分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-hpdapp01-1 | 2019-08-30 11:34:37 | 2019-08-30 11:37:21 | 164 秒 |
魔盾分数
9.25
危险的
文件详细信息
| 文件名 | virus.exe |
|---|---|
| 文件大小 | 5530624 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 2e47cfecc1447bbb0ac1525d91c237fa |
| SHA1 | 009ab623d19b9e716c0d5bb263dee8663c61590d |
| SHA256 | a79321aabc84d9020f2dc34ebf9e1fb60d93a1f83a3f1e22d53ed082c1d99b00 |
| SHA512 | 61e911c16aca1a975666ea04f1a744de9d5eabf17d777d88db0e535b52041f015b33f5aa90dcb290d8f131a174e1604cce1ce0a28ef05ef4ab4a37463cd15c11 |
| CRC32 | C5E49AC9 |
| Ssdeep | 98304:K1vPpRViGa3g+BN7rlcL7N5xstPG0yRoATcn+1P2ik9r2+yiE70c0:6HpbiGUg+BxrlGx4PWRo2cqP2iqq+yiP |
| Yara | 登录查看Yara规则 |
| 样本下载 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 199.168.187.66 | 未知 | 美国 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| www.soft.enkeladress.com | 未知 | A 199.168.187.66 |
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x0089341c |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x005545ac |
| 最低操作系统版本要求 | 5.0 |
| 编译时间 | 1992-06-20 06:22:17 |
| 载入哈希 | 466f8acb62ecab597efddde4b2152b2c |
版本信息
| LegalCopyright | |
|---|---|
| InternalName | |
| FileVersion | |
| CompanyName | |
| LegalTrademarks | |
| Comments | |
| ProductName | |
| ProductVersion | |
| FileDescription | |
| OriginalFilename | |
| Translation |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| CODE | 0x00001000 | 0x00068de8 | 0x00000000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 0.00 |
| DATA | 0x0006a000 | 0x00001438 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| BSS | 0x0006c000 | 0x00000ca5 | 0x00000000 | IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .idata | 0x0006d000 | 0x00002758 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .tls | 0x00070000 | 0x00000010 | 0x00000000 | IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .rdata | 0x00071000 | 0x00000018 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 0.00 |
| .vmp0 | 0x00072000 | 0x00325015 | 0x00000000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 0.00 |
| .vmp1 | 0x00398000 | 0x00543d70 | 0x00543e00 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 7.96 |
| .rsrc | 0x008dc000 | 0x0000215c | 0x00002200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 4.11 |
导入
库: kernel32.dll:
• 0x901000 GetVersion
库: user32.dll:
• 0x901008 GetKeyboardType
库: advapi32.dll:
• 0x901010 RegQueryValueExA
库: oleaut32.dll:
• 0x901018 SysFreeString
库: kernel32.dll:
• 0x901020 TlsSetValue
库: advapi32.dll:
• 0x901028 RegSetValueExA
库: version.dll:
• 0x90103c VerQueryValueA
库: gdi32.dll:
• 0x901044 UnrealizeObject
库: user32.dll:
• 0x90104c CreateWindowExA
库: kernel32.dll:
• 0x901054 Sleep
库: oleaut32.dll:
• 0x90105c SafeArrayPtrOfIndex
库: ole32.dll:
• 0x901064 CreateStreamOnHGlobal
库: oleaut32.dll:
• 0x90106c CreateErrorInfo
库: comctl32.dll:
• 0x901074 ImageList_SetIconSize
库: shell32.dll:
• 0x90107c ShellExecuteA
库: shell32.dll:
• 0x901084 SHGetSpecialFolderLocation
库: comdlg32.dll:
• 0x90108c GetSaveFileNameA
库: wsock32.dll:
• 0x901094 WSACleanup
库: WTSAPI32.dll:
• 0x90109c WTSSendMessageW
库: kernel32.dll:
• 0x9010a4 VirtualQuery
库: user32.dll:
• 0x9010ac GetUserObjectInformationW
库: kernel32.dll:
• 0x9010b4 LocalAlloc
• 0x9010b8 LocalFree
• 0x9010bc GetModuleFileNameW
• 0x9010c0 GetProcessAffinityMask
• 0x9010c4 SetProcessAffinityMask
• 0x9010c8 SetThreadAffinityMask
• 0x9010cc Sleep
• 0x9010d0 ExitProcess
• 0x9010d4 FreeLibrary
• 0x9010d8 LoadLibraryA
• 0x9010dc GetModuleHandleA
• 0x9010e0 GetProcAddress
`DATA
.idata
.rdata
P.vmp0
`.vmp1
`.rsrc
yW"fl
Sleep
tDDxd
F)LX*x4
GetProcessWindowStation
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 199.168.187.66 | 未知 | 美国 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49160 | 199.168.187.66 www.soft.enkeladress.com | 80 |
| 192.168.122.201 | 49161 | 199.168.187.66 www.soft.enkeladress.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 61698 | 192.168.122.1 | 53 |
| 192.168.122.201 | 62233 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| www.soft.enkeladress.com | 未知 | A 199.168.187.66 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49160 | 199.168.187.66 www.soft.enkeladress.com | 80 |
| 192.168.122.201 | 49161 | 199.168.187.66 www.soft.enkeladress.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 61698 | 192.168.122.1 | 53 |
| 192.168.122.201 | 62233 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://www.soft.enkeladress.com/ | GET / HTTP/1.1 Accept: */* Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: www.soft.enkeladress.com Connection: Keep-Alive |
| URL专业沙箱检测 -> http://www.soft.enkeladress.com/favicon.ico | GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.soft.enkeladress.com Connection: Keep-Alive Cookie: PHPSESSID=08f803a69252d59da18de27a8d94a071 |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 60.031 seconds )
- 20.556 NetworkAnalysis
- 15.506 Suricata
- 15.338 Static
- 6.278 TargetInfo
- 1.393 VirusTotal
- 0.429 peid
- 0.402 BehaviorAnalysis
- 0.094 AnalysisInfo
- 0.018 config_decoder
- 0.014 Strings
- 0.003 Memory
Signatures ( 2.333 seconds )
- 1.933 md_url_bl
- 0.084 antiav_detectreg
- 0.031 infostealer_ftp
- 0.019 api_spamming
- 0.018 infostealer_im
- 0.017 antianalysis_detectreg
- 0.016 md_domain_bl
- 0.015 stealth_timeout
- 0.014 stealth_decoy_document
- 0.014 anomaly_persistence_autorun
- 0.01 infostealer_mail
- 0.008 antiav_detectfile
- 0.008 geodo_banking_trojan
- 0.008 network_http
- 0.006 disables_browser_warn
- 0.006 ransomware_files
- 0.005 antivm_generic_scsi
- 0.005 infostealer_bitcoin
- 0.005 ransomware_extensions
- 0.004 betabot_behavior
- 0.004 kibex_behavior
- 0.004 antivm_parallels_keys
- 0.004 antivm_xen_keys
- 0.004 browser_security
- 0.004 darkcomet_regkeys
- 0.003 tinba_behavior
- 0.003 antivm_generic_services
- 0.003 anormaly_invoke_kills
- 0.003 cerber_behavior
- 0.003 antivm_generic_diskreg
- 0.003 antivm_vbox_files
- 0.003 modify_proxy
- 0.003 network_torgateway
- 0.002 antiemu_wine_func
- 0.002 rat_nanocore
- 0.002 mimics_filetime
- 0.002 reads_self
- 0.002 infostealer_browser_password
- 0.002 kovter_behavior
- 0.002 browser_addon
- 0.002 disables_system_restore
- 0.002 md_bad_drop
- 0.002 network_cnc_http
- 0.002 recon_fingerprint
- 0.002 stealth_modify_uac_prompt
- 0.001 network_tor
- 0.001 antivm_vbox_libs
- 0.001 bootkit
- 0.001 antiav_avast_libs
- 0.001 stealth_file
- 0.001 anomaly_persistence_bootexecute
- 0.001 injection_createremotethread
- 0.001 anomaly_reset_winsock
- 0.001 ursnif_behavior
- 0.001 antisandbox_sunbelt_libs
- 0.001 ransomeware_modifies_desktop_wallpaper
- 0.001 shifu_behavior
- 0.001 antivm_generic_disk
- 0.001 antidbg_windows
- 0.001 virus
- 0.001 hancitor_behavior
- 0.001 bypass_firewall
- 0.001 antianalysis_detectfile
- 0.001 antidbg_devices
- 0.001 antisandbox_productid
- 0.001 antivm_generic_system
- 0.001 antivm_xen_keys
- 0.001 antivm_hyperv_keys
- 0.001 antivm_vbox_acpi
- 0.001 antivm_vbox_keys
- 0.001 antivm_vmware_keys
- 0.001 antivm_vpc_keys
- 0.001 banker_zeus_mutex
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 disables_windows_defender
- 0.001 malicious_drop_executable_file_to_temp_folder
- 0.001 office_security
- 0.001 packer_armadillo_regkey
- 0.001 ransomware_radamant
- 0.001 rat_spynet
- 0.001 stealth_hiddenreg
- 0.001 stealth_hide_notifications
- 0.001 stealth_modify_security_center_warnings
Reporting ( 1.021 seconds )
- 0.896 ReportHTMLSummary
- 0.125 Malheur
| Task ID | 362026 |
|---|---|
| Mongo ID | 5d689a412f8f2e6aa06a6770 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号