比较分析...

分析任务

分析类型 虚拟机标签 开始时间 结束时间 持续时间
文件 (Windows) win7-sp1-x64-hpdapp01-1 2020-07-05 22:22:09 2020-07-05 22:26:44 275 秒

魔盾分数

10.0

危险的

文件详细信息

文件名 Microzoft Wihdwos 13 Installer.exe
文件大小 169984 字节
文件类型 PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 12f9c20d15250702d0755ccb0a1021a0
SHA1 0db346dc42a602cc138ddb3788dd17d93a8134f3
SHA256 96ce64de17338bd87af3f1245a760ce2338bec2e0d679a285567e7ab15a03047
SHA512 658366106aa36fcaa14dc72c00e93eef336de38c0e38c31a82789460bb9de5bd4c61270d373f59fdfb90feb02677aa9c0fa6454905df2f65225fdd954b939d5b
CRC32 AB4BBC87
Ssdeep 768:V8Oa4aO6LigGKr6JmVHjk+imH6NWZ/YuDO/Q7lS1q4A3KFFNozVSh9uR5hYUvCOQ:Va5uKVHjv+0J5QXFL8SzUnTRW
Yara 登录查看Yara规则
样本下载 提交误报
登录查看威胁特征

运行截图

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

摘要

登录查看详细行为信息

PE 信息

初始地址 0x00400000
入口地址 0x004014a0
声明校验值 0x00033df1
实际校验值 0x00033df1
最低操作系统版本要求 4.0
编译时间 2020-07-05 22:21:24
载入哈希 e6e8af777b66a4e4859bed9eb0f774a9

PE 数据组成

名称 虚拟地址 虚拟大小 原始数据大小 特征 熵(Entropy)
.text 0x00001000 0x00009b58 0x00009c00 IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES 5.99
.data 0x0000b000 0x00010290 0x00010400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES 1.13
.rdata 0x0001c000 0x00001060 0x00001200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_32BYTES 4.61
.bss 0x0001e000 0x00000ec4 0x00000000 IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES 0.00
.idata 0x0001f000 0x00000b7c 0x00000c00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 5.19
.CRT 0x00020000 0x00000034 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 0.27
.tls 0x00021000 0x00000008 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 0.00
.rsrc 0x00022000 0x0000d0a0 0x0000d0a0 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 4.52

覆盖

偏移量 0x000296a0
大小 0x00000160

导入

库: ADVAPI32.dll:
• 0x41f228 CryptGenRandom
• 0x41f22c RegCloseKey
• 0x41f230 RegCreateKeyExW
• 0x41f234 RegFlushKey
• 0x41f238 RegOpenKeyW
• 0x41f23c RegSetValueExW
库: GDI32.dll:
• 0x41f244 BitBlt
库: KERNEL32.dll:
• 0x41f24c CloseHandle
• 0x41f250 CreateFileA
• 0x41f254 CreateMutexA
• 0x41f258 CreateProcessW
• 0x41f25c CreateThread
• 0x41f268 ExitProcess
• 0x41f26c GetCurrentProcess
• 0x41f270 GetCurrentProcessId
• 0x41f274 GetCurrentThreadId
• 0x41f278 GetLastError
• 0x41f27c GetModuleFileNameW
• 0x41f280 GetModuleHandleW
• 0x41f284 GetProcAddress
• 0x41f288 GetStartupInfoA
• 0x41f290 GetTickCount
• 0x41f298 IsDBCSLeadByteEx
• 0x41f2a0 LoadLibraryA
• 0x41f2a4 LocalAlloc
• 0x41f2a8 MultiByteToWideChar
• 0x41f2b0 ReleaseMutex
• 0x41f2b8 Sleep
• 0x41f2bc TerminateProcess
• 0x41f2c0 TerminateThread
• 0x41f2c4 TlsGetValue
• 0x41f2cc VirtualProtect
• 0x41f2d0 VirtualQuery
• 0x41f2d4 WaitForSingleObject
• 0x41f2d8 WideCharToMultiByte
• 0x41f2dc WriteFile
• 0x41f2e0 lstrlenW
库: msvcrt.dll:
• 0x41f2e8 __getmainargs
• 0x41f2ec __initenv
• 0x41f2f0 __lconv_init
• 0x41f2f4 __mb_cur_max
• 0x41f2f8 __p__acmdln
• 0x41f2fc __p__fmode
• 0x41f300 __set_app_type
• 0x41f304 __setusermatherr
• 0x41f308 _amsg_exit
• 0x41f30c _cexit
• 0x41f310 _errno
• 0x41f314 _initterm
• 0x41f318 _iob
• 0x41f31c _onexit
• 0x41f320 abort
• 0x41f324 atoi
• 0x41f328 calloc
• 0x41f32c exit
• 0x41f330 fprintf
• 0x41f334 fputc
• 0x41f338 free
• 0x41f33c fwrite
• 0x41f340 localeconv
• 0x41f344 malloc
• 0x41f348 memset
• 0x41f34c memcpy
• 0x41f350 setlocale
• 0x41f354 signal
• 0x41f358 strchr
• 0x41f35c strerror
• 0x41f360 strlen
• 0x41f364 strncmp
• 0x41f368 vfprintf
• 0x41f36c wcslen
库: SHELL32.dll:
• 0x41f374 ShellExecuteA
库: USER32.dll:
• 0x41f37c CallNextHookEx
• 0x41f380 DrawIcon
• 0x41f384 ExitWindowsEx
• 0x41f388 GetAsyncKeyState
• 0x41f38c GetCursorPos
• 0x41f390 GetDesktopWindow
• 0x41f394 GetSystemMetrics
• 0x41f398 GetWindowDC
• 0x41f39c LoadIconA
• 0x41f3a0 MessageBoxW
• 0x41f3a4 SendInput
• 0x41f3a8 SetCursorPos
• 0x41f3ac SetWindowsHookExA
• 0x41f3b4 UnhookWindowsHookEx
.text
P`.data
.rdata
`@.bss
.idata
.rsrc
???000??
5.b$/
Attempting to kill the installer or log off current user will directly cause your system to be completely destoryed in an instant,so don't try it easily. :D
FuckPCMutex
\\.\PhysicalDrive0
\\.\PhysicalDrive%u
\note.txt
notepad
ntdll.dll
RtlAdjustPrivilege
NtRaiseHardError
NtTerminateProcess
Unknown error
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
The result is too small to be represented (UNDERFLOW)
Total loss of significance (TLOSS)
Partial loss of significance (PLOSS)
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
(null)
Infinity
___lc_codepage_func
__lc_codepage
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
GCC: (tdm64-1) 9.2.0
CryptAcquireContextA
CryptGenRandom
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegOpenKeyW
RegSetValueExW
BitBlt
CloseHandle
CreateFileA
CreateMutexA
CreateProcessW
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalAlloc
MultiByteToWideChar
QueryPerformanceCounter
ReleaseMutex
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrlenW
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_errno
_initterm
_onexit
abort
calloc
fprintf
fputc
fwrite
localeconv
malloc
memset
memcpy
setlocale
signal
strchr
strerror
strlen
strncmp
vfprintf
wcslen
ShellExecuteA
CallNextHookEx
DrawIcon
ExitWindowsEx
GetAsyncKeyState
GetCursorPos
GetDesktopWindow
GetSystemMetrics
GetWindowDC
LoadIconA
MessageBoxW
SendInput
SetCursorPos
SetWindowsHookExA
SystemParametersInfoA
UnhookWindowsHookEx
ADVAPI32.dll
GDI32.dll
KERNEL32.dll
msvcrt.dll
SHELL32.dll
USER32.dll
########(
is not a valid Win32 application.
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
attrib.exe
Debugger
bcdboot.exe
bcdedit.exe
chkdsk.exe
command.com
conhost.exe
control.exe
cmd.exe
cscript.exe
debug.exe
drvinst.exe
dwm.exe
edit.com
explorer.exe
logonui.exe
makecab.exe
mmc.exe
msconfig.exe
msiexec.exe
net.exe
net1.exe
netsh.exe
ntsd.exe
ntvdm.exe
powershell.exe
reg.exe
regedt32.exe
regini.exe
regsvr32.exe
resmon.exe
runas.exe
rundll32.exe
sfc.exe
slui.exe
spoolsv.exe
svchost.exe
sysedit.exe
taskmgr.exe
taskhost.exe
tasklist.exe
takeown.exe
tskill.exe
tscon.exe
UI0Detect.exe
userinit.exe
wermgr.exe
WerFault.exe
winrs.exe
WmiPrvSE.exe
wscript.exe
taskkill.exe
shutdown.exe
(null)
msvcrt.dll
没有防病毒引擎扫描信息!

进程树

Microzoft Wihdwos 13 Installer.exe, PID: 2720, 上一级进程 PID: 2336
notepad.exe, PID: 2836, 上一级进程 PID: 2720
Microzoft Wihdwos 13 Installer.exe, PID: 2932, 上一级进程 PID: 2720
Microzoft Wihdwos 13 Installer.exe, PID: 2984, 上一级进程 PID: 2720
Microzoft Wihdwos 13 Installer.exe, PID: 3060, 上一级进程 PID: 2720
Microzoft Wihdwos 13 Installer.exe, PID: 2440, 上一级进程 PID: 2720
Microzoft Wihdwos 13 Installer.exe, PID: 2572, 上一级进程 PID: 2720
Microzoft Wihdwos 13 Installer.exe, PID: 960, 上一级进程 PID: 2720
Microzoft Wihdwos 13 Installer.exe, PID: 1484, 上一级进程 PID: 2720
Microzoft Wihdwos 13 Installer.exe, PID: 928, 上一级进程 PID: 2720
下载PCAP包

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

TCP

无TCP连接纪录.

UDP

无UDP连接纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

TCP

无TCP连接纪录.

UDP

无UDP连接纪录.

HTTP 请求

未发现HTTP请求.

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

No TLS

Suricata HTTP

No Suricata HTTP

未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
HTML 总结报告
(需15-60分钟同步)		 下载

Processing ( 25.186 seconds )

  • 15.57 Suricata
  • 4.79 VirusTotal
  • 2.071 BehaviorAnalysis
  • 1.352 Static
  • 0.528 peid
  • 0.371 TargetInfo
  • 0.358 NetworkAnalysis
  • 0.126 AnalysisInfo
  • 0.017 Strings
  • 0.003 Memory

Signatures ( 1.084 seconds )

  • 0.186 antiav_detectreg
  • 0.126 api_spamming
  • 0.104 stealth_decoy_document
  • 0.102 stealth_timeout
  • 0.066 infostealer_ftp
  • 0.039 antianalysis_detectreg
  • 0.038 infostealer_im
  • 0.036 antisandbox_sleep
  • 0.021 infostealer_mail
  • 0.02 md_domain_bl
  • 0.02 md_url_bl
  • 0.017 antivm_generic_scsi
  • 0.015 anomaly_persistence_autorun
  • 0.013 kibex_behavior
  • 0.01 antivm_generic_disk
  • 0.01 virus
  • 0.01 antivm_xen_keys
  • 0.009 stealth_file
  • 0.009 antivm_generic_services
  • 0.009 antivm_parallels_keys
  • 0.009 darkcomet_regkeys
  • 0.008 mimics_filetime
  • 0.008 betabot_behavior
  • 0.008 anormaly_invoke_kills
  • 0.008 antiav_detectfile
  • 0.008 geodo_banking_trojan
  • 0.007 injection_createremotethread
  • 0.007 reads_self
  • 0.007 ransomware_files
  • 0.007 recon_fingerprint
  • 0.006 ransomware_message
  • 0.006 antivm_generic_diskreg
  • 0.006 disables_browser_warn
  • 0.006 infostealer_bitcoin
  • 0.006 ransomware_extensions
  • 0.005 injection_runpe
  • 0.005 hancitor_behavior
  • 0.004 kovter_behavior
  • 0.004 antisandbox_productid
  • 0.004 browser_security
  • 0.004 packer_armadillo_regkey
  • 0.003 tinba_behavior
  • 0.003 antidbg_windows
  • 0.003 cerber_behavior
  • 0.003 bypass_firewall
  • 0.003 antivm_xen_keys
  • 0.003 antivm_hyperv_keys
  • 0.003 antivm_vbox_acpi
  • 0.003 antivm_vbox_files
  • 0.003 antivm_vbox_keys
  • 0.003 antivm_vmware_keys
  • 0.003 antivm_vpc_keys
  • 0.003 modify_proxy
  • 0.003 maldun_anomaly_invoke_vb_vba
  • 0.002 antiemu_wine_func
  • 0.002 rat_nanocore
  • 0.002 antisandbox_mouse_hook
  • 0.002 infostealer_browser_password
  • 0.002 infostealer_keylog
  • 0.002 antivm_generic_bios
  • 0.002 antivm_generic_cpu
  • 0.002 antivm_generic_system
  • 0.002 browser_addon
  • 0.002 disables_system_restore
  • 0.002 md_bad_drop
  • 0.002 recon_programs
  • 0.002 stealth_modify_uac_prompt
  • 0.001 network_tor
  • 0.001 antivm_vbox_libs
  • 0.001 maldun_malicious_write_executeable_under_temp_to_regrun
  • 0.001 dridex_behavior
  • 0.001 anomaly_persistence_bootexecute
  • 0.001 maldun_anomaly_write_exe_and_obsfucate_extension
  • 0.001 anomaly_reset_winsock
  • 0.001 sets_autoconfig_url
  • 0.001 ursnif_behavior
  • 0.001 ransomeware_modifies_desktop_wallpaper
  • 0.001 shifu_behavior
  • 0.001 exec_crash
  • 0.001 antianalysis_detectfile
  • 0.001 antidbg_devices
  • 0.001 banker_zeus_mutex
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 disables_windows_defender
  • 0.001 maldun_malicious_drop_executable_file_to_temp_folder
  • 0.001 office_security
  • 0.001 ransomware_radamant
  • 0.001 rat_pcclient
  • 0.001 rat_spynet
  • 0.001 stealth_hiddenreg
  • 0.001 stealth_hide_notifications
  • 0.001 stealth_modify_security_center_warnings

Reporting ( 1.337 seconds )

  • 1.059 ReportHTMLSummary
  • 0.278 Malheur
Task ID 557765
Mongo ID 5f01e3512f8f2e3862663312
Cuckoo release 1.4-Maldun