分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-hpdapp01-1 | 2020-07-05 22:05:00 | 2020-07-05 22:05:54 | 54 秒 |
魔盾分数
1.4
正常的
文件详细信息
| 文件名 | Microzoft Wihdwos 13 Installer.exe |
|---|---|
| 文件大小 | 172544 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows |
| MD5 | 4c97212631eaadfbb77369c4244de253 |
| SHA1 | 62e1754a92a1969e85d6c4b408feb68c38e95ab4 |
| SHA256 | 89e0dcc9f05a8bcc0de2dc3aa9d839ec244e52d16bd7c59d79001875525be8af |
| SHA512 | ac6464161ca5038c250e222368159197e0cefd727416dd44952bef456002a6ee08e26c20d27f63384e944be3c1f429b980a165a94fd65ad5cdeac6b6317e2e5e |
| CRC32 | E3F71402 |
| Ssdeep | 768:XhrOa4aDgiPigKer6Jm9HjsWiUH5NWZ/YuDOnZQdlSGq4A3KFFNozVSh9uR5hYUQ:RDP6y9Hj/f0JJFXFL8SzUnTRW |
| Yara | 登录查看Yara规则 |
| 样本下载 提交漏报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x004014a0 |
| 声明校验值 | 0x0002fd00 |
| 实际校验值 | 0x0002fd00 |
| 最低操作系统版本要求 | 4.0 |
| 编译时间 | 2020-07-05 21:57:51 |
| 载入哈希 | e6e8af777b66a4e4859bed9eb0f774a9 |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x00009c58 | 0x00009e00 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES | 5.97 |
| .data | 0x0000b000 | 0x00010290 | 0x00010400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES | 1.13 |
| .rdata | 0x0001c000 | 0x00001860 | 0x00001a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_32BYTES | 4.56 |
| .bss | 0x0001e000 | 0x00000ec4 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES | 0.00 |
| .idata | 0x0001f000 | 0x00000b7c | 0x00000c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES | 5.19 |
| .CRT | 0x00020000 | 0x00000034 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES | 0.27 |
| .tls | 0x00021000 | 0x00000008 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES | 0.00 |
| .rsrc | 0x00022000 | 0x0000d0a0 | 0x0000d0a0 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES | 4.52 |
覆盖
| 偏移量 | 0x0002a0a0 |
| 大小 | 0x00000160 |
导入
库: ADVAPI32.dll:
• 0x41f224 CryptAcquireContextA
• 0x41f228 CryptGenRandom
• 0x41f22c RegCloseKey
• 0x41f230 RegCreateKeyExW
• 0x41f234 RegFlushKey
• 0x41f238 RegOpenKeyW
• 0x41f23c RegSetValueExW
库: GDI32.dll:
• 0x41f244 BitBlt
库: KERNEL32.dll:
• 0x41f24c CloseHandle
• 0x41f250 CreateFileA
• 0x41f254 CreateMutexA
• 0x41f258 CreateProcessW
• 0x41f25c CreateThread
• 0x41f260 DeleteCriticalSection
• 0x41f264 EnterCriticalSection
• 0x41f268 ExitProcess
• 0x41f26c GetCurrentProcess
• 0x41f270 GetCurrentProcessId
• 0x41f274 GetCurrentThreadId
• 0x41f278 GetLastError
• 0x41f27c GetModuleFileNameW
• 0x41f280 GetModuleHandleW
• 0x41f284 GetProcAddress
• 0x41f288 GetStartupInfoA
• 0x41f28c GetSystemTimeAsFileTime
• 0x41f290 GetTickCount
• 0x41f294 InitializeCriticalSection
• 0x41f298 IsDBCSLeadByteEx
• 0x41f29c LeaveCriticalSection
• 0x41f2a0 LoadLibraryA
• 0x41f2a4 LocalAlloc
• 0x41f2a8 MultiByteToWideChar
• 0x41f2ac QueryPerformanceCounter
• 0x41f2b0 ReleaseMutex
• 0x41f2b4 SetUnhandledExceptionFilter
• 0x41f2b8 Sleep
• 0x41f2bc TerminateProcess
• 0x41f2c0 TerminateThread
• 0x41f2c4 TlsGetValue
• 0x41f2c8 UnhandledExceptionFilter
• 0x41f2cc VirtualProtect
• 0x41f2d0 VirtualQuery
• 0x41f2d4 WaitForSingleObject
• 0x41f2d8 WideCharToMultiByte
• 0x41f2dc WriteFile
• 0x41f2e0 lstrlenW
库: msvcrt.dll:
• 0x41f2e8 __getmainargs
• 0x41f2ec __initenv
• 0x41f2f0 __lconv_init
• 0x41f2f4 __mb_cur_max
• 0x41f2f8 __p__acmdln
• 0x41f2fc __p__fmode
• 0x41f300 __set_app_type
• 0x41f304 __setusermatherr
• 0x41f308 _amsg_exit
• 0x41f30c _cexit
• 0x41f310 _errno
• 0x41f314 _initterm
• 0x41f318 _iob
• 0x41f31c _onexit
• 0x41f320 abort
• 0x41f324 atoi
• 0x41f328 calloc
• 0x41f32c exit
• 0x41f330 fprintf
• 0x41f334 fputc
• 0x41f338 free
• 0x41f33c fwrite
• 0x41f340 localeconv
• 0x41f344 malloc
• 0x41f348 memset
• 0x41f34c memcpy
• 0x41f350 setlocale
• 0x41f354 signal
• 0x41f358 strchr
• 0x41f35c strerror
• 0x41f360 strlen
• 0x41f364 strncmp
• 0x41f368 vfprintf
• 0x41f36c wcslen
库: SHELL32.dll:
• 0x41f374 ShellExecuteA
库: USER32.dll:
• 0x41f37c CallNextHookEx
• 0x41f380 DrawIcon
• 0x41f384 ExitWindowsEx
• 0x41f388 GetAsyncKeyState
• 0x41f38c GetCursorPos
• 0x41f390 GetDesktopWindow
• 0x41f394 GetSystemMetrics
• 0x41f398 GetWindowDC
• 0x41f39c LoadIconA
• 0x41f3a0 MessageBoxW
• 0x41f3a4 SendInput
• 0x41f3a8 SetCursorPos
• 0x41f3ac SetWindowsHookExA
• 0x41f3b0 SystemParametersInfoA
• 0x41f3b4 UnhookWindowsHookEx
.text
P`.data
.rdata
`@.bss
.idata
.rsrc
???000??
5.b$/
Attempting to kill the installer or log off current user will directly cause your system to be completely destoryed in an instant,so don't try it easily. :D
FuckPCMutex
s(Wck(W
\\.\PhysicalDrive0
\\.\PhysicalDrive%u
\note.txt
notepad
ntdll.dll
RtlAdjustPrivilege
NtRaiseHardError
NtTerminateProcess
Unknown error
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
The result is too small to be represented (UNDERFLOW)
Total loss of significance (TLOSS)
Partial loss of significance (PLOSS)
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
(null)
Infinity
___lc_codepage_func
__lc_codepage
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
CryptAcquireContextA
CryptGenRandom
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegOpenKeyW
RegSetValueExW
BitBlt
CloseHandle
CreateFileA
CreateMutexA
CreateProcessW
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalAlloc
MultiByteToWideChar
QueryPerformanceCounter
ReleaseMutex
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrlenW
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_errno
_initterm
_onexit
abort
calloc
fprintf
fputc
fwrite
localeconv
malloc
memset
memcpy
setlocale
signal
strchr
strerror
strlen
strncmp
vfprintf
wcslen
ShellExecuteA
CallNextHookEx
DrawIcon
ExitWindowsEx
GetAsyncKeyState
GetCursorPos
GetDesktopWindow
GetSystemMetrics
GetWindowDC
LoadIconA
MessageBoxW
SendInput
SetCursorPos
SetWindowsHookExA
SystemParametersInfoA
UnhookWindowsHookEx
ADVAPI32.dll
GDI32.dll
KERNEL32.dll
msvcrt.dll
SHELL32.dll
USER32.dll
########(
is not a valid Win32 application.
xMicrozoft Wihdwos 13 Installer - Fatal
QUIT THE PROGRAM NOW?
Microzoft Wihdwos 13 Installer - Information
Por favor, entra en modo seguro.
Microzoft Wihdwos 13 Installer - Confirm
ARE YOU SURE THAT YOU WANT TO CONTINUE?
STILL CONTINUE? THINK ABOUT IT FIRST.
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
attrib.exe
Debugger
bcdboot.exe
bcdedit.exe
chkdsk.exe
command.com
conhost.exe
control.exe
cmd.exe
cscript.exe
debug.exe
drvinst.exe
dwm.exe
edit.com
explorer.exe
logonui.exe
makecab.exe
mmc.exe
msconfig.exe
msiexec.exe
net.exe
net1.exe
netsh.exe
ntsd.exe
ntvdm.exe
powershell.exe
reg.exe
regedt32.exe
regini.exe
regsvr32.exe
resmon.exe
runas.exe
rundll32.exe
sfc.exe
slui.exe
spoolsv.exe
svchost.exe
sysedit.exe
taskmgr.exe
taskhost.exe
tasklist.exe
takeown.exe
tskill.exe
tscon.exe
UI0Detect.exe
userinit.exe
wermgr.exe
WerFault.exe
winrs.exe
WmiPrvSE.exe
wscript.exe
taskkill.exe
shutdown.exe
(null)
msvcrt.dll
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
无TCP连接纪录.
UDP
无UDP连接纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
TCP
无TCP连接纪录.
UDP
无UDP连接纪录.
HTTP 请求
未发现HTTP请求.
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 25.93 seconds )
- 17.355 Suricata
- 5.832 VirusTotal
- 1.339 Static
- 0.516 peid
- 0.358 NetworkAnalysis
- 0.352 TargetInfo
- 0.095 BehaviorAnalysis
- 0.062 AnalysisInfo
- 0.018 Strings
- 0.003 Memory
Signatures ( 0.233 seconds )
- 0.034 antiav_detectreg
- 0.02 md_url_bl
- 0.019 md_domain_bl
- 0.015 infostealer_ftp
- 0.01 anomaly_persistence_autorun
- 0.01 antiav_detectfile
- 0.009 infostealer_im
- 0.007 infostealer_bitcoin
- 0.007 ransomware_extensions
- 0.007 ransomware_files
- 0.006 antianalysis_detectreg
- 0.006 infostealer_mail
- 0.005 stealth_decoy_document
- 0.005 api_spamming
- 0.005 stealth_timeout
- 0.005 disables_browser_warn
- 0.004 antivm_vbox_files
- 0.004 geodo_banking_trojan
- 0.003 tinba_behavior
- 0.003 rat_nanocore
- 0.003 browser_security
- 0.002 betabot_behavior
- 0.002 cerber_behavior
- 0.002 antivm_parallels_keys
- 0.002 antivm_xen_keys
- 0.002 bot_drive
- 0.002 bot_drive2
- 0.002 modify_proxy
- 0.002 maldun_malicious_drop_executable_file_to_temp_folder
- 0.002 md_bad_drop
- 0.001 network_tor
- 0.001 mimics_filetime
- 0.001 antivm_generic_services
- 0.001 reads_self
- 0.001 ursnif_behavior
- 0.001 kibex_behavior
- 0.001 antivm_generic_scsi
- 0.001 shifu_behavior
- 0.001 antivm_generic_disk
- 0.001 antidbg_windows
- 0.001 virus
- 0.001 antianalysis_detectfile
- 0.001 antidbg_devices
- 0.001 antivm_generic_diskreg
- 0.001 antivm_vmware_files
- 0.001 banker_zeus_mutex
- 0.001 bot_athenahttp
- 0.001 browser_addon
- 0.001 disables_system_restore
- 0.001 disables_windows_defender
- 0.001 codelux_behavior
- 0.001 darkcomet_regkeys
- 0.001 malicous_targeted_flame
- 0.001 office_security
- 0.001 rat_spynet
- 0.001 recon_fingerprint
- 0.001 stealth_hide_notifications
- 0.001 stealth_modify_uac_prompt
Reporting ( 0.952 seconds )
- 0.952 ReportHTMLSummary
| Task ID | 557762 |
|---|---|
| Mongo ID | 5f01de722f8f2e385f663200 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号