恶意软件分析 & URL链接扫描免费在线病毒分析平台

分析任务

分析类型	虚拟机标签	开始时间	结束时间	持续时间
文件 (Windows)	win7-sp1-x64-shaapp02-1	2024-11-30 21:55:30	2024-11-30 21:56:07	37 秒

魔盾分数

2.35

可疑的

文件详细信息

文件名	tests.exe
文件大小	1150976 字节
文件类型	PE32+ executable (console) x86-64, for MS Windows
MD5	b52804806aba3e36a07d6867d5bff5aa
SHA1	8737876116c1795941e4052585811d9370185fe5
SHA256	970feba828b90020d4bc2daa7891d1f0d5803ca712ef60725040c562b2d3e8c6
SHA512	102dd97a5fb58ea47eedbe684c23eb20d5cc879e644709bdc59ff4903937562696e4973db74041290bdc7595af33ee8f979fa43ba1e89e0124a7fab62ee6ebce
CRC32	8BD6CBAB
Ssdeep	12288:rMagz8IFwOhwEne5HTJgj6yXln1JeTepvaMW:r1gz8yh1qFojpvaR
Yara	登录查看Yara规则
	找不到该样本提交漏报

登录查看威胁特征

运行截图

没有可用的屏幕截图

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

摘要

登录查看详细行为信息

PE 信息

初始地址	0x140000000
入口地址	0x1400aad30
声明校验值	0x00000000
实际校验值	0x0011b5c0
最低操作系统版本要求	6.0
PDB路径	D:\Program Files\EXE\Y3Y\yuzu\build\bin\Release\tests.pdb
编译时间	2024-03-31 05:07:43
载入哈希	0a082d366da1d701957f51bfd93700e8

PE 数据组成

名称	虚拟地址	虚拟大小	原始数据大小	特征	熵(Entropy)
.text	0x00001000	0x000caebc	0x000cb000	IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ	6.23
.rdata	0x000cc000	0x00035860	0x00035a00	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	5.30
.data	0x00102000	0x000b17c8	0x0000ca00	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	5.00
.pdata	0x001b4000	0x00009444	0x00009600	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	5.96
.reloc	0x001be000	0x0000207c	0x00002200	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ	5.37

导入

库: WS2_32.dll:

• 0x1400cc6d0 bind

• 0x1400cc6d8 WSAPoll

• 0x1400cc6e0 WSAStringToAddressW

• 0x1400cc6e8 sendto

• 0x1400cc6f0 send

• 0x1400cc6f8 recvfrom

• 0x1400cc700 recv

• 0x1400cc708 listen

• 0x1400cc710 getsockopt

• 0x1400cc718 getpeername

• 0x1400cc720 connect

• 0x1400cc728 accept

• 0x1400cc730 WSAAddressToStringW

• 0x1400cc738 WSASocketW

• 0x1400cc740 WSASendTo

• 0x1400cc748 WSASend

• 0x1400cc750 WSARecvFrom

• 0x1400cc758 WSAGetLastError

• 0x1400cc760 WSASetLastError

• 0x1400cc768 WSACleanup

• 0x1400cc770 WSAStartup

• 0x1400cc778 shutdown

• 0x1400cc780 setsockopt

• 0x1400cc788 select

• 0x1400cc790 ntohs

• 0x1400cc798 ntohl

• 0x1400cc7a0 htons

• 0x1400cc7a8 htonl

• 0x1400cc7b0 getsockname

• 0x1400cc7b8 ioctlsocket

• 0x1400cc7c0 closesocket

• 0x1400cc7c8 socket

库: boost_context-vc143-mt-x64-1_83.dll:

• 0x1400cca40 make_fcontext

• 0x1400cca48 jump_fcontext

库: fmt.dll:

• 0x1400cca58 ?throw_format_error@detail@v10@fmt@@YAXPEBD@Z

• 0x1400cca60 ?write_loc@detail@v10@fmt@@YA_NVappender@23@Vloc_value@23@AEBU?$format_specs@D@23@Vlocale_ref@123@@Z

• 0x1400cca68 ?is_printable@detail@v10@fmt@@YA_NI@Z

• 0x1400cca70 ?vformat@v10@fmt@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v10@fmt@@D@v10@fmt@@@12@@Z

库: KERNEL32.dll:

• 0x1400cc000 GetModuleHandleW

• 0x1400cc008 ReleaseSRWLockExclusive

• 0x1400cc010 AcquireSRWLockExclusive

• 0x1400cc018 Sleep

• 0x1400cc020 GetSystemTimePreciseAsFileTime

• 0x1400cc028 GetLocaleInfoEx

• 0x1400cc030 TerminateProcess

• 0x1400cc038 InitializeSListHead

• 0x1400cc040 GetSystemTimeAsFileTime

• 0x1400cc048 GetCurrentThreadId

• 0x1400cc050 GetCurrentProcessId

• 0x1400cc058 QueryPerformanceCounter

• 0x1400cc060 IsProcessorFeaturePresent

• 0x1400cc068 CloseHandle

• 0x1400cc070 GetLastError

• 0x1400cc078 SetLastError

• 0x1400cc080 CreateIoCompletionPort

• 0x1400cc088 GetQueuedCompletionStatus

• 0x1400cc090 PostQueuedCompletionStatus

• 0x1400cc098 EnterCriticalSection

• 0x1400cc0a0 LeaveCriticalSection

• 0x1400cc0a8 InitializeCriticalSectionAndSpinCount

• 0x1400cc0b0 DeleteCriticalSection

• 0x1400cc0b8 SetEvent

• 0x1400cc0c0 WaitForSingleObject

• 0x1400cc0c8 SleepEx

• 0x1400cc0d0 CreateEventW

• 0x1400cc0d8 SetWaitableTimer

• 0x1400cc0e0 WaitForMultipleObjects

• 0x1400cc0e8 QueueUserAPC

• 0x1400cc0f0 TerminateThread

• 0x1400cc0f8 LocalFree

• 0x1400cc100 FormatMessageA

• 0x1400cc108 FormatMessageW

• 0x1400cc110 WideCharToMultiByte

• 0x1400cc118 GetCurrentProcess

• 0x1400cc120 VirtualFree

• 0x1400cc128 VirtualFreeEx

• 0x1400cc130 DebugBreak

• 0x1400cc138 VirtualAlloc

• 0x1400cc140 FreeLibrary

• 0x1400cc148 GetProcAddress

• 0x1400cc150 LoadLibraryA

• 0x1400cc158 GetCurrentThread

• 0x1400cc160 SetThreadPriority

• 0x1400cc168 SetThreadDescription

• 0x1400cc170 GetStdHandle

• 0x1400cc178 GetConsoleScreenBufferInfo

• 0x1400cc180 SetConsoleTextAttribute

• 0x1400cc188 MultiByteToWideChar

• 0x1400cc190 CreateWaitableTimerW

• 0x1400cc198 IsDebuggerPresent

• 0x1400cc1a0 SetUnhandledExceptionFilter

• 0x1400cc1a8 SetThreadStackGuarantee

• 0x1400cc1b0 WakeAllConditionVariable

• 0x1400cc1b8 SleepConditionVariableSRW

• 0x1400cc1c0 UnhandledExceptionFilter

• 0x1400cc1c8 OutputDebugStringA

库: MSVCP140.dll:

• 0x1400cc1d8 ?uncaught_exceptions@std@@YAHXZ

• 0x1400cc1e0 ?_Xlength_error@std@@YAXPEBD@Z

• 0x1400cc1e8 ?good@ios_base@std@@QEBA_NXZ

• 0x1400cc1f0 ?flags@ios_base@std@@QEBAHXZ

• 0x1400cc1f8 ?width@ios_base@std@@QEBA_JXZ

• 0x1400cc200 ?width@ios_base@std@@QEAA_J_J@Z

• 0x1400cc208 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

• 0x1400cc210 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

• 0x1400cc218 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

• 0x1400cc220 ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

• 0x1400cc228 ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

• 0x1400cc230 ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ

• 0x1400cc238 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

• 0x1400cc240 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

• 0x1400cc248 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z

• 0x1400cc250 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

• 0x1400cc258 ?_Xout_of_range@std@@YAXPEBD@Z

• 0x1400cc260 _Thrd_join

• 0x1400cc268 _Thrd_id

• 0x1400cc270 _Mtx_init_in_situ

• 0x1400cc278 _Mtx_destroy_in_situ

• 0x1400cc280 _Mtx_lock

• 0x1400cc288 _Mtx_unlock

• 0x1400cc290 _Cnd_do_broadcast_at_thread_exit

• 0x1400cc298 ?_Throw_Cpp_error@std@@YAXH@Z

• 0x1400cc2a0 _Thrd_yield

• 0x1400cc2a8 ?__ExceptionPtrCreate@@YAXPEAX@Z

• 0x1400cc2b0 ?__ExceptionPtrDestroy@@YAXPEAX@Z

• 0x1400cc2b8 ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z

• 0x1400cc2c0 ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z

• 0x1400cc2c8 ?__ExceptionPtrCurrentException@@YAXPEAX@Z

• 0x1400cc2d0 ?__ExceptionPtrRethrow@@YAXPEBX@Z

• 0x1400cc2d8 ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z

• 0x1400cc2e0 _Cnd_init_in_situ

• 0x1400cc2e8 _Cnd_destroy_in_situ

• 0x1400cc2f0 _Cnd_timedwait

• 0x1400cc2f8 _Cnd_signal

• 0x1400cc300 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z

• 0x1400cc308 _Mtx_trylock

• 0x1400cc310 ?_Xbad_function_call@std@@YAXXZ

• 0x1400cc318 _Query_perf_counter

• 0x1400cc320 _Query_perf_frequency

• 0x1400cc328 ?_Xbad_alloc@std@@YAXXZ

• 0x1400cc330 _Cnd_wait

• 0x1400cc338 ?_Syserror_map@std@@YAPEBDH@Z

• 0x1400cc340 ?_Winerror_map@std@@YAHH@Z

• 0x1400cc348 ?_Xinvalid_argument@std@@YAXPEBD@Z

• 0x1400cc350 ??Bid@locale@std@@QEAA_KXZ

• 0x1400cc358 ??Bios_base@std@@QEBA_NXZ

• 0x1400cc360 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

• 0x1400cc368 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

• 0x1400cc370 ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

• 0x1400cc378 ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

• 0x1400cc380 ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

• 0x1400cc388 ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

• 0x1400cc390 ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

• 0x1400cc398 ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

• 0x1400cc3a0 ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

• 0x1400cc3a8 ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

• 0x1400cc3b0 ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

• 0x1400cc3b8 ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

• 0x1400cc3c0 ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z

• 0x1400cc3c8 ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

• 0x1400cc3d0 ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

• 0x1400cc3d8 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

• 0x1400cc3e0 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

• 0x1400cc3e8 ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

• 0x1400cc3f0 ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

• 0x1400cc3f8 ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

• 0x1400cc400 ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

• 0x1400cc408 ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

• 0x1400cc410 ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

• 0x1400cc418 ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

• 0x1400cc420 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

• 0x1400cc428 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

• 0x1400cc430 ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

• 0x1400cc438 ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

• 0x1400cc440 ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

• 0x1400cc448 ?fail@ios_base@std@@QEBA_NXZ

• 0x1400cc450 ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

• 0x1400cc458 ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z

• 0x1400cc460 ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z

• 0x1400cc468 ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z

• 0x1400cc470 ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z

• 0x1400cc478 ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

• 0x1400cc480 ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z

• 0x1400cc488 ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z

• 0x1400cc490 ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

• 0x1400cc498 _Thrd_detach

• 0x1400cc4a0 ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

• 0x1400cc4a8 ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

• 0x1400cc4b0 ?_Random_device@std@@YAIXZ

• 0x1400cc4b8 ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

• 0x1400cc4c0 ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

• 0x1400cc4c8 ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

• 0x1400cc4d0 ?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEBV12@@Z

• 0x1400cc4d8 ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

• 0x1400cc4e0 ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

• 0x1400cc4e8 ?uncaught_exception@std@@YA_NXZ

• 0x1400cc4f0 ?setf@ios_base@std@@QEAAHHH@Z

• 0x1400cc4f8 ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z

• 0x1400cc500 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

• 0x1400cc508 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z

• 0x1400cc510 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

• 0x1400cc518 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z

• 0x1400cc520 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z

• 0x1400cc528 ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z

• 0x1400cc530 ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

• 0x1400cc538 ??0_Lockit@std@@QEAA@H@Z

• 0x1400cc540 ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z

• 0x1400cc548 ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

• 0x1400cc550 ?__ExceptionPtrToBool@@YA_NPEBX@Z

• 0x1400cc558 ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z

• 0x1400cc560 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

• 0x1400cc568 ?flags@ios_base@std@@QEAAHH@Z

• 0x1400cc570 ?setf@ios_base@std@@QEAAHH@Z

• 0x1400cc578 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z

• 0x1400cc580 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x1400cc588 ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x1400cc590 ?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x1400cc598 ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

• 0x1400cc5a0 ?always_noconv@codecvt_base@std@@QEBA_NXZ

• 0x1400cc5a8 ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

• 0x1400cc5b0 ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

• 0x1400cc5b8 ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

• 0x1400cc5c0 ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

• 0x1400cc5c8 ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

• 0x1400cc5d0 ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

• 0x1400cc5d8 ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

• 0x1400cc5e0 ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ

• 0x1400cc5e8 ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

• 0x1400cc5f0 ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ

• 0x1400cc5f8 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ

• 0x1400cc600 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z

• 0x1400cc608 ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

• 0x1400cc610 ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

• 0x1400cc618 _Xtime_get_ticks

• 0x1400cc620 ??1_Lockit@std@@QEAA@XZ

库: MSVCP140_ATOMIC_WAIT.dll:

• 0x1400cc630 __std_atomic_wait_direct

• 0x1400cc638 __std_atomic_notify_all_direct

库: VCRUNTIME140.dll:

• 0x1400cc648 __std_type_info_compare

• 0x1400cc650 __current_exception

• 0x1400cc658 memchr

• 0x1400cc660 __current_exception_context

• 0x1400cc668 memmove

• 0x1400cc670 memcmp

• 0x1400cc678 memcpy

• 0x1400cc680 _CxxThrowException

• 0x1400cc688 __std_exception_destroy

• 0x1400cc690 __std_exception_copy

• 0x1400cc698 __std_terminate

• 0x1400cc6a0 __C_specific_handler

• 0x1400cc6a8 memset

• 0x1400cc6b0 _purecall

库: VCRUNTIME140_1.dll:

• 0x1400cc6c0 __CxxFrameHandler4

库: api-ms-win-crt-heap-l1-1-0.dll:

• 0x1400cc828 _callnewh

• 0x1400cc830 free

• 0x1400cc838 malloc

• 0x1400cc840 _aligned_free

• 0x1400cc848 _set_new_mode

库: api-ms-win-crt-runtime-l1-1-0.dll:

• 0x1400cc880 _register_thread_local_exe_atexit_callback

• 0x1400cc888 __p___argv

• 0x1400cc890 __p___argc

• 0x1400cc898 _exit

• 0x1400cc8a0 exit

• 0x1400cc8a8 _seh_filter_exe

• 0x1400cc8b0 _initterm_e

• 0x1400cc8b8 _initterm

• 0x1400cc8c0 _c_exit

• 0x1400cc8c8 _cexit

• 0x1400cc8d0 _crt_atexit

• 0x1400cc8d8 terminate

• 0x1400cc8e0 _register_onexit_function

• 0x1400cc8e8 _set_app_type

• 0x1400cc8f0 _beginthreadex

• 0x1400cc8f8 _get_initial_narrow_environment

• 0x1400cc900 _configure_narrow_argv

• 0x1400cc908 _initialize_narrow_environment

• 0x1400cc910 _initialize_onexit_table

• 0x1400cc918 abort

• 0x1400cc920 _errno

• 0x1400cc928 _invalid_parameter_noinfo_noreturn

库: api-ms-win-crt-utility-l1-1-0.dll:

• 0x1400cca30 rand

库: api-ms-win-crt-math-l1-1-0.dll:

• 0x1400cc868 __setusermatherr

• 0x1400cc870 ceilf

库: api-ms-win-crt-stdio-l1-1-0.dll:

• 0x1400cc938 fputc

• 0x1400cc940 fgetpos

• 0x1400cc948 fgetc

• 0x1400cc950 _get_stream_buffer_pointers

• 0x1400cc958 fsetpos

• 0x1400cc960 __stdio_common_vsprintf

• 0x1400cc968 __stdio_common_vfprintf

• 0x1400cc970 __stdio_common_vsprintf_s

• 0x1400cc978 __acrt_iob_func

• 0x1400cc980 ungetc

• 0x1400cc988 __p__commode

• 0x1400cc990 _set_fmode

• 0x1400cc998 fclose

• 0x1400cc9a0 fflush

• 0x1400cc9a8 setvbuf

• 0x1400cc9b0 fread

• 0x1400cc9b8 _fseeki64

• 0x1400cc9c0 fwrite

• 0x1400cc9c8 getchar

库: api-ms-win-crt-string-l1-1-0.dll:

• 0x1400cc9d8 _stricmp

• 0x1400cc9e0 tolower

• 0x1400cc9e8 strcmp

• 0x1400cc9f0 strncmp

• 0x1400cc9f8 isalnum

• 0x1400cca00 strncpy

库: api-ms-win-crt-convert-l1-1-0.dll:

• 0x1400cc7d8 strtol

• 0x1400cc7e0 strtoull

• 0x1400cc7e8 strtof

• 0x1400cc7f0 strtoll

库: api-ms-win-crt-time-l1-1-0.dll:

• 0x1400cca10 _gmtime64_s

• 0x1400cca18 strftime

• 0x1400cca20 _time64

库: api-ms-win-crt-filesystem-l1-1-0.dll:

• 0x1400cc810 _unlock_file

• 0x1400cc818 _lock_file

库: api-ms-win-crt-environment-l1-1-0.dll:

• 0x1400cc800 getenv

库: api-ms-win-crt-locale-l1-1-0.dll:

• 0x1400cc858 _configthreadlocale

库: ntdll.dll:

• 0x1400cca80 RtlLookupFunctionEntry

• 0x1400cca88 RtlVirtualUnwind

• 0x1400cca90 RtlCaptureContext

• 0x1400cca98 NtDelayExecution

.text
`.rdata
@.data
.pdata
@.reloc
D$x.;

没有防病毒引擎扫描信息!

下载PCAP包

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

TCP

源地址	源端口	目标地址	目标端口
192.168.122.201	49160	23.212.62.85	80

UDP

源地址	源端口	目标地址	目标端口
192.168.122.201	63246	192.168.122.1	53

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

TCP

源地址	源端口	目标地址	目标端口
192.168.122.201	49160	23.212.62.85	80

UDP

源地址	源端口	目标地址	目标端口
192.168.122.201	63246	192.168.122.1	53

HTTP 请求

URI	HTTP数据
URL专业沙箱检测 -> http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip	GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1 Accept: / If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT User-Agent: IPM Host: acroipm.adobe.com Connection: Keep-Alive Cache-Control: no-cache

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

No TLS

Suricata HTTP

No Suricata HTTP

未发现网络提取文件

抱歉! 没有任何文件投放。

没有发现相似的分析.

HTML 总结报告 (需15-60分钟同步)	下载

Processing ( 19.258 seconds )

12.79 Suricata
4.552 Static
0.974 NetworkAnalysis
0.531 TargetInfo
0.361 peid
0.028 AnalysisInfo
0.011 Strings
0.005 Memory
0.004 BehaviorAnalysis
0.002 config_decoder

Signatures ( 1.555 seconds )

1.467 proprietary_url_bl
0.013 antiav_detectreg
0.01 proprietary_domain_bl
0.007 ransomware_extensions
0.006 anomaly_persistence_autorun
0.005 antiav_detectfile
0.005 infostealer_ftp
0.004 geodo_banking_trojan
0.004 ransomware_files
0.003 infostealer_bitcoin
0.003 infostealer_im
0.003 network_http
0.002 tinba_behavior
0.002 rat_nanocore
0.002 cerber_behavior
0.002 antianalysis_detectreg
0.002 antivm_vbox_files
0.002 disables_browser_warn
0.002 infostealer_mail
0.002 proprietary_bad_drop
0.001 betabot_behavior
0.001 antivm_parallels_keys
0.001 bot_drive
0.001 bot_drive2
0.001 browser_security
0.001 modify_proxy
0.001 proprietary_malicious_drop_executable_file_to_temp_folder
0.001 proprietary_anomaly_mismatch_mime_extension
0.001 network_cnc_http

Reporting ( 0.527 seconds )

0.519 ReportHTMLSummary
0.008 Malheur


Task ID	764219
Mongo ID	674b199cdc327b16b9727628
Cuckoo release	1.4-Maldun