分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-shaapp01-1 | 2020-04-26 12:25:06 | 2020-04-26 12:25:44 | 38 秒 |
魔盾分数
10.0
危险的
文件详细信息
| 文件名 | Plants_Vs_Zombies_V1.0.0.1051_CN_V2.exe |
|---|---|
| 文件大小 | 27593846 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive |
| MD5 | 91fa4faf6b80c90f4bc4ac6d2d4ac4cc |
| SHA1 | 4f616cfdac52173cff00870eed89ba65eb9849b7 |
| SHA256 | 11e992381be482c9337ca2162759b316297a46f4f371e9ffd61ecc093bfd10f6 |
| SHA512 | fe39195f3bd2bd2ad0b166e21051dbd48ef95c00bac4a304055b58b1886db532023f930dfa6e0ec8be653eb6c310707b337c05e2c361e0118854fb776f7f1a02 |
| CRC32 | 6A7CD787 |
| Ssdeep | 786432:oh5ROUg0W6tjYMJlVXQNgxGTvEeW++O2jhyK5vpVrax:IOUg3ktJl6NgxkMt+MNTVrY |
| Yara | 登录查看Yara规则 |
| 样本下载 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x0040a7b1 |
| 声明校验值 | 0x000236e4 |
| 实际校验值 | 0x01a53dc9 |
| 最低操作系统版本要求 | 5.0 |
| PDB路径 | d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb |
| 编译时间 | 2010-03-15 14:27:50 |
| 载入哈希 | 9402b48d966c911f0785b076b349b5ef |
| 图标 |  |
| 图标精确哈希值 | 3e02527e67af010d267e693e882cb3da |
| 图标相似性哈希值 | a0355d3e8cef586bb6e00314ed096af5 |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x0001076e | 0x00010800 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.58 |
| .rdata | 0x00012000 | 0x00001865 | 0x00001a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.33 |
| .data | 0x00014000 | 0x0000bff4 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 3.55 |
| .CRT | 0x00020000 | 0x00000010 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 0.21 |
| .rsrc | 0x00021000 | 0x00003e60 | 0x00004000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.69 |
覆盖
| 偏移量 | 0x00016a00 |
| 大小 | 0x01a3a276 |
资源
| 名称 | 偏移量 | 大小 | 语言 | 子语言 | 熵(Entropy) | 文件类型 |
|---|---|---|---|---|---|---|
| RT_BITMAP | 0x0002148c | 0x00000bb6 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.19 | data |
| RT_ICON | 0x000229bc | 0x000008a8 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.69 | data |
| RT_ICON | 0x000229bc | 0x000008a8 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.69 | data |
| RT_ICON | 0x000229bc | 0x000008a8 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.69 | data |
| RT_ICON | 0x000229bc | 0x000008a8 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.69 | data |
| RT_DIALOG | 0x000238f4 | 0x0000019e | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 3.81 | data |
| RT_DIALOG | 0x000238f4 | 0x0000019e | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 3.81 | data |
| RT_DIALOG | 0x000238f4 | 0x0000019e | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 3.81 | data |
| RT_DIALOG | 0x000238f4 | 0x0000019e | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 3.81 | data |
| RT_DIALOG | 0x000238f4 | 0x0000019e | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 3.81 | data |
| RT_DIALOG | 0x000238f4 | 0x0000019e | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 3.81 | data |
| RT_STRING | 0x00023f5c | 0x0000002c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 1.97 | data |
| RT_STRING | 0x00023f5c | 0x0000002c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 1.97 | data |
| RT_STRING | 0x00023f5c | 0x0000002c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 1.97 | data |
| RT_STRING | 0x00023f5c | 0x0000002c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 1.97 | data |
| RT_STRING | 0x00023f5c | 0x0000002c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 1.97 | data |
| RT_GROUP_ICON | 0x00023f88 | 0x0000003e | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 2.65 | MS Windows icon resource - 4 icons, 16x16, 16 colors |
| RT_MANIFEST | 0x00023fc8 | 0x000005b8 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.21 | XML 1.0 document, ASCII text, with CRLF line terminators |
导入
库: COMCTL32.dll:
• 0x41202c None
库: KERNEL32.dll:
• 0x412068 DeleteFileA
• 0x41206c DeleteFileW
• 0x412070 CreateDirectoryA
• 0x412074 CreateDirectoryW
• 0x412078 FindClose
• 0x41207c FindNextFileA
• 0x412080 FindFirstFileA
• 0x412084 FindNextFileW
• 0x412088 FindFirstFileW
• 0x41208c GetTickCount
• 0x412090 WideCharToMultiByte
• 0x412094 MultiByteToWideChar
• 0x412098 GetVersionExA
• 0x41209c GlobalAlloc
• 0x4120a0 lstrlenA
• 0x4120a4 GetModuleFileNameA
• 0x4120a8 FindResourceA
• 0x4120ac GetModuleHandleA
• 0x4120b0 HeapAlloc
• 0x4120b4 GetProcessHeap
• 0x4120b8 HeapFree
• 0x4120bc HeapReAlloc
• 0x4120c0 CompareStringA
• 0x4120c4 ExitProcess
• 0x4120c8 GetLocaleInfoA
• 0x4120cc GetNumberFormatA
• 0x4120d0 lstrcmpiA
• 0x4120d4 GetProcAddress
• 0x4120d8 GetDateFormatA
• 0x4120dc GetTimeFormatA
• 0x4120e0 FileTimeToSystemTime
• 0x4120e4 FileTimeToLocalFileTime
• 0x4120e8 ExpandEnvironmentStringsA
• 0x4120ec WaitForSingleObject
• 0x4120f0 SetCurrentDirectoryA
• 0x4120f4 Sleep
• 0x4120f8 GetTempPathA
• 0x4120fc MoveFileExA
• 0x412100 UnmapViewOfFile
• 0x412104 GetCommandLineA
• 0x412108 MapViewOfFile
• 0x41210c CreateFileMappingA
• 0x412110 GetModuleFileNameW
• 0x412114 SetEnvironmentVariableA
• 0x412118 OpenFileMappingA
• 0x41211c LocalFileTimeToFileTime
• 0x412120 SystemTimeToFileTime
• 0x412124 GetSystemTime
• 0x412128 IsDBCSLeadByte
• 0x41212c GetCPInfo
• 0x412130 FreeLibrary
• 0x412134 LoadLibraryA
• 0x412138 GetCurrentDirectoryA
• 0x41213c GetFullPathNameA
• 0x412140 SetFileAttributesW
• 0x412144 SetFileAttributesA
• 0x412148 GetFileAttributesW
• 0x41214c GetFileAttributesA
• 0x412150 WriteFile
• 0x412154 SetLastError
• 0x412158 GetStdHandle
• 0x41215c ReadFile
• 0x412160 CreateFileW
• 0x412164 CreateFileA
• 0x412168 GetFileType
• 0x41216c SetEndOfFile
• 0x412170 SetFilePointer
• 0x412174 MoveFileA
• 0x412178 SetFileTime
• 0x41217c GetCurrentProcess
• 0x412180 CloseHandle
• 0x412184 GetLastError
• 0x412188 DosDateTimeToFileTime
库: USER32.dll:
• 0x4121bc ReleaseDC
• 0x4121c0 GetDC
• 0x4121c4 SendMessageA
• 0x4121c8 wsprintfA
• 0x4121cc SetDlgItemTextA
• 0x4121d0 EndDialog
• 0x4121d4 DestroyIcon
• 0x4121d8 SendDlgItemMessageA
• 0x4121dc GetDlgItemTextA
• 0x4121e0 DialogBoxParamA
• 0x4121e4 IsWindowVisible
• 0x4121e8 WaitForInputIdle
• 0x4121ec GetSysColor
• 0x4121f0 PostMessageA
• 0x4121f4 SetMenu
• 0x4121f8 SetFocus
• 0x4121fc LoadBitmapA
• 0x412200 LoadIconA
• 0x412204 CharToOemA
• 0x412208 OemToCharA
• 0x41220c GetClassNameA
• 0x412210 CharUpperA
• 0x412214 GetWindowRect
• 0x412218 GetParent
• 0x41221c MapWindowPoints
• 0x412220 CreateWindowExA
• 0x412224 UpdateWindow
• 0x412228 SetWindowTextA
• 0x41222c LoadCursorA
• 0x412230 RegisterClassExA
• 0x412234 SetWindowLongA
• 0x412238 GetWindowLongA
• 0x41223c DefWindowProcA
• 0x412240 PeekMessageA
• 0x412244 GetMessageA
• 0x412248 TranslateMessage
• 0x41224c DispatchMessageA
• 0x412250 GetClientRect
• 0x412254 CopyRect
• 0x412258 IsWindow
• 0x41225c MessageBoxA
• 0x412260 ShowWindow
• 0x412264 GetDlgItem
• 0x412268 EnableWindow
• 0x41226c FindWindowExA
• 0x412270 wvsprintfA
• 0x412274 CharToOemBuffA
• 0x412278 LoadStringA
• 0x41227c SetWindowPos
• 0x412280 GetWindowTextA
• 0x412284 GetWindow
• 0x412288 GetSystemMetrics
• 0x41228c OemToCharBuffA
• 0x412290 DestroyWindow
库: GDI32.dll:
• 0x412044 GetDeviceCaps
• 0x412048 GetObjectA
• 0x41204c CreateCompatibleBitmap
• 0x412050 SelectObject
• 0x412054 StretchBlt
• 0x412058 CreateCompatibleDC
• 0x41205c DeleteObject
• 0x412060 DeleteDC
库: COMDLG32.dll:
• 0x412034 GetSaveFileNameA
• 0x412038 CommDlgExtendedError
• 0x41203c GetOpenFileNameA
库: ADVAPI32.dll:
• 0x412000 LookupPrivilegeValueA
• 0x412004 RegOpenKeyExA
• 0x412008 RegQueryValueExA
• 0x41200c RegCreateKeyExA
• 0x412010 RegSetValueExA
• 0x412014 RegCloseKey
• 0x412018 SetFileSecurityW
• 0x41201c SetFileSecurityA
• 0x412020 OpenProcessToken
• 0x412024 AdjustTokenPrivileges
库: SHELL32.dll:
• 0x412198 ShellExecuteExA
• 0x41219c SHFileOperationA
• 0x4121a0 SHGetFileInfoA
• 0x4121a4 SHGetSpecialFolderLocation
• 0x4121a8 SHGetMalloc
• 0x4121ac SHBrowseForFolderA
• 0x4121b0 SHGetPathFromIDListA
• 0x4121b4 SHChangeNotify
库: ole32.dll:
• 0x412298 CreateStreamOnHGlobal
• 0x41229c OleInitialize
• 0x4122a0 CoCreateInstance
• 0x4122a4 OleUninitialize
• 0x4122a8 CLSIDFromString
库: OLEAUT32.dll:
• 0x412190 VariantInit
.text
`.rdata
@.data
@.rsrc
t!h #A
zuFh$#A
Sh8#A
Rhx(A
QhX(A
Rhx(A
Rhx(A
Rhx(A
RhX(A
Sh4$A
u<h$$A
@Wh(%A
t0h<%A
Vh@%A
PhP%A
PhH(A
uMhL#A
SSSh4&A
SSh<'A
Sh<'A
tFhh'A
- ???
SeRestorePrivilege
SeSecurityPrivilege
%.*s(%d)%s
rtmp%d
YNANRC
bad allocation
<style>body{font-family:"Arial";font-size:12;}</style>
</html>
utf-8"></head>
<head><meta http-equiv="content-type" content="text/html; charset=
<html>
</style>
<style>
RarHtmlClassName
__rar_
?*<>|"
*messages***
RarSFX
SHAutoComplete
shlwapi.dll
%s %s
%s %s %s
REPLACEFILEDLG
RENAMEDLG
GETPASSWORD1
ASKNEXTVOL
Software\WinRAR SFX
STATIC
Install
%s%s%d
ProgramFilesDir
Software\Microsoft\Windows\CurrentVersion
%s.%d.tmp
Delete
Title
Silent
Overwrite
Setup
TempMode
License
Presetup
Shortcut
SavePath
Update
LICENSEDLG
RichEdit
runas
winrarsfxmappingfile.tmp
-el -s2 "-d%s" "-p%s" "-sp%s"
__tmp_rar_sfx_access_check_%u
STARTDLG
sfxname
sfxcmd
Z2fQ`InitCommonControlsEx
COMCTL32.DLL
riched20.dll
riched32.dll
COMCTL32.dll
GetCurrentDirectoryA
SetLastError
GetLastError
CloseHandle
GetCurrentProcess
SetFileTime
MoveFileA
SetFilePointer
SetEndOfFile
GetFileType
CreateFileA
CreateFileW
ReadFile
GetStdHandle
WriteFile
GetFileAttributesA
GetFileAttributesW
SetFileAttributesA
SetFileAttributesW
GetFullPathNameA
DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GlobalAlloc
lstrlenA
GetModuleFileNameA
FindResourceA
GetModuleHandleA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
CompareStringA
ExitProcess
GetLocaleInfoA
GetNumberFormatA
lstrcmpiA
GetProcAddress
DosDateTimeToFileTime
GetDateFormatA
GetTimeFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsA
WaitForSingleObject
SetCurrentDirectoryA
Sleep
GetTempPathA
MoveFileExA
UnmapViewOfFile
GetCommandLineA
MapViewOfFile
CreateFileMappingA
GetModuleFileNameW
SetEnvironmentVariableA
OpenFileMappingA
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
IsDBCSLeadByte
GetCPInfo
FreeLibrary
LoadLibraryA
KERNEL32.dll
OemToCharBuffA
EnableWindow
GetDlgItem
ShowWindow
MessageBoxA
IsWindow
CopyRect
GetClientRect
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
DefWindowProcA
GetWindowLongA
SetWindowLongA
RegisterClassExA
LoadCursorA
SetWindowTextA
UpdateWindow
CreateWindowExA
MapWindowPoints
GetParent
GetWindowRect
CharUpperA
GetWindow
GetSystemMetrics
GetWindowTextA
SetWindowPos
LoadStringA
CharToOemBuffA
wvsprintfA
FindWindowExA
GetClassNameA
ReleaseDC
GetDC
SendMessageA
wsprintfA
SetDlgItemTextA
EndDialog
DestroyIcon
SendDlgItemMessageA
GetDlgItemTextA
DialogBoxParamA
IsWindowVisible
WaitForInputIdle
GetSysColor
PostMessageA
SetMenu
SetFocus
LoadBitmapA
LoadIconA
CharToOemA
OemToCharA
USER32.dll
DeleteDC
StretchBlt
SelectObject
CreateCompatibleBitmap
GetObjectA
CreateCompatibleDC
GetDeviceCaps
DeleteObject
GDI32.dll
CommDlgExtendedError
GetSaveFileNameA
GetOpenFileNameA
COMDLG32.dll
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
SetFileSecurityW
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
ADVAPI32.dll
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFileInfoA
SHFileOperationA
ShellExecuteExA
SHChangeNotify
SHELL32.dll
CoCreateInstance
CLSIDFromString
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
ole32.dll
OLEAUT32.dll
WINRAR.SFX
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
gwgw`
r"%wP
Wwgu"'P
{{{{0
8888888888887
USq88
UU888
rrrrrrr
rrrrrrr
rrrrrrr
rrrrrmm
rrrrr
rrrrrr
rrrrrrr
rrrrrrrr
~X[(W
fbc:N:
N_cOW
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
Plants_Vs_Zombies_V1.0.0.1051_CN_V2\bass.dll
4@T@w
about:blank
Shell.Explorer
STARTDLG
(&B)...
(&E):
(&W)...
hmsctls_progress32
</lI></ul>
| 防病毒引擎/厂商 | 病毒名/规则匹配 | 病毒库日期 |
|---|---|---|
| Bkav | 未发现病毒 | 20200414 |
| MicroWorld-eScan | 未发现病毒 | 20200414 |
| CMC | 未发现病毒 | 20190321 |
| CAT-QuickHeal | 未发现病毒 | 20200413 |
| McAfee | 未发现病毒 | 20200414 |
| Cylance | 未发现病毒 | 20200414 |
| Zillya | 未发现病毒 | 20200413 |
| SUPERAntiSpyware | 未发现病毒 | 20200411 |
| Sangfor | 未发现病毒 | 20200412 |
| K7AntiVirus | 未发现病毒 | 20200407 |
| Alibaba | 未发现病毒 | 20190527 |
| K7GW | 未发现病毒 | 20200414 |
| Cybereason | 未发现病毒 | 20190616 |
| TrendMicro | 未发现病毒 | 20200414 |
| Baidu | 未发现病毒 | 20190318 |
| F-Prot | 未发现病毒 | 20200414 |
| Symantec | 未发现病毒 | 20200414 |
| TotalDefense | 未发现病毒 | 20200414 |
| APEX | 未发现病毒 | 20200413 |
| Avast | 未发现病毒 | 20200413 |
| ClamAV | 未发现病毒 | 20200413 |
| GData | 未发现病毒 | 20200414 |
| Kaspersky | 未发现病毒 | 20200414 |
| BitDefender | 未发现病毒 | 20200414 |
| NANO-Antivirus | 未发现病毒 | 20200414 |
| Paloalto | 未发现病毒 | 20200414 |
| AegisLab | 未发现病毒 | 20200414 |
| Tencent | 未发现病毒 | 20200414 |
| Endgame | 未发现病毒 | 20200226 |
| Sophos | 未发现病毒 | 20200414 |
| Comodo | 未发现病毒 | 20200414 |
| F-Secure | 未发现病毒 | 20200414 |
| DrWeb | 未发现病毒 | 20200414 |
| VIPRE | 未发现病毒 | 20200414 |
| Invincea | 未发现病毒 | 20200407 |
| McAfee-GW-Edition | 未发现病毒 | 20200413 |
| MaxSecure | 未发现病毒 | 20200413 |
| Trapmine | malicious.high.ml.score | 20200123 |
| FireEye | 未发现病毒 | 20200316 |
| Emsisoft | 未发现病毒 | 20200414 |
| SentinelOne | 未发现病毒 | 20200406 |
| Cyren | 未发现病毒 | 20200414 |
| Jiangmin | 未发现病毒 | 20200413 |
| Webroot | 未发现病毒 | 20200414 |
| Avira | 未发现病毒 | 20200414 |
| Antiy-AVL | 未发现病毒 | 20200414 |
| Kingsoft | 未发现病毒 | 20200414 |
| Arcabit | 未发现病毒 | 20200414 |
| ViRobot | 未发现病毒 | 20200414 |
| ZoneAlarm | 未发现病毒 | 20200414 |
| Avast-Mobile | 未发现病毒 | 20200414 |
| Microsoft | 未发现病毒 | 20200414 |
| TACHYON | 未发现病毒 | 20200414 |
| AhnLab-V3 | 未发现病毒 | 20200414 |
| Acronis | 未发现病毒 | 20200409 |
| VBA32 | 未发现病毒 | 20200413 |
| ALYac | 未发现病毒 | 20200414 |
| MAX | 未发现病毒 | 20200414 |
| Ad-Aware | 未发现病毒 | 20200414 |
| Malwarebytes | 未发现病毒 | 20200414 |
| Zoner | 未发现病毒 | 20200414 |
| ESET-NOD32 | 未发现病毒 | 20200414 |
| TrendMicro-HouseCall | 未发现病毒 | 20200414 |
| Rising | 未发现病毒 | 20200414 |
| Yandex | 未发现病毒 | 20200413 |
| Ikarus | 未发现病毒 | 20200413 |
| eGambit | 未发现病毒 | 20200414 |
| Fortinet | 未发现病毒 | 20200414 |
| BitDefenderTheta | 未发现病毒 | 20200408 |
| AVG | 未发现病毒 | 20200413 |
| Panda | 未发现病毒 | 20200413 |
| CrowdStrike | 未发现病毒 | 20190702 |
| Qihoo-360 | 未发现病毒 | 20200414 |
进程树
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
无TCP连接纪录.
UDP
无UDP连接纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
TCP
无TCP连接纪录.
UDP
无UDP连接纪录.
HTTP 请求
未发现HTTP请求.
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 16.145 seconds )
- 8.391 Static
- 4.155 TargetInfo
- 2.103 VirusTotal
- 0.791 BehaviorAnalysis
- 0.416 peid
- 0.221 NetworkAnalysis
- 0.045 config_decoder
- 0.011 Strings
- 0.01 AnalysisInfo
- 0.002 Memory
Signatures ( 0.47 seconds )
- 0.055 antiav_detectreg
- 0.034 api_spamming
- 0.028 stealth_timeout
- 0.027 mimics_filetime
- 0.024 stealth_decoy_document
- 0.024 stealth_file
- 0.023 infostealer_ftp
- 0.022 reads_self
- 0.013 antiav_detectfile
- 0.013 infostealer_im
- 0.012 bootkit
- 0.011 antianalysis_detectreg
- 0.011 ransomware_extensions
- 0.01 infostealer_browser
- 0.009 infostealer_bitcoin
- 0.008 antivm_generic_scsi
- 0.008 virus
- 0.008 infostealer_mail
- 0.008 md_url_bl
- 0.008 ransomware_files
- 0.007 md_domain_bl
- 0.006 antivm_generic_services
- 0.006 antivm_generic_disk
- 0.005 anomaly_persistence_autorun
- 0.005 anormaly_invoke_kills
- 0.005 antivm_vbox_files
- 0.004 ipc_namedpipe
- 0.003 maldun_malicious_write_executeable_under_temp_to_regrun
- 0.003 maldun_anomaly_write_exe_and_obsfucate_extension
- 0.003 maldun_anomaly_massive_file_ops
- 0.003 betabot_behavior
- 0.003 kibex_behavior
- 0.003 infostealer_browser_password
- 0.003 hancitor_behavior
- 0.003 securityxploded_modules
- 0.003 geodo_banking_trojan
- 0.003 maldun_malicious_drop_executable_file_to_temp_folder
- 0.002 tinba_behavior
- 0.002 rat_nanocore
- 0.002 ransomware_message
- 0.002 sets_autoconfig_url
- 0.002 antidbg_devices
- 0.002 antivm_generic_diskreg
- 0.002 antivm_parallels_keys
- 0.002 antivm_xen_keys
- 0.002 disables_browser_warn
- 0.002 darkcomet_regkeys
- 0.001 antiemu_wine_func
- 0.001 network_tor
- 0.001 antivm_vbox_libs
- 0.001 disables_spdy
- 0.001 kazybot_behavior
- 0.001 shifu_behavior
- 0.001 maldun_anomaly_write_exe_and_dll_under_winroot_run
- 0.001 antidbg_windows
- 0.001 disables_wfp
- 0.001 cerber_behavior
- 0.001 kovter_behavior
- 0.001 bypass_firewall
- 0.001 antisandbox_productid
- 0.001 antivm_hyperv_keys
- 0.001 antivm_vbox_keys
- 0.001 antivm_vmware_files
- 0.001 antivm_vmware_keys
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_security
- 0.001 modify_proxy
- 0.001 codelux_behavior
- 0.001 maldun_anomaly_invoke_vb_vba
- 0.001 md_bad_drop
- 0.001 rat_pcclient
- 0.001 recon_fingerprint
Reporting ( 0.75 seconds )
- 0.6 ReportHTMLSummary
- 0.15 Malheur
| Task ID | 540014 |
|---|---|
| Mongo ID | 5ea50d5ebb7d570593797f01 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号