分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-shaapp03-1 | 2024-04-29 16:24:04 | 2024-04-29 16:24:41 | 37 秒 |
魔盾分数
1.4
正常的
文件详细信息
| 文件名 | Titan Patch.dll |
|---|---|
| 文件大小 | 242176 字节 |
| 文件类型 | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| MD5 | b3ba8a9236f840045988c6492b7b24db |
| SHA1 | c998037110fb54b3597208c8af69dcbcc1c957d1 |
| SHA256 | 45bc4ed9e4a6251ff8261dd8a1dd6ffb3b269e84ed376054526bd2433e8d69d7 |
| SHA512 | ca508b32247bb315643c21c451700a3604c243c20e31a8d825f26560047fa7fb6b80e11a1ae04748578869f1e5bb0d0ed63ff3f51773dcb78c3150a1a349710d |
| CRC32 | 98484231 |
| Ssdeep | 3072:lEkMLXhsO6gWwdwZqU+m5Zj85DmYiEEd86eW5q+eIyEgUOhoknMJeMhuWsEGEGhh:zEhsCgqUz5Zj85DHi5d8cnEce7EM |
| Yara | 登录查看Yara规则 |
| 找不到该样本 提交漏报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x180000000 |
|---|---|
| 入口地址 | 0x180008bb4 |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x0004239b |
| 最低操作系统版本要求 | 6.0 |
| PDB路径 | F:\Desktop\12\mdays - \xe5\x89\xaf\xe6\x9c\xac\x64\Release\hwdcrack.pdb |
| 编译时间 | 2024-04-29 03:23:53 |
| 载入哈希 | 89bbbd53c7ab1257c481a2de3e1d98b8 |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x000264bc | 0x00026600 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.43 |
| .rdata | 0x00028000 | 0x0000fc84 | 0x0000fe00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.82 |
| .data | 0x00038000 | 0x00003180 | 0x00001600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 3.64 |
| .pdata | 0x0003c000 | 0x00002574 | 0x00002600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.36 |
| _RDATA | 0x0003f000 | 0x0000015c | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 2.82 |
| .rsrc | 0x00040000 | 0x000000f8 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 2.51 |
| .reloc | 0x00041000 | 0x00000928 | 0x00000a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 5.26 |
资源
| 名称 | 偏移量 | 大小 | 语言 | 子语言 | 熵(Entropy) | 文件类型 |
|---|---|---|---|---|---|---|
| RT_MANIFEST | 0x00040060 | 0x00000091 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.89 | XML 1.0 document text |
导入
库: KERNEL32.dll:
• 0x180028000 Process32First
• 0x180028008 VirtualProtect
• 0x180028010 Module32Next
• 0x180028018 Module32First
• 0x180028020 GetModuleHandleA
• 0x180028028 CreateToolhelp32Snapshot
• 0x180028030 Sleep
• 0x180028038 Process32Next
• 0x180028040 CloseHandle
• 0x180028048 CreateThread
• 0x180028050 GetProcAddress
• 0x180028058 SetConsoleCP
• 0x180028060 SetConsoleOutputCP
• 0x180028068 AllocConsole
• 0x180028070 GetModuleHandleW
• 0x180028078 WriteConsoleW
• 0x180028080 SetEndOfFile
• 0x180028088 QueryPerformanceCounter
• 0x180028090 QueryPerformanceFrequency
• 0x180028098 WideCharToMultiByte
• 0x1800280a0 GetCurrentThreadId
• 0x1800280a8 EnterCriticalSection
• 0x1800280b0 LeaveCriticalSection
• 0x1800280b8 InitializeCriticalSectionEx
• 0x1800280c0 DeleteCriticalSection
• 0x1800280c8 EncodePointer
• 0x1800280d0 DecodePointer
• 0x1800280d8 MultiByteToWideChar
• 0x1800280e0 LCMapStringEx
• 0x1800280e8 FlsAlloc
• 0x1800280f0 FlsGetValue
• 0x1800280f8 FlsSetValue
• 0x180028100 FlsFree
• 0x180028108 ReleaseSRWLockExclusive
• 0x180028110 AcquireSRWLockExclusive
• 0x180028118 WakeAllConditionVariable
• 0x180028120 SleepConditionVariableSRW
• 0x180028128 GetSystemTimeAsFileTime
• 0x180028130 GetStringTypeW
• 0x180028138 GetCPInfo
• 0x180028140 RtlCaptureContext
• 0x180028148 RtlLookupFunctionEntry
• 0x180028150 RtlVirtualUnwind
• 0x180028158 UnhandledExceptionFilter
• 0x180028160 SetUnhandledExceptionFilter
• 0x180028168 GetCurrentProcess
• 0x180028170 TerminateProcess
• 0x180028178 IsProcessorFeaturePresent
• 0x180028180 IsDebuggerPresent
• 0x180028188 GetStartupInfoW
• 0x180028190 GetCurrentProcessId
• 0x180028198 InitializeSListHead
• 0x1800281a0 GetLastError
• 0x1800281a8 HeapCreate
• 0x1800281b0 HeapDestroy
• 0x1800281b8 HeapAlloc
• 0x1800281c0 HeapReAlloc
• 0x1800281c8 HeapFree
• 0x1800281d0 OpenThread
• 0x1800281d8 SuspendThread
• 0x1800281e0 ResumeThread
• 0x1800281e8 GetThreadContext
• 0x1800281f0 SetThreadContext
• 0x1800281f8 FlushInstructionCache
• 0x180028200 Thread32First
• 0x180028208 Thread32Next
• 0x180028210 GetSystemInfo
• 0x180028218 VirtualAlloc
• 0x180028220 VirtualFree
• 0x180028228 VirtualQuery
• 0x180028230 RtlUnwindEx
• 0x180028238 RtlPcToFileHeader
• 0x180028240 RaiseException
• 0x180028248 InterlockedFlushSList
• 0x180028250 SetLastError
• 0x180028258 InitializeCriticalSectionAndSpinCount
• 0x180028260 TlsAlloc
• 0x180028268 TlsGetValue
• 0x180028270 TlsSetValue
• 0x180028278 TlsFree
• 0x180028280 FreeLibrary
• 0x180028288 LoadLibraryExW
• 0x180028290 GetModuleHandleExW
• 0x180028298 ExitProcess
• 0x1800282a0 GetModuleFileNameW
• 0x1800282a8 LCMapStringW
• 0x1800282b0 GetLocaleInfoW
• 0x1800282b8 IsValidLocale
• 0x1800282c0 GetUserDefaultLCID
• 0x1800282c8 EnumSystemLocalesW
• 0x1800282d0 GetStdHandle
• 0x1800282d8 GetFileType
• 0x1800282e0 FlushFileBuffers
• 0x1800282e8 WriteFile
• 0x1800282f0 GetConsoleOutputCP
• 0x1800282f8 GetConsoleMode
• 0x180028300 ReadFile
• 0x180028308 GetFileSizeEx
• 0x180028310 SetFilePointerEx
• 0x180028318 ReadConsoleW
• 0x180028320 FindClose
• 0x180028328 FindFirstFileExW
• 0x180028330 FindNextFileW
• 0x180028338 IsValidCodePage
• 0x180028340 GetACP
• 0x180028348 GetOEMCP
• 0x180028350 GetCommandLineA
• 0x180028358 GetCommandLineW
• 0x180028360 GetEnvironmentStringsW
• 0x180028368 FreeEnvironmentStringsW
• 0x180028370 GetProcessHeap
• 0x180028378 SetStdHandle
• 0x180028380 CreateFileW
• 0x180028388 HeapSize
• 0x180028390 RtlUnwind
.text
`.rdata
@.data
.pdata
@_RDATA
@.rsrc
@.reloc
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49160 | 104.114.76.194 | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 59401 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49160 | 104.114.76.194 | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 59401 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip | GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 15.125 seconds )
- 12.11 Suricata
- 1.751 NetworkAnalysis
- 0.597 Static
- 0.335 peid
- 0.305 TargetInfo
- 0.011 AnalysisInfo
- 0.011 Strings
- 0.003 BehaviorAnalysis
- 0.002 Memory
Signatures ( 1.508 seconds )
- 1.428 proprietary_url_bl
- 0.011 antiav_detectreg
- 0.009 proprietary_domain_bl
- 0.005 anomaly_persistence_autorun
- 0.005 antiav_detectfile
- 0.005 infostealer_ftp
- 0.004 geodo_banking_trojan
- 0.004 ransomware_extensions
- 0.004 ransomware_files
- 0.003 antianalysis_detectreg
- 0.003 infostealer_bitcoin
- 0.003 infostealer_im
- 0.003 network_http
- 0.002 tinba_behavior
- 0.002 antivm_vbox_files
- 0.002 disables_browser_warn
- 0.002 infostealer_mail
- 0.002 proprietary_malicious_drop_executable_file_to_temp_folder
- 0.001 rat_nanocore
- 0.001 betabot_behavior
- 0.001 cerber_behavior
- 0.001 antianalysis_detectfile
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_addon
- 0.001 browser_security
- 0.001 modify_proxy
- 0.001 proprietary_bad_drop
- 0.001 network_cnc_http
Reporting ( 0.531 seconds )
- 0.531 ReportHTMLSummary
| Task ID | 744450 |
|---|---|
| Mongo ID | 662f59887e769a05bb3db619 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号