分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-shaapp02-1 | 2024-04-29 10:43:59 | 2024-04-29 10:46:20 | 141 秒 |
魔盾分数
10.0
危险的
文件详细信息
| 文件名 | Internet Download Manager 6.42.9.exe |
|---|---|
| 文件大小 | 15133902 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 826bcbd86d98f949cc7c2a2f8276df29 |
| SHA1 | ed7e8dadffa0037aacb14e0bf19e2ed45e101ca8 |
| SHA256 | 465369bb238689209abe44f7dec3582eff3d7d05a6603b19b1323a4901355c36 |
| SHA512 | fb5a1df685a69b84d8aeff2f0da0a4fd9316f4805bc86a7924b2dfe9d24026d218283b501d30ed7783575a7dff4d3cf56478f4494e84e107346e5d27d96637a1 |
| CRC32 | D6B71F69 |
| Ssdeep | 393216:RIBoVRAozONTN9ckAyMc0P7X0D6yzmsVx5s6pojKrJ:ooVRAuOB0P7EOmx5siojKd |
| Yara | 登录查看Yara规则 |
| 找不到该样本 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 104.85.241.42 | 美国 | |
| 否 | 5.44.221.96 | 拉脱维亚 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| lrepacks.net | 未知 | A 5.44.221.96 |
| x1.i.lencr.org | 未知 |
A 104.85.241.42 CNAME crl.root-x1.letsencrypt.org.edgekey.net CNAME e8652.dscx.akamaiedge.net |
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x00409c14 |
| 声明校验值 | 0x0001cc27 |
| 实际校验值 | 0x00e74b3a |
| 最低操作系统版本要求 | 1.0 |
| 编译时间 | 1992-06-20 06:22:17 |
| 载入哈希 | 884310b1928934402ea6fec1dbd3cf5e |
版本信息
| LegalCopyright | |
|---|---|
| FileVersion | |
| CompanyName | |
| Comments | |
| ProductName | |
| ProductVersion | |
| FileDescription | |
| Translation |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| CODE | 0x00001000 | 0x00009338 | 0x00009400 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.56 |
| DATA | 0x0000b000 | 0x0000024c | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 2.74 |
| BSS | 0x0000c000 | 0x00000e8c | 0x00000000 | IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .idata | 0x0000d000 | 0x00000950 | 0x00000a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.43 |
| .tls | 0x0000e000 | 0x00000008 | 0x00000000 | IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .rdata | 0x0000f000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 0.20 |
| .reloc | 0x00010000 | 0x000008b0 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 0.00 |
| .rsrc | 0x00011000 | 0x000053b8 | 0x00005400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 5.33 |
覆盖
| 偏移量 | 0x000163b8 |
| 大小 | 0x00e58916 |
导入
库: kernel32.dll:
• 0x40d0b4 DeleteCriticalSection
• 0x40d0b8 LeaveCriticalSection
• 0x40d0bc EnterCriticalSection
• 0x40d0c0 InitializeCriticalSection
• 0x40d0c4 VirtualFree
• 0x40d0c8 VirtualAlloc
• 0x40d0cc LocalFree
• 0x40d0d0 LocalAlloc
• 0x40d0d4 WideCharToMultiByte
• 0x40d0d8 TlsSetValue
• 0x40d0dc TlsGetValue
• 0x40d0e0 MultiByteToWideChar
• 0x40d0e4 GetModuleHandleA
• 0x40d0e8 GetLastError
• 0x40d0ec GetCommandLineA
• 0x40d0f0 WriteFile
• 0x40d0f4 SetFilePointer
• 0x40d0f8 SetEndOfFile
• 0x40d0fc RtlUnwind
• 0x40d100 ReadFile
• 0x40d104 RaiseException
• 0x40d108 GetStdHandle
• 0x40d10c GetFileSize
• 0x40d110 GetSystemTime
• 0x40d114 GetFileType
• 0x40d118 ExitProcess
• 0x40d11c CreateFileA
• 0x40d120 CloseHandle
库: user32.dll:
• 0x40d128 MessageBoxA
库: oleaut32.dll:
• 0x40d130 VariantChangeTypeEx
• 0x40d134 VariantCopyInd
• 0x40d138 VariantClear
• 0x40d13c SysStringLen
• 0x40d140 SysAllocStringLen
库: advapi32.dll:
• 0x40d148 RegQueryValueExA
• 0x40d14c RegOpenKeyExA
• 0x40d150 RegCloseKey
• 0x40d154 OpenProcessToken
• 0x40d158 LookupPrivilegeValueA
库: kernel32.dll:
• 0x40d160 WriteFile
• 0x40d164 VirtualQuery
• 0x40d168 VirtualProtect
• 0x40d16c VirtualFree
• 0x40d170 VirtualAlloc
• 0x40d174 Sleep
• 0x40d178 SizeofResource
• 0x40d17c SetLastError
• 0x40d180 SetFilePointer
• 0x40d184 SetErrorMode
• 0x40d188 SetEndOfFile
• 0x40d18c RemoveDirectoryA
• 0x40d190 ReadFile
• 0x40d194 LockResource
• 0x40d198 LoadResource
• 0x40d19c LoadLibraryA
• 0x40d1a0 IsDBCSLeadByte
• 0x40d1a4 GetWindowsDirectoryA
• 0x40d1a8 GetVersionExA
• 0x40d1ac GetUserDefaultLangID
• 0x40d1b0 GetSystemInfo
• 0x40d1b4 GetSystemDefaultLCID
• 0x40d1b8 GetProcAddress
• 0x40d1bc GetModuleHandleA
• 0x40d1c0 GetModuleFileNameA
• 0x40d1c4 GetLocaleInfoA
• 0x40d1c8 GetLastError
• 0x40d1cc GetFullPathNameA
• 0x40d1d0 GetFileSize
• 0x40d1d4 GetFileAttributesA
• 0x40d1d8 GetExitCodeProcess
• 0x40d1dc GetEnvironmentVariableA
• 0x40d1e0 GetCurrentProcess
• 0x40d1e4 GetCommandLineA
• 0x40d1e8 GetACP
• 0x40d1ec InterlockedExchange
• 0x40d1f0 FormatMessageA
• 0x40d1f4 FindResourceA
• 0x40d1f8 DeleteFileA
• 0x40d1fc CreateProcessA
• 0x40d200 CreateFileA
• 0x40d204 CreateDirectoryA
• 0x40d208 CloseHandle
库: user32.dll:
• 0x40d210 TranslateMessage
• 0x40d214 SetWindowLongA
• 0x40d218 PeekMessageA
• 0x40d21c MsgWaitForMultipleObjects
• 0x40d220 MessageBoxA
• 0x40d224 LoadStringA
• 0x40d228 ExitWindowsEx
• 0x40d22c DispatchMessageA
• 0x40d230 DestroyWindow
• 0x40d234 CreateWindowExA
• 0x40d238 CallWindowProcA
• 0x40d23c CharPrevA
库: comctl32.dll:
• 0x40d244 InitCommonControls
库: advapi32.dll:
• 0x40d24c AdjustTokenPrivileges
`DATA
.idata
.rdata
P.reloc
P.rsrc
string
UhV%@
PhM,@
Ph|-@
Ph`.@
UWVSj
Uh`9@
F$S:@
F #:@
F$#:@
F &:@
|HtE=
,EXB@
,EXB@
Uh^C@
kernel32.dll
SetDllDirectoryW
SetSearchPathMode
SetProcessDEPPolicy
Exception
EInOutError
ERangeError
EZeroDivide
EInvalidPointer
UhzS@
m/d/yy
mmmm d, yyyy
AMPM
:mm:ss
UhWY@
UhK\@
Uh@k@
USERPROFILE
GetUserDefaultUILanguage
kernel32.dll
.DEFAULT\Control Panel\International
Locale
Control Panel\Desktop\ResourceLocale
[ExceptObject=nil]
Uh5t@
File I/O error %d
Sh0|@
Compressed block is corrupted
Compressed block is corrupted
Compressed block is corrupted
lzmadecompsmall: Compressed data is corrupted (%d)
lzmadecompsmall: %s
UhI~@
LzmaDecode failed (%d)
TSetupLanguageEntryA
The setup files are corrupted. Please obtain a new copy of the program.
Wow64DisableWow64FsRedirection
kernel32.dll
Wow64RevertWow64FsRedirection
shell32.dll
SeShutdownPrivilege
/SPAWNWND=
/Lang=
The setup files are corrupted. Please obtain a new copy of the program.
h,}@
h,}@
InnoSetupLdrWindow
STATIC
/SL5="$%x,%d,%d,
Runtime error at 00000000
Error
Inno Setup Setup Data (5.5.0)
Inno Setup Messages (5.5.0)
0123456789ABCDEFGHIJKLMNOPQRSTUV
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
WideCharToMultiByte
TlsSetValue
TlsGetValue
MultiByteToWideChar
GetModuleHandleA
GetLastError
GetCommandLineA
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetSystemTime
GetFileType
ExitProcess
CreateFileA
CloseHandle
user32.dll
MessageBoxA
oleaut32.dll
VariantChangeTypeEx
VariantCopyInd
VariantClear
SysStringLen
SysAllocStringLen
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
kernel32.dll
WriteFile
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
Sleep
SizeofResource
SetLastError
SetFilePointer
SetErrorMode
SetEndOfFile
RemoveDirectoryA
ReadFile
LockResource
LoadResource
LoadLibraryA
IsDBCSLeadByte
GetWindowsDirectoryA
GetVersionExA
GetUserDefaultLangID
GetSystemInfo
GetSystemDefaultLCID
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeProcess
GetEnvironmentVariableA
GetCurrentProcess
GetCommandLineA
GetACP
InterlockedExchange
FormatMessageA
FindResourceA
DeleteFileA
CreateProcessA
CreateFileA
CreateDirectoryA
CloseHandle
user32.dll
TranslateMessage
SetWindowLongA
PeekMessageA
MsgWaitForMultipleObjects
MessageBoxA
LoadStringA
ExitWindowsEx
DispatchMessageA
DestroyWindow
CreateWindowExA
CallWindowProcA
CharPrevA
comctl32.dll
InitCommonControls
advapi32.dll
AdjustTokenPrivileges
MAINICON
External exception %x
December
Saturday
VS_VERSION_INFO
StringFileInfo
000004b0
Comments
This installation was built with Inno Setup.
CompanyName
FileDescription
Internet Download Manager Setup
FileVersion
6.42.9.0
LegalCopyright
ProductName
Internet Download Manager
ProductVersion
6.42.9
VarFileInfo
Translation
进程树
-
Internet Download Manager 6.42.9.exe id: 2680
-
Internet Download Manager 6.42.9.tmp id: 2852
- regsvr32.exe id: 2920
- regsvr32.exe id: 2380
- regsvr32.exe id: 2744
-
Internet Download Manager 6.42.9.tmp id: 2852
Internet Download Manager 6.42.9.exe, PID: 2680, 上一级进程 PID: 2328
Internet Download Manager 6.42.9.tmp, PID: 2852, 上一级进程 PID: 2680
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 104.85.241.42 | 美国 | |
| 否 | 5.44.221.96 | 拉脱维亚 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49163 | 104.85.241.42 x1.i.lencr.org | 80 |
| 192.168.122.201 | 49158 | 23.219.206.59 | 80 |
| 192.168.122.201 | 49162 | 5.44.221.96 lrepacks.net | 443 |
| 192.168.122.201 | 49165 | 5.44.221.96 lrepacks.net | 443 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 53118 | 192.168.122.1 | 53 |
| 192.168.122.201 | 57526 | 192.168.122.1 | 53 |
| 192.168.122.201 | 63246 | 192.168.122.1 | 53 |
| 192.168.122.201 | 63472 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| lrepacks.net | 未知 | A 5.44.221.96 |
| x1.i.lencr.org | 未知 |
A 104.85.241.42 CNAME crl.root-x1.letsencrypt.org.edgekey.net CNAME e8652.dscx.akamaiedge.net |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49163 | 104.85.241.42 x1.i.lencr.org | 80 |
| 192.168.122.201 | 49158 | 23.219.206.59 | 80 |
| 192.168.122.201 | 49162 | 5.44.221.96 lrepacks.net | 443 |
| 192.168.122.201 | 49165 | 5.44.221.96 lrepacks.net | 443 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 53118 | 192.168.122.1 | 53 |
| 192.168.122.201 | 57526 | 192.168.122.1 | 53 |
| 192.168.122.201 | 63246 | 192.168.122.1 | 53 |
| 192.168.122.201 | 63472 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip | GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache |
| URL专业沙箱检测 -> http://x1.i.lencr.org/ | GET / HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: x1.i.lencr.org |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
| Timestamp | Source IP | Source Port | Destination IP | Destination Port | Version | Issuer | Subject | Fingerprint |
|---|---|---|---|---|---|---|---|---|
| 2024-04-29 10:44:36.909888+0800 | 192.168.122.201 | 49162 | 5.44.221.96 | 443 | TLS 1.2 | C=US, O=Let's Encrypt, CN=R3 | CN=lrepacks.net | 68:62:1e:06:f5:2b:1f:b8:c1:67:10:33:44:5c:f9:6d:3c:e9:61:3c |
| 2024-04-29 10:44:49.251662+0800 | 192.168.122.201 | 49165 | 5.44.221.96 | 443 | TLS 1.2 | C=US, O=Let's Encrypt, CN=R3 | CN=lrepacks.net | 68:62:1e:06:f5:2b:1f:b8:c1:67:10:33:44:5c:f9:6d:3c:e9:61:3c |
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 56.405 seconds )
- 24.361 Static
- 12.887 NetworkAnalysis
- 10.94 Suricata
- 4.567 BehaviorAnalysis
- 3.135 TargetInfo
- 0.457 peid
- 0.031 config_decoder
- 0.013 Strings
- 0.011 AnalysisInfo
- 0.003 Memory
Signatures ( 42.02 seconds )
- 37.112 network_http
- 1.506 proprietary_url_bl
- 0.268 api_spamming
- 0.267 antiav_detectreg
- 0.224 stealth_timeout
- 0.208 stealth_decoy_document
- 0.199 mimics_filetime
- 0.151 proprietary_anomaly_write_exe_and_obsfucate_extension
- 0.127 reads_self
- 0.119 infostealer_ftp
- 0.116 stealth_file
- 0.107 bootkit
- 0.095 ransomware_extensions
- 0.086 virus
- 0.078 antiav_detectfile
- 0.073 infostealer_im
- 0.067 antivm_generic_disk
- 0.056 antianalysis_detectreg
- 0.055 infostealer_bitcoin
- 0.054 proprietary_anomaly_massive_file_ops
- 0.041 ransomware_files
- 0.04 infostealer_mail
- 0.037 antivm_generic_scsi
- 0.035 hancitor_behavior
- 0.034 anomaly_persistence_autorun
- 0.033 proprietary_malicious_write_executeable_under_temp_to_regrun
- 0.031 antivm_vbox_files
- 0.027 sets_autoconfig_url
- 0.026 securityxploded_modules
- 0.023 ransomware_message
- 0.023 ipc_namedpipe
- 0.022 antivm_generic_services
- 0.021 anormaly_invoke_kills
- 0.02 injection_createremotethread
- 0.019 infostealer_browser
- 0.018 ransomware_file_modifications
- 0.018 infostealer_browser_password
- 0.017 proprietary_anomaly_write_exe_and_dll_under_winroot_run
- 0.017 kibex_behavior
- 0.015 betabot_behavior
- 0.015 kovter_behavior
- 0.015 geodo_banking_trojan
- 0.014 antidbg_windows
- 0.014 disables_wfp
- 0.014 injection_runpe
- 0.014 antidbg_devices
- 0.014 darkcomet_regkeys
- 0.013 disables_spdy
- 0.013 antivm_parallels_keys
- 0.013 antivm_xen_keys
- 0.012 antiemu_wine_func
- 0.011 rat_luminosity
- 0.011 proprietary_domain_bl
- 0.01 antiav_avast_libs
- 0.01 office_dl_write_exe
- 0.01 antisandbox_sunbelt_libs
- 0.01 disables_browser_warn
- 0.01 recon_fingerprint
- 0.009 proprietary_anomaly_terminated_process
- 0.009 network_tor
- 0.009 antivm_generic_diskreg
- 0.009 rat_pcclient
- 0.008 office_write_exe
- 0.008 antisandbox_sboxie_libs
- 0.008 vawtrak_behavior
- 0.007 antiav_bitdefender_libs
- 0.007 browser_security
- 0.006 rat_nanocore
- 0.006 process_interest
- 0.006 antisandbox_productid
- 0.006 modify_proxy
- 0.006 codelux_behavior
- 0.005 tinba_behavior
- 0.005 anomaly_persistence_bootexecute
- 0.005 kazybot_behavior
- 0.005 shifu_behavior
- 0.005 antivm_vbox_keys
- 0.005 antivm_vmware_files
- 0.005 antivm_vmware_keys
- 0.005 browser_addon
- 0.004 banker_prinimalka
- 0.004 hawkeye_behavior
- 0.004 antivm_vbox_libs
- 0.004 ransomware_dmalocker
- 0.004 anomaly_reset_winsock
- 0.004 creates_largekey
- 0.004 cerber_behavior
- 0.004 bypass_firewall
- 0.004 sniffer_winpcap
- 0.004 antivm_generic_cpu
- 0.004 antivm_xen_keys
- 0.004 antivm_hyperv_keys
- 0.004 antivm_vbox_acpi
- 0.004 antivm_vpc_keys
- 0.004 proprietary_anomaly_invoke_vb_vba
- 0.004 packer_armadillo_regkey
- 0.004 recon_programs
- 0.003 antivm_vbox_window
- 0.003 kelihos_behavior
- 0.003 process_needed
- 0.003 antivm_generic_bios
- 0.003 antivm_generic_system
- 0.003 banker_cridex
- 0.003 disables_system_restore
- 0.003 disables_windows_defender
- 0.003 malicous_targeted_flame
- 0.003 network_tor_service
- 0.003 stealth_modify_uac_prompt
- 0.002 injection_explorer
- 0.002 ransomeware_modifies_desktop_wallpaper
- 0.002 exec_crash
- 0.002 antisandbox_script_timer
- 0.002 pony_behavior
- 0.002 antianalysis_detectfile
- 0.002 antisandbox_sunbelt_files
- 0.002 antivm_vpc_files
- 0.002 proprietary_malicious_drop_executable_file_to_temp_folder
- 0.002 network_torgateway
- 0.002 office_security
- 0.002 ransomware_radamant
- 0.002 rat_spynet
- 0.002 stealth_hiddenreg
- 0.002 stealth_hide_notifications
- 0.002 stealth_modify_security_center_warnings
- 0.001 powershell_command
- 0.001 upatre_behavior
- 0.001 stealth_childproc
- 0.001 stealth_hidden_window
- 0.001 antivm_vmware_libs
- 0.001 proprietary_anomaly_heavy_create_suspended
- 0.001 bcdedit_command
- 0.001 gootkit_behavior
- 0.001 ursnif_behavior
- 0.001 dead_link
- 0.001 debugs_self
- 0.001 deletes_shadow_copies
- 0.001 h1n1_behavior
- 0.001 spreading_autoruninf
- 0.001 modifies_certs
- 0.001 modifies_hostfile
- 0.001 antiav_srp
- 0.001 antisandbox_fortinet_files
- 0.001 antisandbox_threattrack_files
- 0.001 antivm_vbox_devices
- 0.001 bitcoin_opencl
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_startpage
- 0.001 disables_app_launch
- 0.001 disables_uac
- 0.001 disables_wer
- 0.001 disables_windowsupdate
- 0.001 dropper
- 0.001 troldesh_behavior
- 0.001 proprietary_bad_drop
- 0.001 network_cnc_http
- 0.001 locker_regedit
- 0.001 locker_taskmgr
- 0.001 stealth_hidden_extension
Reporting ( 1.381 seconds )
- 1.337 ReportHTMLSummary
- 0.044 Malheur
| Task ID | 744440 |
|---|---|
| Mongo ID | 662f0aa3dc327b46c18112f5 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号