分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-hpdapp01-1 | 2021-04-21 16:50:09 | 2021-04-21 16:52:46 | 157 秒 |
魔盾分数
7.3125
危险的
文件详细信息
| 文件名 | Install.exe |
|---|---|
| 文件大小 | 217088 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 99aeaecb36dce3dca06074dd48108964 |
| SHA1 | 639b784b44dd31376b9aa16079171d59308a20cc |
| SHA256 | b280af73d5d4cf7ed45d44048b6ed2c3572a8b094fd94fedb6980fa8fe5c59ca |
| SHA512 | 9cd515760c903cb6523aa1f28474a34de413d6364e198044e33c15db09a3ae35c6f5d648a5afd3dc12638adc89922234049c0f1199b6175e6c3ec8a576458aa4 |
| CRC32 | 2292C5F4 |
| Ssdeep | 3072:wnDjKDfAoDL3nJ+gW5ZZTaUDp2MQUtNuSbu:wDjKDvL3npWpTRlNoL |
| Yara | 登录查看Yara规则 |
| 样本下载 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| acroipm.adobe.com |
CNAME acroipm.adobe.com.edgesuite.net A 23.220.203.65 CNAME a1983.dscd.akamai.net A 23.220.203.58 |
|
| www.baidu.com |
CNAME www.a.shifen.com A 180.101.49.11 A 180.101.49.12 |
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x0040248e |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x0003fca3 |
| 最低操作系统版本要求 | 4.0 |
| 编译时间 | 2021-04-04 14:35:21 |
| 载入哈希 | 188b8aa3e48c571af09aae8527c2eef5 |
版本信息
| LegalCopyright | |
|---|---|
| InternalName | |
| FileVersion | |
| CompanyName | |
| LegalTrademarks | |
| ProductName | |
| ProductVersion | |
| FileDescription | |
| OriginalFilename | |
| Translation |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x00001744 | 0x00002000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 4.89 |
| .rdata | 0x00003000 | 0x0000109c | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 3.09 |
| .data | 0x00005000 | 0x00006784 | 0x00007000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 3.81 |
| .rsrc | 0x0000c000 | 0x00028874 | 0x00029000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.15 |
导入
库: MFC42.DLL:
• 0x403044 None
• 0x403048 None
• 0x40304c None
• 0x403050 None
• 0x403054 None
• 0x403058 None
• 0x40305c None
• 0x403060 None
• 0x403064 None
• 0x403068 None
• 0x40306c None
• 0x403070 None
• 0x403074 None
• 0x403078 None
• 0x40307c None
• 0x403080 None
• 0x403084 None
• 0x403088 None
• 0x40308c None
• 0x403090 None
• 0x403094 None
• 0x403098 None
• 0x40309c None
• 0x4030a0 None
• 0x4030a4 None
• 0x4030a8 None
• 0x4030ac None
• 0x4030b0 None
• 0x4030b4 None
• 0x4030b8 None
• 0x4030bc None
• 0x4030c0 None
• 0x4030c4 None
• 0x4030c8 None
• 0x4030cc None
• 0x4030d0 None
• 0x4030d4 None
• 0x4030d8 None
• 0x4030dc None
• 0x4030e0 None
• 0x4030e4 None
• 0x4030e8 None
• 0x4030ec None
• 0x4030f0 None
• 0x4030f4 None
• 0x4030f8 None
• 0x4030fc None
• 0x403100 None
• 0x403104 None
• 0x403108 None
• 0x40310c None
• 0x403110 None
• 0x403114 None
• 0x403118 None
• 0x40311c None
• 0x403120 None
• 0x403124 None
• 0x403128 None
• 0x40312c None
• 0x403130 None
• 0x403134 None
• 0x403138 None
• 0x40313c None
• 0x403140 None
• 0x403144 None
• 0x403148 None
• 0x40314c None
• 0x403150 None
• 0x403154 None
• 0x403158 None
• 0x40315c None
• 0x403160 None
• 0x403164 None
• 0x403168 None
• 0x40316c None
• 0x403170 None
• 0x403174 None
• 0x403178 None
• 0x40317c None
• 0x403180 None
• 0x403184 None
• 0x403188 None
• 0x40318c None
• 0x403190 None
• 0x403194 None
• 0x403198 None
• 0x40319c None
• 0x4031a0 None
• 0x4031a4 None
• 0x4031a8 None
• 0x4031ac None
• 0x4031b0 None
• 0x4031b4 None
• 0x4031b8 None
• 0x4031bc None
• 0x4031c0 None
• 0x4031c4 None
• 0x4031c8 None
• 0x4031cc None
• 0x4031d0 None
• 0x4031d4 None
• 0x4031d8 None
• 0x4031dc None
• 0x4031e0 None
• 0x4031e4 None
• 0x4031e8 None
• 0x4031ec None
• 0x4031f0 None
• 0x4031f4 None
• 0x4031f8 None
• 0x4031fc None
• 0x403200 None
• 0x403204 None
• 0x403208 None
• 0x40320c None
• 0x403210 None
• 0x403214 None
• 0x403218 None
• 0x40321c None
• 0x403220 None
• 0x403224 None
• 0x403228 None
• 0x40322c None
• 0x403230 None
• 0x403234 None
• 0x403238 None
• 0x40323c None
• 0x403240 None
• 0x403244 None
• 0x403248 None
• 0x40324c None
• 0x403250 None
• 0x403254 None
• 0x403258 None
• 0x40325c None
• 0x403260 None
• 0x403264 None
• 0x403268 None
• 0x40326c None
• 0x403270 None
• 0x403274 None
• 0x403278 None
• 0x40327c None
• 0x403280 None
• 0x403284 None
• 0x403288 None
• 0x40328c None
• 0x403290 None
• 0x403294 None
• 0x403298 None
• 0x40329c None
• 0x4032a0 None
• 0x4032a4 None
• 0x4032a8 None
• 0x4032ac None
• 0x4032b0 None
• 0x4032b4 None
• 0x4032b8 None
• 0x4032bc None
• 0x4032c0 None
• 0x4032c4 None
• 0x4032c8 None
• 0x4032cc None
• 0x4032d0 None
• 0x4032d4 None
• 0x4032d8 None
• 0x4032dc None
• 0x4032e0 None
• 0x4032e4 None
• 0x4032e8 None
• 0x4032ec None
• 0x4032f0 None
• 0x4032f4 None
• 0x4032f8 None
• 0x4032fc None
• 0x403300 None
• 0x403304 None
• 0x403308 None
• 0x40330c None
库: MSVCRT.dll:
• 0x403314 _except_handler3
• 0x403318 __set_app_type
• 0x40331c __p__fmode
• 0x403320 __p__commode
• 0x403324 _adjust_fdiv
• 0x403328 __setusermatherr
• 0x40332c _initterm
• 0x403330 __getmainargs
• 0x403334 _acmdln
• 0x403338 exit
• 0x40333c _XcptFilter
• 0x403340 _exit
• 0x403344 _onexit
• 0x403348 __dllonexit
• 0x40334c fopen
• 0x403350 fwrite
• 0x403354 fclose
• 0x403358 __CxxFrameHandler
• 0x40335c _setmbcp
• 0x403360 _controlfp
库: KERNEL32.dll:
• 0x403000 GetProcAddress
• 0x403004 HeapAlloc
• 0x403008 GetProcessHeap
• 0x40300c VirtualAlloc
• 0x403010 HeapFree
• 0x403014 VirtualFree
• 0x403018 FreeLibrary
• 0x40301c ExitProcess
• 0x403020 SizeofResource
• 0x403024 LockResource
• 0x403028 LoadResource
• 0x40302c FindResourceA
• 0x403030 ExpandEnvironmentStringsA
• 0x403034 GetModuleHandleA
• 0x403038 GetStartupInfoA
• 0x40303c LoadLibraryA
库: USER32.dll:
• 0x403368 EnableWindow
.text
`.rdata
@.data
.rsrc
T$0Rj
SVWQRj
MFC42.DLL
__CxxFrameHandler
fclose
fwrite
fopen
MSVCRT.dll
__dllonexit
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
GetProcAddress
LoadLibraryA
HeapAlloc
GetProcessHeap
VirtualAlloc
HeapFree
VirtualFree
FreeLibrary
ExitProcess
SizeofResource
LockResource
LoadResource
FindResourceA
ExpandEnvironmentStringsA
GetModuleHandleA
GetStartupInfoA
KERNEL32.dll
EnableWindow
USER32.dll
_setmbcp
CMainFrame
Microsoft Wsacug wgwioqeo
Windows Manager SuperProServer Msiauu smsysaogSuperProServer Ayesoa ikcwaagoSuperProServer Ksyoyw wogeemuiSuperProServer Ggigky ckicequuSuperProServer Mqecik gacyamso
Ygiqqs umckiukweqekyamqqo
%ProgramFiles%\Aimgea.dll
kernel32.dll
HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
VirtualAlloc
VirtualProtect
VirtualFree
KERNEL32.dll
install
CSadqweDoc
CSadqweView
.text
`.rdata
@.data
.idata
.reloc
SVWUj
F*PjTWj
F+PjUWj
F,PjVWj
F-PjWWj
F.PjRWj
VjSWj
kernel32.dll
HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
VirtualAlloc
VirtualProtect
VirtualFree
KERNEL32.dll
__GLOBAL_HEAP_SELECTED
__MSVCRT_HEAP_SELECT
runtime error
Microsoft Visual C++ Runtime Library
Program:
<program name unknown>
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
LC_TIME
LC_NUMERIC
LC_MONETARY
LC_CTYPE
LC_COLLATE
LC_ALL
Paraguay
Uruguay
Chile
Ecuador
Argentina
Colombia
Venezuela
Dominican Republic
South Africa
Panama
Luxembourg
Costa Rica
Switzerland
Guatemala
Canada
Spanish - Modern Sort
Australia
English
Austria
German
Belgium
Mexico
Spanish
Basque
Sweden
Swedish
Iceland
Icelandic
France
French
Finland
Finnish
Spain
Spanish - Traditional Sort
united-states
united-kingdom
trinidad & tobago
south-korea
south-africa
south korea
south africa
slovak
puerto-rico
pr-china
pr china
new-zealand
hong-kong
holland
great britain
england
czech
china
britain
america
swiss
swedish-finland
spanish-venezuela
spanish-uruguay
spanish-puerto rico
spanish-peru
spanish-paraguay
spanish-panama
spanish-nicaragua
spanish-modern
spanish-mexican
spanish-honduras
spanish-guatemala
spanish-el salvador
spanish-ecuador
spanish-dominican republic
spanish-costa rica
spanish-colombia
spanish-chile
spanish-bolivia
spanish-argentina
portuguese-brazilian
norwegian-nynorsk
norwegian-bokmal
norwegian
italian-swiss
irish-english
german-swiss
german-luxembourg
german-lichtenstein
german-austrian
french-swiss
french-luxembourg
french-canadian
french-belgian
english-usa
english-us
english-uk
english-trinidad y tobago
english-south africa
english-nz
english-jamaica
english-ire
english-caribbean
english-can
english-belize
english-aus
english-american
dutch-belgian
chinese-traditional
chinese-singapore
chinese-simplified
chinese-hongkong
chinese
canadian
belgian
australian
american-english
american english
american
H:mm:ss
dddd, MMMM dd, yyyy
M/d/yy
December
November
October
September
August
April
March
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
am/pm
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
server.dll
??4CDllLoad@@QAEAAV0@ABV0@@Z
ServiceMain
进程树
- Install.exe id: 2764
-
services.exe id: 428
- svchost.exe id: 2000
-
svchost.exe id: 2100
- WerFault.exe id: 2380
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49158 | 23.220.203.65 acroipm.adobe.com | 80 |
| 192.168.122.201 | 49159 | 59.80.44.45 | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 61084 | 192.168.122.1 | 53 |
| 192.168.122.201 | 63282 | 192.168.122.1 | 53 |
| 192.168.122.201 | 63619 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| acroipm.adobe.com |
CNAME acroipm.adobe.com.edgesuite.net A 23.220.203.65 CNAME a1983.dscd.akamai.net A 23.220.203.58 |
|
| www.baidu.com |
CNAME www.a.shifen.com A 180.101.49.11 A 180.101.49.12 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49158 | 23.220.203.65 acroipm.adobe.com | 80 |
| 192.168.122.201 | 49159 | 59.80.44.45 | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 61084 | 192.168.122.1 | 53 |
| 192.168.122.201 | 63282 | 192.168.122.1 | 53 |
| 192.168.122.201 | 63619 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip | GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache |
| URL专业沙箱检测 -> http://59.80.44.45/acroipm.adobe.com/202104211652/23F2CC8D77E1D18E88E877DE26ABD578/11/rdr/CHS/win/nooem/none/message.zip | GET /acroipm.adobe.com/202104211652/23F2CC8D77E1D18E88E877DE26ABD578/11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* User-Agent: IPM Host: 59.80.44.45 Connection: Keep-Alive Cache-Control: no-cache |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 24.659 seconds )
- 15.494 Suricata
- 2.74 NetworkAnalysis
- 2.414 BehaviorAnalysis
- 1.644 VirusTotal
- 1.28 Static
- 0.448 peid
- 0.419 TargetInfo
- 0.098 Memory
- 0.097 AnalysisInfo
- 0.024 Strings
- 0.001 config_decoder
Signatures ( 14.339 seconds )
- 11.449 network_http
- 1.964 md_url_bl
- 0.13 api_spamming
- 0.108 injection_createremotethread
- 0.104 stealth_timeout
- 0.09 stealth_decoy_document
- 0.07 injection_runpe
- 0.056 injection_explorer
- 0.048 antiav_detectreg
- 0.026 md_domain_bl
- 0.021 infostealer_ftp
- 0.014 antiav_detectfile
- 0.012 infostealer_im
- 0.01 mimics_filetime
- 0.01 virus
- 0.01 antianalysis_detectreg
- 0.01 infostealer_bitcoin
- 0.009 reads_self
- 0.009 anomaly_persistence_autorun
- 0.009 ransomware_extensions
- 0.009 ransomware_files
- 0.008 bootkit
- 0.008 stealth_file
- 0.008 antivm_generic_disk
- 0.008 kovter_behavior
- 0.007 infostealer_browser_password
- 0.007 geodo_banking_trojan
- 0.007 infostealer_mail
- 0.006 antiemu_wine_func
- 0.006 antivm_vbox_files
- 0.006 network_torgateway
- 0.005 antivm_vbox_libs
- 0.005 hancitor_behavior
- 0.004 antivm_generic_scsi
- 0.004 disables_browser_warn
- 0.003 tinba_behavior
- 0.003 betabot_behavior
- 0.003 kibex_behavior
- 0.003 antidbg_windows
- 0.003 md_bad_drop
- 0.002 rat_nanocore
- 0.002 maldun_anomaly_massive_file_ops
- 0.002 sets_autoconfig_url
- 0.002 antisandbox_sunbelt_libs
- 0.002 shifu_behavior
- 0.002 cerber_behavior
- 0.002 antidbg_devices
- 0.002 antivm_parallels_keys
- 0.002 antivm_xen_keys
- 0.002 browser_security
- 0.002 modify_proxy
- 0.002 darkcomet_regkeys
- 0.002 network_cnc_http
- 0.002 rat_pcclient
- 0.002 recon_fingerprint
- 0.001 hawkeye_behavior
- 0.001 network_tor
- 0.001 antiav_avast_libs
- 0.001 infostealer_browser
- 0.001 maldun_malicious_write_executeable_under_temp_to_regrun
- 0.001 antivm_vmware_libs
- 0.001 maldun_anomaly_write_exe_and_obsfucate_extension
- 0.001 antivm_generic_services
- 0.001 ursnif_behavior
- 0.001 kazybot_behavior
- 0.001 antisandbox_sboxie_libs
- 0.001 ipc_namedpipe
- 0.001 antiav_bitdefender_libs
- 0.001 exec_crash
- 0.001 anormaly_invoke_kills
- 0.001 bypass_firewall
- 0.001 antianalysis_detectfile
- 0.001 antisandbox_productid
- 0.001 antivm_generic_diskreg
- 0.001 antivm_vmware_files
- 0.001 banker_zeus_mutex
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_addon
- 0.001 disables_system_restore
- 0.001 disables_windows_defender
- 0.001 codelux_behavior
- 0.001 maldun_malicious_drop_executable_file_to_temp_folder
- 0.001 network_tor_service
- 0.001 office_security
- 0.001 packer_armadillo_regkey
- 0.001 ransomware_radamant
- 0.001 rat_spynet
- 0.001 stealth_hiddenreg
- 0.001 stealth_hide_notifications
- 0.001 stealth_modify_uac_prompt
- 0.001 stealth_modify_security_center_warnings
Reporting ( 1.453 seconds )
- 0.92 ReportHTMLSummary
- 0.533 Malheur
| Task ID | 631810 |
|---|---|
| Mongo ID | 607fe82c2f8f2e3546ce3951 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号