恶意软件分析 & URL链接扫描免费在线病毒分析平台

分析任务

分析类型	虚拟机标签	开始时间	结束时间	持续时间
文件 (Windows)	win7-sp1-x64-shaapp01-1	2020-04-08 19:41:18	2020-04-08 19:43:32	134 秒

魔盾分数

10.0

危险的

文件详细信息

文件名	Finder.exe
文件大小	3966976 字节
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	77bde3a6392ea0d7b1ce5cf90a54d07d
SHA1	74f02b3e956bd585c823a64d367fa0df7a3e9737
SHA256	9cb758ba8ceeb376eb3b4e2d5909f306e57fa97b250a52783921c396d6b31046
SHA512	b0693483e00f9db7c0dbff2fd858c5cb3629f8b3a5dbfae8370ec9181603d59f8113038f134e4b87d8235b1d17cf6bd49ccb316b16708e1a2803b05bda0aec4b
CRC32	4597CE70
Ssdeep	98304:mIISvokg7C3ixc344VlSlmcMQX9ORQavwmaWfy:mI7vRge3imI4DSllMiA
Yara	登录查看Yara规则
	样本下载提交误报

登录查看威胁特征

运行截图

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

域名解析 (可点击查询WPING实时安全评级)

域名	安全评级	响应
ip.cn	未知	A 198.41.214.99 A 104.16.25.99 A 198.41.215.99
www.baidu.com	CNAME www.a.shifen.com A 180.101.49.11 A 180.101.49.12

摘要

登录查看详细行为信息

PE 信息

初始地址	0x00400000
入口地址	0x0112f7e0
声明校验值	0x003c9cd6
实际校验值	0x003c9cd6
最低操作系统版本要求	4.0
编译时间	2019-10-13 13:48:10
载入哈希	39377f0114f24d341cca951a328a8f25
图标
图标精确哈希值	81550947a9310ecb92f62a64fc4911da
图标相似性哈希值	3545091877939d64324c0a70928d72e4

版本信息

LegalCopyright
FileVersion
CompanyName
Comments
ProductName
ProductVersion
FileDescription
Translation

PEiD 规则

[u'UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser']

PE 数据组成

名称	虚拟地址	虚拟大小	原始数据大小	特征	熵(Entropy)
UPX0	0x00001000	0x00994000	0x00000000	IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	0.00
UPX1	0x00995000	0x0039b000	0x0039aa00	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	7.93
.rsrc	0x00d30000	0x0002e000	0x0002da00	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	6.34

资源

名称	偏移量	大小	语言	子语言	熵(Entropy)	文件类型
TEXTINCLUDE	0x00cfd6a8	0x00000151	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	6.97	data
TEXTINCLUDE	0x00cfd6a8	0x00000151	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	6.97	data
TEXTINCLUDE	0x00cfd6a8	0x00000151	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	6.97	data
RT_CURSOR	0x00cfdb98	0x000000b4	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	6.60	data
RT_CURSOR	0x00cfdb98	0x000000b4	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	6.60	data
RT_CURSOR	0x00cfdb98	0x000000b4	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	6.60	data
RT_CURSOR	0x00cfdb98	0x000000b4	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	6.60	data
RT_BITMAP	0x00cfdc4c	0x0000016c	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	7.06	data
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_ICON	0x00d5c8ac	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.32	GLS_BINARY_LSB_FIRST
RT_DIALOG	0x00d2a9d4	0x000000e2	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	6.85	data
RT_DIALOG	0x00d2a9d4	0x000000e2	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	6.85	data
RT_DIALOG	0x00d2a9d4	0x000000e2	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	6.85	data
RT_GROUP_CURSOR	0x00d2aae0	0x00000022	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	4.68	data
RT_GROUP_CURSOR	0x00d2aae0	0x00000022	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	4.68	data
RT_GROUP_CURSOR	0x00d2aae0	0x00000022	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	4.68	data
RT_GROUP_ICON	0x00d5cd18	0x00000084	LANG_NEUTRAL	SUBLANG_NEUTRAL	3.07	MS Windows icon resource - 9 icons, 256x256
RT_VERSION	0x00d5cda0	0x000002b4	LANG_CHINESE	SUBLANG_CHINESE_SIMPLIFIED	4.20	data
RT_MANIFEST	0x00d5d058	0x00000607	LANG_NEUTRAL	SUBLANG_NEUTRAL	5.05	XML 1.0 document, ASCII text, with CRLF line terminators

导入

库: KERNEL32.DLL:

• 0x115d7a0 LoadLibraryA

• 0x115d7a4 GetProcAddress

• 0x115d7a8 VirtualProtect

• 0x115d7ac VirtualAlloc

• 0x115d7b0 VirtualFree

• 0x115d7b4 ExitProcess

库: ADVAPI32.dll:

• 0x115d7bc RegCloseKey

库: COMCTL32.dll:

• 0x115d7c4 None

库: comdlg32.dll:

• 0x115d7cc ChooseColorA

库: GDI32.dll:

• 0x115d7d4 LineTo

库: gdiplus.dll:

• 0x115d7dc GdipDeletePen

库: imm32.dll:

• 0x115d7e4 ImmGetContext

库: ole32.dll:

• 0x115d7ec OleRun

库: OLEAUT32.dll:

• 0x115d7f4 VariantCopy

库: SHELL32.dll:

• 0x115d7fc DragFinish

库: shlwapi.dll:

• 0x115d804 PathFileExistsA

库: USER32.dll:

• 0x115d80c GetDC

库: winmm.dll:

• 0x115d814 PlaySoundA

库: WINSPOOL.DRV:

• 0x115d81c ClosePrinter

库: WS2_32.dll:

• 0x115d824 inet_ntoa

.rsrc
GO8,$5
R!{:`V
bw[ep
!tpl1
9@15\
pbW9G 
HESRe
D<<XA
#z9#92
[rx8#*
+jj4H
mi<jo
E%cT@u

防病毒引擎/厂商	病毒名/规则匹配	病毒库日期
Bkav	未发现病毒	20191228
DrWeb	未发现病毒	20191229
MicroWorld-eScan	未发现病毒	20191229
CMC	未发现病毒	20190321
CAT-QuickHeal	Trojan.Wacatac	20191229
McAfee	Artemis!77BDE3A6392E	20191229
Cylance	Unsafe	20191229
Zillya	未发现病毒	20191228
Sangfor	未发现病毒	20191224
K7AntiVirus	Adware ( 005070c51 )	20191229
BitDefender	未发现病毒	20191229
K7GW	Adware ( 005070c51 )	20191229
Cybereason	malicious.e956bd	20190616
TrendMicro	未发现病毒	20191229
BitDefenderTheta	Gen:NN.ZexaF.33558.YpKfaCxIy2ob	20191223
F-Prot	W32/Trojan.CLL.gen!Eldorado	20191229
Symantec	Trojan Horse	20191220
ESET-NOD32	a variant of Win32/Packed.BlackMoon.A potentially unwanted	20191229
APEX	未发现病毒	20191228
Paloalto	generic.ml	20191229
ClamAV	未发现病毒	20191229
GData	未发现病毒	20191229
Kaspersky	未发现病毒	20191229
Alibaba	未发现病毒	20190527
NANO-Antivirus	未发现病毒	20191229
ViRobot	未发现病毒	20191229
SUPERAntiSpyware	未发现病毒	20191227
Rising	Trojan.Kryptik!1.B3E8 (TFE:5:fpZJMZROweE)	20191229
Ad-Aware	未发现病毒	20191229
Emsisoft	未发现病毒	20191229
Comodo	Malware@#1iyufsdw0rmbv	20191229
F-Secure	未发现病毒	20191229
Baidu	未发现病毒	20190318
VIPRE	未发现病毒	20191229
Invincea	heuristic	20191211
McAfee-GW-Edition	BehavesLike.Win32.Flyagent.wc	20191229
Trapmine	未发现病毒	20191216
FireEye	未发现病毒	20191229
Sophos	Generic PUA HE (PUA)	20191229
SentinelOne	DFI - Malicious PE	20191218
Cyren	W32/Trojan.CLL.gen!Eldorado	20191229
Jiangmin	未发现病毒	20191229
MaxSecure	未发现病毒	20191228
Avira	未发现病毒	20191229
MAX	未发现病毒	20191229
Antiy-AVL	GrayWare/Win32.FlyStudio.a	20191229
Kingsoft	未发现病毒	20191229
Endgame	malicious (moderate confidence)	20190918
Arcabit	未发现病毒	20191229
AegisLab	未发现病毒	20191220
ZoneAlarm	未发现病毒	20191229
Avast-Mobile	未发现病毒	20191219
Microsoft	Trojan:Win32/Tiggre!rfn	20191229
AhnLab-V3	未发现病毒	20191229
Acronis	未发现病毒	20191224
VBA32	BScope.Trojan.Tiggre	20191227
ALYac	未发现病毒	20191229
TACHYON	未发现病毒	20191229
Malwarebytes	未发现病毒	20191229
Panda	未发现病毒	20191229
Zoner	未发现病毒	20191229
TrendMicro-HouseCall	未发现病毒	20191229
Tencent	未发现病毒	20191229
Yandex	未发现病毒	20191229
Ikarus	Trojan-PSW.QQpass	20191229
eGambit	未发现病毒	20191229
Fortinet	W32/Agent.65CA!tr	20191229
Webroot	未发现病毒	20191229
AVG	Win32:Malware-gen	20191229
Avast	Win32:Malware-gen	20191229
CrowdStrike	win/malicious_confidence_70% (W)	20190702
Qihoo-360	未发现病毒	20191229

进程树

Finder.exe id: 2680
services.exe id: 424
- mscorsvw.exe id: 2508
- mscorsvw.exe id: 1412

Finder.exe, PID: 2680, 上一级进程 PID: 2320

缺省注册表文件系统网络进程线程服务设备同步加密浏览器全部

services.exe, PID: 424, 上一级进程 PID: 328

缺省注册表文件系统网络进程线程服务设备同步加密浏览器全部

mscorsvw.exe, PID: 2508, 上一级进程 PID: 424

缺省注册表文件系统网络进程线程服务设备同步加密浏览器全部

mscorsvw.exe, PID: 1412, 上一级进程 PID: 424

缺省注册表文件系统网络进程线程服务设备同步加密浏览器全部

下载PCAP包

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

TCP

源地址	源端口	目标地址	目标端口
192.168.122.201	49162	180.101.49.11 www.baidu.com	80
192.168.122.201	49163	180.101.49.11 www.baidu.com	443
192.168.122.201	49161	198.41.214.99 ip.cn	443

UDP

源地址	源端口	目标地址	目标端口
192.168.122.201	59968	192.168.122.1	53
192.168.122.201	62882	192.168.122.1	53

域名解析 (可点击查询WPING实时安全评级)

域名	安全评级	响应
ip.cn	未知	A 198.41.214.99 A 104.16.25.99 A 198.41.215.99
www.baidu.com	CNAME www.a.shifen.com A 180.101.49.11 A 180.101.49.12

TCP

源地址	源端口	目标地址	目标端口
192.168.122.201	49162	180.101.49.11 www.baidu.com	80
192.168.122.201	49163	180.101.49.11 www.baidu.com	443
192.168.122.201	49161	198.41.214.99 ip.cn	443

UDP

源地址	源端口	目标地址	目标端口
192.168.122.201	59968	192.168.122.1	53
192.168.122.201	62882	192.168.122.1	53

HTTP 请求

URI	HTTP数据
URL专业沙箱检测 -> http://www.baidu.com/	GET / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: text/html, application/xhtml+xml, / Accept-Encoding: gbk, GB2312 Accept-Language: zh-cn User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Host: www.baidu.com

URI

HTTP数据

URL专业沙箱检测 -> http://www.baidu.com/

GET / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: text/html, application/xhtml+xml, */*
Accept-Encoding: gbk, GB2312
Accept-Language: zh-cn
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: www.baidu.com

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

Timestamp	Source IP	Source Port	Destination IP	Destination Port	Version	Issuer	Subject	Fingerprint
2020-04-08 19:41:42.785106+0800	192.168.122.201	49163	180.101.49.11	443	TLSv1	C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2	C=CN, ST=beijing, L=beijing, OU=service operation department, O=Beijing Baidu Netcom Science Technology Co., Ltd, CN=baidu.com	d1:f6:32:3d:b6:f2:ec:81:e7:02:36:90:f4:9b:2d:91:e0:c3:99:3a
2020-04-08 19:41:43.023167+0800	192.168.122.201	49161	198.41.214.99	443	TLSv1	C=US, ST=CA, L=San Francisco, O=CloudFlare, Inc., CN=CloudFlare Inc RSA CA-1	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	34:49:4e:02:90:4d:9e:69:3d:11:88:5b:fb:07:8c:aa:1f:50:d6:cb

Suricata HTTP

No Suricata HTTP

未发现网络提取文件

抱歉! 没有任何文件投放。

没有发现相似的分析.

HTML 总结报告 (需15-60分钟同步)	下载

Processing ( 33.525 seconds )

10.691 NetworkAnalysis
9.509 Suricata
6.733 VirusTotal
2.829 BehaviorAnalysis
2.443 Static
0.914 TargetInfo
0.364 peid
0.018 AnalysisInfo
0.013 config_decoder
0.009 Strings
0.002 Memory

Signatures ( 1.994 seconds )

1.129 md_url_bl
0.127 api_spamming
0.109 stealth_timeout
0.1 stealth_decoy_document
0.065 antiav_detectreg
0.026 infostealer_ftp
0.023 antidbg_windows
0.022 mimics_filetime
0.02 antivm_vbox_libs
0.017 stealth_file
0.017 reads_self
0.017 antivm_generic_disk
0.017 virus
0.015 bootkit
0.015 infostealer_im
0.014 kovter_behavior
0.014 md_domain_bl
0.013 infostealer_browser_password
0.013 antianalysis_detectreg
0.012 antiemu_wine_func
0.01 hancitor_behavior
0.01 antiav_detectfile
0.009 exec_crash
0.008 injection_createremotethread
0.008 infostealer_mail
0.007 maldun_anomaly_massive_file_ops
0.007 antivm_generic_services
0.007 antisandbox_sunbelt_libs
0.007 antivm_generic_scsi
0.007 infostealer_bitcoin
0.006 antiav_avast_libs
0.006 infostealer_browser
0.005 antivm_vmware_libs
0.005 antivm_vbox_window
0.005 antisandbox_sboxie_libs
0.005 antiav_bitdefender_libs
0.005 anormaly_invoke_kills
0.005 injection_runpe
0.005 geodo_banking_trojan
0.004 anomaly_persistence_autorun
0.004 antivm_vbox_files
0.004 network_http
0.004 ransomware_extensions
0.004 ransomware_files
0.003 betabot_behavior
0.003 kibex_behavior
0.003 shifu_behavior
0.003 antisandbox_script_timer
0.003 antivm_parallels_keys
0.003 antivm_xen_keys
0.003 darkcomet_regkeys
0.002 injection_explorer
0.002 antivm_generic_diskreg
0.002 disables_browser_warn
0.002 network_torgateway
0.001 tinba_behavior
0.001 hawkeye_behavior
0.001 network_tor
0.001 rat_nanocore
0.001 maldun_malicious_write_executeable_under_temp_to_regrun
0.001 packer_themida
0.001 maldun_anomaly_write_exe_and_obsfucate_extension
0.001 browser_needed
0.001 stealth_network
0.001 ipc_namedpipe
0.001 vawtrak_behavior
0.001 cerber_behavior
0.001 process_needed
0.001 bypass_firewall
0.001 antidbg_devices
0.001 antisandbox_productid
0.001 antivm_xen_keys
0.001 antivm_hyperv_keys
0.001 antivm_vbox_acpi
0.001 antivm_vbox_keys
0.001 antivm_vmware_keys
0.001 antivm_vpc_keys
0.001 bot_drive
0.001 bot_drive2
0.001 browser_security
0.001 modify_proxy
0.001 maldun_malicious_drop_executable_file_to_temp_folder
0.001 maldun_anomaly_invoke_vb_vba
0.001 md_bad_drop
0.001 network_cnc_http
0.001 packer_armadillo_regkey
0.001 rat_pcclient
0.001 recon_fingerprint

Reporting ( 0.677 seconds )

0.635 ReportHTMLSummary
0.042 Malheur


Task ID	535171
Mongo ID	5e8db912bb7d5727dc78b7f2
Cuckoo release	1.4-Maldun