分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-shaapp02-1 | 2024-04-25 22:36:23 | 2024-04-25 22:37:09 | 46 秒 |
魔盾分数
6.5603125
危险的
文件详细信息
| 文件名 | uninst.exe |
|---|---|
| 文件大小 | 2284480 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 1f1b7076af28d9049f5c6edc568ff37a |
| SHA1 | ed96821d468715f11c4f058ae325f9d59c0ca9da |
| SHA256 | 6fe6b7c4b14ef770126e5ba7587aee683b19d7f1327b2832b1063dd44df49891 |
| SHA512 | a586e738c427e2c31f5d490ecbf6a231cd4be13f79f118fb2e5e8fc965bfad82c19f3636e48560b102e3cc84bdadcc145586f2f7ee46b55dc138e2be005873c6 |
| CRC32 | CD5C28C0 |
| Ssdeep | 49152:LCPIauI2iFHrQ66gbilgcrySCKmVlmDe0TLRvzS:LCg/I2GB9bizrdmVlm7tS |
| Yara | 登录查看Yara规则 |
| 找不到该样本 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 152.195.38.76 | 美国 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| cacerts.digicert.com |
CNAME fp2e7a.wpc.2be4.phicdn.net CNAME fp2e7a.wpc.phicdn.net A 152.195.38.76 |
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x004030de |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x00235067 |
| 最低操作系统版本要求 | 4.0 |
| 编译时间 | 2015-12-11 15:12:34 |
| 载入哈希 | 5e27740d9754d3decf77cb65d4f31c5f |
版本信息
| LegalCopyright | |
|---|---|
| FileVersion | |
| CompanyName | |
| LegalTrademarks | |
| ProductName | |
| ProductVersion | |
| FileDescription | |
| Translation |
微软证书验证 (Sign Tool)
| SHA1 | 时间戳 | 有效性 | 错误 |
|---|---|---|---|
| None | Mon Mar 25 19:31:35 2024 | WinVerifyTrust returned error 0x80096010 |
| 证书链 | Certificate Chain 1 |
| 发行给 | DigiCert Trusted Root G4 |
| 发行人 | DigiCert Trusted Root G4 |
| 有效期 | Fri Jan 15 200000 2038 |
| SHA1 哈希 | ddfb16cd4931c973a2037d3fc83a4d7d775d05e4 |
| 证书链 | Certificate Chain 2 |
| 发行给 | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
| 发行人 | DigiCert Trusted Root G4 |
| 有效期 | Tue Apr 29 075959 2036 |
| SHA1 哈希 | 7b0f360b775f76c94a12ca48445aa2d2a875701c |
| 证书链 | Certificate Chain 3 |
| 发行给 | |
| 发行人 | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
| 有效期 | Wed Feb 05 075959 2025 |
| SHA1 哈希 | 9aa68c8a1b9886189ce3e3450552e33455efdbf7 |
| 证书链 | Timestamp Chain 1 |
| 发行给 | VeriSign Universal Root Certification Authority |
| 发行人 | VeriSign Universal Root Certification Authority |
| 有效期 | Wed Dec 02 075959 2037 |
| SHA1 哈希 | 3679ca35668772304d30a5fb873b0fa77bb70d54 |
| 证书链 | Timestamp Chain 2 |
| 发行给 | Symantec SHA256 TimeStamping CA |
| 发行人 | VeriSign Universal Root Certification Authority |
| 有效期 | Sun Jan 12 075959 2031 |
| SHA1 哈希 | 6fc9edb5e00ab64151c1cdfcac74ad2c7b7e3be4 |
| 证书链 | Timestamp Chain 3 |
| 发行给 | Symantec SHA256 TimeStamping Signer - G3 |
| 发行人 | Symantec SHA256 TimeStamping CA |
| 有效期 | Fri Mar 23 075959 2029 |
| SHA1 哈希 | a9a4121063d71d48e8529a4681de803e3e7954b0 |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x00005a97 | 0x00005c00 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 6.43 |
| .rdata | 0x00007000 | 0x0000115e | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 5.14 |
| .data | 0x00009000 | 0x0003e038 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.04 |
| .ndata | 0x00048000 | 0x0004a000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .rsrc | 0x00092000 | 0x0004f000 | 0x0003ba00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 5.09 |
导入
库: KERNEL32.dll:
• 0x407064 SetFileAttributesA
• 0x407068 GetShortPathNameA
• 0x40706c GetFullPathNameA
• 0x407070 MoveFileA
• 0x407074 SetCurrentDirectoryA
• 0x407078 GetFileAttributesA
• 0x40707c GetLastError
• 0x407080 CompareFileTime
• 0x407084 SearchPathA
• 0x407088 Sleep
• 0x40708c GetTickCount
• 0x407090 GetFileSize
• 0x407094 GetModuleFileNameA
• 0x407098 GetCurrentProcess
• 0x40709c CopyFileA
• 0x4070a0 ExitProcess
• 0x4070a4 CreateDirectoryA
• 0x4070a8 lstrcmpiA
• 0x4070ac GetCommandLineA
• 0x4070b0 SetErrorMode
• 0x4070b4 lstrcpynA
• 0x4070b8 GetDiskFreeSpaceA
• 0x4070bc GlobalUnlock
• 0x4070c0 GlobalLock
• 0x4070c4 CreateThread
• 0x4070c8 CreateProcessA
• 0x4070cc RemoveDirectoryA
• 0x4070d0 CreateFileA
• 0x4070d4 GetTempFileNameA
• 0x4070d8 lstrlenA
• 0x4070dc lstrcatA
• 0x4070e0 GetSystemDirectoryA
• 0x4070e4 GetVersion
• 0x4070e8 LoadLibraryA
• 0x4070ec SetFileTime
• 0x4070f0 CloseHandle
• 0x4070f4 GlobalFree
• 0x4070f8 lstrcmpA
• 0x4070fc ExpandEnvironmentStringsA
• 0x407100 GetExitCodeProcess
• 0x407104 GlobalAlloc
• 0x407108 WaitForSingleObject
• 0x40710c GetWindowsDirectoryA
• 0x407110 GetTempPathA
• 0x407114 GetProcAddress
• 0x407118 FindFirstFileA
• 0x40711c FindNextFileA
• 0x407120 DeleteFileA
• 0x407124 SetFilePointer
• 0x407128 ReadFile
• 0x40712c FindClose
• 0x407130 GetPrivateProfileStringA
• 0x407134 WritePrivateProfileStringA
• 0x407138 WriteFile
• 0x40713c MulDiv
• 0x407140 LoadLibraryExA
• 0x407144 GetModuleHandleA
• 0x407148 MultiByteToWideChar
• 0x40714c FreeLibrary
库: USER32.dll:
• 0x407170 GetWindowRect
• 0x407174 EnableMenuItem
• 0x407178 GetSystemMenu
• 0x40717c ScreenToClient
• 0x407180 SetClassLongA
• 0x407184 IsWindowEnabled
• 0x407188 SetWindowPos
• 0x40718c GetSysColor
• 0x407190 GetWindowLongA
• 0x407194 SetCursor
• 0x407198 LoadCursorA
• 0x40719c CheckDlgButton
• 0x4071a0 GetMessagePos
• 0x4071a4 LoadBitmapA
• 0x4071a8 CallWindowProcA
• 0x4071ac IsWindowVisible
• 0x4071b0 CloseClipboard
• 0x4071b4 SetForegroundWindow
• 0x4071b8 PostQuitMessage
• 0x4071bc RegisterClassA
• 0x4071c0 EndDialog
• 0x4071c4 AppendMenuA
• 0x4071c8 CreatePopupMenu
• 0x4071cc GetSystemMetrics
• 0x4071d0 SetDlgItemTextA
• 0x4071d4 GetDlgItemTextA
• 0x4071d8 MessageBoxIndirectA
• 0x4071dc CharPrevA
• 0x4071e0 DispatchMessageA
• 0x4071e4 PeekMessageA
• 0x4071e8 EnableWindow
• 0x4071ec InvalidateRect
• 0x4071f0 SendMessageA
• 0x4071f4 DefWindowProcA
• 0x4071f8 BeginPaint
• 0x4071fc GetClientRect
• 0x407200 FillRect
• 0x407204 DrawTextA
• 0x407208 EndPaint
• 0x40720c SystemParametersInfoA
• 0x407210 CreateWindowExA
• 0x407214 GetClassInfoA
• 0x407218 DialogBoxParamA
• 0x40721c CharNextA
• 0x407220 ExitWindowsEx
• 0x407224 DestroyWindow
• 0x407228 OpenClipboard
• 0x40722c TrackPopupMenu
• 0x407230 SendMessageTimeoutA
• 0x407234 GetDC
• 0x407238 LoadImageA
• 0x40723c GetDlgItem
• 0x407240 FindWindowExA
• 0x407244 IsWindow
• 0x407248 SetClipboardData
• 0x40724c SetWindowLongA
• 0x407250 EmptyClipboard
• 0x407254 SetTimer
• 0x407258 CreateDialogParamA
• 0x40725c wsprintfA
• 0x407260 ShowWindow
• 0x407264 SetWindowTextA
库: GDI32.dll:
• 0x407040 SelectObject
• 0x407044 SetBkMode
• 0x407048 CreateFontIndirectA
• 0x40704c SetTextColor
• 0x407050 DeleteObject
• 0x407054 GetDeviceCaps
• 0x407058 CreateBrushIndirect
• 0x40705c SetBkColor
库: SHELL32.dll:
• 0x407154 SHGetSpecialFolderLocation
• 0x407158 SHGetPathFromIDListA
• 0x40715c SHBrowseForFolderA
• 0x407160 SHGetFileInfoA
• 0x407164 ShellExecuteA
• 0x407168 SHFileOperationA
库: ADVAPI32.dll:
• 0x407000 RegDeleteValueA
• 0x407004 SetFileSecurityA
• 0x407008 RegOpenKeyExA
• 0x40700c RegDeleteKeyA
• 0x407010 RegEnumValueA
• 0x407014 RegCloseKey
• 0x407018 RegCreateKeyExA
• 0x40701c RegSetValueExA
• 0x407020 RegQueryValueExA
• 0x407024 RegEnumKeyA
库: COMCTL32.dll:
• 0x40702c ImageList_Create
• 0x407030 ImageList_Destroy
• 0x407034 None
• 0x407038 ImageList_AddMasked
库: ole32.dll:
• 0x40726c OleUninitialize
• 0x407270 OleInitialize
• 0x407274 CoTaskMemFree
• 0x407278 CoCreateInstance
.text
.rdata
.data
.ndata
.rsrc
;5loD
;5loD
s495loD
;5loD
v#VhQ+@
j@Vh`oD
ih19@
9=loD
;=loD
9=loD
uUh4s@
>h4s@
@PWShDs@
RichEdit
RichEdit20A
RichEd32
RichEd20
.DEFAULT\Control Panel\International
Control Panel\Desktop\ResourceLocale
Software\Microsoft\Windows\CurrentVersion
\Microsoft\Internet Explorer\Quick Launch
MulDiv
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
ReadFile
WriteFile
GetPrivateProfileStringA
WritePrivateProfileStringA
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
lstrcmpA
lstrcmpiA
CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
LoadLibraryA
KERNEL32.dll
EndPaint
DrawTextA
FillRect
GetClientRect
BeginPaint
DefWindowProcA
SendMessageA
InvalidateRect
EnableWindow
GetDC
LoadImageA
SetWindowLongA
GetDlgItem
IsWindow
FindWindowExA
SendMessageTimeoutA
wsprintfA
ShowWindow
SetForegroundWindow
PostQuitMessage
SetWindowTextA
SetTimer
CreateDialogParamA
DestroyWindow
ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
USER32.dll
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
GDI32.dll
SHFileOperationA
ShellExecuteA
SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHELL32.dll
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
SetFileSecurityA
ADVAPI32.dll
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
COMCTL32.dll
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
ole32.dll
verifying installer: %d%%
http://nsis.sf.net/NSIS_Error
Error launching installer
... %d%%
SeShutdownPrivilege
\Temp
NSIS Error
Error writing temporary file. Make sure your temp folder is valid.
%u.%u%s%s
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VERSION
SHGetFolderPathA
SHFOLDER
SHAutoComplete
SHLWAPI
SHELL32
InitiateShutdownA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyExA
ADVAPI32
GetUserDefaultUILanguage
MoveFileExA
GetDiskFreeSpaceExA
SetDefaultDllDirectories
KERNEL32
*?|<>/":
%s%s.dll
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 152.195.38.76 | 美国 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49158 | 152.195.38.76 cacerts.digicert.com | 80 |
| 192.168.122.201 | 49159 | 23.10.249.155 | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 57526 | 192.168.122.1 | 53 |
| 192.168.122.201 | 63246 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| cacerts.digicert.com |
CNAME fp2e7a.wpc.2be4.phicdn.net CNAME fp2e7a.wpc.phicdn.net A 152.195.38.76 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49158 | 152.195.38.76 cacerts.digicert.com | 80 |
| 192.168.122.201 | 49159 | 23.10.249.155 | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 57526 | 192.168.122.1 | 53 |
| 192.168.122.201 | 63246 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://cacerts.digicert.com/DigiCertTrustedRootG4.crt | GET /DigiCertTrustedRootG4.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com |
| URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip | GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: */* If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 46.031 seconds )
- 23.869 VirusTotal
- 11.026 Suricata
- 5.186 NetworkAnalysis
- 4.78 Static
- 0.658 TargetInfo
- 0.396 peid
- 0.09 BehaviorAnalysis
- 0.01 AnalysisInfo
- 0.01 Strings
- 0.004 config_decoder
- 0.002 Memory
Signatures ( 3.031 seconds )
- 1.542 network_http
- 1.375 proprietary_url_bl
- 0.019 antiav_detectreg
- 0.01 proprietary_domain_bl
- 0.008 infostealer_ftp
- 0.005 anomaly_persistence_autorun
- 0.005 antiav_detectfile
- 0.005 antianalysis_detectreg
- 0.005 infostealer_im
- 0.004 api_spamming
- 0.004 geodo_banking_trojan
- 0.004 ransomware_extensions
- 0.004 ransomware_files
- 0.003 stealth_decoy_document
- 0.003 stealth_timeout
- 0.003 infostealer_bitcoin
- 0.003 infostealer_mail
- 0.002 tinba_behavior
- 0.002 antivm_vbox_files
- 0.002 bot_drive
- 0.002 disables_browser_warn
- 0.002 network_torgateway
- 0.001 bootkit
- 0.001 rat_nanocore
- 0.001 mimics_filetime
- 0.001 stealth_file
- 0.001 betabot_behavior
- 0.001 reads_self
- 0.001 kibex_behavior
- 0.001 antivm_generic_disk
- 0.001 cerber_behavior
- 0.001 virus
- 0.001 antidbg_devices
- 0.001 antivm_parallels_keys
- 0.001 antivm_xen_keys
- 0.001 bot_drive2
- 0.001 browser_security
- 0.001 modify_proxy
- 0.001 proprietary_malicious_drop_executable_file_to_temp_folder
- 0.001 proprietary_bad_drop
- 0.001 network_cnc_http
Reporting ( 0.489 seconds )
- 0.487 ReportHTMLSummary
- 0.002 Malheur
| Task ID | 744318 |
|---|---|
| Mongo ID | 662a6ae6dc327b93ab415c60 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号