恶意软件分析 & URL链接扫描免费在线病毒分析平台

分析任务

分析类型	虚拟机标签	开始时间	结束时间	持续时间
文件 (Windows)	win7-sp1-x64-hpdapp01-1	2020-07-05 21:59:32	2020-07-05 22:02:00	148 秒

魔盾分数

10.0

危险的

文件详细信息

文件名	助瞄单板狙击111111.exe
文件大小	5701632 字节
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	e15ecbfcb485b7eecfd304021ff4d8ae
SHA1	b82b042ce6e526ff0792be82be9f0ae5ece1ca6d
SHA256	d8123a317ae325cb414a787209e55c64bb96080a40fb269906ffc7fe96b09622
SHA512	3abf935b418a2e2c573ea585c92dd3b30d89ba3f85d1ac406ca5cdf0e213032a8389b2ff7640c65a948a60a41ae84e28153702a18ddb644e3052e1481cd3a27d
CRC32	008B91A8
Ssdeep	98304:CMmOgOyPkVk5KEXyfzlfVWFoP32M8A4bONSDDYJz2GNInSailuSQs6YLNcofy3SC:CV3oVEXYzNVKVhKNSDDEdNGZTs6YBxSH
Yara	登录查看Yara规则
	样本下载提交误报

登录查看威胁特征

运行截图

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

摘要

登录查看详细行为信息

PE 信息

初始地址	0x00400000
入口地址	0x00478681
声明校验值	0x00000000
实际校验值	0x00575cc3
最低操作系统版本要求	4.0
编译时间	2020-07-05 21:58:48
载入哈希	7431a6302592dac35e8d9f421cc52c8c

版本信息

LegalCopyright
FileVersion
CompanyName
Comments
ProductName
ProductVersion
FileDescription
Translation

PE 数据组成

名称	虚拟地址	虚拟大小	原始数据大小	特征	熵(Entropy)
.text	0x00001000	0x00096faa	0x00097000	IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ	6.54
.rdata	0x00098000	0x004bb8d0	0x004bc000	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	7.54
.data	0x00554000	0x000383ea	0x00012000	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	5.10
.rsrc	0x0058d000	0x00009088	0x0000a000	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	4.52

导入

库: WINMM.dll:

• 0x49866c midiStreamOut

• 0x498670 midiOutPrepareHeader

• 0x498674 waveOutWrite

• 0x498678 waveOutPause

• 0x49867c waveOutReset

• 0x498680 waveOutClose

• 0x498684 waveOutGetNumDevs

• 0x498688 waveOutOpen

• 0x49868c midiOutUnprepareHeader

• 0x498690 midiStreamOpen

• 0x498694 midiStreamProperty

• 0x498698 midiStreamStop

• 0x49869c midiOutReset

• 0x4986a0 midiStreamClose

• 0x4986a4 midiStreamRestart

• 0x4986a8 waveOutUnprepareHeader

• 0x4986ac waveOutPrepareHeader

库: WS2_32.dll:

• 0x4986c4 WSACleanup

• 0x4986c8 closesocket

• 0x4986cc getpeername

• 0x4986d0 accept

• 0x4986d4 WSAAsyncSelect

• 0x4986d8 recvfrom

• 0x4986dc ioctlsocket

• 0x4986e0 inet_ntoa

• 0x4986e4 recv

库: KERNEL32.dll:

• 0x498198 GetTimeZoneInformation

• 0x49819c GetVersion

• 0x4981a0 FreeEnvironmentStringsA

• 0x4981a4 UnhandledExceptionFilter

• 0x4981a8 GetACP

• 0x4981ac HeapSize

• 0x4981b0 RaiseException

• 0x4981b4 GetLocalTime

• 0x4981b8 GetSystemTime

• 0x4981bc RtlUnwind

• 0x4981c0 GetStartupInfoA

• 0x4981c4 GetOEMCP

• 0x4981c8 GetCPInfo

• 0x4981cc GetProcessVersion

• 0x4981d0 SetErrorMode

• 0x4981d4 GlobalFlags

• 0x4981d8 GetCurrentThread

• 0x4981dc GetFileTime

• 0x4981e0 TlsGetValue

• 0x4981e4 LocalReAlloc

• 0x4981e8 TlsSetValue

• 0x4981ec TlsFree

• 0x4981f0 GlobalHandle

• 0x4981f4 TlsAlloc

• 0x4981f8 LocalAlloc

• 0x4981fc lstrcmpA

• 0x498200 GlobalGetAtomNameA

• 0x498204 GlobalAddAtomA

• 0x498208 GlobalFindAtomA

• 0x49820c GlobalDeleteAtom

• 0x498210 lstrcmpiA

• 0x498214 SetEndOfFile

• 0x498218 UnlockFile

• 0x49821c LockFile

• 0x498220 FlushFileBuffers

• 0x498224 DuplicateHandle

• 0x498228 lstrcpynA

• 0x49822c FileTimeToLocalFileTime

• 0x498230 FileTimeToSystemTime

• 0x498234 LocalFree

• 0x498238 InterlockedDecrement

• 0x49823c InterlockedIncrement

• 0x498240 SetLastError

• 0x498244 TerminateProcess

• 0x498248 GetCurrentProcess

• 0x49824c GetFileSize

• 0x498250 SetFilePointer

• 0x498254 CreateSemaphoreA

• 0x498258 ResumeThread

• 0x49825c ReleaseSemaphore

• 0x498260 EnterCriticalSection

• 0x498264 LeaveCriticalSection

• 0x498268 GetProfileStringA

• 0x49826c WriteFile

• 0x498270 WaitForMultipleObjects

• 0x498274 CreateFileA

• 0x498278 SetEvent

• 0x49827c FindResourceA

• 0x498280 LoadResource

• 0x498284 LockResource

• 0x498288 ReadFile

• 0x49828c lstrlenW

• 0x498290 GetModuleFileNameA

• 0x498294 WideCharToMultiByte

• 0x498298 MultiByteToWideChar

• 0x49829c GetCurrentThreadId

• 0x4982a0 ExitProcess

• 0x4982a4 GlobalSize

• 0x4982a8 GlobalFree

• 0x4982ac DeleteCriticalSection

• 0x4982b0 InitializeCriticalSection

• 0x4982b4 lstrcatA

• 0x4982b8 lstrlenA

• 0x4982bc InterlockedExchange

• 0x4982c0 WinExec

• 0x4982c4 lstrcpyA

• 0x4982c8 FindNextFileA

• 0x4982cc GlobalReAlloc

• 0x4982d0 HeapFree

• 0x4982d4 HeapReAlloc

• 0x4982d8 GetProcessHeap

• 0x4982dc HeapAlloc

• 0x4982e0 GetUserDefaultLCID

• 0x4982e4 GetFullPathNameA

• 0x4982e8 FreeLibrary

• 0x4982ec LoadLibraryA

• 0x4982f0 GetLastError

• 0x4982f4 GetVersionExA

• 0x4982f8 WritePrivateProfileStringA

• 0x4982fc CreateThread

• 0x498300 CreateEventA

• 0x498304 Sleep

• 0x498308 GlobalAlloc

• 0x49830c GlobalLock

• 0x498310 GlobalUnlock

• 0x498314 FindFirstFileA

• 0x498318 FindClose

• 0x49831c SetFileAttributesA

• 0x498320 GetFileAttributesA

• 0x498324 MoveFileA

• 0x498328 DeleteFileA

• 0x49832c SetCurrentDirectoryA

• 0x498330 GetVolumeInformationA

• 0x498334 GetModuleHandleA

• 0x498338 GetProcAddress

• 0x49833c MulDiv

• 0x498340 GetCommandLineA

• 0x498344 GetTickCount

• 0x498348 CreateProcessA

• 0x49834c WaitForSingleObject

• 0x498350 CloseHandle

• 0x498354 FreeEnvironmentStringsW

• 0x498358 GetEnvironmentStrings

• 0x49835c GetEnvironmentStringsW

• 0x498360 SetHandleCount

• 0x498364 GetStdHandle

• 0x498368 GetFileType

• 0x49836c GetEnvironmentVariableA

• 0x498370 HeapDestroy

• 0x498374 HeapCreate

• 0x498378 VirtualFree

• 0x49837c SetEnvironmentVariableA

• 0x498380 LCMapStringA

• 0x498384 LCMapStringW

• 0x498388 VirtualAlloc

• 0x49838c IsBadWritePtr

• 0x498390 SetUnhandledExceptionFilter

• 0x498394 GetStringTypeA

• 0x498398 GetStringTypeW

• 0x49839c CompareStringA

• 0x4983a0 CompareStringW

• 0x4983a4 IsBadReadPtr

• 0x4983a8 IsBadCodePtr

• 0x4983ac SetStdHandle

库: USER32.dll:

• 0x4983f4 IsZoomed

• 0x4983f8 GetClassInfoA

• 0x4983fc DefWindowProcA

• 0x498400 GetSystemMenu

• 0x498404 DeleteMenu

• 0x498408 GetSysColorBrush

• 0x49840c ShowWindow

• 0x498410 SystemParametersInfoA

• 0x498414 LoadImageA

• 0x498418 EnumDisplaySettingsA

• 0x49841c ClientToScreen

• 0x498420 EnableMenuItem

• 0x498424 GetSubMenu

• 0x498428 GetDlgCtrlID

• 0x49842c CreateAcceleratorTableA

• 0x498430 CreateMenu

• 0x498434 ModifyMenuA

• 0x498438 AppendMenuA

• 0x49843c CreatePopupMenu

• 0x498440 DrawIconEx

• 0x498444 CreateIconFromResource

• 0x498448 CreateIconFromResourceEx

• 0x49844c RegisterClipboardFormatA

• 0x498450 SetRectEmpty

• 0x498454 DispatchMessageA

• 0x498458 GetMessageA

• 0x49845c WindowFromPoint

• 0x498460 DrawFocusRect

• 0x498464 GetMenu

• 0x498468 SetMenu

• 0x49846c PeekMessageA

• 0x498470 IsIconic

• 0x498474 SetFocus

• 0x498478 GetActiveWindow

• 0x49847c GetWindow

• 0x498480 DrawEdge

• 0x498484 SetWindowRgn

• 0x498488 GetMessagePos

• 0x49848c ScreenToClient

• 0x498490 ChildWindowFromPointEx

• 0x498494 CopyRect

• 0x498498 LoadBitmapA

• 0x49849c WinHelpA

• 0x4984a0 KillTimer

• 0x4984a4 SetTimer

• 0x4984a8 ReleaseCapture

• 0x4984ac GetCapture

• 0x4984b0 LoadStringA

• 0x4984b4 GetMenuCheckMarkDimensions

• 0x4984b8 GetMenuState

• 0x4984bc SetMenuItemBitmaps

• 0x4984c0 SetCapture

• 0x4984c4 GetScrollRange

• 0x4984c8 SetScrollRange

• 0x4984cc PostQuitMessage

• 0x4984d0 SetRect

• 0x4984d4 InflateRect

• 0x4984d8 IntersectRect

• 0x4984dc DestroyIcon

• 0x4984e0 PtInRect

• 0x4984e4 OffsetRect

• 0x4984e8 IsWindowVisible

• 0x4984ec EnableWindow

• 0x4984f0 RedrawWindow

• 0x4984f4 GetWindowLongA

• 0x4984f8 SetWindowLongA

• 0x4984fc GetSysColor

• 0x498500 SetActiveWindow

• 0x498504 SetCursorPos

• 0x498508 LoadCursorA

• 0x49850c SetCursor

• 0x498510 GetDC

• 0x498514 FillRect

• 0x498518 IsRectEmpty

• 0x49851c ReleaseDC

• 0x498520 IsChild

• 0x498524 DestroyMenu

• 0x498528 SetForegroundWindow

• 0x49852c GetWindowRect

• 0x498530 EqualRect

• 0x498534 UpdateWindow

• 0x498538 ValidateRect

• 0x49853c InvalidateRect

• 0x498540 GetClientRect

• 0x498544 GetFocus

• 0x498548 GetParent

• 0x49854c GetTopWindow

• 0x498550 PostMessageA

• 0x498554 IsWindow

• 0x498558 SetParent

• 0x49855c DestroyCursor

• 0x498560 SendMessageA

• 0x498564 SetWindowPos

• 0x498568 MessageBoxA

• 0x49856c GetCursorPos

• 0x498570 GetSystemMetrics

• 0x498574 EmptyClipboard

• 0x498578 SetClipboardData

• 0x49857c OpenClipboard

• 0x498580 GetClipboardData

• 0x498584 CloseClipboard

• 0x498588 wsprintfA

• 0x49858c WaitForInputIdle

• 0x498590 DrawFrameControl

• 0x498594 TranslateMessage

• 0x498598 LoadIconA

• 0x49859c CallWindowProcA

• 0x4985a0 CreateWindowExA

• 0x4985a4 UnregisterHotKey

• 0x4985a8 GetDesktopWindow

• 0x4985ac GetClassNameA

• 0x4985b0 GetDlgItem

• 0x4985b4 GetWindowTextA

• 0x4985b8 GetForegroundWindow

• 0x4985bc CopyAcceleratorTableA

• 0x4985c0 GetKeyState

• 0x4985c4 TranslateAcceleratorA

• 0x4985c8 SetScrollPos

• 0x4985cc IsWindowEnabled

• 0x4985d0 DestroyAcceleratorTable

• 0x4985d4 UnregisterClassA

• 0x4985d8 RegisterHotKey

• 0x4985dc GetWindowTextLengthA

• 0x4985e0 CharUpperA

• 0x4985e4 GetWindowDC

• 0x4985e8 BeginPaint

• 0x4985ec EndPaint

• 0x4985f0 TabbedTextOutA

• 0x4985f4 DrawTextA

• 0x4985f8 GrayStringA

• 0x4985fc DestroyWindow

• 0x498600 CreateDialogIndirectParamA

• 0x498604 EndDialog

• 0x498608 GetNextDlgTabItem

• 0x49860c GetWindowPlacement

• 0x498610 RegisterWindowMessageA

• 0x498614 GetLastActivePopup

• 0x498618 GetMessageTime

• 0x49861c RemovePropA

• 0x498620 GetPropA

• 0x498624 UnhookWindowsHookEx

• 0x498628 SetPropA

• 0x49862c GetClassLongA

• 0x498630 CallNextHookEx

• 0x498634 SetWindowsHookExA

• 0x498638 GetMenuItemID

• 0x49863c GetMenuItemCount

• 0x498640 RegisterClassA

• 0x498644 GetScrollPos

• 0x498648 AdjustWindowRectEx

• 0x49864c MapWindowPoints

• 0x498650 SendDlgItemMessageA

• 0x498654 ScrollWindowEx

• 0x498658 IsDialogMessageA

• 0x49865c SetWindowTextA

• 0x498660 MoveWindow

• 0x498664 CheckMenuItem

库: GDI32.dll:

• 0x498044 LineTo

• 0x498048 MoveToEx

• 0x49804c ExcludeClipRect

• 0x498050 CreateBitmap

• 0x498054 SelectObject

• 0x498058 CreatePen

• 0x49805c PatBlt

• 0x498060 CombineRgn

• 0x498064 CreateRectRgn

• 0x498068 FillRgn

• 0x49806c CreateSolidBrush

• 0x498070 CreateFontIndirectA

• 0x498074 GetStockObject

• 0x498078 GetObjectA

• 0x49807c EndPage

• 0x498080 EndDoc

• 0x498084 DeleteDC

• 0x498088 StartDocA

• 0x49808c StartPage

• 0x498090 BitBlt

• 0x498094 CreateCompatibleDC

• 0x498098 ExtSelectClipRgn

• 0x49809c Ellipse

• 0x4980a0 Rectangle

• 0x4980a4 LPtoDP

• 0x4980a8 DPtoLP

• 0x4980ac GetCurrentObject

• 0x4980b0 RoundRect

• 0x4980b4 GetTextExtentPoint32A

• 0x4980b8 GetDeviceCaps

• 0x4980bc SetBkColor

• 0x4980c0 CreateFontA

• 0x4980c4 TranslateCharsetInfo

• 0x4980c8 GetClipBox

• 0x4980cc ScaleWindowExtEx

• 0x4980d0 SetWindowExtEx

• 0x4980d4 SetWindowOrgEx

• 0x4980d8 ScaleViewportExtEx

• 0x4980dc SetViewportExtEx

• 0x4980e0 OffsetViewportOrgEx

• 0x4980e4 SetViewportOrgEx

• 0x4980e8 SetMapMode

• 0x4980ec SetTextColor

• 0x4980f0 SetROP2

• 0x4980f4 GetViewportExtEx

• 0x4980f8 PtVisible

• 0x4980fc RectVisible

• 0x498100 TextOutA

• 0x498104 ExtTextOutA

• 0x498108 Escape

• 0x49810c GetTextMetricsA

• 0x498110 CreateDCA

• 0x498114 CreateCompatibleBitmap

• 0x498118 GetPolyFillMode

• 0x49811c GetStretchBltMode

• 0x498120 GetROP2

• 0x498124 GetBkColor

• 0x498128 GetBkMode

• 0x49812c GetTextColor

• 0x498130 CreateRoundRectRgn

• 0x498134 CreateEllipticRgn

• 0x498138 PathToRegion

• 0x49813c EndPath

• 0x498140 BeginPath

• 0x498144 SetPolyFillMode

• 0x498148 SetBkMode

• 0x49814c RestoreDC

• 0x498150 SaveDC

• 0x498154 GetWindowOrgEx

• 0x498158 GetViewportOrgEx

• 0x49815c GetWindowExtEx

• 0x498160 GetDIBits

• 0x498164 RealizePalette

• 0x498168 SelectPalette

• 0x49816c StretchBlt

• 0x498170 CreatePalette

• 0x498174 GetSystemPaletteEntries

• 0x498178 CreateDIBitmap

• 0x49817c DeleteObject

• 0x498180 SelectClipRgn

• 0x498184 CreateRectRgnIndirect

• 0x498188 GetClipRgn

• 0x49818c SetStretchBltMode

• 0x498190 CreatePolygonRgn

库: WINSPOOL.DRV:

• 0x4986b4 OpenPrinterA

• 0x4986b8 DocumentPropertiesA

• 0x4986bc ClosePrinter

库: ADVAPI32.dll:

• 0x498000 RegOpenKeyExA

• 0x498004 RegSetValueExA

• 0x498008 RegQueryValueA

• 0x49800c RegCreateKeyExA

• 0x498010 RegCloseKey

库: SHELL32.dll:

• 0x4983dc DragQueryFileA

• 0x4983e0 ShellExecuteA

• 0x4983e4 Shell_NotifyIconA

• 0x4983e8 DragAcceptFiles

• 0x4983ec DragFinish

库: ole32.dll:

• 0x498700 CLSIDFromProgID

• 0x498704 OleRun

• 0x498708 CoCreateInstance

• 0x49870c CLSIDFromString

• 0x498710 OleUninitialize

• 0x498714 OleInitialize

库: OLEAUT32.dll:

• 0x4983b4 UnRegisterTypeLib

• 0x4983b8 LoadTypeLib

• 0x4983bc LHashValOfNameSys

• 0x4983c0 RegisterTypeLib

• 0x4983c4 SysAllocString

• 0x4983c8 VariantInit

• 0x4983cc VariantCopyInd

• 0x4983d0 VariantChangeType

• 0x4983d4 VariantClear

库: COMCTL32.dll:

• 0x498018 ImageList_Add

• 0x49801c ImageList_BeginDrag

• 0x498020 ImageList_Create

• 0x498024 ImageList_Destroy

• 0x498028 ImageList_DragEnter

• 0x49802c ImageList_DragLeave

• 0x498030 ImageList_DragMove

• 0x498034 ImageList_DragShowNolock

• 0x498038 ImageList_EndDrag

• 0x49803c None

库: comdlg32.dll:

• 0x4986ec ChooseColorA

• 0x4986f0 GetFileTitleA

• 0x4986f4 GetSaveFileNameA

• 0x4986f8 GetOpenFileNameA

.text
`.rdata
@.data
.rsrc
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
VMProtect begin
VMProtect end
8`}<j
T$hVj
DRQPj
T$|Vj
T$th 
|$`Vj
|$|Vj
T$\Vj
jjjjh

没有防病毒引擎扫描信息!

进程树

__________________111111.exe id: 2728

搜索
__________________111111.exe (2728)

__________________111111.exe, PID: 2728, 上一级进程 PID: 2340

缺省注册表文件系统网络进程线程服务设备同步加密浏览器全部

下载PCAP包

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

TCP

无TCP连接纪录.

UDP

无UDP连接纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

TCP

无TCP连接纪录.

UDP

无UDP连接纪录.

HTTP 请求

未发现HTTP请求.

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

No TLS

Suricata HTTP

No Suricata HTTP

未发现网络提取文件

抱歉! 没有任何文件投放。

没有发现相似的分析.

HTML 总结报告 (需15-60分钟同步)	下载

Processing ( 41.233 seconds )

17.24 Static
15.491 Suricata
5.74 VirusTotal
1.719 TargetInfo
0.43 peid
0.359 NetworkAnalysis
0.132 BehaviorAnalysis
0.083 AnalysisInfo
0.018 Strings
0.017 config_decoder
0.004 Memory

Signatures ( 0.198 seconds )

0.027 antiav_detectreg
0.023 md_url_bl
0.018 md_domain_bl
0.011 infostealer_ftp
0.008 ransomware_extensions
0.008 ransomware_files
0.007 anomaly_persistence_autorun
0.007 antiav_detectfile
0.007 infostealer_im
0.006 antianalysis_detectreg
0.005 antidbg_windows
0.005 infostealer_bitcoin
0.004 api_spamming
0.004 infostealer_mail
0.003 tinba_behavior
0.003 stealth_decoy_document
0.003 stealth_timeout
0.003 antivm_vbox_files
0.003 geodo_banking_trojan
0.003 disables_browser_warn
0.002 rat_nanocore
0.002 betabot_behavior
0.002 cerber_behavior
0.002 browser_security
0.002 modify_proxy
0.002 md_bad_drop
0.001 antivm_vbox_window
0.001 ursnif_behavior
0.001 kibex_behavior
0.001 antivm_generic_scsi
0.001 shifu_behavior
0.001 antianalysis_detectfile
0.001 antidbg_devices
0.001 antivm_generic_diskreg
0.001 antivm_parallels_keys
0.001 antivm_xen_keys
0.001 banker_zeus_mutex
0.001 bot_drive
0.001 bot_drive2
0.001 browser_addon
0.001 disables_system_restore
0.001 disables_windows_defender
0.001 darkcomet_regkeys
0.001 maldun_malicious_drop_executable_file_to_temp_folder
0.001 mimics_extension
0.001 office_security
0.001 ransomware_radamant
0.001 rat_pcclient
0.001 rat_spynet
0.001 recon_fingerprint
0.001 stealth_hiddenreg
0.001 stealth_hide_notifications
0.001 stealth_modify_uac_prompt
0.001 stealth_modify_security_center_warnings

Reporting ( 1.207 seconds )

0.889 ReportHTMLSummary
0.318 Malheur


Task ID	557761
Mongo ID	5f01dd902f8f2e385e6631c0
Cuckoo release	1.4-Maldun