DeleteObject
• 0x7dd344 PtVisible
• 0x7dd348 RectVisible
• 0x7dd34c SetTextColor
• 0x7dd350 SetMapMode
• 0x7dd354 SetViewportOrgEx
• 0x7dd358 OffsetViewportOrgEx
• 0x7dd35c SetViewportExtEx
• 0x7dd360 ScaleViewportExtEx
• 0x7dd364 SetWindowExtEx
• 0x7dd368 ScaleWindowExtEx
• 0x7dd36c GetClipBox
• 0x7dd370 GetDeviceCaps
库: PSAPI.DLL:
• 0x7dd378 GetProcessImageFileNameA
库: ADVAPI32.dll:
• 0x7dd380 RegCloseKey
• 0x7dd384 RegOpenKeyExA
• 0x7dd388 RegSetValueExA
• 0x7dd38c RegCreateKeyExA
库: COMCTL32.dll:
• 0x7dd3a4 None
库: USER32.dll:
• 0x7dd3bc MessageBoxA
.text
`.rdata
@.data
.vmp0
`.vmp1
.reloc
GetVersionExA
EnableWindow
GetWindowTextA
CreateBitmap
LocalReAlloc
SetErrorMode
SetMapMode
SetMenuItemBitmaps
GlobalHandle
GetForegroundWindow
CallWindowProcA
LoadStringA
GlobalAlloc
TranslateMessage
GlobalUnlock
PeekMessageA
InterlockedDecrement
SetHandleCount
ScaleViewportExtEx
IsBadWritePtr
CreateToolhelp32Snapshot
HeapAlloc
GetCurrentThreadId
GlobalFlags
PlaySoundA
GlobalFree
LoadLibraryA
LoadCursorA
GetLastError
Sleep
FreeEnvironmentStringsW
AdjustWindowRectEx
GetWindowRect
SetWindowsHookExA
GetCommandLineA
TabbedTextOutA
GetCapture
MoveFileA
SetLastError
Escape
ScaleWindowExtEx
IsWindowEnabled
GetSubMenu
SetStdHandle
GetLastActivePopup
RemovePropA
CreateEventA
SetForegroundWindow
GlobalFindAtomA
GetNextDlgTabItem
FlushFileBuffers
GetMessageTime
GetOEMCP
WideCharToMultiByte
GetCurrentProcess
GetDC
GetFileSize
GetFileType
eUSER32.dll
GetClassInfoA
InterlockedExchange
GetProcessImageFileNameA
eK ptK
:6%(q
\w=$Z
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
无TCP连接纪录.
UDP
无UDP连接纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
TCP
无TCP连接纪录.
UDP
无UDP连接纪录.
HTTP 请求
未发现HTTP请求.
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 217.237 seconds )
- 185.073 BehaviorAnalysis
- 15.555 Suricata
- 12.173 Static
- 2.376 VirusTotal
- 1.108 TargetInfo
- 0.437 peid
- 0.356 NetworkAnalysis
- 0.133 AnalysisInfo
- 0.015 Strings
- 0.008 config_decoder
- 0.003 Memory
Signatures ( 80.893 seconds )
- 13.475 process_interest
- 12.294 api_spamming
- 12.271 injection_createremotethread
- 9.322 stealth_timeout
- 8.97 injection_runpe
- 8.798 vawtrak_behavior
- 7.29 stealth_decoy_document
- 5.992 process_needed
- 0.412 mimics_filetime
- 0.367 reads_self
- 0.348 virus
- 0.322 stealth_file
- 0.312 antivm_generic_disk
- 0.29 hancitor_behavior
- 0.262 bootkit
- 0.027 antiav_detectreg
- 0.018 md_url_bl
- 0.017 md_domain_bl
- 0.011 infostealer_ftp
- 0.007 anomaly_persistence_autorun
- 0.007 antiav_detectfile
- 0.007 infostealer_im
- 0.007 ransomware_files
- 0.006 antianalysis_detectreg
- 0.006 ransomware_extensions
- 0.005 infostealer_bitcoin
- 0.004 infostealer_mail
- 0.003 tinba_behavior
- 0.003 antivm_vbox_files
- 0.003 geodo_banking_trojan
- 0.003 disables_browser_warn
- 0.002 rat_nanocore
- 0.002 betabot_behavior
- 0.002 cerber_behavior
- 0.002 browser_security
- 0.002 modify_proxy
- 0.002 md_bad_drop
- 0.001 hawkeye_behavior
- 0.001 ursnif_behavior
- 0.001 kibex_behavior
- 0.001 antivm_generic_scsi
- 0.001 shifu_behavior
- 0.001 antianalysis_detectfile
- 0.001 antivm_generic_diskreg
- 0.001 antivm_parallels_keys
- 0.001 antivm_xen_keys
- 0.001 banker_zeus_mutex
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_addon
- 0.001 disables_system_restore
- 0.001 disables_windows_defender
- 0.001 darkcomet_regkeys
- 0.001 maldun_malicious_drop_executable_file_to_temp_folder
- 0.001 office_security
- 0.001 rat_spynet
- 0.001 recon_fingerprint
- 0.001 stealth_hide_notifications
- 0.001 stealth_modify_uac_prompt
Reporting ( 0.844 seconds )
- 0.842 ReportHTMLSummary
- 0.002 Malheur
| Task ID | 444206 |
|---|---|
| Mongo ID | 5dc6d8bc2f8f2e289d325831 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号