分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-hpdapp01-1 | 2020-09-25 21:35:50 | 2020-09-25 21:38:12 | 142 秒 |
魔盾分数
10.0
危险的
文件详细信息
| 文件名 | 查好友And设备v3.6.0破解_.exe |
|---|---|
| 文件大小 | 935603 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5 | 55e629cb320955a2fae7f0619816f3f5 |
| SHA1 | cced7872113d46d77f44edff460d2d57c03a4bba |
| SHA256 | eefaf7042ae3a1775311c1651ff76cf275624536ef9164f53e0c25f4296573b7 |
| SHA512 | 07eeec985a422b6c25e95f35f93c2db7c92e87b58e41874db7437259b0139196cf072e8e9ed0a681e232403857103957709e1adb9ed983e6438ed1c1c6be644c |
| CRC32 | 8028707C |
| Ssdeep | 24576:8MeQa2CsHfEcMOUEkK/SWwsqD88uECDNQpdkKVH95mi6x:8JQa2CAfeRE6WiDnuE5XB95mi6x |
| Yara | 登录查看Yara规则 |
| 样本下载 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| acroipm.adobe.com |
A 23.219.38.64 CNAME acroipm.adobe.com.edgesuite.net CNAME a1983.dscd.akamai.net A 23.219.38.35 |
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x004030b4 |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x000f3c61 |
| 最低操作系统版本要求 | 4.0 |
| 编译时间 | 2008-05-03 22:08:38 |
| 载入哈希 | 7fa974366048f9c551ef45714595665e |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x000057aa | 0x00005800 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.46 |
| .rdata | 0x00007000 | 0x00001190 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.18 |
| .data | 0x00009000 | 0x0001af58 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.59 |
| .ndata | 0x00024000 | 0x00041000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .rsrc | 0x00065000 | 0x00004000 | 0x00003200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.63 |
覆盖
| 偏移量 | 0x00069000 |
| 大小 | 0x0007b6b3 |
导入
库: KERNEL32.dll:
• 0x407060 CompareFileTime
• 0x407064 SearchPathA
• 0x407068 GetShortPathNameA
• 0x40706c GetFullPathNameA
• 0x407070 MoveFileA
• 0x407074 SetCurrentDirectoryA
• 0x407078 GetFileAttributesA
• 0x40707c GetLastError
• 0x407080 CreateDirectoryA
• 0x407084 SetFileAttributesA
• 0x407088 Sleep
• 0x40708c GetTickCount
• 0x407090 GetFileSize
• 0x407094 GetModuleFileNameA
• 0x407098 GetCurrentProcess
• 0x40709c CopyFileA
• 0x4070a0 ExitProcess
• 0x4070a4 GetWindowsDirectoryA
• 0x4070a8 SetFileTime
• 0x4070ac GetCommandLineA
• 0x4070b0 SetErrorMode
• 0x4070b4 LoadLibraryA
• 0x4070b8 lstrcpynA
• 0x4070bc GetDiskFreeSpaceA
• 0x4070c0 GlobalUnlock
• 0x4070c4 GlobalLock
• 0x4070c8 CreateThread
• 0x4070cc CreateProcessA
• 0x4070d0 RemoveDirectoryA
• 0x4070d4 CreateFileA
• 0x4070d8 GetTempFileNameA
• 0x4070dc lstrlenA
• 0x4070e0 lstrcatA
• 0x4070e4 GetSystemDirectoryA
• 0x4070e8 GetVersion
• 0x4070ec CloseHandle
• 0x4070f0 lstrcmpiA
• 0x4070f4 lstrcmpA
• 0x4070f8 ExpandEnvironmentStringsA
• 0x4070fc GlobalFree
• 0x407100 GlobalAlloc
• 0x407104 WaitForSingleObject
• 0x407108 GetExitCodeProcess
• 0x40710c GetModuleHandleA
• 0x407110 LoadLibraryExA
• 0x407114 GetProcAddress
• 0x407118 FreeLibrary
• 0x40711c MultiByteToWideChar
• 0x407120 WritePrivateProfileStringA
• 0x407124 GetPrivateProfileStringA
• 0x407128 WriteFile
• 0x40712c ReadFile
• 0x407130 MulDiv
• 0x407134 SetFilePointer
• 0x407138 FindClose
• 0x40713c FindNextFileA
• 0x407140 FindFirstFileA
• 0x407144 DeleteFileA
• 0x407148 GetTempPathA
库: USER32.dll:
• 0x40716c EndDialog
• 0x407170 ScreenToClient
• 0x407174 GetWindowRect
• 0x407178 EnableMenuItem
• 0x40717c GetSystemMenu
• 0x407180 SetClassLongA
• 0x407184 IsWindowEnabled
• 0x407188 SetWindowPos
• 0x40718c GetSysColor
• 0x407190 GetWindowLongA
• 0x407194 SetCursor
• 0x407198 LoadCursorA
• 0x40719c CheckDlgButton
• 0x4071a0 GetMessagePos
• 0x4071a4 LoadBitmapA
• 0x4071a8 CallWindowProcA
• 0x4071ac IsWindowVisible
• 0x4071b0 CloseClipboard
• 0x4071b4 SetClipboardData
• 0x4071b8 EmptyClipboard
• 0x4071bc RegisterClassA
• 0x4071c0 TrackPopupMenu
• 0x4071c4 AppendMenuA
• 0x4071c8 CreatePopupMenu
• 0x4071cc GetSystemMetrics
• 0x4071d0 SetDlgItemTextA
• 0x4071d4 GetDlgItemTextA
• 0x4071d8 MessageBoxIndirectA
• 0x4071dc CharPrevA
• 0x4071e0 DispatchMessageA
• 0x4071e4 PeekMessageA
• 0x4071e8 DestroyWindow
• 0x4071ec CreateDialogParamA
• 0x4071f0 SetTimer
• 0x4071f4 SetWindowTextA
• 0x4071f8 PostQuitMessage
• 0x4071fc SetForegroundWindow
• 0x407200 wsprintfA
• 0x407204 SendMessageTimeoutA
• 0x407208 FindWindowExA
• 0x40720c SystemParametersInfoA
• 0x407210 CreateWindowExA
• 0x407214 GetClassInfoA
• 0x407218 DialogBoxParamA
• 0x40721c CharNextA
• 0x407220 OpenClipboard
• 0x407224 ExitWindowsEx
• 0x407228 IsWindow
• 0x40722c GetDlgItem
• 0x407230 SetWindowLongA
• 0x407234 LoadImageA
• 0x407238 GetDC
• 0x40723c EnableWindow
• 0x407240 InvalidateRect
• 0x407244 SendMessageA
• 0x407248 DefWindowProcA
• 0x40724c BeginPaint
• 0x407250 GetClientRect
• 0x407254 FillRect
• 0x407258 DrawTextA
• 0x40725c EndPaint
• 0x407260 ShowWindow
库: GDI32.dll:
• 0x40703c SetBkColor
• 0x407040 GetDeviceCaps
• 0x407044 DeleteObject
• 0x407048 CreateBrushIndirect
• 0x40704c CreateFontIndirectA
• 0x407050 SetBkMode
• 0x407054 SetTextColor
• 0x407058 SelectObject
库: SHELL32.dll:
• 0x407150 SHGetPathFromIDListA
• 0x407154 SHBrowseForFolderA
• 0x407158 SHGetFileInfoA
• 0x40715c ShellExecuteA
• 0x407160 SHFileOperationA
• 0x407164 SHGetSpecialFolderLocation
库: ADVAPI32.dll:
• 0x407000 RegQueryValueExA
• 0x407004 RegSetValueExA
• 0x407008 RegEnumKeyA
• 0x40700c RegEnumValueA
• 0x407010 RegOpenKeyExA
• 0x407014 RegDeleteKeyA
• 0x407018 RegDeleteValueA
• 0x40701c RegCloseKey
• 0x407020 RegCreateKeyExA
库: COMCTL32.dll:
• 0x407028 ImageList_AddMasked
• 0x40702c ImageList_Destroy
• 0x407030 None
• 0x407034 ImageList_Create
库: ole32.dll:
• 0x407278 CoTaskMemFree
• 0x40727c OleInitialize
• 0x407280 OleUninitialize
• 0x407284 CoCreateInstance
库: VERSION.dll:
• 0x407268 GetFileVersionInfoSizeA
• 0x40726c GetFileVersionInfoA
• 0x407270 VerQueryValueA
.text
`.rdata
@.data
.ndata
.rsrc
Phts@
Vh-+@
9-,6B
9-,6B
9-,6B
9-86B
Ph*M@
RichEdit
RichEdit20A
RichEd32
RichEd20
.DEFAULT\Control Panel\International
Control Panel\Desktop\ResourceLocale
Software\Microsoft\Windows\CurrentVersion
\Microsoft\Internet Explorer\Quick Launch
MulDiv
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
ReadFile
WriteFile
GetPrivateProfileStringA
WritePrivateProfileStringA
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
lstrcmpA
lstrcmpiA
CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
KERNEL32.dll
EndPaint
DrawTextA
FillRect
GetClientRect
BeginPaint
DefWindowProcA
SendMessageA
InvalidateRect
EnableWindow
GetDC
LoadImageA
SetWindowLongA
GetDlgItem
IsWindow
FindWindowExA
SendMessageTimeoutA
wsprintfA
ShowWindow
SetForegroundWindow
PostQuitMessage
SetWindowTextA
SetTimer
CreateDialogParamA
DestroyWindow
ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
USER32.dll
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
GDI32.dll
SHFileOperationA
ShellExecuteA
SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHELL32.dll
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
ADVAPI32.dll
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
COMCTL32.dll
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
ole32.dll
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VERSION.dll
verifying installer: %d%%
http://nsis.sf.net/NSIS_Error
Error launching installer
... %d%%
SeShutdownPrivilege
~nsu.tmp
\Temp
NSIS Error
Error writing temporary file. Make sure your temp folder is valid.
%u.%u%s%s
SHGetFolderPathA
SHFOLDER
SHAutoComplete
SHLWAPI
GetUserDefaultUILanguage
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyExA
ADVAPI32
MoveFileExA
GetDiskFreeSpaceExA
KERNEL32
*?|<>/":
NullsoftInstT'
BPDO[ S
}B*%R
MS Shell Dlg
MS Shell Dlg
msctls_progress32
SysListView32
MS Shell Dlg
进程树
-
_________And______v3.6.0_______.exe id: 2412
- svchost-8888.exe id: 2620
- 查好友And设备v3.6.0破解.exe id: 2676
-
services.exe id: 428
-
Skcsk.exe id: 2952
- Skcsk.exe id: 1980
- taskhost.exe id: 2452
-
wsqmcons.exe id: 2992
- schtasks.exe id: 2560
-
Skcsk.exe id: 2952
_________And______v3.6.0_______.exe, PID: 2412, 上一级进程 PID: 2168
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49169 | 103.45.107.99 | 8888 |
| 192.168.122.201 | 49158 | 23.219.38.35 acroipm.adobe.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 63282 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| acroipm.adobe.com |
A 23.219.38.64 CNAME acroipm.adobe.com.edgesuite.net CNAME a1983.dscd.akamai.net A 23.219.38.35 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49169 | 103.45.107.99 | 8888 |
| 192.168.122.201 | 49158 | 23.219.38.35 acroipm.adobe.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 63282 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip | GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 23.468 seconds )
- 15.514 Suricata
- 2.956 Static
- 2.674 BehaviorAnalysis
- 1.172 NetworkAnalysis
- 0.567 TargetInfo
- 0.426 peid
- 0.135 AnalysisInfo
- 0.019 Strings
- 0.003 Memory
- 0.002 config_decoder
Signatures ( 3.086 seconds )
- 1.846 md_url_bl
- 0.146 api_spamming
- 0.122 stealth_timeout
- 0.108 stealth_decoy_document
- 0.105 antiav_detectreg
- 0.041 infostealer_ftp
- 0.035 stealth_file
- 0.032 injection_createremotethread
- 0.025 kovter_behavior
- 0.024 mimics_filetime
- 0.024 virus
- 0.023 process_interest
- 0.023 reads_self
- 0.023 infostealer_im
- 0.022 antiemu_wine_func
- 0.022 infostealer_browser_password
- 0.022 antianalysis_detectreg
- 0.022 md_domain_bl
- 0.021 vawtrak_behavior
- 0.021 injection_runpe
- 0.02 bootkit
- 0.02 antivm_generic_disk
- 0.015 hancitor_behavior
- 0.015 antiav_detectfile
- 0.014 infostealer_mail
- 0.013 process_needed
- 0.012 antivm_generic_scsi
- 0.01 anomaly_persistence_autorun
- 0.01 infostealer_bitcoin
- 0.009 antivm_vbox_libs
- 0.009 antiav_avast_libs
- 0.009 antisandbox_sleep
- 0.009 antisandbox_sunbelt_libs
- 0.009 geodo_banking_trojan
- 0.007 betabot_behavior
- 0.007 antisandbox_sboxie_libs
- 0.007 antiav_bitdefender_libs
- 0.007 ransomware_extensions
- 0.006 kibex_behavior
- 0.006 antivm_vbox_files
- 0.006 ransomware_files
- 0.005 antivm_generic_services
- 0.005 exec_crash
- 0.005 antivm_parallels_keys
- 0.005 antivm_xen_keys
- 0.005 darkcomet_regkeys
- 0.005 network_http
- 0.004 infostealer_browser
- 0.004 sets_autoconfig_url
- 0.004 shifu_behavior
- 0.004 antidbg_windows
- 0.004 anormaly_invoke_kills
- 0.004 antivm_generic_diskreg
- 0.004 recon_fingerprint
- 0.003 tinba_behavior
- 0.003 andromeda_behavior
- 0.003 maldun_malicious_write_executeable_under_temp_to_regrun
- 0.003 maldun_anomaly_write_exe_and_obsfucate_extension
- 0.003 maldun_anomaly_massive_file_ops
- 0.003 injection_explorer
- 0.003 ipc_namedpipe
- 0.003 securityxploded_modules
- 0.003 antisandbox_productid
- 0.003 disables_browser_warn
- 0.003 network_torgateway
- 0.002 network_tor
- 0.002 rat_nanocore
- 0.002 dridex_behavior
- 0.002 antivm_vmware_libs
- 0.002 ransomware_message
- 0.002 Locky_behavior
- 0.002 antivm_vmware_events
- 0.002 cerber_behavior
- 0.002 bypass_firewall
- 0.002 antidbg_devices
- 0.002 antivm_hyperv_keys
- 0.002 antivm_vbox_keys
- 0.002 antivm_vmware_keys
- 0.002 antivm_vpc_keys
- 0.002 browser_security
- 0.002 modify_proxy
- 0.002 maldun_malicious_drop_executable_file_to_temp_folder
- 0.002 maldun_anomaly_invoke_vb_vba
- 0.002 md_bad_drop
- 0.002 network_cnc_http
- 0.001 hawkeye_behavior
- 0.001 disables_spdy
- 0.001 office_dl_write_exe
- 0.001 ursnif_behavior
- 0.001 kazybot_behavior
- 0.001 maldun_anomaly_write_exe_and_dll_under_winroot_run
- 0.001 disables_wfp
- 0.001 cryptowall_behavior
- 0.001 antianalysis_detectfile
- 0.001 antivm_generic_bios
- 0.001 antivm_generic_cpu
- 0.001 antivm_generic_system
- 0.001 antivm_xen_keys
- 0.001 antivm_vbox_acpi
- 0.001 antivm_vmware_files
- 0.001 banker_zeus_mutex
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_addon
- 0.001 disables_system_restore
- 0.001 disables_windows_defender
- 0.001 codelux_behavior
- 0.001 malicous_targeted_flame
- 0.001 packer_armadillo_regkey
- 0.001 rat_pcclient
- 0.001 rat_spynet
- 0.001 recon_programs
- 0.001 stealth_modify_uac_prompt
Reporting ( 1.266 seconds )
- 0.945 ReportHTMLSummary
- 0.321 Malheur
| Task ID | 577695 |
|---|---|
| Mongo ID | 5f6df3152f8f2e0abb52cf4d |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号