分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-shaapp03-1 | 2020-09-25 16:08:03 | 2020-09-25 16:08:46 | 43 秒 |
魔盾分数
10.0
Malicious病毒
文件详细信息
| 文件名 | Polycom Management Application 8.7.5.exe |
|---|---|
| 文件大小 | 80384 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5 | 83f73c203b104a5bdc9087552e5ec625 |
| SHA1 | 87edbb883744d7a1b92c8180e6a98b6e4044af55 |
| SHA256 | 0d5edf44acb4ea369730b808adc902f02c45da74bd711e128f0249b2ebd95f58 |
| SHA512 | 17a93efbd1f4745f9252b726ccbb67259d9a278a47b1d62e28f4d5c41ee00c8b8d2c60ed633d1bf6af5bd26740cab10915df02300f0e2739a9d31571f3ad6cf1 |
| CRC32 | FBBB1708 |
| Ssdeep | 1536:/2j7rFFRWYKADqyCv5gy7WKzQeDOqYbqR/okC9BkjJk:+j1xKgqyE37DznDOqYb6oB9Bkjm |
| Yara | 登录查看Yara规则 |
| 样本下载 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| acroipm.adobe.com |
CNAME acroipm.adobe.com.edgesuite.net CNAME a1983.dscd.akamai.net A 23.206.195.113 |
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x00413e7e |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x000176b5 |
| 最低操作系统版本要求 | 4.0 |
| PDB路径 | C:\build-views\Official\SVN_Main\workspace\EMA_8.7.5\EMA\MIG\EMA\EMA.Utils\EMA.Utils.ClickOnce\obj\Release\Polycom Management Application 8.7.5.pdb |
| 编译时间 | 2018-09-06 17:48:07 |
| 载入哈希 | f34d5f2d4577ed6d9ceec516c1f5a744 |
| 图标 |  |
| 图标精确哈希值 | 1c44d4bea06fff2f609feca3d15f8ce2 |
| 图标相似性哈希值 | fa7912d017429dcda0fa476abadd3283 |
版本信息
| Translation | |
|---|---|
| LegalCopyright | |
| Assembly Version | |
| InternalName | |
| FileVersion | |
| CompanyName | |
| ProductName | |
| ProductVersion | |
| FileDescription | |
| OriginalFilename |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00002000 | 0x00011e84 | 0x00012000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.36 |
| .rsrc | 0x00014000 | 0x00001520 | 0x00001600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 3.93 |
| .reloc | 0x00016000 | 0x0000000c | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 0.10 |
资源
| 名称 | 偏移量 | 大小 | 语言 | 子语言 | 熵(Entropy) | 文件类型 |
|---|---|---|---|---|---|---|
| RT_ICON | 0x00014460 | 0x000010a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.64 | data |
| RT_GROUP_ICON | 0x00015508 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 1.94 | MS Windows icon resource - 1 icon, 32x32 |
| RT_VERSION | 0x000140e8 | 0x00000374 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.40 | data |
导入
库: mscoree.dll:
• 0x402000 _CorExeMain
装载信息
| 名称 | Polycom Management Application 8.7.5 |
|---|---|
| 版本 | 8.7.5.1 |
装载参考
| 名称 | 版本 |
|---|---|
| mscorlib | 2.0.0.0 |
| System | 2.0.0.0 |
| System.Windows.Forms | 2.0.0.0 |
| System.Deployment | 2.0.0.0 |
类型参考
| 装载 | 类型名称 |
|---|---|
| System | System.CodeDom.Compiler.GeneratedCodeAttribute |
| System | System.ComponentModel.EditorBrowsableAttribute |
| System | System.ComponentModel.EditorBrowsableState |
| System | System.Configuration.ApplicationSettingsBase |
| System | System.Configuration.SettingsBase |
| System | System.Diagnostics.EventLog |
| System | System.Diagnostics.Process |
| System | System.Diagnostics.ProcessStartInfo |
| System | System.Diagnostics.ProcessWindowStyle |
| System | System.Uri |
| System.Deployment | System.Deployment.Application.ApplicationDeployment |
| System.Windows.Forms | System.Windows.Forms.Application |
| System.Windows.Forms | System.Windows.Forms.DialogResult |
| System.Windows.Forms | System.Windows.Forms.MessageBox |
| mscorlib | System.ActivationContext |
| mscorlib | System.AppDomain |
| mscorlib | System.ApplicationId |
| mscorlib | System.Array |
| mscorlib | System.Attribute |
| mscorlib | System.Byte |
| mscorlib | System.Diagnostics.DebuggableAttribute |
| mscorlib | System.Diagnostics.DebuggableAttribute/DebuggingModes |
| mscorlib | System.Diagnostics.DebuggerNonUserCodeAttribute |
| mscorlib | System.Environment |
| mscorlib | System.Environment/SpecialFolder |
| mscorlib | System.Exception |
| mscorlib | System.Globalization.CultureInfo |
| mscorlib | System.IDisposable |
| mscorlib | System.IO.File |
| mscorlib | System.IO.FileAttributes |
| mscorlib | System.IO.FileInfo |
| mscorlib | System.IO.FileStream |
| mscorlib | System.IO.FileSystemInfo |
| mscorlib | System.IO.Path |
| mscorlib | System.IO.Stream |
| mscorlib | System.IO.StreamReader |
| mscorlib | System.IO.StreamWriter |
| mscorlib | System.IO.TextReader |
| mscorlib | System.IO.TextWriter |
| mscorlib | System.Int32 |
| mscorlib | System.Object |
| mscorlib | System.Reflection.Assembly |
| mscorlib | System.Reflection.AssemblyCompanyAttribute |
| mscorlib | System.Reflection.AssemblyConfigurationAttribute |
| mscorlib | System.Reflection.AssemblyCopyrightAttribute |
| mscorlib | System.Reflection.AssemblyCultureAttribute |
| mscorlib | System.Reflection.AssemblyDelaySignAttribute |
| mscorlib | System.Reflection.AssemblyDescriptionAttribute |
| mscorlib | System.Reflection.AssemblyKeyFileAttribute |
| mscorlib | System.Reflection.AssemblyKeyNameAttribute |
| mscorlib | System.Reflection.AssemblyName |
| mscorlib | System.Reflection.AssemblyProductAttribute |
| mscorlib | System.Reflection.AssemblyTitleAttribute |
| mscorlib | System.Reflection.AssemblyTrademarkAttribute |
| mscorlib | System.Reflection.AssemblyVersionAttribute |
| mscorlib | System.Resources.ResourceManager |
| mscorlib | System.Runtime.CompilerServices.CompilationRelaxationsAttribute |
| mscorlib | System.Runtime.CompilerServices.CompilerGeneratedAttribute |
| mscorlib | System.Runtime.CompilerServices.RuntimeCompatibilityAttribute |
| mscorlib | System.RuntimeTypeHandle |
| mscorlib | System.STAThreadAttribute |
| mscorlib | System.Security.AllowPartiallyTrustedCallersAttribute |
| mscorlib | System.Security.Policy.ApplicationSecurityInfo |
| mscorlib | System.String |
| mscorlib | System.Text.StringBuilder |
| mscorlib | System.Type |
| mscorlib | System.Version |
.text
`.rsrc
@.reloc
.text
`.data
.rsrc
2.0.50727.42
MK_S_HIM
MK_S_US
MK_S_MONIKERALREADYREGISTERED
MK_S_ME
OLEOBJ_S_INVALIDHWND
INPLACE_S_TRUNCATED
CONVERT10_S_NO_PRESENTATION
MK_S_REDUCED_TO_SELF
OLEOBJ_S_CANNOT_DOVERB_NOW
CACHE_S_FORMATETC_NOTSUPPORTED
CACHE_S_SAMECACHE
CACHE_S_SOMECACHES_NOTUPDATED
OLEOBJ_S_INVALIDVERB
VIEW_S_ALREADY_FROZEN
DRAGDROP_S_DROP
DRAGDROP_S_CANCEL
DRAGDROP_S_USEDEFAULTCURSORS
DATA_S_SAMEFORMATETC
OLE_S_MAC_CLIPFORMAT
S_FALSE
STG_S_CONVERTED
OLE_S_USEREG
OLE_S_STATIC
CTL_E_PRINTERERROR
CTL_E_CANTSAVEFILETOTEMP
CTL_E_SEARCHTEXTNOTFOUND
CTL_E_REPLACEMENTSTOOLONG
CTL_E_INVALIDPICTURE
CTL_E_GETNOTSUPPORTEDATRUNTIME
CTL_E_GETNOTSUPPORTED
CTL_E_PROPERTYNOTFOUND
CTL_E_INVALIDCLIPBOARDFORMAT
CTL_E_SETNOTPERMITTED
CTL_E_INVALIDPROPERTYARRAYINDEX
CTL_E_SETNOTSUPPORTEDATRUNTIME
CTL_E_SETNOTSUPPORTED
CTL_E_NEEDPROPERTYARRAYINDEX
CTL_E_INVALIDPROPERTYVALUE
CTL_E_INVALIDFILEFORMAT
CTL_E_INVALIDUSEOFNULL
CTL_E_INVALIDPATTERNSTRING
CTL_E_PATHNOTFOUND
CTL_E_PATHFILEACCESSERROR
CTL_E_DISKNOTREADY
CTL_E_PERMISSIONDENIED
CTL_E_DEVICEUNAVAILABLE
CTL_E_TOOMANYFILES
CTL_E_BADFILENAME
CTL_E_BADRECORDNUMBER
CTL_E_DISKFULL
CTL_E_BADRECORDLENGTH
CTL_E_FILEALREADYEXISTS
CTL_E_DEVICEIOERROR
CTL_E_FILEALREADYOPEN
CTL_E_BADFILEMODE
CTL_E_FILENOTFOUND
CTL_E_BADFILENAMEORNUMBER
CTL_E_OUTOFSTACKSPACE
CTL_E_OVERFLOW
CTL_E_OUTOFMEMORY
CTL_E_DIVISIONBYZERO
CTL_E_OUTOFSTRINGSPACE
CTL_E_ILLEGALFUNCTIONCALL
CO_E_SERVER_STOPPING
MEM_E_INVALID_ROOT
MEM_E_INVALID_LINK
MEM_E_INVALID_SIZE
MK_E_NO_NORMALIZED
CO_E_SCM_RPC_FAILURE
CO_E_BAD_PATH
CO_E_SERVER_EXEC_FAILURE
CO_E_OBJSRV_RPC_FAILURE
CO_E_SCM_ERROR
E_HANDLE
E_OUTOFMEMORY
E_INVALIDARG
CO_E_CLASS_CREATE_FAILED
E_ACCESSDENIED
CO_E_RELEASED
CO_E_APPDIDNTREG
CO_E_OBJNOTCONNECTED
CO_E_OBJISREG
CO_E_OBJNOTREG
CO_E_WRONGOSFORAPP
CO_E_ERRORINDLL
CO_E_DLLNOTFOUND
CO_E_ERRORINAPP
CO_E_APPSINGLEUSE
CO_E_APPNOTFOUND
CO_E_IIDSTRING
CO_E_CLASSSTRING
CO_E_CANTDETERMINECLASS
CO_E_ALREADYINITIALIZED
CO_E_NOTINITIALIZED
MK_E_ENUMERATION_FAILED
MK_E_NOPREFIX
MK_E_NOSTORAGE
MK_E_NOINVERSE
MK_E_MUSTBOTHERUSER
MK_E_CANTOPENFILE
MK_E_NOTBOUND
MK_E_NOTBINDABLE
MK_E_INTERMEDIATEINTERFACENOTSUPPORTED
MK_E_INVALIDEXTENSION
MK_E_NOOBJECT
MK_E_SYNTAX
MK_E_UNAVAILABLE
MK_E_NEEDGENERIC
MK_E_EXCEEDEDDEADLINE
MK_E_CONNECTMANUALLY
CLIPBRD_E_CANT_CLOSE
CONVERT10_E_STG_DIB_TO_BITMAP
CLIPBRD_E_CANT_OPEN
CLIPBRD_E_CANT_EMPTY
CLIPBRD_E_CANT_SET
CLIPBRD_E_BAD_DATA
CONVERT10_E_STG_NO_STD_STREAM
INPLACE_E_NOTOOLSPACE
CONVERT10_E_OLESTREAM_GET
CONVERT10_E_OLESTREAM_PUT
CONVERT10_E_OLESTREAM_FMT
CONVERT10_E_OLESTREAM_BITMAP_TO_DIB
CONVERT10_E_STG_FMT
INPLACE_E_NOTUNDOABLE
REGDB_E_KEYMISSING
REGDB_E_INVALIDVALUE
REGDB_E_CLASSNOTREG
CACHE_E_NOCACHE_UPDATED
OLEOBJ_E_NOVERBS
REGDB_E_WRITEREGDB
DRAGDROP_E_ALREADYREGISTERED
DRAGDROP_E_INVALIDHWND
CLASS_E_NOAGGREGATION
CLASS_E_CLASSNOTAVAILABLE
VIEW_E_DRAW
REGDB_E_READREGDB
DRAGDROP_E_NOTREGISTERED
DV_E_NOIVIEWOBJECT
DV_E_DVTARGETDEVICE_SIZE
DV_E_DVASPECT
DV_E_CLIPFORMAT
DV_E_TYMED
DV_E_LINDEX
DV_E_STATDATA
DV_E_STGMEDIUM
DV_E_DVTARGETDEVICE
DV_E_FORMATETC
OLE_E_NOSTORAGE
OLE_E_CANTCONVERT
OLE_E_NOT_INPLACEACTIVE
OLE_E_INVALIDHWND
OLE_E_WRONGCOMPOBJ
OLE_E_INVALIDRECT
OLE_E_PROMPTSAVECANCELLED
OLE_E_STATIC
OLE_E_CANT_BINDTOSOURCE
OLE_E_CANT_GETMONIKER
OLE_E_CLASSDIFF
OLE_E_BLANK
OLE_E_NOCACHE
OLE_E_NOTRUNNING
OLE_E_NOCONNECTION
OLE_E_ADVISENOTSUPPORTED
OLE_E_ENUM_NOMORE
OLE_E_ADVF
OLE_E_OLEVERB
STG_E_NOTFILEBASEDSTORAGE
STG_E_SHAREREQUIRED
STG_E_OLDDLL
STG_E_OLDFORMAT
STG_E_CANTSAVE
STG_E_REVERTED
STG_E_NOTCURRENT
STG_E_INUSE
STG_E_INVALIDFLAG
STG_E_UNIMPLEMENTEDFUNCTION
STG_E_UNKNOWN
STG_E_INVALIDNAME
STG_E_INVALIDHEADER
STG_E_ABNORMALAPIEXIT
STG_E_MEDIUMFULL
STG_E_WRITEFAULT
STG_E_READFAULT
STG_E_SHAREVIOLATION
STG_E_LOCKVIOLATION
STG_E_FILEALREADYEXISTS
STG_E_INVALIDPARAMETER
STG_E_SEEKERROR
STG_E_ACCESSDENIED
STG_E_INVALIDHANDLE
STG_E_INSUFFICIENTMEMORY
STG_E_INVALIDPOINTER
STG_E_NOMOREFILES
STG_E_DISKISWRITEPROTECTED
STG_E_TOOMANYOPENFILES
TYPE_E_CANTLOADLIBRARY
TYPE_E_INCONSISTENTPROPFUNCS
TYPE_E_CIRCULARTYPE
STG_E_INVALIDFUNCTION
STG_E_FILENOTFOUND
STG_E_PATHNOTFOUND
TYPE_E_CANTCREATETMPFILE
TYPE_E_SIZETOOBIG
TYPE_E_DUPLICATEID
TYPE_E_INVALIDID
TYPE_E_TYPEMISMATCH
TYPE_E_OUTOFBOUNDS
TYPE_E_IOERROR
TYPE_E_BADMODULEKIND
TYPE_E_DLLFUNCTIONNOTFOUND
TYPE_E_UNKNOWNLCID
TYPE_E_NAMECONFLICT
TYPE_E_AMBIGUOUSNAME
TYPE_E_ELEMENTNOTFOUND
TYPE_E_WRONGTYPEKIND
TYPE_E_INVALIDSTATE
TYPE_E_QUALIFIEDNAMEDISALLOWED
TYPE_E_UNDEFINEDTYPE
TYPE_E_LIBNOTREGISTERED
TYPE_E_REGISTRYACCESS
TYPE_E_UNSUPFORMAT
TYPE_E_INVDATAREAD
TYPE_E_BUFFERTOOSMALL
DISP_E_NOTACOLLECTION
DISP_E_BADCALLEE
DISP_E_PARAMNOTOPTIONAL
DISP_E_BADPARAMCOUNT
DISP_E_ARRAYISLOCKED
DISP_E_UNKNOWNLCID
DISP_E_BADINDEX
DISP_E_OVERFLOW
DISP_E_EXCEPTION
DISP_E_BADVARTYPE
DISP_E_NONAMEDARGS
DISP_E_UNKNOWNNAME
DISP_E_TYPEMISMATCH
DISP_E_PARAMNOTFOUND
DISP_E_MEMBERNOTFOUND
DISP_E_UNKNOWNINTERFACE
RPC_E_UNEXPECTED
RPC_E_THREAD_NOT_INIT
RPC_E_WRONG_THREAD
RPC_E_CANTCALLOUT_ININPUTSYNCCALL
RPC_E_INVALID_CALLDATA
RPC_E_SERVERCALL_REJECTED
RPC_E_SERVERCALL_RETRYLATER
RPC_E_RETRY
RPC_E_DISCONNECTED
RPC_E_INVALIDMETHOD
RPC_E_CHANGED_MODE
RPC_E_SERVERFAULT
RPC_E_FAULT
RPC_E_NOT_REGISTERED
RPC_E_ATTEMPTED_MULTITHREAD
RPC_E_OUT_OF_RESOURCES
RPC_E_SYS_CALL_FAILED
RPC_E_SERVER_DIED_DNE
RPC_E_CANTCALLOUT_AGAIN
RPC_E_INVALID_PARAMETER
RPC_E_INVALID_DATA
RPC_E_SERVER_CANTUNMARSHAL_DATA
RPC_E_SERVER_CANTMARSHAL_DATA
RPC_E_CLIENT_CANTUNMARSHAL_DATA
RPC_E_CLIENT_CANTMARSHAL_DATA
RPC_E_CANTTRANSMIT_CALL
RPC_E_INVALID_DATAPACKET
RPC_E_CLIENT_DIED
RPC_E_SERVER_DIED
RPC_E_CONNECTION_TERMINATED
RPC_E_CANTCALLOUT_INEXTERNALCALL
RPC_E_CANTCALLOUT_INASYNCCALL
RPC_E_CANTPOST_INSENDCALL
RPC_E_CALL_CANCELED
RPC_E_CALL_REJECTED
E_UNEXPECTED
CO_E_INIT_ONLY_SINGLE_THREADED
CO_E_INIT_SCM_EXEC_FAILURE
CO_E_INIT_SCM_MAP_VIEW_OF_FILE
CO_E_INIT_SCM_FILE_MAPPING_EXISTS
CO_E_INIT_SCM_MUTEX_EXISTS
CO_E_INIT_UNACCEPTED_USER_ALLOCATOR
CO_E_INIT_TLS_CHANNEL_CONTROL
CO_E_INIT_TLS_SET_CHANNEL_CONTROL
CO_E_INIT_RPC_CHANNEL
CO_E_INIT_CLASS_CACHE
CO_E_INIT_MEMORY_ALLOCATOR
CO_E_INIT_SHARED_ALLOCATOR
CO_E_INIT_TLS
E_FAIL
E_ABORT
E_POINTER
E_NOINTERFACE
E_NOTIMPL
Unknown exception
Out Of Memory
rSOFTWARE
<Unknown>
rABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
CCompRC
CorFlags.pdb
WhP1@
Ph RHh$1@
PPPPPPPPPPh
t#h 5@
PjAQQhL5@
Shd5@
GetRequestedRuntimeInfo
mscoree.dll
__CxxFrameHandler3
printf
wprintf
_CxxThrowException
_wcslwr_s
memset
_purecall
memcpy
memmove
wcscpy_s
wcsncpy_s
strcpy_s
_errno
_vsnprintf_s
_vsnwprintf_s
strncmp
strchr
malloc
wcscat_s
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
MSVCR80.dll
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_invoke_watson
_controlfp_s
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
RegCloseKey
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
CloseHandle
UnmapViewOfFile
GetFileSize
MapViewOfFile
GetModuleHandleA
TlsGetValue
InterlockedCompareExchange
GetLastError
SetLastError
FreeLibrary
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
LocalFree
MultiByteToWideChar
GetCPInfo
GetVersionExA
WideCharToMultiByte
lstrlenW
TerminateProcess
GetCurrentProcess
LoadLibraryExA
LoadLibraryExW
GetModuleFileNameA
GetModuleFileNameW
RaiseException
CreateFileA
CreateFileW
CreateSemaphoreA
CreateSemaphoreW
CreateMutexA
CreateMutexW
CreateEventA
CreateEventW
CreateFileMappingA
CreateFileMappingW
GetCurrentProcessId
LocalAlloc
FormatMessageA
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
TlsSetValue
TlsAlloc
TlsFree
HeapAlloc
GetProcessHeap
HeapFree
WaitForSingleObjectEx
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
InterlockedExchange
Sleep
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
KERNEL32.dll
LoadStringA
LoadStringW
USER32.dll
.PAVException@@
.PAVHRException@@
v1.0.3705
retail
COMPLUS
.?AVtype_info@@
End function
v2.0.50727
#Strings
#GUID
#Blob
<Module>
Polycom Management Application 8.7.5.exe
Program
EMA.Utils.ClickOnce
Settings
EMA.Utils.ClickOnce.Properties
Resources
mscorlib
System
Object
System.Configuration
ApplicationSettingsBase
CreateUninstallShortCut
GetPublicKeyToken
RemovingVersionFromCabAtConfig
prepareVariablesForVBScript
writeVbsFile
Is64bitOS
mRecreateAllExecutableResources
changePEHeader32bit
defaultInstance
get_Default
.ctor
Default
System.Resources
ResourceManager
resourceMan
System.Globalization
CultureInfo
resourceCulture
get_ResourceManager
get_Culture
set_Culture
get_VBS_CODE
Culture
VBS_CODE
productName
vbsVariables
fullpathScript
value
System.Reflection
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyConfigurationAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
AssemblyCultureAttribute
System.Security
AllowPartiallyTrustedCallersAttribute
AssemblyVersionAttribute
AssemblyDelaySignAttribute
AssemblyKeyNameAttribute
AssemblyKeyFileAttribute
System.Diagnostics
DebuggableAttribute
DebuggingModes
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
Polycom Management Application 8.7.5
STAThreadAttribute
System.Windows.Forms
Application
EnableVisualStyles
SetCompatibleTextRenderingDefault
System.Deployment
System.Deployment.Application
ApplicationDeployment
get_CurrentDeployment
String
Empty
get_ActivationUri
op_Inequality
get_Query
Exception
get_Message
Concat
EventLog
WriteEntry
get_IsFirstRun
Process
Start
Assembly
GetExecutingAssembly
AssemblyName
GetName
Version
get_Version
ToString
RuntimeTypeHandle
GetTypeFromHandle
Attribute
IsDefined
GetCustomAttribute
get_Company
get_Major
Int32
get_Minor
Format
AppDomain
get_CurrentDomain
ActivationContext
get_ActivationContext
System.Security.Policy
ApplicationSecurityInfo
ApplicationId
get_ApplicationId
get_PublicKeyToken
System.Text
StringBuilder
Append
Array
GetLength
Environment
get_CurrentDirectory
System.IO
FileInfo
FileSystemInfo
FileAttributes
set_Attributes
StreamReader
OpenText
TextReader
ReadToEnd
Close
IDisposable
Dispose
IndexOf
get_Length
Substring
Replace
StreamWriter
CreateText
TextWriter
Write
GetEnvironmentVariable
Combine
Exists
SpecialFolder
GetFolderPath
get_BaseDirectory
ProcessStartInfo
ProcessWindowStyle
set_WindowStyle
set_Arguments
set_FileName
WriteLine
GetManifestResourceNames
EndsWith
get_Exists
FileStream
OpenWrite
Stream
GetManifestResourceStream
MessageBox
DialogResult
set_WorkingDirectory
WaitForExit
CompilerGeneratedAttribute
System.CodeDom.Compiler
GeneratedCodeAttribute
.cctor
SettingsBase
Synchronized
DebuggerNonUserCodeAttribute
ReferenceEquals
get_Assembly
GetString
System.ComponentModel
EditorBrowsableAttribute
EditorBrowsableState
EMA.Utils.ClickOnce.CorFlags.exe
EMA.Utils.ClickOnce.Properties.Resources.resources
10.0.0.0
4.0.0.0
EMA ClickOnce
Polycom Inc.
Carmel
Copyright(c) Polycom, Inc.
C:\build-views\Official\SVN_Main\workspace\EMA_8.7.5\EMA\MIG\EMA\EMA.Utils\EMA.Utils.ClickOnce\obj\Release\Polycom Management Application 8.7.5.pdb
_CorExeMain
mscoree.dll
CF000
-help
/help
-nologo
/nologo
-revertclrheader
/revertclrheader
-upgradeclrheader
/upgradeclrheader
-force
/force
-32bit-
/32bit-
-32bit+
/32bit+
-ilonly-
/ilonly-
-ilonly+
/ilonly+
CF010
CF009
CF008
CF007
CF006
CF005
CF004
CF003
CF002
CF001
PE32+
CF011
CF014
CF013
CF012
Copyright (c) Microsoft Corporation. All rights reserved.
(%S)
0x%.8X
SOFTWARE
SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
Debugger
DisableConfigCache
mscorrc.dll
v2.0.50727
retail
COMPLUS
@Microsoft (R) .NET Framework CorFlags Conversion Tool. Version
Options:
/ILONLY+ /ILONLY- Sets/clears the ILONLY flag
/32BIT+ /32BIT- Sets/clears the 32BIT flag
/UpgradeCLRHeader Upgrade the CLR Header to version 2.5
/RevertCLRHeader Revert the CLR Header to version 2.0
/Force Force an assembly update even if the image is
strong name signed.
WARNING: Updating a strong name signed assembly
will require the assembly to be resigned before
it will execute properly.
/nologo Prevents corflags from displaying logo
/? or /help Display this usage message
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
Microsoft Common Language Runtime Agnostic Assembly Conversion Tool
FileVersion
2.0.50727.42 (RTM.050727-4200)
InternalName
CorFlags.exe
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
CorFlags.exe
ProductName
.NET Framework
ProductVersion
2.0.50727.42
Comments
Flavor=Retail
VarFileInfo
Translation
VBS_CODE
VBS_CODE
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
CompanyName
Polycom Inc.
FileDescription
EMA ClickOnce
FileVersion
8.7.5.1
InternalName
Polycom Management Application 8.7.5.exe
LegalCopyright
Copyright(c) Polycom, Inc.
OriginalFilename
Polycom Management Application 8.7.5.exe
ProductName
Carmel
ProductVersion
8.7.5.1
Assembly Version
8.7.5.1
| 防病毒引擎/厂商 | 病毒名/规则匹配 | 病毒库日期 |
|---|---|---|
| Bkav | 未发现病毒 | 20200415 |
| MicroWorld-eScan | 未发现病毒 | 20200415 |
| FireEye | 未发现病毒 | 20200316 |
| CAT-QuickHeal | 未发现病毒 | 20200415 |
| Qihoo-360 | 未发现病毒 | 20200415 |
| ALYac | 未发现病毒 | 20200415 |
| Cylance | 未发现病毒 | 20200415 |
| Zillya | 未发现病毒 | 20200415 |
| SUPERAntiSpyware | 未发现病毒 | 20200415 |
| Sangfor | 未发现病毒 | 20200412 |
| K7AntiVirus | 未发现病毒 | 20200407 |
| Alibaba | 未发现病毒 | 20190527 |
| K7GW | 未发现病毒 | 20200415 |
| Cybereason | malicious.83744d | 20190616 |
| Arcabit | 未发现病毒 | 20200415 |
| TrendMicro | 未发现病毒 | 20200415 |
| BitDefenderTheta | 未发现病毒 | 20200408 |
| F-Prot | 未发现病毒 | 20200415 |
| Symantec | 未发现病毒 | 20200415 |
| TotalDefense | 未发现病毒 | 20200415 |
| Baidu | 未发现病毒 | 20190318 |
| APEX | Malicious | 20200413 |
| Avast | 未发现病毒 | 20200415 |
| ClamAV | 未发现病毒 | 20200415 |
| GData | 未发现病毒 | 20200415 |
| Kaspersky | 未发现病毒 | 20200415 |
| BitDefender | 未发现病毒 | 20200415 |
| NANO-Antivirus | 未发现病毒 | 20200415 |
| AegisLab | 未发现病毒 | 20200415 |
| Rising | 未发现病毒 | 20200415 |
| Ad-Aware | 未发现病毒 | 20200415 |
| Sophos | 未发现病毒 | 20200415 |
| Comodo | 未发现病毒 | 20200415 |
| F-Secure | 未发现病毒 | 20200415 |
| DrWeb | 未发现病毒 | 20200415 |
| VIPRE | 未发现病毒 | 20200415 |
| Invincea | 未发现病毒 | 20200407 |
| McAfee-GW-Edition | 未发现病毒 | 20200415 |
| Trapmine | 未发现病毒 | 20200123 |
| CMC | 未发现病毒 | 20190321 |
| Emsisoft | 未发现病毒 | 20200415 |
| Paloalto | 未发现病毒 | 20200415 |
| Cyren | 未发现病毒 | 20200415 |
| Jiangmin | 未发现病毒 | 20200415 |
| Webroot | 未发现病毒 | 20200415 |
| Avira | 未发现病毒 | 20200415 |
| Antiy-AVL | 未发现病毒 | 20200415 |
| Kingsoft | 未发现病毒 | 20200415 |
| Microsoft | 未发现病毒 | 20200415 |
| Endgame | 未发现病毒 | 20200226 |
| ViRobot | 未发现病毒 | 20200415 |
| ZoneAlarm | 未发现病毒 | 20200415 |
| Avast-Mobile | 未发现病毒 | 20200415 |
| TACHYON | 未发现病毒 | 20200415 |
| AhnLab-V3 | 未发现病毒 | 20200415 |
| Acronis | 未发现病毒 | 20200409 |
| McAfee | 未发现病毒 | 20200415 |
| MAX | 未发现病毒 | 20200415 |
| VBA32 | 未发现病毒 | 20200415 |
| Malwarebytes | 未发现病毒 | 20200415 |
| Zoner | 未发现病毒 | 20200414 |
| ESET-NOD32 | 未发现病毒 | 20200415 |
| TrendMicro-HouseCall | 未发现病毒 | 20200415 |
| Tencent | 未发现病毒 | 20200415 |
| Yandex | 未发现病毒 | 20200415 |
| SentinelOne | 未发现病毒 | 20200406 |
| eGambit | 未发现病毒 | 20200415 |
| Fortinet | 未发现病毒 | 20200415 |
| AVG | 未发现病毒 | 20200415 |
| Panda | 未发现病毒 | 20200415 |
| CrowdStrike | 未发现病毒 | 20190702 |
| MaxSecure | 未发现病毒 | 20200415 |
进程树
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49160 | 23.206.195.113 acroipm.adobe.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 59401 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| acroipm.adobe.com |
CNAME acroipm.adobe.com.edgesuite.net CNAME a1983.dscd.akamai.net A 23.206.195.113 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49160 | 23.206.195.113 acroipm.adobe.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 59401 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip | GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 14.288 seconds )
- 10.601 Suricata
- 1.427 VirusTotal
- 0.764 NetworkAnalysis
- 0.505 Static
- 0.286 peid
- 0.272 BehaviorAnalysis
- 0.239 TargetInfo
- 0.163 static_dotnet
- 0.019 Strings
- 0.01 AnalysisInfo
- 0.002 Memory
Signatures ( 1.491 seconds )
- 1.285 md_url_bl
- 0.031 antiav_detectreg
- 0.018 infostealer_ftp
- 0.015 api_spamming
- 0.011 stealth_decoy_document
- 0.011 stealth_timeout
- 0.01 antiav_detectfile
- 0.01 md_domain_bl
- 0.008 infostealer_im
- 0.006 antianalysis_detectreg
- 0.006 infostealer_bitcoin
- 0.005 anomaly_persistence_autorun
- 0.005 infostealer_mail
- 0.004 antivm_vbox_files
- 0.004 geodo_banking_trojan
- 0.004 ransomware_files
- 0.003 network_http
- 0.003 ransomware_extensions
- 0.002 tinba_behavior
- 0.002 antiemu_wine_func
- 0.002 mimics_filetime
- 0.002 injection_createremotethread
- 0.002 betabot_behavior
- 0.002 kibex_behavior
- 0.002 antivm_generic_scsi
- 0.002 infostealer_browser_password
- 0.002 kovter_behavior
- 0.002 disables_browser_warn
- 0.002 network_torgateway
- 0.001 hawkeye_behavior
- 0.001 network_tor
- 0.001 antivm_vbox_libs
- 0.001 bootkit
- 0.001 rat_nanocore
- 0.001 stealth_file
- 0.001 maldun_anomaly_massive_file_ops
- 0.001 antivm_generic_services
- 0.001 reads_self
- 0.001 shifu_behavior
- 0.001 antivm_generic_disk
- 0.001 anormaly_invoke_kills
- 0.001 cerber_behavior
- 0.001 injection_runpe
- 0.001 virus
- 0.001 hancitor_behavior
- 0.001 antidbg_devices
- 0.001 antivm_generic_diskreg
- 0.001 antivm_parallels_keys
- 0.001 antivm_xen_keys
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_security
- 0.001 modify_proxy
- 0.001 darkcomet_regkeys
- 0.001 maldun_malicious_drop_executable_file_to_temp_folder
- 0.001 md_bad_drop
- 0.001 network_cnc_http
- 0.001 rat_pcclient
- 0.001 recon_fingerprint
Reporting ( 0.472 seconds )
- 0.469 ReportHTMLSummary
- 0.003 Malheur
| Task ID | 577647 |
|---|---|
| Mongo ID | 5f6da5a37e769a53cfc22197 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号