分析任务

分析类型 虚拟机标签 开始时间 结束时间 持续时间
文件 (Windows) win7-sp1-x64-shaapp02-2 2022-08-19 11:42:56 2022-08-19 11:45:14 138 秒

魔盾分数

10.0

危险的

文件详细信息

文件名 香肠派对.exe
文件大小 20545536 字节
文件类型 PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c162477e4fb7ccbfa2dd16661d64c955
SHA1 9b6ab64831f2512ac4b7ae47e6219bd8266a48a4
SHA256 b524a52c05392f8d5ea3aedd9afd258c6ff810a1128b947396926ea77386274e
SHA512 b03b0e9ab2d4584f09a62735edd22f5ee9da708db08d59e241a5b0dfb0fd8dd1adbc1a064bf66ff03cfe5d29e74c85c6b3f443695a0bf142cf9b5ee7881dd899
CRC32 96B667CD
Ssdeep 393216:4gahdhx++yGLSttHYerbym86JE+5fa4I5lDrqag9Whs3tetw6bX:uhM0eLzb9JEyfa4oqaIEK6r
Yara 登录查看Yara规则
找不到该样本 提交误报

登录查看威胁特征

运行截图


访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
154.83.15.20 Seychelles
69.42.215.252 美国

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
xred.mooo.com 未知 NXDOMAIN
freedns.afraid.org 未知 A 69.42.215.252
docs.google.com 未知 A 154.83.15.20

摘要

登录查看详细行为信息

PE 信息

初始地址 0x00400000
入口地址 0x0049ab80
声明校验值 0x00000000
最低操作系统版本要求 4.0
编译时间 1992-06-20 06:22:17
载入哈希 332f7ce65ead0adfb3d35147033aabe9

版本信息

LegalCopyright
InternalName
FileVersion
CompanyName
LegalTrademarks
Comments
ProductName
ProductVersion
FileDescription
OriginalFilename
Translation

PE 数据组成

名称 虚拟地址 虚拟大小 原始数据大小 特征 熵(Entropy)
CODE 0x00001000 0x00099bec 0x00099c00 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.57
DATA 0x0009b000 0x00002e54 0x00003000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4.85
BSS 0x0009e000 0x000011e5 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.idata 0x000a0000 0x00002a42 0x00002c00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4.92
.tls 0x000a3000 0x00000010 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.rdata 0x000a4000 0x00000039 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 0.78
.reloc 0x000a5000 0x0000a980 0x0000aa00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 6.67
.rsrc 0x000b0000 0x012ed658 0x012ed800 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 7.98

导入

库: kernel32.dll:
0x4a01dc VirtualFree
0x4a01e0 VirtualAlloc
0x4a01e4 LocalFree
0x4a01e8 LocalAlloc
0x4a01ec GetTickCount
0x4a01f4 GetVersion
0x4a01f8 GetCurrentThreadId
0x4a0204 VirtualQuery
0x4a0208 WideCharToMultiByte
0x4a0210 MultiByteToWideChar
0x4a0214 lstrlenA
0x4a0218 lstrcpynA
0x4a021c LoadLibraryExA
0x4a0220 GetThreadLocale
0x4a0224 GetStartupInfoA
0x4a0228 GetProcAddress
0x4a022c GetModuleHandleA
0x4a0230 GetModuleFileNameA
0x4a0234 GetLocaleInfoA
0x4a0238 GetLastError
0x4a0240 GetCommandLineA
0x4a0244 FreeLibrary
0x4a0248 FindFirstFileA
0x4a024c FindClose
0x4a0250 ExitProcess
0x4a0254 ExitThread
0x4a0258 CreateThread
0x4a025c WriteFile
0x4a0264 SetFilePointer
0x4a0268 SetEndOfFile
0x4a026c RtlUnwind
0x4a0270 ReadFile
0x4a0274 RaiseException
0x4a0278 GetStdHandle
0x4a027c GetFileSize
0x4a0280 GetFileType
0x4a0284 CreateFileA
0x4a0288 CloseHandle
库: user32.dll:
0x4a0290 GetKeyboardType
0x4a0294 LoadStringA
0x4a0298 MessageBoxA
0x4a029c CharNextA
库: advapi32.dll:
0x4a02a4 RegQueryValueExA
0x4a02a8 RegOpenKeyExA
0x4a02ac RegCloseKey
库: oleaut32.dll:
0x4a02b4 SysFreeString
0x4a02b8 SysReAllocStringLen
0x4a02bc SysAllocStringLen
库: kernel32.dll:
0x4a02c4 TlsSetValue
0x4a02c8 TlsGetValue
0x4a02cc LocalAlloc
0x4a02d0 GetModuleHandleA
库: advapi32.dll:
0x4a02d8 RegSetValueExA
0x4a02dc RegQueryValueExA
0x4a02e0 RegOpenKeyExA
0x4a02e8 RegFlushKey
0x4a02ec RegDeleteValueA
0x4a02f0 RegCreateKeyExA
0x4a02f4 RegCloseKey
0x4a02f8 OpenProcessToken
0x4a0300 GetUserNameA
库: kernel32.dll:
0x4a030c lstrcpyA
0x4a0314 WriteFile
0x4a0318 WaitForSingleObject
0x4a0320 VirtualQuery
0x4a0324 VirtualAlloc
0x4a0328 UpdateResourceA
0x4a032c UnmapViewOfFile
0x4a0330 TerminateProcess
0x4a0334 Sleep
0x4a0338 SizeofResource
0x4a033c SetThreadLocale
0x4a0340 SetFilePointer
0x4a0344 SetFileAttributesA
0x4a0348 SetEvent
0x4a034c SetErrorMode
0x4a0350 SetEndOfFile
0x4a0354 ResumeThread
0x4a0358 ResetEvent
0x4a035c RemoveDirectoryA
0x4a0360 ReadFile
0x4a0364 OpenProcess
0x4a0368 OpenMutexA
0x4a036c MultiByteToWideChar
0x4a0370 MulDiv
0x4a0374 MoveFileA
0x4a0378 MapViewOfFile
0x4a037c LockResource
0x4a0380 LoadResource
0x4a0384 LoadLibraryA
0x4a0390 GlobalUnlock
0x4a0394 GlobalReAlloc
0x4a0398 GlobalHandle
0x4a039c GlobalLock
0x4a03a0 GlobalFree
0x4a03a4 GlobalFindAtomA
0x4a03a8 GlobalDeleteAtom
0x4a03ac GlobalAlloc
0x4a03b0 GlobalAddAtomA
0x4a03b4 GetVersionExA
0x4a03b8 GetVersion
0x4a03c0 GetTickCount
0x4a03c4 GetThreadLocale
0x4a03c8 GetTempPathA
0x4a03cc GetTempFileNameA
0x4a03d0 GetSystemInfo
0x4a03d4 GetSystemDirectoryA
0x4a03d8 GetStringTypeExA
0x4a03dc GetStdHandle
0x4a03e0 GetProcAddress
0x4a03e8 GetModuleHandleA
0x4a03ec GetModuleFileNameA
0x4a03f0 GetLogicalDrives
0x4a03f4 GetLocaleInfoA
0x4a03f8 GetLocalTime
0x4a03fc GetLastError
0x4a0400 GetFullPathNameA
0x4a0404 GetFileSize
0x4a0408 GetFileAttributesA
0x4a040c GetExitCodeThread
0x4a0410 GetDriveTypeA
0x4a0414 GetDiskFreeSpaceA
0x4a0418 GetDateFormatA
0x4a041c GetCurrentThreadId
0x4a0420 GetCurrentProcessId
0x4a0424 GetCurrentProcess
0x4a0428 GetComputerNameA
0x4a042c GetCPInfo
0x4a0430 GetACP
0x4a0434 FreeResource
0x4a043c InterlockedExchange
0x4a0444 FreeLibrary
0x4a0448 FormatMessageA
0x4a044c FindResourceA
0x4a0450 FindNextFileA
0x4a0454 FindFirstFileA
0x4a0458 FindClose
0x4a0464 EnumCalendarInfoA
0x4a046c EndUpdateResourceA
0x4a0470 DeleteFileA
0x4a0478 CreateThread
0x4a047c CreateProcessA
0x4a0480 CreatePipe
0x4a0484 CreateMutexA
0x4a0488 CreateFileMappingA
0x4a048c CreateFileA
0x4a0490 CreateEventA
0x4a0494 CreateDirectoryA
0x4a0498 CopyFileA
0x4a049c CompareStringA
0x4a04a0 CloseHandle
库: version.dll:
0x4a04ac VerQueryValueA
0x4a04b4 GetFileVersionInfoA
库: gdi32.dll:
0x4a04bc UnrealizeObject
0x4a04c0 StretchBlt
0x4a04c4 SetWindowOrgEx
0x4a04c8 SetWinMetaFileBits
0x4a04cc SetViewportOrgEx
0x4a04d0 SetTextColor
0x4a04d4 SetStretchBltMode
0x4a04d8 SetROP2
0x4a04dc SetPixel
0x4a04e0 SetEnhMetaFileBits
0x4a04e4 SetDIBColorTable
0x4a04e8 SetBrushOrgEx
0x4a04ec SetBkMode
0x4a04f0 SetBkColor
0x4a04f4 SelectPalette
0x4a04f8 SelectObject
0x4a04fc SaveDC
0x4a0500 RestoreDC
0x4a0504 RectVisible
0x4a0508 RealizePalette
0x4a050c PlayEnhMetaFile
0x4a0510 PatBlt
0x4a0514 MoveToEx
0x4a0518 MaskBlt
0x4a051c LineTo
0x4a0520 IntersectClipRect
0x4a0524 GetWindowOrgEx
0x4a0528 GetWinMetaFileBits
0x4a052c GetTextMetricsA
0x4a0538 GetStockObject
0x4a053c GetPixel
0x4a0540 GetPaletteEntries
0x4a0544 GetObjectA
0x4a0550 GetEnhMetaFileBits
0x4a0554 GetDeviceCaps
0x4a0558 GetDIBits
0x4a055c GetDIBColorTable
0x4a0560 GetDCOrgEx
0x4a0568 GetClipBox
0x4a056c GetBrushOrgEx
0x4a0570 GetBitmapBits
0x4a0574 GdiFlush
0x4a0578 ExcludeClipRect
0x4a057c DeleteObject
0x4a0580 DeleteEnhMetaFile
0x4a0584 DeleteDC
0x4a0588 CreateSolidBrush
0x4a058c CreatePenIndirect
0x4a0590 CreatePalette
0x4a0598 CreateFontIndirectA
0x4a059c CreateDIBitmap
0x4a05a0 CreateDIBSection
0x4a05a4 CreateCompatibleDC
0x4a05ac CreateBrushIndirect
0x4a05b0 CreateBitmap
0x4a05b4 CopyEnhMetaFileA
0x4a05b8 BitBlt
库: user32.dll:
0x4a05c0 CreateWindowExA
0x4a05c4 WindowFromPoint
0x4a05c8 WinHelpA
0x4a05cc WaitMessage
0x4a05d0 UpdateWindow
0x4a05d4 UnregisterClassA
0x4a05d8 UnhookWindowsHookEx
0x4a05dc TranslateMessage
0x4a05e4 TrackPopupMenu
0x4a05e8 ToAsciiEx
0x4a05f0 ShowWindow
0x4a05f4 ShowScrollBar
0x4a05f8 ShowOwnedPopups
0x4a05fc ShowCursor
0x4a0600 SetWindowsHookExA
0x4a0604 SetWindowTextA
0x4a0608 SetWindowPos
0x4a060c SetWindowPlacement
0x4a0610 SetWindowLongA
0x4a0614 SetTimer
0x4a0618 SetScrollRange
0x4a061c SetScrollPos
0x4a0620 SetScrollInfo
0x4a0624 SetRect
0x4a0628 SetPropA
0x4a062c SetParent
0x4a0630 SetMenuItemInfoA
0x4a0634 SetMenu
0x4a0638 SetForegroundWindow
0x4a063c SetFocus
0x4a0640 SetCursor
0x4a0644 SetClassLongA
0x4a0648 SetCapture
0x4a064c SetActiveWindow
0x4a0650 SendMessageA
0x4a0654 ScrollWindow
0x4a0658 ScreenToClient
0x4a065c RemovePropA
0x4a0660 RemoveMenu
0x4a0664 ReleaseDC
0x4a0668 ReleaseCapture
0x4a0674 RegisterClassA
0x4a0678 RedrawWindow
0x4a067c PtInRect
0x4a0680 PostQuitMessage
0x4a0684 PostMessageA
0x4a0688 PeekMessageA
0x4a068c OffsetRect
0x4a0690 OemToCharA
0x4a0698 MessageBoxA
0x4a069c MapWindowPoints
0x4a06a0 MapVirtualKeyExA
0x4a06a4 MapVirtualKeyA
0x4a06a8 LoadStringA
0x4a06ac LoadKeyboardLayoutA
0x4a06b0 LoadIconA
0x4a06b4 LoadCursorA
0x4a06b8 LoadBitmapA
0x4a06bc KillTimer
0x4a06c0 IsZoomed
0x4a06c4 IsWindowVisible
0x4a06c8 IsWindowEnabled
0x4a06cc IsWindow
0x4a06d0 IsRectEmpty
0x4a06d4 IsIconic
0x4a06d8 IsDialogMessageA
0x4a06dc IsChild
0x4a06e0 InvalidateRect
0x4a06e4 IntersectRect
0x4a06e8 InsertMenuItemA
0x4a06ec InsertMenuA
0x4a06f0 InflateRect
0x4a06fc GetWindowTextA
0x4a0700 GetWindowRect
0x4a0704 GetWindowPlacement
0x4a0708 GetWindowLongA
0x4a070c GetWindowDC
0x4a0710 GetTopWindow
0x4a0714 GetSystemMetrics
0x4a0718 GetSystemMenu
0x4a071c GetSysColorBrush
0x4a0720 GetSysColor
0x4a0724 GetSubMenu
0x4a0728 GetScrollRange
0x4a072c GetScrollPos
0x4a0730 GetScrollInfo
0x4a0734 GetPropA
0x4a0738 GetParent
0x4a073c GetWindow
0x4a0740 GetMenuStringA
0x4a0744 GetMenuState
0x4a0748 GetMenuItemInfoA
0x4a074c GetMenuItemID
0x4a0750 GetMenuItemCount
0x4a0754 GetMenu
0x4a0758 GetLastActivePopup
0x4a075c GetKeyboardState
0x4a0764 GetKeyboardLayout
0x4a0768 GetKeyState
0x4a076c GetKeyNameTextA
0x4a0770 GetIconInfo
0x4a0774 GetForegroundWindow
0x4a0778 GetFocus
0x4a077c GetDesktopWindow
0x4a0780 GetDCEx
0x4a0784 GetDC
0x4a0788 GetCursorPos
0x4a078c GetCursor
0x4a0790 GetClipboardData
0x4a0794 GetClientRect
0x4a0798 GetClassNameA
0x4a079c GetClassInfoA
0x4a07a0 GetCapture
0x4a07a4 GetActiveWindow
0x4a07a8 FrameRect
0x4a07ac FindWindowA
0x4a07b0 FillRect
0x4a07b4 EqualRect
0x4a07b8 EnumWindows
0x4a07bc EnumThreadWindows
0x4a07c0 EndPaint
0x4a07c4 EnableWindow
0x4a07c8 EnableScrollBar
0x4a07cc EnableMenuItem
0x4a07d0 DrawTextA
0x4a07d4 DrawMenuBar
0x4a07d8 DrawIconEx
0x4a07dc DrawIcon
0x4a07e0 DrawFrameControl
0x4a07e4 DrawEdge
0x4a07e8 DispatchMessageA
0x4a07ec DestroyWindow
0x4a07f0 DestroyMenu
0x4a07f4 DestroyIcon
0x4a07f8 DestroyCursor
0x4a07fc DeleteMenu
0x4a0800 DefWindowProcA
0x4a0804 DefMDIChildProcA
0x4a0808 DefFrameProcA
0x4a080c CreatePopupMenu
0x4a0810 CreateMenu
0x4a0814 CreateIcon
0x4a0818 ClientToScreen
0x4a081c CheckMenuItem
0x4a0820 CallWindowProcA
0x4a0824 CallNextHookEx
0x4a0828 BeginPaint
0x4a082c CharNextA
0x4a0830 CharLowerBuffA
0x4a0834 CharLowerA
0x4a0838 CharUpperBuffA
0x4a083c CharToOemA
0x4a0840 AdjustWindowRectEx
库: ole32.dll:
0x4a084c CLSIDFromString
库: kernel32.dll:
0x4a0854 Sleep
库: oleaut32.dll:
0x4a085c SafeArrayPtrOfIndex
0x4a0860 SafeArrayGetUBound
0x4a0864 SafeArrayGetLBound
0x4a0868 SafeArrayCreate
0x4a086c VariantChangeType
0x4a0870 VariantCopyInd
0x4a0874 VariantCopy
0x4a0878 VariantClear
0x4a087c VariantInit
库: ole32.dll:
0x4a0884 CLSIDFromProgID
0x4a0888 CoCreateInstance
0x4a088c CoUninitialize
0x4a0890 CoInitialize
库: oleaut32.dll:
0x4a0898 GetErrorInfo
0x4a089c SysFreeString
库: comctl32.dll:
0x4a08ac ImageList_Write
0x4a08b0 ImageList_Read
0x4a08c0 ImageList_DragMove
0x4a08c4 ImageList_DragLeave
0x4a08c8 ImageList_DragEnter
0x4a08cc ImageList_EndDrag
0x4a08d0 ImageList_BeginDrag
0x4a08d4 ImageList_Remove
0x4a08d8 ImageList_DrawEx
0x4a08dc ImageList_Draw
0x4a08ec ImageList_Add
0x4a08f4 ImageList_Destroy
0x4a08f8 ImageList_Create
库: shell32.dll:
0x4a0900 ShellExecuteExA
0x4a0904 ExtractIconExW
库: wininet.dll:
0x4a0910 InternetReadFile
0x4a0914 InternetOpenUrlA
0x4a0918 InternetOpenA
0x4a091c InternetCloseHandle
库: shell32.dll:
0x4a092c SHGetMalloc
0x4a0930 SHGetDesktopFolder
库: advapi32.dll:
0x4a0938 OpenSCManagerA
0x4a093c CloseServiceHandle
库: wsock32.dll:
0x4a0944 WSACleanup
0x4a0948 WSAStartup
0x4a094c gethostname
0x4a0950 gethostbyname
0x4a0954 inet_ntoa
库: netapi32.dll:
0x4a095c Netbios

`DATA
.idata
.rdata
P.reloc
P.rsrc
System
IInterface
UhI'@
UhY+@
F$P-@
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
Uh$=@
PhdA@
Ph"E@
UhjF@
kernel32.dll
GetLongPathNameA
Software\Borland\Locales
Software\Borland\Delphi\Locales
Uhoi@
Uhcj@
Uh.k@
Magellan MSWHEEL
MouseZ
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
UhY|@
SysUtils
False
AM/PM
D$LPj
WUWSj
m/d/yy
mmmm d, yyyy
AMPM
AMPM
:mm:ss
kernel32.dll
GetDiskFreeSpaceExA
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarOr
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
Variants
UhW!A
UhX'A
Uha,A
Uhj>A
Uh7?A
UhcEA
Uh~FA
UhDGA
Uh'GA
Uh:RA
UhDTA
Uh/VA
UhyWA
Uh5XA
UhH[A
Uh7eA
UhmhA
Uh]iA
Empty
Smallint
Integer
Single
Double
Currency
OleStr
Dispatch
Error
Boolean
Variant
Unknown
Decimal
ShortInt
LongWord
Int64
String
Array
ByRef
UhspA
UhwsA
Uh!tA
UhquA
False
Uh$yA
Uh&zA
tagEXCEPINFO
UhU~A
TNotifyEvent
TObject
Classes
Classes
Classes
Classes
Classes
TStrings
Classes
Classes
Classes
EThread
Classes
%s[%d]
Strings
Owner
False
%s_%d
没有防病毒引擎扫描信息!

进程树


____________.exe, PID: 2712, 上一级进程 PID: 2340
._cache_____________.exe, PID: 2944, 上一级进程 PID: 2712
._cache_____________.tmp, PID: 2376, 上一级进程 PID: 2944
Synaptics.exe, PID: 2560, 上一级进程 PID: 2712

访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
154.83.15.20 Seychelles
69.42.215.252 美国

TCP

源地址 源端口 目标地址 目标端口
192.168.122.202 49157 23.33.32.227 80
192.168.122.202 49165 69.42.215.252 freedns.afraid.org 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.202 52362 192.168.122.1 53
192.168.122.202 60917 192.168.122.1 53
192.168.122.202 63030 192.168.122.1 53
192.168.122.202 63087 192.168.122.1 53

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
xred.mooo.com 未知 NXDOMAIN
freedns.afraid.org 未知 A 69.42.215.252
docs.google.com 未知 A 154.83.15.20

TCP

源地址 源端口 目标地址 目标端口
192.168.122.202 49157 23.33.32.227 80
192.168.122.202 49165 69.42.215.252 freedns.afraid.org 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.202 52362 192.168.122.1 53
192.168.122.202 60917 192.168.122.1 53
192.168.122.202 63030 192.168.122.1 53
192.168.122.202 63087 192.168.122.1 53

HTTP 请求

URI HTTP数据
URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip
GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1
Accept: */*
If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT
User-Agent: IPM
Host: acroipm.adobe.com
Connection: Keep-Alive
Cache-Control: no-cache

URL专业沙箱检测 -> http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
User-Agent: MyApp
Host: freedns.afraid.org
Cache-Control: no-cache

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

No TLS

Suricata HTTP

No Suricata HTTP

未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
HTML 总结报告
(需15-60分钟同步)
下载

Processing ( 68.287 seconds )

  • 35.896 Static
  • 11.766 NetworkAnalysis
  • 10.995 Suricata
  • 3.988 BehaviorAnalysis
  • 3.793 TargetInfo
  • 1.396 VirusTotal
  • 0.364 peid
  • 0.06 config_decoder
  • 0.017 Strings
  • 0.01 AnalysisInfo
  • 0.002 Memory

Signatures ( 38.395 seconds )

  • 34.752 network_http
  • 1.404 md_url_bl
  • 0.468 antiav_detectreg
  • 0.194 api_spamming
  • 0.165 infostealer_ftp
  • 0.156 stealth_timeout
  • 0.154 stealth_decoy_document
  • 0.106 antianalysis_detectreg
  • 0.091 infostealer_im
  • 0.063 antivm_generic_scsi
  • 0.052 infostealer_mail
  • 0.043 stealth_file
  • 0.038 mimics_filetime
  • 0.034 reads_self
  • 0.033 recon_fingerprint
  • 0.026 antivm_generic_services
  • 0.026 antivm_generic_disk
  • 0.026 virus
  • 0.025 anormaly_invoke_kills
  • 0.024 bootkit
  • 0.024 darkcomet_regkeys
  • 0.023 kibex_behavior
  • 0.023 antivm_parallels_keys
  • 0.023 antivm_xen_keys
  • 0.02 geodo_banking_trojan
  • 0.017 betabot_behavior
  • 0.016 hancitor_behavior
  • 0.015 antisandbox_productid
  • 0.015 antivm_generic_diskreg
  • 0.014 antiav_detectfile
  • 0.013 antidbg_windows
  • 0.013 md_domain_bl
  • 0.012 packer_armadillo_regkey
  • 0.011 infostealer_browser_password
  • 0.009 infostealer_browser
  • 0.009 anomaly_persistence_autorun
  • 0.009 kovter_behavior
  • 0.009 infostealer_bitcoin
  • 0.009 ransomware_extensions
  • 0.009 ransomware_files
  • 0.009 recon_programs
  • 0.008 antiemu_wine_func
  • 0.008 maldun_anomaly_massive_file_ops
  • 0.008 injection_createremotethread
  • 0.008 shifu_behavior
  • 0.008 antivm_vbox_keys
  • 0.008 antivm_vmware_keys
  • 0.008 maldun_anomaly_invoke_vb_vba
  • 0.007 bypass_firewall
  • 0.007 antivm_xen_keys
  • 0.007 antivm_hyperv_keys
  • 0.007 antivm_vbox_acpi
  • 0.007 antivm_vpc_keys
  • 0.006 antivm_generic_bios
  • 0.006 antivm_generic_cpu
  • 0.006 antivm_generic_system
  • 0.006 antivm_vbox_files
  • 0.005 maldun_malicious_write_executeable_under_temp_to_regrun
  • 0.005 maldun_anomaly_write_exe_and_obsfucate_extension
  • 0.005 injection_runpe
  • 0.005 network_torgateway
  • 0.004 antivm_vbox_libs
  • 0.003 antiav_avast_libs
  • 0.003 antisandbox_sunbelt_libs
  • 0.003 ipc_namedpipe
  • 0.003 maldun_anomaly_write_exe_and_dll_under_winroot_run
  • 0.003 exec_crash
  • 0.002 tinba_behavior
  • 0.002 maldun_anomaly_terminated_process
  • 0.002 dridex_behavior
  • 0.002 rat_luminosity
  • 0.002 anomaly_persistence_bootexecute
  • 0.002 antivm_vbox_window
  • 0.002 injection_explorer
  • 0.002 antisandbox_sboxie_libs
  • 0.002 antiav_bitdefender_libs
  • 0.002 antisandbox_script_timer
  • 0.002 antidbg_devices
  • 0.002 browser_security
  • 0.002 disables_browser_warn
  • 0.002 rat_pcclient
  • 0.001 hawkeye_behavior
  • 0.001 network_tor
  • 0.001 rat_nanocore
  • 0.001 antivm_vmware_libs
  • 0.001 anomaly_reset_winsock
  • 0.001 ransomware_message
  • 0.001 sets_autoconfig_url
  • 0.001 creates_largekey
  • 0.001 kazybot_behavior
  • 0.001 creates_nullvalue
  • 0.001 nymaim_behavior
  • 0.001 cerber_behavior
  • 0.001 h1n1_behavior
  • 0.001 securityxploded_modules
  • 0.001 antianalysis_detectfile
  • 0.001 antivm_vmware_files
  • 0.001 antiemu_wine_reg
  • 0.001 banker_zeus_mutex
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 browser_addon
  • 0.001 modify_proxy
  • 0.001 codelux_behavior
  • 0.001 maldun_malicious_drop_executable_file_to_temp_folder
  • 0.001 md_bad_drop
  • 0.001 network_cnc_http
  • 0.001 network_tor_service
  • 0.001 office_security
  • 0.001 ransomware_radamant
  • 0.001 rat_spynet
  • 0.001 stealth_modify_uac_prompt

Reporting ( 0.965 seconds )

  • 0.918 ReportHTMLSummary
  • 0.047 Malheur
Task ID 704742
Mongo ID 62ff07cadc327beba5e01c7d
Cuckoo release 1.4-Maldun