比较分析...

分析任务

分析类型 虚拟机标签 开始时间 结束时间 持续时间
文件 (Windows) win7-sp1-x64-hpdapp01-1 2019-01-22 03:22:29 2019-01-22 03:24:55 146 秒

魔盾分数

9.1

危险的

文件详细信息

文件名 Cache.dat
文件大小 25600 字节
文件类型 PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b52e877559dfebbba89463df013645f4
SHA1 eac06aa100e22ca474c2a14999ad1bb697a9a21b
SHA256 22dbbb0fac94da2aac1dd6763ba9acf1f41cc81f8a679e0b109f29f83b1c78cf
SHA512 8ce7047d7ab8c34c5d441c996f2e339df2b119fa672212bbe99055bd89452e869a823774afb108c0a5f352174940accf65bd93f0a00c7e1c50c82a360e1c5e01
CRC32 BA19E30D
Ssdeep 384:G4vo0B5ugihbUgVmDh4bGBoRlFvWcpmdCUwQZdJNqnWi7UB8E1oOOuK+wy+y:+02UgIeKBSU/Xis8EQy+y
Yara 登录查看Yara规则
样本下载 提交误报
登录查看威胁特征

运行截图

访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
否 123.125.115.110 中国

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
baidu.com A 123.125.115.110
A 220.181.57.216

摘要

登录查看详细行为信息

PE 信息

初始地址 0x00400000
入口地址 0x00404f9f
声明校验值 0x00000000
实际校验值 0x0000743b
最低操作系统版本要求 4.0
编译时间 2015-01-28 17:43:36
载入哈希 8569656ff3314023cf8db4198febb66e

PE 数据组成

名称 虚拟地址 虚拟大小 原始数据大小 特征 熵(Entropy)
.text 0x00001000 0x000041ba 0x00004200 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.13
.rdata 0x00006000 0x0000102c 0x00001200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3.51
.data 0x00008000 0x00000c34 0x00000c00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4.84

导入

库: KERNEL32.dll:
• 0x406038 lstrcatA
• 0x40603c lstrcpyA
• 0x406044 GetShortPathNameA
• 0x406048 GetModuleFileNameA
• 0x40604c ExitProcess
• 0x406050 GetLastError
• 0x406054 CreateMutexA
• 0x406058 GetCurrentProcess
• 0x40605c CopyFileA
• 0x406060 GetSystemDirectoryA
• 0x406068 GetComputerNameA
• 0x406070 GetModuleHandleA
• 0x406074 TerminateProcess
• 0x406078 SetPriorityClass
• 0x40607c GetCurrentThread
• 0x406080 SetThreadPriority
• 0x406084 CreateProcessA
• 0x406088 ResumeThread
• 0x40608c WaitForSingleObject
• 0x406090 CloseHandle
• 0x406094 GetTempPathA
• 0x406098 LoadLibraryA
• 0x40609c GetProcAddress
• 0x4060a0 WinExec
• 0x4060a4 CreateThread
• 0x4060a8 lstrlenA
• 0x4060ac Sleep
• 0x4060b0 ExitThread
• 0x4060b4 GetTickCount
• 0x4060b8 GetStartupInfoA
库: USER32.dll:
• 0x406144 wsprintfA
库: ADVAPI32.dll:
• 0x406000 OpenSCManagerA
• 0x406004 CreateServiceA
• 0x406008 OpenServiceA
• 0x40600c StartServiceA
• 0x406010 RegOpenKeyA
• 0x406014 RegSetValueExA
• 0x406018 CloseServiceHandle
• 0x40601c RegCloseKey
• 0x406020 RegOpenKeyExA
• 0x40602c SetServiceStatus
• 0x406030 RegQueryValueExA
库: WS2_32.dll:
• 0x40614c WSAStartup
• 0x406150 send
• 0x406154 select
• 0x406158 __WSAFDIsSet
• 0x40615c recv
• 0x406160 setsockopt
• 0x406164 connect
• 0x406168 closesocket
• 0x40616c WSAIoctl
• 0x406170 socket
• 0x406174 htons
• 0x406178 gethostbyname
• 0x40617c inet_addr
• 0x406180 sendto
• 0x406184 WSASocketA
• 0x406188 htonl
库: MSVCRT.dll:
• 0x4060c0 rand
• 0x4060c4 __p__commode
• 0x4060c8 _controlfp
• 0x4060d0 ??3@YAXPAX@Z
• 0x4060d4 __set_app_type
• 0x4060d8 memcpy
• 0x4060dc atoi
• 0x4060e0 strcpy
• 0x4060e4 strncpy
• 0x4060e8 strcspn
• 0x4060ec strstr
• 0x4060f0 strcat
• 0x4060f4 sprintf
• 0x4060f8 localtime
• 0x4060fc time
• 0x406100 exit
• 0x406104 memset
• 0x406108 strncmp
• 0x40610c strlen
• 0x406110 _except_handler3
• 0x406114 _adjust_fdiv
• 0x406118 malloc
• 0x40611c __CxxFrameHandler
• 0x406120 _CxxThrowException
• 0x406124 _exit
• 0x406128 _XcptFilter
• 0x40612c _acmdln
• 0x406130 __getmainargs
• 0x406134 _initterm
• 0x406138 __setusermatherr
• 0x40613c __p__fmode
.text
`.rdata
@.data
WWVhP-@
WWVh0G@
WWVhP-@
WWVh0>@
WWVhP-@
WWVh 1@
WWVhP-@
WWVh0>@
WWVh@D@
WWVh@D@
WWVhP-@
~KWWVh0G@
WWVh@7@
~<WWVh@N@
WWVhPM@
0123456789abcdefghijklmnopqrstuvwxyz
GET ^FuckAvast .htm
Sleep
CreateThread
WinExec
GetProcAddress
LoadLibraryA
GetTempPathA
CloseHandle
WaitForSingleObject
ResumeThread
CreateProcessA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
ExitProcess
GetLastError
CreateMutexA
lstrlenA
CopyFileA
GetSystemDirectoryA
GlobalMemoryStatusEx
GetComputerNameA
GetSystemDefaultUILanguage
KERNEL32.dll
wsprintfA
USER32.dll
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegOpenKeyExA
RegCloseKey
CloseServiceHandle
RegSetValueExA
RegOpenKeyA
StartServiceA
OpenServiceA
CreateServiceA
OpenSCManagerA
RegQueryValueExA
ADVAPI32.dll
WSAIoctl
WS2_32.dll
memcpy
strcpy
strncpy
strcspn
strstr
strcat
sprintf
localtime
memset
strncmp
strlen
_except_handler3
malloc
__CxxFrameHandler
_CxxThrowException
MSVCRT.dll
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??3@YAXPAX@Z
??1type_info@@UAE@XZ
_controlfp
GetTickCount
ExitThread
TerminateProcess
GetModuleHandleA
GetStartupInfoA
WSASocketA
192.168.0.100:8080
baidu.com
\%c%c%c%c%c.exe
URLDownloadToFileA
urlmon.dll
%c%c%c%c%c.exe
> nul
/c del
COMSPEC
%04d%02d%02d
SYSTEM\CurrentControlSet\Services\
Description
%c%c%c%c%c%c.exe
BF2008
%u MB
%u MHz
HARDWARE\DESCRIPTION\System\CentralProcessor\0
Windows NT
Windows 7
Windows 2008
Windows Vista
Vista
Windows 2003
Windows XP
Windows 2000
ProductName
SOFTWARE\Microsoft\Windows NT\CurrentVersion
KERNEL32.dll
GetSystemDirectoryA
#0%s!
%s/%s
%s %s%s
%d.%d.%d.%d
192.168.1.244
.?AVtype_info@@
没有防病毒引擎扫描信息!

进程树

Cache.dat, PID: 2424, 上一级进程 PID: 2296
services.exe, PID: 428, 上一级进程 PID: 332
cmekse.exe, PID: 2572, 上一级进程 PID: 428
cmd.exe, PID: 2664, 上一级进程 PID: 2424
mscorsvw.exe, PID: 2080, 上一级进程 PID: 428
mscorsvw.exe, PID: 2400, 上一级进程 PID: 428
下载PCAP包

访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
否 123.125.115.110 中国

TCP

无TCP连接纪录.

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 62233 192.168.122.1 53

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
baidu.com A 123.125.115.110
A 220.181.57.216

TCP

无TCP连接纪录.

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 62233 192.168.122.1 53

HTTP 请求

未发现HTTP请求.

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

No TLS

Suricata HTTP

No Suricata HTTP

未发现网络提取文件
文件名 cmekse.exe
相关文件
C:\Windows\System32\cmekse.exe
文件大小 25600 字节
文件类型 PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b52e877559dfebbba89463df013645f4
SHA1 eac06aa100e22ca474c2a14999ad1bb697a9a21b
SHA256 22dbbb0fac94da2aac1dd6763ba9acf1f41cc81f8a679e0b109f29f83b1c78cf
CRC32 BA19E30D
Ssdeep 384:G4vo0B5ugihbUgVmDh4bGBoRlFvWcpmdCUwQZdJNqnWi7UB8E1oOOuK+wy+y:+02UgIeKBSU/Xis8EQy+y
下载  提交魔盾安全分析
没有发现相似的分析.
HTML 总结报告
(需15-60分钟同步)		 下载

Processing ( 29.718 seconds )

  • 15.641 Suricata
  • 9.438 NetworkAnalysis
  • 1.894 VirusTotal
  • 0.842 BehaviorAnalysis
  • 0.832 Static
  • 0.491 peid
  • 0.441 TargetInfo
  • 0.126 AnalysisInfo
  • 0.005 Dropped
  • 0.005 Strings
  • 0.003 Memory

Signatures ( 0.763 seconds )

  • 0.305 md_bad_drop
  • 0.057 antiav_detectreg
  • 0.045 api_spamming
  • 0.037 stealth_timeout
  • 0.032 stealth_decoy_document
  • 0.022 infostealer_ftp
  • 0.021 md_domain_bl
  • 0.019 md_url_bl
  • 0.013 infostealer_im
  • 0.01 mimics_filetime
  • 0.009 reads_self
  • 0.009 virus
  • 0.008 stealth_file
  • 0.008 anomaly_persistence_autorun
  • 0.008 shifu_behavior
  • 0.008 antivm_generic_disk
  • 0.008 antiav_detectfile
  • 0.007 bootkit
  • 0.007 antivm_generic_scsi
  • 0.007 hancitor_behavior
  • 0.007 infostealer_mail
  • 0.007 ransomware_extensions
  • 0.007 ransomware_files
  • 0.006 infostealer_bitcoin
  • 0.005 dridex_behavior
  • 0.004 hawkeye_behavior
  • 0.004 antivm_generic_services
  • 0.004 anormaly_invoke_kills
  • 0.004 antivm_vbox_files
  • 0.004 geodo_banking_trojan
  • 0.004 network_torgateway
  • 0.003 tinba_behavior
  • 0.003 injection_createremotethread
  • 0.003 kelihos_behavior
  • 0.003 stealth_network
  • 0.003 betabot_behavior
  • 0.003 kibex_behavior
  • 0.003 cerber_behavior
  • 0.003 antivm_xen_keys
  • 0.003 disables_browser_warn
  • 0.002 rat_nanocore
  • 0.002 kazybot_behavior
  • 0.002 injection_runpe
  • 0.002 antivm_generic_diskreg
  • 0.002 antivm_parallels_keys
  • 0.002 browser_security
  • 0.002 modify_proxy
  • 0.002 darkcomet_regkeys
  • 0.002 recon_fingerprint
  • 0.001 network_tor
  • 0.001 network_anomaly
  • 0.001 antisandbox_sleep
  • 0.001 ursnif_behavior
  • 0.001 dead_connect
  • 0.001 antisandbox_productid
  • 0.001 antivm_xen_keys
  • 0.001 antivm_hyperv_keys
  • 0.001 antivm_vbox_acpi
  • 0.001 antivm_vbox_keys
  • 0.001 antivm_vmware_keys
  • 0.001 antivm_vpc_keys
  • 0.001 banker_zeus_mutex
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 browser_addon
  • 0.001 disables_system_restore
  • 0.001 disables_windows_defender
  • 0.001 packer_armadillo_regkey
  • 0.001 rat_pcclient
  • 0.001 rat_spynet
  • 0.001 stealth_modify_uac_prompt

Reporting ( 1.115 seconds )

  • 0.854 ReportHTMLSummary
  • 0.261 Malheur
Task ID 234137
Mongo ID 5c461cb12f8f2e05d65a2962
Cuckoo release 1.4-Maldun