分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
---|---|---|---|---|
文件 (Windows) | win7-sp1-x64-hpdapp01-1 | 2019-01-22 00:00:50 | 2019-01-22 00:03:42 | 172 秒 |
文件名 | 123.exe |
---|---|
文件大小 | 401408 字节 |
文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5 | 849e12b2f1036d9573df99067091a185 |
SHA1 | 012aef6e82605e4be62f57f2da446da2809bf01f |
SHA256 | ac5a58231b2b28e5152ceeb355c292c7674b23443aa6ca30d58e81582366b6e4 |
SHA512 | 5bf6248f11160d38f2928dd89d34b46859005aa5f8c14b967c69daaa6f0a778efe395e3e498e3d410566f9e1fae8d9bf24a6593fa9f65ea6c7dc50ca5a45c769 |
CRC32 | 90212F0F |
Ssdeep | 12288:+0JYImdqb2bZtoGBnlgHyZmedx4mA+hRUXVzZv:+l7Eb2d6GBlgi/xvVshZv |
Yara | 登录查看Yara规则 |
样本下载 提交误报 |
无主机纪录.
无域名信息.
初始地址 | 0x00400000 |
---|---|
入口地址 | 0x0051ff22 |
声明校验值 | 0x00000000 |
实际校验值 | 0x000677f7 |
最低操作系统版本要求 | 4.0 |
编译时间 | 2016-04-26 16:41:40 |
载入哈希 | bf0f8799b071f51d876d5bc3805285a9 |
LegalCopyright | |
---|---|
FileVersion | |
CompanyName | |
Comments | |
ProductName | |
ProductVersion | |
FileDescription | |
Translation |
名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0007d30a | 0x00000000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 0.00 |
.rdata | 0x0007f000 | 0x000141d6 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 0.00 |
.data | 0x00094000 | 0x000268e8 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
.rsrc | 0x000bb000 | 0x00005778 | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 3.20 |
.vmp0 | 0x000c1000 | 0x00004050 | 0x00000000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
.vmp1 | 0x000c6000 | 0x0005d530 | 0x0005e000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 7.91 |
.reloc | 0x00124000 | 0x00000070 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 0.23 |
名称 | 偏移量 | 大小 | 语言 | 子语言 | 熵(Entropy) | 文件类型 |
---|---|---|---|---|---|---|
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_BITMAP | 0x000be928 | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_MENU | 0x000bea78 | 0x00000284 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_MENU | 0x000bea78 | 0x00000284 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_DIALOG | 0x000bfcc0 | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_DIALOG | 0x000bfcc0 | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_DIALOG | 0x000bfcc0 | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_DIALOG | 0x000bfcc0 | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_DIALOG | 0x000bfcc0 | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_DIALOG | 0x000bfcc0 | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_DIALOG | 0x000bfcc0 | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_DIALOG | 0x000bfcc0 | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_DIALOG | 0x000bfcc0 | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_DIALOG | 0x000bfcc0 | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_STRING | 0x000c0708 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_GROUP_CURSOR | 0x000c0754 | 0x00000022 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_GROUP_CURSOR | 0x000c0754 | 0x00000022 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
RT_GROUP_CURSOR | 0x000c0754 | 0x00000022 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0.00 | None |
无主机纪录.
无TCP连接纪录.
无UDP连接纪录.
无域名信息.
无TCP连接纪录.
无UDP连接纪录.
未发现HTTP请求.
无SMTP流量.
无IRC请求.
无ICMP流量.
无 CIF 结果
无警报
No TLS
No Suricata HTTP
HTML 总结报告 (需15-60分钟同步) |
下载 |
---|
Task ID | 234116 |
---|---|
Mongo ID | 5c45ed812f8f2e05da5a1ea4 |
Cuckoo release | 1.4-Maldun |