分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-hpdapp01-1 | 2019-09-16 17:03:28 | 2019-09-16 17:06:03 | 155 秒 |
魔盾分数
10.0
危险的
文件详细信息
| 文件名 | QQQ 9-16.exe |
|---|---|
| 文件大小 | 7329280 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 389e45aec2bf96d27934bf3813567b12 |
| SHA1 | fa0e82e95fc525124905e5d8baccf56561aa65bc |
| SHA256 | a40f7c59c723029b04cd7755b4bfd8f7adf14e5e1d81f6c8df23e92e7baef7c2 |
| SHA512 | 2cc15abf41acb0dd2982ec6b2280ea38a1a0acd01fc779e144722c48b0abc5c09ed31e91d67620951ef32757493e60d9a6577b291227fcb3d1fc241face429ca |
| CRC32 | 1A4C2394 |
| Ssdeep | 98304:Knsmtk2apurdmJ/KP0nsmtk2aAZFlcGlC6IYDuUIiLP+lWAEhyP0i3mLG:ELsJoaLLgYIiLDgV |
| Yara | 登录查看Yara规则 |
| 样本下载 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 50.23.197.94 | 美国 | |
| 否 | 69.171.234.18 | 未知 | 美国 |
| 否 | 77.4.7.92 | 德国 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| xred.mooo.com | A 77.4.7.92 | |
| docs.google.com | A 69.171.234.18 | |
| freedns.afraid.org |
A 204.140.20.21 A 50.23.197.94 |
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x0049ab80 |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x00701165 |
| 最低操作系统版本要求 | 4.0 |
| 编译时间 | 1992-06-20 06:22:17 |
| 载入哈希 | 332f7ce65ead0adfb3d35147033aabe9 |
版本信息
| LegalCopyright | |
|---|---|
| InternalName | |
| FileVersion | |
| CompanyName | |
| LegalTrademarks | |
| Comments | |
| ProductName | |
| ProductVersion | |
| FileDescription | |
| OriginalFilename | |
| Translation |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| CODE | 0x00001000 | 0x00099bec | 0x00099c00 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.57 |
| DATA | 0x0009b000 | 0x00002e54 | 0x00003000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.85 |
| BSS | 0x0009e000 | 0x000011e5 | 0x00000000 | IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .idata | 0x000a0000 | 0x00002a42 | 0x00002c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.92 |
| .tls | 0x000a3000 | 0x00000010 | 0x00000000 | IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .rdata | 0x000a4000 | 0x00000039 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 0.78 |
| .reloc | 0x000a5000 | 0x0000a980 | 0x0000aa00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 6.67 |
| .rsrc | 0x000b0000 | 0x00652d30 | 0x00652e00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 6.42 |
导入
库: kernel32.dll:
• 0x4a01cc DeleteCriticalSection
• 0x4a01d0 LeaveCriticalSection
• 0x4a01d4 EnterCriticalSection
• 0x4a01d8 InitializeCriticalSection
• 0x4a01dc VirtualFree
• 0x4a01e0 VirtualAlloc
• 0x4a01e4 LocalFree
• 0x4a01e8 LocalAlloc
• 0x4a01ec GetTickCount
• 0x4a01f0 QueryPerformanceCounter
• 0x4a01f4 GetVersion
• 0x4a01f8 GetCurrentThreadId
• 0x4a01fc InterlockedDecrement
• 0x4a0200 InterlockedIncrement
• 0x4a0204 VirtualQuery
• 0x4a0208 WideCharToMultiByte
• 0x4a020c SetCurrentDirectoryA
• 0x4a0210 MultiByteToWideChar
• 0x4a0214 lstrlenA
• 0x4a0218 lstrcpynA
• 0x4a021c LoadLibraryExA
• 0x4a0220 GetThreadLocale
• 0x4a0224 GetStartupInfoA
• 0x4a0228 GetProcAddress
• 0x4a022c GetModuleHandleA
• 0x4a0230 GetModuleFileNameA
• 0x4a0234 GetLocaleInfoA
• 0x4a0238 GetLastError
• 0x4a023c GetCurrentDirectoryA
• 0x4a0240 GetCommandLineA
• 0x4a0244 FreeLibrary
• 0x4a0248 FindFirstFileA
• 0x4a024c FindClose
• 0x4a0250 ExitProcess
• 0x4a0254 ExitThread
• 0x4a0258 CreateThread
• 0x4a025c WriteFile
• 0x4a0260 UnhandledExceptionFilter
• 0x4a0264 SetFilePointer
• 0x4a0268 SetEndOfFile
• 0x4a026c RtlUnwind
• 0x4a0270 ReadFile
• 0x4a0274 RaiseException
• 0x4a0278 GetStdHandle
• 0x4a027c GetFileSize
• 0x4a0280 GetFileType
• 0x4a0284 CreateFileA
• 0x4a0288 CloseHandle
库: user32.dll:
• 0x4a0290 GetKeyboardType
• 0x4a0294 LoadStringA
• 0x4a0298 MessageBoxA
• 0x4a029c CharNextA
库: oleaut32.dll:
• 0x4a02b4 SysFreeString
• 0x4a02b8 SysReAllocStringLen
• 0x4a02bc SysAllocStringLen
库: kernel32.dll:
• 0x4a02c4 TlsSetValue
• 0x4a02c8 TlsGetValue
• 0x4a02cc LocalAlloc
• 0x4a02d0 GetModuleHandleA
库: advapi32.dll:
• 0x4a02d8 RegSetValueExA
• 0x4a02dc RegQueryValueExA
• 0x4a02e0 RegOpenKeyExA
• 0x4a02e4 RegNotifyChangeKeyValue
• 0x4a02e8 RegFlushKey
• 0x4a02ec RegDeleteValueA
• 0x4a02f0 RegCreateKeyExA
• 0x4a02f4 RegCloseKey
• 0x4a02f8 OpenProcessToken
• 0x4a02fc LookupPrivilegeValueA
• 0x4a0300 GetUserNameA
• 0x4a0304 AdjustTokenPrivileges
库: kernel32.dll:
• 0x4a030c lstrcpyA
• 0x4a0310 WritePrivateProfileStringA
• 0x4a0314 WriteFile
• 0x4a0318 WaitForSingleObject
• 0x4a031c WaitForMultipleObjects
• 0x4a0320 VirtualQuery
• 0x4a0324 VirtualAlloc
• 0x4a0328 UpdateResourceA
• 0x4a032c UnmapViewOfFile
• 0x4a0330 TerminateProcess
• 0x4a0334 Sleep
• 0x4a0338 SizeofResource
• 0x4a033c SetThreadLocale
• 0x4a0340 SetFilePointer
• 0x4a0344 SetFileAttributesA
• 0x4a0348 SetEvent
• 0x4a034c SetErrorMode
• 0x4a0350 SetEndOfFile
• 0x4a0354 ResumeThread
• 0x4a0358 ResetEvent
• 0x4a035c RemoveDirectoryA
• 0x4a0360 ReadFile
• 0x4a0364 OpenProcess
• 0x4a0368 OpenMutexA
• 0x4a036c MultiByteToWideChar
• 0x4a0370 MulDiv
• 0x4a0374 MoveFileA
• 0x4a0378 MapViewOfFile
• 0x4a037c LockResource
• 0x4a0380 LoadResource
• 0x4a0384 LoadLibraryA
• 0x4a0388 LeaveCriticalSection
• 0x4a038c InitializeCriticalSection
• 0x4a0390 GlobalUnlock
• 0x4a0394 GlobalReAlloc
• 0x4a0398 GlobalHandle
• 0x4a039c GlobalLock
• 0x4a03a0 GlobalFree
• 0x4a03a4 GlobalFindAtomA
• 0x4a03a8 GlobalDeleteAtom
• 0x4a03ac GlobalAlloc
• 0x4a03b0 GlobalAddAtomA
• 0x4a03b4 GetVersionExA
• 0x4a03b8 GetVersion
• 0x4a03bc GetTimeZoneInformation
• 0x4a03c0 GetTickCount
• 0x4a03c4 GetThreadLocale
• 0x4a03c8 GetTempPathA
• 0x4a03cc GetTempFileNameA
• 0x4a03d0 GetSystemInfo
• 0x4a03d4 GetSystemDirectoryA
• 0x4a03d8 GetStringTypeExA
• 0x4a03dc GetStdHandle
• 0x4a03e0 GetProcAddress
• 0x4a03e4 GetPrivateProfileStringA
• 0x4a03e8 GetModuleHandleA
• 0x4a03ec GetModuleFileNameA
• 0x4a03f0 GetLogicalDrives
• 0x4a03f4 GetLocaleInfoA
• 0x4a03f8 GetLocalTime
• 0x4a03fc GetLastError
• 0x4a0400 GetFullPathNameA
• 0x4a0404 GetFileSize
• 0x4a0408 GetFileAttributesA
• 0x4a040c GetExitCodeThread
• 0x4a0410 GetDriveTypeA
• 0x4a0414 GetDiskFreeSpaceA
• 0x4a0418 GetDateFormatA
• 0x4a041c GetCurrentThreadId
• 0x4a0420 GetCurrentProcessId
• 0x4a0424 GetCurrentProcess
• 0x4a0428 GetComputerNameA
• 0x4a042c GetCPInfo
• 0x4a0430 GetACP
• 0x4a0434 FreeResource
• 0x4a0438 InterlockedIncrement
• 0x4a043c InterlockedExchange
• 0x4a0440 InterlockedDecrement
• 0x4a0444 FreeLibrary
• 0x4a0448 FormatMessageA
• 0x4a044c FindResourceA
• 0x4a0450 FindNextFileA
• 0x4a0454 FindFirstFileA
• 0x4a0458 FindClose
• 0x4a045c FileTimeToLocalFileTime
• 0x4a0460 FileTimeToDosDateTime
• 0x4a0464 EnumCalendarInfoA
• 0x4a0468 EnterCriticalSection
• 0x4a046c EndUpdateResourceA
• 0x4a0470 DeleteFileA
• 0x4a0474 DeleteCriticalSection
• 0x4a0478 CreateThread
• 0x4a047c CreateProcessA
• 0x4a0480 CreatePipe
• 0x4a0484 CreateMutexA
• 0x4a0488 CreateFileMappingA
• 0x4a048c CreateFileA
• 0x4a0490 CreateEventA
• 0x4a0494 CreateDirectoryA
• 0x4a0498 CopyFileA
• 0x4a049c CompareStringA
• 0x4a04a0 CloseHandle
• 0x4a04a4 BeginUpdateResourceA
库: version.dll:
• 0x4a04ac VerQueryValueA
• 0x4a04b0 GetFileVersionInfoSizeA
• 0x4a04b4 GetFileVersionInfoA
库: gdi32.dll:
• 0x4a04bc UnrealizeObject
• 0x4a04c0 StretchBlt
• 0x4a04c4 SetWindowOrgEx
• 0x4a04c8 SetWinMetaFileBits
• 0x4a04cc SetViewportOrgEx
• 0x4a04d0 SetTextColor
• 0x4a04d4 SetStretchBltMode
• 0x4a04d8 SetROP2
• 0x4a04dc SetPixel
• 0x4a04e0 SetEnhMetaFileBits
• 0x4a04e4 SetDIBColorTable
• 0x4a04e8 SetBrushOrgEx
• 0x4a04ec SetBkMode
• 0x4a04f0 SetBkColor
• 0x4a04f4 SelectPalette
• 0x4a04f8 SelectObject
• 0x4a04fc SaveDC
• 0x4a0500 RestoreDC
• 0x4a0504 RectVisible
• 0x4a0508 RealizePalette
• 0x4a050c PlayEnhMetaFile
• 0x4a0510 PatBlt
• 0x4a0514 MoveToEx
• 0x4a0518 MaskBlt
• 0x4a051c LineTo
• 0x4a0520 IntersectClipRect
• 0x4a0524 GetWindowOrgEx
• 0x4a0528 GetWinMetaFileBits
• 0x4a052c GetTextMetricsA
• 0x4a0530 GetTextExtentPoint32A
• 0x4a0534 GetSystemPaletteEntries
• 0x4a0538 GetStockObject
• 0x4a053c GetPixel
• 0x4a0540 GetPaletteEntries
• 0x4a0544 GetObjectA
• 0x4a0548 GetEnhMetaFilePaletteEntries
• 0x4a054c GetEnhMetaFileHeader
• 0x4a0550 GetEnhMetaFileBits
• 0x4a0554 GetDeviceCaps
• 0x4a0558 GetDIBits
• 0x4a055c GetDIBColorTable
• 0x4a0560 GetDCOrgEx
• 0x4a0564 GetCurrentPositionEx
• 0x4a0568 GetClipBox
• 0x4a056c GetBrushOrgEx
• 0x4a0570 GetBitmapBits
• 0x4a0574 GdiFlush
• 0x4a0578 ExcludeClipRect
• 0x4a057c DeleteObject
• 0x4a0580 DeleteEnhMetaFile
• 0x4a0584 DeleteDC
• 0x4a0588 CreateSolidBrush
• 0x4a058c CreatePenIndirect
• 0x4a0590 CreatePalette
• 0x4a0594 CreateHalftonePalette
• 0x4a0598 CreateFontIndirectA
• 0x4a059c CreateDIBitmap
• 0x4a05a0 CreateDIBSection
• 0x4a05a4 CreateCompatibleDC
• 0x4a05a8 CreateCompatibleBitmap
• 0x4a05ac CreateBrushIndirect
• 0x4a05b0 CreateBitmap
• 0x4a05b4 CopyEnhMetaFileA
• 0x4a05b8 BitBlt
库: user32.dll:
• 0x4a05c0 CreateWindowExA
• 0x4a05c4 WindowFromPoint
• 0x4a05c8 WinHelpA
• 0x4a05cc WaitMessage
• 0x4a05d0 UpdateWindow
• 0x4a05d4 UnregisterClassA
• 0x4a05d8 UnhookWindowsHookEx
• 0x4a05dc TranslateMessage
• 0x4a05e0 TranslateMDISysAccel
• 0x4a05e4 TrackPopupMenu
• 0x4a05e8 ToAsciiEx
• 0x4a05ec SystemParametersInfoA
• 0x4a05f0 ShowWindow
• 0x4a05f4 ShowScrollBar
• 0x4a05f8 ShowOwnedPopups
• 0x4a05fc ShowCursor
• 0x4a0600 SetWindowsHookExA
• 0x4a0604 SetWindowTextA
• 0x4a0608 SetWindowPos
• 0x4a060c SetWindowPlacement
• 0x4a0610 SetWindowLongA
• 0x4a0614 SetTimer
• 0x4a0618 SetScrollRange
• 0x4a061c SetScrollPos
• 0x4a0620 SetScrollInfo
• 0x4a0624 SetRect
• 0x4a0628 SetPropA
• 0x4a062c SetParent
• 0x4a0630 SetMenuItemInfoA
• 0x4a0634 SetMenu
• 0x4a0638 SetForegroundWindow
• 0x4a063c SetFocus
• 0x4a0640 SetCursor
• 0x4a0644 SetClassLongA
• 0x4a0648 SetCapture
• 0x4a064c SetActiveWindow
• 0x4a0650 SendMessageA
• 0x4a0654 ScrollWindow
• 0x4a0658 ScreenToClient
• 0x4a065c RemovePropA
• 0x4a0660 RemoveMenu
• 0x4a0664 ReleaseDC
• 0x4a0668 ReleaseCapture
• 0x4a066c RegisterWindowMessageA
• 0x4a0670 RegisterClipboardFormatA
• 0x4a0674 RegisterClassA
• 0x4a0678 RedrawWindow
• 0x4a067c PtInRect
• 0x4a0680 PostQuitMessage
• 0x4a0684 PostMessageA
• 0x4a0688 PeekMessageA
• 0x4a068c OffsetRect
• 0x4a0690 OemToCharA
• 0x4a0694 MsgWaitForMultipleObjects
• 0x4a0698 MessageBoxA
• 0x4a069c MapWindowPoints
• 0x4a06a0 MapVirtualKeyExA
• 0x4a06a4 MapVirtualKeyA
• 0x4a06a8 LoadStringA
• 0x4a06ac LoadKeyboardLayoutA
• 0x4a06b0 LoadIconA
• 0x4a06b4 LoadCursorA
• 0x4a06b8 LoadBitmapA
• 0x4a06bc KillTimer
• 0x4a06c0 IsZoomed
• 0x4a06c4 IsWindowVisible
• 0x4a06c8 IsWindowEnabled
• 0x4a06cc IsWindow
• 0x4a06d0 IsRectEmpty
• 0x4a06d4 IsIconic
• 0x4a06d8 IsDialogMessageA
• 0x4a06dc IsChild
• 0x4a06e0 InvalidateRect
• 0x4a06e4 IntersectRect
• 0x4a06e8 InsertMenuItemA
• 0x4a06ec InsertMenuA
• 0x4a06f0 InflateRect
• 0x4a06f4 GetWindowThreadProcessId
• 0x4a06f8 GetWindowTextLengthA
• 0x4a06fc GetWindowTextA
• 0x4a0700 GetWindowRect
• 0x4a0704 GetWindowPlacement
• 0x4a0708 GetWindowLongA
• 0x4a070c GetWindowDC
• 0x4a0710 GetTopWindow
• 0x4a0714 GetSystemMetrics
• 0x4a0718 GetSystemMenu
• 0x4a071c GetSysColorBrush
• 0x4a0720 GetSysColor
• 0x4a0724 GetSubMenu
• 0x4a0728 GetScrollRange
• 0x4a072c GetScrollPos
• 0x4a0730 GetScrollInfo
• 0x4a0734 GetPropA
• 0x4a0738 GetParent
• 0x4a073c GetWindow
• 0x4a0740 GetMenuStringA
• 0x4a0744 GetMenuState
• 0x4a0748 GetMenuItemInfoA
• 0x4a074c GetMenuItemID
• 0x4a0750 GetMenuItemCount
• 0x4a0754 GetMenu
• 0x4a0758 GetLastActivePopup
• 0x4a075c GetKeyboardState
• 0x4a0760 GetKeyboardLayoutList
• 0x4a0764 GetKeyboardLayout
• 0x4a0768 GetKeyState
• 0x4a076c GetKeyNameTextA
• 0x4a0770 GetIconInfo
• 0x4a0774 GetForegroundWindow
• 0x4a0778 GetFocus
• 0x4a077c GetDesktopWindow
• 0x4a0780 GetDCEx
• 0x4a0784 GetDC
• 0x4a0788 GetCursorPos
• 0x4a078c GetCursor
• 0x4a0790 GetClipboardData
• 0x4a0794 GetClientRect
• 0x4a0798 GetClassNameA
• 0x4a079c GetClassInfoA
• 0x4a07a0 GetCapture
• 0x4a07a4 GetActiveWindow
• 0x4a07a8 FrameRect
• 0x4a07ac FindWindowA
• 0x4a07b0 FillRect
• 0x4a07b4 EqualRect
• 0x4a07b8 EnumWindows
• 0x4a07bc EnumThreadWindows
• 0x4a07c0 EndPaint
• 0x4a07c4 EnableWindow
• 0x4a07c8 EnableScrollBar
• 0x4a07cc EnableMenuItem
• 0x4a07d0 DrawTextA
• 0x4a07d4 DrawMenuBar
• 0x4a07d8 DrawIconEx
• 0x4a07dc DrawIcon
• 0x4a07e0 DrawFrameControl
• 0x4a07e4 DrawEdge
• 0x4a07e8 DispatchMessageA
• 0x4a07ec DestroyWindow
• 0x4a07f0 DestroyMenu
• 0x4a07f4 DestroyIcon
• 0x4a07f8 DestroyCursor
• 0x4a07fc DeleteMenu
• 0x4a0800 DefWindowProcA
• 0x4a0804 DefMDIChildProcA
• 0x4a0808 DefFrameProcA
• 0x4a080c CreatePopupMenu
• 0x4a0810 CreateMenu
• 0x4a0814 CreateIcon
• 0x4a0818 ClientToScreen
• 0x4a081c CheckMenuItem
• 0x4a0820 CallWindowProcA
• 0x4a0824 CallNextHookEx
• 0x4a0828 BeginPaint
• 0x4a082c CharNextA
• 0x4a0830 CharLowerBuffA
• 0x4a0834 CharLowerA
• 0x4a0838 CharUpperBuffA
• 0x4a083c CharToOemA
• 0x4a0840 AdjustWindowRectEx
• 0x4a0844 ActivateKeyboardLayout
库: ole32.dll:
• 0x4a084c CLSIDFromString
库: kernel32.dll:
• 0x4a0854 Sleep
库: oleaut32.dll:
• 0x4a085c SafeArrayPtrOfIndex
• 0x4a0860 SafeArrayGetUBound
• 0x4a0864 SafeArrayGetLBound
• 0x4a0868 SafeArrayCreate
• 0x4a086c VariantChangeType
• 0x4a0870 VariantCopyInd
• 0x4a0874 VariantCopy
• 0x4a0878 VariantClear
• 0x4a087c VariantInit
库: ole32.dll:
• 0x4a0884 CLSIDFromProgID
• 0x4a0888 CoCreateInstance
• 0x4a088c CoUninitialize
• 0x4a0890 CoInitialize
库: comctl32.dll:
• 0x4a08a4 ImageList_SetIconSize
• 0x4a08a8 ImageList_GetIconSize
• 0x4a08ac ImageList_Write
• 0x4a08b0 ImageList_Read
• 0x4a08b4 ImageList_GetDragImage
• 0x4a08b8 ImageList_DragShowNolock
• 0x4a08bc ImageList_SetDragCursorImage
• 0x4a08c0 ImageList_DragMove
• 0x4a08c4 ImageList_DragLeave
• 0x4a08c8 ImageList_DragEnter
• 0x4a08cc ImageList_EndDrag
• 0x4a08d0 ImageList_BeginDrag
• 0x4a08d4 ImageList_Remove
• 0x4a08d8 ImageList_DrawEx
• 0x4a08dc ImageList_Draw
• 0x4a08e0 ImageList_GetBkColor
• 0x4a08e4 ImageList_SetBkColor
• 0x4a08e8 ImageList_ReplaceIcon
• 0x4a08ec ImageList_Add
• 0x4a08f0 ImageList_GetImageCount
• 0x4a08f4 ImageList_Destroy
• 0x4a08f8 ImageList_Create
库: wininet.dll:
• 0x4a090c InternetGetConnectedState
• 0x4a0910 InternetReadFile
• 0x4a0914 InternetOpenUrlA
• 0x4a0918 InternetOpenA
• 0x4a091c InternetCloseHandle
库: shell32.dll:
• 0x4a0924 SHGetSpecialFolderLocation
• 0x4a0928 SHGetPathFromIDListA
• 0x4a092c SHGetMalloc
• 0x4a0930 SHGetDesktopFolder
库: wsock32.dll:
• 0x4a0944 WSACleanup
• 0x4a0948 WSAStartup
• 0x4a094c gethostname
• 0x4a0950 gethostbyname
• 0x4a0954 inet_ntoa
库: netapi32.dll:
• 0x4a095c Netbios
`DATA
.idata
.rdata
P.reloc
P.rsrc
System
IInterface
UhI'@
UhY+@
F$P-@
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
Uh$=@
PhdA@
Ph"E@
UhjF@
kernel32.dll
GetLongPathNameA
Software\Borland\Locales
Software\Borland\Delphi\Locales
Uhoi@
Uhcj@
Uh.k@
Magellan MSWHEEL
MouseZ
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
UhY|@
SysUtils
False
AM/PM
D$LPj
WUWSj
m/d/yy
mmmm d, yyyy
AMPM
AMPM
:mm:ss
kernel32.dll
GetDiskFreeSpaceExA
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarOr
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
Variants
UhW!A
UhX'A
Uha,A
Uhj>A
Uh7?A
UhcEA
Uh~FA
UhDGA
Uh'GA
Uh:RA
UhDTA
Uh/VA
UhyWA
Uh5XA
UhH[A
Uh7eA
UhmhA
Uh]iA
Empty
Smallint
Integer
Single
Double
Currency
OleStr
Dispatch
Error
Boolean
Variant
Unknown
Decimal
ShortInt
LongWord
Int64
String
Array
ByRef
UhspA
UhwsA
Uh!tA
UhquA
False
Uh$yA
Uh&zA
tagEXCEPINFO
UhU~A
TNotifyEvent
TObject
Classes
Classes
Classes
Classes
Classes
TStrings
Classes
Classes
Classes
EThread
Classes
%s[%d]
Strings
Owner
False
%s_%d
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 50.23.197.94 | 美国 | |
| 否 | 69.171.234.18 | 未知 | 美国 |
| 否 | 77.4.7.92 | 德国 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49166 | 50.23.197.94 freedns.afraid.org | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49310 | 192.168.122.1 | 53 |
| 192.168.122.201 | 49608 | 192.168.122.1 | 53 |
| 192.168.122.201 | 64912 | 192.168.122.1 | 53 |
域名解析 (可点击查询WPING实时安全评级)
| 域名 | 安全评级 | 响应 |
|---|---|---|
| xred.mooo.com | A 77.4.7.92 | |
| docs.google.com | A 69.171.234.18 | |
| freedns.afraid.org |
A 204.140.20.21 A 50.23.197.94 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49166 | 50.23.197.94 freedns.afraid.org | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.201 | 49310 | 192.168.122.1 | 53 |
| 192.168.122.201 | 49608 | 192.168.122.1 | 53 |
| 192.168.122.201 | 64912 | 192.168.122.1 | 53 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 | GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 61.7 seconds )
- 23.082 Static
- 15.547 Suricata
- 14.799 NetworkAnalysis
- 4.694 BehaviorAnalysis
- 1.67 TargetInfo
- 1.329 VirusTotal
- 0.486 peid
- 0.051 AnalysisInfo
- 0.022 config_decoder
- 0.017 Strings
- 0.003 Memory
Signatures ( 4.742 seconds )
- 1.892 md_url_bl
- 0.686 antiav_detectreg
- 0.238 infostealer_ftp
- 0.215 api_spamming
- 0.18 stealth_timeout
- 0.166 stealth_decoy_document
- 0.144 antianalysis_detectreg
- 0.133 infostealer_im
- 0.076 infostealer_mail
- 0.07 antivm_generic_scsi
- 0.05 stealth_file
- 0.036 mimics_filetime
- 0.036 antivm_parallels_keys
- 0.035 antivm_xen_keys
- 0.035 darkcomet_regkeys
- 0.034 kibex_behavior
- 0.033 reads_self
- 0.031 antivm_generic_services
- 0.03 geodo_banking_trojan
- 0.03 recon_fingerprint
- 0.028 anormaly_invoke_kills
- 0.028 md_domain_bl
- 0.027 virus
- 0.026 antivm_generic_disk
- 0.025 bootkit
- 0.025 betabot_behavior
- 0.023 antivm_generic_diskreg
- 0.02 antisandbox_productid
- 0.018 antiav_detectfile
- 0.017 hancitor_behavior
- 0.013 infostealer_bitcoin
- 0.012 antivm_vbox_keys
- 0.012 antivm_vmware_keys
- 0.011 anomaly_persistence_autorun
- 0.011 infostealer_browser_password
- 0.011 bypass_firewall
- 0.011 antivm_xen_keys
- 0.011 antivm_hyperv_keys
- 0.011 antivm_vbox_acpi
- 0.011 antivm_vpc_keys
- 0.011 maldun_anormaly_invoke_vb_vba
- 0.011 packer_armadillo_regkey
- 0.01 kovter_behavior
- 0.01 antivm_generic_bios
- 0.01 antivm_generic_system
- 0.01 recon_programs
- 0.009 antivm_generic_cpu
- 0.008 antiemu_wine_func
- 0.008 infostealer_browser
- 0.007 maldun_anomaly_massive_file_ops
- 0.007 shifu_behavior
- 0.007 antivm_vbox_files
- 0.006 antivm_vbox_libs
- 0.006 injection_createremotethread
- 0.006 network_http
- 0.006 ransomware_extensions
- 0.006 ransomware_files
- 0.004 maldun_malicious_write_executeable_under_temp_to_regrun
- 0.004 maldun_anomaly_write_exe_and_dll_under_winroot_run
- 0.004 antidbg_windows
- 0.004 injection_runpe
- 0.004 disables_browser_warn
- 0.003 tinba_behavior
- 0.003 antisandbox_sunbelt_libs
- 0.003 ipc_namedpipe
- 0.003 exec_crash
- 0.003 antidbg_devices
- 0.003 network_torgateway
- 0.002 network_tor
- 0.002 rat_nanocore
- 0.002 antiav_avast_libs
- 0.002 dridex_behavior
- 0.002 rat_luminosity
- 0.002 anomaly_persistence_bootexecute
- 0.002 anomaly_reset_winsock
- 0.002 antisandbox_sleep
- 0.002 creates_largekey
- 0.002 antisandbox_sboxie_libs
- 0.002 antiav_bitdefender_libs
- 0.002 ransomeware_modifies_desktop_wallpaper
- 0.002 creates_nullvalue
- 0.002 cerber_behavior
- 0.002 antiemu_wine_reg
- 0.002 browser_security
- 0.002 modify_proxy
- 0.002 md_bad_drop
- 0.002 network_cnc_http
- 0.002 rat_pcclient
- 0.001 hawkeye_behavior
- 0.001 antivm_vmware_libs
- 0.001 injection_explorer
- 0.001 sets_autoconfig_url
- 0.001 ursnif_behavior
- 0.001 kazybot_behavior
- 0.001 nymaim_behavior
- 0.001 h1n1_behavior
- 0.001 securityxploded_modules
- 0.001 sniffer_winpcap
- 0.001 antianalysis_detectfile
- 0.001 antivm_vmware_files
- 0.001 banker_zeus_mutex
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_addon
- 0.001 disables_system_restore
- 0.001 disables_windows_defender
- 0.001 codelux_behavior
- 0.001 maldun_malicious_drop_executable_file_to_temp_folder
- 0.001 malicous_targeted_flame
- 0.001 maldun_network_blacklist
- 0.001 rat_spynet
- 0.001 stealth_hide_notifications
- 0.001 stealth_modify_uac_prompt
Reporting ( 0.912 seconds )
- 0.851 ReportHTMLSummary
- 0.061 Malheur
| Task ID | 374011 |
|---|---|
| Mongo ID | 5d7f50d32f8f2e3c5cbb5ef2 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号