分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-hpdapp01-3 | 2018-10-12 15:41:44 | 2018-10-12 15:45:06 | 202 秒 |
魔盾分数
5.4
可疑的
文件详细信息
| 文件名 | 哈啤.exe |
|---|---|
| 文件大小 | 9043968 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 83c23dd3a39402d3583a1f84b89df78c |
| SHA1 | 3019195e8d6ce3b5e26341649f8c34cf8914725c |
| SHA256 | 6c040ad4312367eb50e7b9365152f866c189cec900dc8f09daf3d3f16fd2e68a |
| SHA512 | 53020b5a3d9aba1ebfd934c790cbeeaa5faae01639c00b0deabf07f8fcc3d78a5acb2a9826657304f2d655e7b861b075c753fb683bdd8603b18f3f6ba15eb93b |
| CRC32 | 96EB06AF |
| Ssdeep | 196608:krddgN8LHgflGs3JvQURheTp0auM7Aut9UnI91QAYVrgPb:sdicelXvVRhgaZL2oI912rC |
| Yara | 登录查看Yara规则 |
| 样本下载 提交漏报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x015c091d |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x008ae551 |
| 最低操作系统版本要求 | 5.0 |
| 编译时间 | 2018-10-12 11:10:33 |
| 载入哈希 | e4d56a3a16c3c884ef9899d02fcf7c65 |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x000f31ce | 0x00000000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 0.00 |
| .rdata | 0x000f5000 | 0x0018ebac | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 0.00 |
| .data | 0x00284000 | 0x0002c848 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .vmp0 | 0x002b1000 | 0x006a6208 | 0x00000000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 0.00 |
| .vmp1 | 0x00958000 | 0x0088bbd0 | 0x0088c000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 8.00 |
| .reloc | 0x011e4000 | 0x00000118 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 0.48 |
| .rsrc | 0x011e5000 | 0x0001139d | 0x00012000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 6.90 |
导入
库: USER32.dll:
• 0x13bd00c wsprintfA
库: GDI32.dll:
• 0x13bd014 SelectClipRgn
库: WINMM.dll:
• 0x13bd01c midiStreamRestart
库: WINSPOOL.DRV:
• 0x13bd024 ClosePrinter
库: ADVAPI32.dll:
• 0x13bd02c RegCloseKey
库: SHELL32.dll:
• 0x13bd034 ShellExecuteA
库: ole32.dll:
• 0x13bd03c OleUninitialize
库: OLEAUT32.dll:
• 0x13bd044 UnRegisterTypeLib
库: COMCTL32.dll:
• 0x13bd04c ImageList_Destroy
库: WS2_32.dll:
• 0x13bd054 recvfrom
库: comdlg32.dll:
• 0x13bd05c GetFileTitleA
库: WTSAPI32.dll:
• 0x13bd064 WTSSendMessageW
库: KERNEL32.dll:
• 0x13bd06c GetCurrentProcess
库: USER32.dll:
• 0x13bd074 CharUpperBuffW
库: ADVAPI32.dll:
• 0x13bd07c RegQueryValueExA
库: KERNEL32.dll:
• 0x13bd084 LocalAlloc
• 0x13bd088 GetCurrentProcess
• 0x13bd08c GetCurrentThread
• 0x13bd090 LocalFree
• 0x13bd094 GetModuleFileNameW
• 0x13bd098 GetProcessAffinityMask
• 0x13bd09c SetProcessAffinityMask
• 0x13bd0a0 SetThreadAffinityMask
• 0x13bd0a4 Sleep
• 0x13bd0a8 ExitProcess
• 0x13bd0ac GetLastError
• 0x13bd0b0 FreeLibrary
• 0x13bd0b4 LoadLibraryA
• 0x13bd0b8 GetModuleHandleA
• 0x13bd0bc GetProcAddress
库: ADVAPI32.dll:
• 0x13bd0c4 OpenSCManagerW
• 0x13bd0c8 EnumServicesStatusExW
• 0x13bd0cc OpenServiceW
• 0x13bd0d0 QueryServiceConfigW
• 0x13bd0d4 CloseServiceHandle
.text
`.rdata
@.data
.vmp0
`.vmp1
`.reloc
@.rsrc
ClosePrinter
>;?S?X?
>(>L>
:):O:
< <&<Q<W<h<
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;
;0>4>8><>@>D>H>L>P>T>X>\>
79P9e9
e5t6b7
0^2r248L8#9)<
586C6M6
1.7<7
5s5.7
0.=B=
2M;J?
376p718
F:";,?
107`8
6C7@8
7q8I;
-0w0'188l8
<8=N=
U5n5-6
>6>{>
l4>:X:
D859)?Z?
4s6~6
5G6j?
146T6l6
393G4
3P=E>
?+?q?
<^=D>
2$2(2
>W?t?
: ;K;
(tR(P
:g$:op<h
0rxw^
w^\&<Fo@
eH@[8
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
无TCP连接纪录.
UDP
无UDP连接纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
TCP
无TCP连接纪录.
UDP
无UDP连接纪录.
HTTP 请求
未发现HTTP请求.
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
| 文件名 | GDIPFONTCACHEV1.DAT |
|---|---|
| 相关文件 |
C:\Users\test\AppData\Local\GDIPFONTCACHEV1.DAT
|
| 文件大小 | 114272 字节 |
| 文件类型 | data |
| MD5 | 2262103813c49a07c65813bb58143c21 |
| SHA1 | a1e4a613f51e8e57592464c61cc271f2fecec4f2 |
| SHA256 | ac3bd52d544a061ee8c90fa787f07af9d01a0c5a72981ed8172617b210798d31 |
| CRC32 | 4C77BE6A |
| Ssdeep | 1536:mLKAaE8z5wHgTlyhAQcDnBlC+X886UMMDbEDuezh:moiuzBzXGMDezh |
| 魔盾安全分析结果 | 2.0 分析时间：2017-03-07 13:12:04 查看分析报告 |
| 下载 提交魔盾安全分析 |
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 54.141 seconds )
- 27.183 Static
- 11.941 Suricata
- 10.175 TargetInfo
- 1.906 VirusTotal
- 1.518 BehaviorAnalysis
- 0.545 AnalysisInfo
- 0.502 peid
- 0.238 NetworkAnalysis
- 0.046 Debug
- 0.044 config_decoder
- 0.019 Dropped
- 0.016 Strings
- 0.008 Memory
Signatures ( 1.706 seconds )
- 0.361 md_bad_drop
- 0.3 antiav_detectreg
- 0.105 infostealer_ftp
- 0.081 stealth_timeout
- 0.065 api_spamming
- 0.063 antianalysis_detectreg
- 0.059 infostealer_im
- 0.053 decoy_document
- 0.033 infostealer_mail
- 0.029 antivm_generic_disk
- 0.028 antivm_generic_scsi
- 0.023 mimics_filetime
- 0.023 md_url_bl
- 0.021 virus
- 0.02 stealth_file
- 0.019 reads_self
- 0.019 antivm_vbox_libs
- 0.018 kibex_behavior
- 0.016 bootkit
- 0.016 antivm_xen_keys
- 0.015 darkcomet_regkeys
- 0.014 betabot_behavior
- 0.014 shifu_behavior
- 0.014 antivm_parallels_keys
- 0.013 hancitor_behavior
- 0.013 antiav_detectfile
- 0.013 geodo_banking_trojan
- 0.013 md_domain_bl
- 0.013 recon_fingerprint
- 0.011 antivm_generic_diskreg
- 0.01 antivm_generic_services
- 0.009 antiav_avast_libs
- 0.009 exec_crash
- 0.009 infostealer_bitcoin
- 0.008 persistence_autorun
- 0.008 antisandbox_productid
- 0.007 ransomware_extensions
- 0.007 ransomware_files
- 0.006 antiemu_wine_func
- 0.006 antisandbox_sunbelt_libs
- 0.006 kovter_behavior
- 0.006 packer_armadillo_regkey
- 0.005 antivm_vmware_libs
- 0.005 injection_createremotethread
- 0.005 antisandbox_sboxie_libs
- 0.005 antiav_bitdefender_libs
- 0.005 infostealer_browser_password
- 0.005 antivm_xen_keys
- 0.005 antivm_hyperv_keys
- 0.005 antivm_vbox_acpi
- 0.005 antivm_vbox_files
- 0.005 antivm_vbox_keys
- 0.005 antivm_vmware_keys
- 0.005 antivm_vpc_keys
- 0.005 bypass_firewall
- 0.004 injection_runpe
- 0.004 antivm_generic_bios
- 0.004 antivm_generic_cpu
- 0.004 antivm_generic_system
- 0.004 disables_browser_warn
- 0.004 recon_programs
- 0.003 rat_nanocore
- 0.003 tinba_behavior
- 0.002 cerber_behavior
- 0.002 antidbg_devices
- 0.002 bot_drive
- 0.002 modify_proxy
- 0.002 browser_security
- 0.001 hawkeye_behavior
- 0.001 network_tor
- 0.001 rat_luminosity
- 0.001 injection_explorer
- 0.001 kazybot_behavior
- 0.001 ursnif_behavior
- 0.001 antidbg_windows
- 0.001 vawtrak_behavior
- 0.001 h1n1_behavior
- 0.001 antianalysis_detectfile
- 0.001 antiemu_wine_reg
- 0.001 antivm_vmware_files
- 0.001 banker_zeus_mutex
- 0.001 bot_drive2
- 0.001 browser_addon
- 0.001 codelux_behavior
- 0.001 disables_system_restore
- 0.001 disables_windows_defender
- 0.001 modify_security_center_warnings
- 0.001 modify_uac_prompt
- 0.001 office_security
- 0.001 ransomware_radamant
- 0.001 rat_pcclient
- 0.001 rat_spynet
- 0.001 stealth_hide_notifications
Reporting ( 0.513 seconds )
- 0.513 Malheur
| Task ID | 195751 |
|---|---|
| Mongo ID | 5bc051492e063355a71af70a |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号