魔盾安全分析报告

分析类型	开始时间	结束时间	持续时间	分析引擎版本
FILE	2021-09-22 08:41:08	2021-09-22 08:41:10	2 秒	1.4-Maldun

虚拟机机器名	标签	虚拟机管理	开机时间	关机时间
win7-sp1-x64-shaapp02-1	win7-sp1-x64-shaapp02-1	KVM	2021-09-22 08:41:10	2021-09-22 08:41:10

魔盾分数
8.15 恶意的

文件详细信息

文件名	voouerDrv.dll
文件大小	4796416 字节
文件类型	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
CRC32	434C03A0
MD5	7d2ee0c5e85cdb7ae5cbf85b93e720a5
SHA1	d84f338963bb4ecb72e31b2b046baf778c42e57e
SHA256	0c110f299e3baeedb561b17e3e836d6bda58a378358aeb9aecb14fa760d74e0c
SHA512	eb5771cd2939fb898d489405900cf258b7e0096ecbdd63c2c909cbff604235b6b6e5e4a7932951528a6f7cdc01ee5cd649f9d4e8676768fda8dc29eaebbdd60a
Ssdeep	98304:7KatKLBCoAR/BEG/VJPaoDmhvPA+NP7XsHRjIz1aVaM04q1juDYZu1jnN:7OLgR/VnaoKh3AizORjkgqpuDYZA
PEiD	无匹配
Yara	DebuggerTiming__PerformanceCounter () DebuggerTiming__Ticks (Detected timing ticks function) anti_dbg (Detected self protection if being debugged) network_http (Detected communications function over HTTP) screenshot (Detected take screenshot function) create_process (Detection function for creating a new process) keylogger (Detected keylogger function) win_registry (Detected system registries modification function) change_win_registry (Change registries to affect system) win_files_operation (Affect private profile) win_hook (Detected hook table access function) win_private_profile (Detected private profile access function) Maldun_Anomoly_Combined_Activities_Network_Logging (Spotted potential abnormal behaviors, like logging and network communications) Maldun_Anomoly_Combined_Activities_7 (Spotted potential malicious behaviors from a small size target, like process manipultion, privilege, token and files) IsPE32 (Detected a 32bit PE sample) IsDLL (Detect a DLL sample) IsWindowsGUI (Detected a Windows GUI sample) IsPacked (Detected Entropy signature) with_images (Detected the presence of an or several images)
VirusTotal	VirusTotal查询失败

特征

二进制文件可能包含加密或压缩数据

section: name: .http://, entropy: 7.93, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0048f000, virtual_size: 0x0048e8c0

异常的二进制特征

anomaly: Found duplicated section names

魔盾安全Yara规则检测结果 - 高危

Critical: Spotted potential abnormal behaviors, like logging and network communications

Critical: Spotted potential malicious behaviors from a small size target, like process manipultion, privilege, token and files

运行截图

无运行截图

网络分析

无信息

静态分析

PE 信息

初始地址	0x10000000
入口地址	0x1043a1bc
声明校验值	0x00000000
实际校验值	0x0049dbf3
最低操作系统版本要求	5.0
编译时间	2021-09-15 23:12:39
载入哈希	9f2438a2c0db50ba7e4bf1b8a93c8a1f
导出DLL库名称	\x31\x31\x31\x31\x31\x31\x36\x31\x31\x34\x31\x31\x31

PE数据组成

名称	虚拟地址	虚拟大小	原始数据大小	特征	熵(Entropy)
.text	0x00001000	0x00086aaa	0x00000000	IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ	0.00
.rdata	0x00088000	0x00037b20	0x00000000	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	0.00
.data	0x000c0000	0x00042e0e	0x00000000	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	0.00
.http://	0x00103000	0x0028b8fb	0x00000000	IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ	0.00
.http://	0x0038f000	0x0048e8c0	0x0048f000	IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ	7.93
.reloc	0x0081e000	0x00000580	0x00001000	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	1.82
.rsrc	0x0081f000	0x000012d1	0x00002000	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	2.55

导入

库 RASAPI32.dll:

• 0x10780000 - RasGetConnectStatusA

• 0x10780004 - RasHangUpA

库 iphlpapi.dll:

• 0x1078000c - GetAdaptersInfo

库 WINMM.dll:

• 0x10780014 - midiStreamOut

• 0x10780018 - waveOutUnprepareHeader

• 0x1078001c - waveOutPrepareHeader

• 0x10780020 - waveOutWrite

• 0x10780024 - waveOutPause

• 0x10780028 - waveOutReset

• 0x1078002c - waveOutClose

• 0x10780030 - waveOutGetNumDevs

• 0x10780034 - waveOutOpen

• 0x10780038 - midiStreamRestart

• 0x1078003c - midiStreamClose

• 0x10780040 - midiOutReset

• 0x10780044 - midiStreamStop

• 0x10780048 - midiOutPrepareHeader

• 0x1078004c - midiStreamProperty

• 0x10780050 - midiStreamOpen

• 0x10780054 - midiOutUnprepareHeader

库 WS2_32.dll:

• 0x1078005c - inet_ntoa

• 0x10780060 - WSAStartup

• 0x10780064 - WSACleanup

• 0x10780068 - select

• 0x1078006c - send

• 0x10780070 - closesocket

• 0x10780074 - WSAAsyncSelect

• 0x10780078 - recvfrom

• 0x1078007c - ioctlsocket

• 0x10780080 - accept

• 0x10780084 - getpeername

• 0x10780088 - recv

库 KERNEL32.dll:

• 0x10780090 - SetFilePointer

• 0x10780094 - GetFileSize

• 0x10780098 - GetCurrentProcess

• 0x1078009c - TerminateProcess

• 0x107800a0 - GetWindowsDirectoryA

• 0x107800a4 - GetSystemDirectoryA

• 0x107800a8 - QueryPerformanceFrequency

• 0x107800ac - QueryPerformanceCounter

• 0x107800b0 - GetVersion

• 0x107800b4 - SetLastError

• 0x107800b8 - GetTimeZoneInformation

• 0x107800bc - FileTimeToSystemTime

• 0x107800c0 - CreateSemaphoreA

• 0x107800c4 - InterlockedExchange

• 0x107800c8 - IsBadCodePtr

• 0x107800cc - IsBadReadPtr

• 0x107800d0 - CompareStringW

• 0x107800d4 - CompareStringA

• 0x107800d8 - GetStringTypeW

• 0x107800dc - GetStringTypeA

• 0x107800e0 - SetUnhandledExceptionFilter

• 0x107800e4 - IsBadWritePtr

• 0x107800e8 - ResumeThread

• 0x107800ec - LCMapStringW

• 0x107800f0 - LCMapStringA

• 0x107800f4 - SetEnvironmentVariableA

• 0x107800f8 - VirtualFree

• 0x107800fc - HeapCreate

• 0x10780100 - HeapDestroy

• 0x10780104 - GetEnvironmentVariableA

• 0x10780108 - GetEnvironmentStringsW

• 0x1078010c - GetEnvironmentStrings

• 0x10780110 - FreeEnvironmentStringsW

• 0x10780114 - FreeEnvironmentStringsA

• 0x10780118 - GetStartupInfoA

• 0x1078011c - GetStdHandle

• 0x10780120 - SetHandleCount

• 0x10780124 - GetFileType

• 0x10780128 - SetStdHandle

• 0x1078012c - GetACP

• 0x10780130 - HeapSize

• 0x10780134 - RaiseException

• 0x10780138 - GetLocalTime

• 0x1078013c - GetSystemTime

• 0x10780140 - RtlUnwind

• 0x10780144 - GetOEMCP

• 0x10780148 - GetCPInfo

• 0x1078014c - GetProcessVersion

• 0x10780150 - SetErrorMode

• 0x10780154 - GlobalFlags

• 0x10780158 - GetCurrentThread

• 0x1078015c - GetFileTime

• 0x10780160 - TlsGetValue

• 0x10780164 - LocalReAlloc

• 0x10780168 - TlsSetValue

• 0x1078016c - TlsFree

• 0x10780170 - GlobalHandle

• 0x10780174 - TlsAlloc

• 0x10780178 - LocalAlloc

• 0x1078017c - lstrcmpA

• 0x10780180 - GlobalGetAtomNameA

• 0x10780184 - GlobalAddAtomA

• 0x10780188 - GlobalFindAtomA

• 0x1078018c - GlobalDeleteAtom

• 0x10780190 - lstrcmpiA

• 0x10780194 - SetEndOfFile

• 0x10780198 - UnlockFile

• 0x1078019c - LockFile

• 0x107801a0 - FlushFileBuffers

• 0x107801a4 - DuplicateHandle

• 0x107801a8 - lstrcpynA

• 0x107801ac - FileTimeToLocalFileTime

• 0x107801b0 - LocalFree

• 0x107801b4 - InterlockedDecrement

• 0x107801b8 - InterlockedIncrement

• 0x107801bc - ReleaseSemaphore

• 0x107801c0 - EnterCriticalSection

• 0x107801c4 - LeaveCriticalSection

• 0x107801c8 - GetProfileStringA

• 0x107801cc - WriteFile

• 0x107801d0 - CloseHandle

• 0x107801d4 - VirtualAlloc

• 0x107801d8 - WaitForSingleObject

• 0x107801dc - GetTickCount

• 0x107801e0 - GetCommandLineA

• 0x107801e4 - MulDiv

• 0x107801e8 - GetProcAddress

• 0x107801ec - GetModuleHandleA

• 0x107801f0 - GetVolumeInformationA

• 0x107801f4 - SetCurrentDirectoryA

• 0x107801f8 - DeleteFileA

• 0x107801fc - GetFileAttributesA

• 0x10780200 - SetFileAttributesA

• 0x10780204 - FindClose

• 0x10780208 - FindFirstFileA

• 0x1078020c - WaitForMultipleObjects

• 0x10780210 - CreateFileA

• 0x10780214 - DeviceIoControl

• 0x10780218 - SetEvent

• 0x1078021c - FindResourceA

• 0x10780220 - LoadResource

• 0x10780224 - LockResource

• 0x10780228 - ReadFile

• 0x1078022c - RemoveDirectoryA

• 0x10780230 - GetModuleFileNameA

• 0x10780234 - WideCharToMultiByte

• 0x10780238 - MultiByteToWideChar

• 0x1078023c - GetCurrentThreadId

• 0x10780240 - ExitProcess

• 0x10780244 - GlobalSize

• 0x10780248 - GlobalFree

• 0x1078024c - DeleteCriticalSection

• 0x10780250 - InitializeCriticalSection

• 0x10780254 - lstrcatA

• 0x10780258 - lstrlenA

• 0x1078025c - WinExec

• 0x10780260 - lstrcpyA

• 0x10780264 - FindNextFileA

• 0x10780268 - GlobalReAlloc

• 0x1078026c - HeapFree

• 0x10780270 - HeapReAlloc

• 0x10780274 - GetProcessHeap

• 0x10780278 - HeapAlloc

• 0x1078027c - GetFullPathNameA

• 0x10780280 - FreeLibrary

• 0x10780284 - LoadLibraryA

• 0x10780288 - GetLastError

• 0x1078028c - GetVersionExA

• 0x10780290 - WritePrivateProfileStringA

• 0x10780294 - CreateThread

• 0x10780298 - CreateEventA

• 0x1078029c - Sleep

• 0x107802a0 - GlobalAlloc

• 0x107802a4 - GlobalLock

• 0x107802a8 - GlobalUnlock

• 0x107802ac - GetTempPathA

库 USER32.dll:

• 0x107802b4 - GetForegroundWindow

• 0x107802b8 - wsprintfA

• 0x107802bc - CloseClipboard

• 0x107802c0 - GetClipboardData

• 0x107802c4 - GetSysColorBrush

• 0x107802c8 - GetWindowTextA

• 0x107802cc - GetDlgItem

• 0x107802d0 - GetClassNameA

• 0x107802d4 - GetDesktopWindow

• 0x107802d8 - SetWindowTextA

• 0x107802dc - LoadIconA

• 0x107802e0 - TranslateMessage

• 0x107802e4 - DrawFrameControl

• 0x107802e8 - DrawEdge

• 0x107802ec - DrawFocusRect

• 0x107802f0 - WindowFromPoint

• 0x107802f4 - GetMessageA

• 0x107802f8 - DispatchMessageA

• 0x107802fc - SetRectEmpty

• 0x10780300 - RegisterClipboardFormatA

• 0x10780304 - CreateIconFromResourceEx

• 0x10780308 - CreateIconFromResource

• 0x1078030c - DrawIconEx

• 0x10780310 - CreatePopupMenu

• 0x10780314 - AppendMenuA

• 0x10780318 - ModifyMenuA

• 0x1078031c - CreateMenu

• 0x10780320 - CreateAcceleratorTableA

• 0x10780324 - GetDlgCtrlID

• 0x10780328 - GetSubMenu

• 0x1078032c - EnableMenuItem

• 0x10780330 - LoadStringA

• 0x10780334 - UnregisterClassA

• 0x10780338 - GetMenuCheckMarkDimensions

• 0x1078033c - GetMenuState

• 0x10780340 - SetMenuItemBitmaps

• 0x10780344 - CheckMenuItem

• 0x10780348 - MoveWindow

• 0x1078034c - IsDialogMessageA

• 0x10780350 - ScrollWindowEx

• 0x10780354 - SendDlgItemMessageA

• 0x10780358 - MapWindowPoints

• 0x1078035c - AdjustWindowRectEx

• 0x10780360 - GetScrollPos

• 0x10780364 - RegisterClassA

• 0x10780368 - GetMenuItemCount

• 0x1078036c - GetMenuItemID

• 0x10780370 - CreateWindowExA

• 0x10780374 - SetWindowsHookExA

• 0x10780378 - CallNextHookEx

• 0x1078037c - GetClassLongA

• 0x10780380 - SetPropA

• 0x10780384 - UnhookWindowsHookEx

• 0x10780388 - GetPropA

• 0x1078038c - CallWindowProcA

• 0x10780390 - RemovePropA

• 0x10780394 - GetMessageTime

• 0x10780398 - GetLastActivePopup

• 0x1078039c - ClientToScreen

• 0x107803a0 - EnumDisplaySettingsA

• 0x107803a4 - LoadImageA

• 0x107803a8 - SystemParametersInfoA

• 0x107803ac - ShowWindow

• 0x107803b0 - IsWindowEnabled

• 0x107803b4 - TranslateAcceleratorA

• 0x107803b8 - GetKeyState

• 0x107803bc - CopyAcceleratorTableA

• 0x107803c0 - PostQuitMessage

• 0x107803c4 - IsZoomed

• 0x107803c8 - GetClassInfoA

• 0x107803cc - DefWindowProcA

• 0x107803d0 - GetMenu

• 0x107803d4 - SetMenu

• 0x107803d8 - PeekMessageA

• 0x107803dc - IsIconic

• 0x107803e0 - SetFocus

• 0x107803e4 - GetActiveWindow

• 0x107803e8 - GetWindow

• 0x107803ec - DestroyAcceleratorTable

• 0x107803f0 - SetWindowRgn

• 0x107803f4 - GetMessagePos

• 0x107803f8 - ScreenToClient

• 0x107803fc - ChildWindowFromPointEx

• 0x10780400 - CopyRect

• 0x10780404 - LoadBitmapA

• 0x10780408 - WinHelpA

• 0x1078040c - KillTimer

• 0x10780410 - SetTimer

• 0x10780414 - ReleaseCapture

• 0x10780418 - GetCapture

• 0x1078041c - SetCapture

• 0x10780420 - GetScrollRange

• 0x10780424 - SetScrollRange

• 0x10780428 - SetScrollPos

• 0x1078042c - SetRect

• 0x10780430 - InflateRect

• 0x10780434 - IntersectRect

• 0x10780438 - DestroyIcon

• 0x1078043c - PtInRect

• 0x10780440 - OffsetRect

• 0x10780444 - IsWindowVisible

• 0x10780448 - EnableWindow

• 0x1078044c - RedrawWindow

• 0x10780450 - GetWindowLongA

• 0x10780454 - SetWindowLongA

• 0x10780458 - GetSysColor

• 0x1078045c - SetActiveWindow

• 0x10780460 - SetCursorPos

• 0x10780464 - LoadCursorA

• 0x10780468 - SetCursor

• 0x1078046c - GetDC

• 0x10780470 - FillRect

• 0x10780474 - IsRectEmpty

• 0x10780478 - ReleaseDC

• 0x1078047c - IsChild

• 0x10780480 - DestroyMenu

• 0x10780484 - SetForegroundWindow

• 0x10780488 - GetWindowRect

• 0x1078048c - EqualRect

• 0x10780490 - UpdateWindow

• 0x10780494 - ValidateRect

• 0x10780498 - InvalidateRect

• 0x1078049c - GetClientRect

• 0x107804a0 - GetFocus

• 0x107804a4 - GetParent

• 0x107804a8 - GetTopWindow

• 0x107804ac - PostMessageA

• 0x107804b0 - IsWindow

• 0x107804b4 - SetParent

• 0x107804b8 - DestroyCursor

• 0x107804bc - SendMessageA

• 0x107804c0 - SetWindowPos

• 0x107804c4 - MessageBoxA

• 0x107804c8 - GetCursorPos

• 0x107804cc - GetSystemMetrics

• 0x107804d0 - EmptyClipboard

• 0x107804d4 - SetClipboardData

• 0x107804d8 - OpenClipboard

• 0x107804dc - GetWindowTextLengthA

• 0x107804e0 - CharUpperA

• 0x107804e4 - GetWindowDC

• 0x107804e8 - BeginPaint

• 0x107804ec - EndPaint

• 0x107804f0 - TabbedTextOutA

• 0x107804f4 - DrawTextA

• 0x107804f8 - GrayStringA

• 0x107804fc - DestroyWindow

• 0x10780500 - CreateDialogIndirectParamA

• 0x10780504 - EndDialog

• 0x10780508 - GetNextDlgTabItem

• 0x1078050c - GetWindowPlacement

• 0x10780510 - RegisterWindowMessageA

库 GDI32.dll:

• 0x10780518 - ExtSelectClipRgn

• 0x1078051c - LineTo

• 0x10780520 - MoveToEx

• 0x10780524 - ExcludeClipRect

• 0x10780528 - GetClipBox

• 0x1078052c - ScaleWindowExtEx

• 0x10780530 - SetWindowExtEx

• 0x10780534 - SetWindowOrgEx

• 0x10780538 - ScaleViewportExtEx

• 0x1078053c - SetViewportExtEx

• 0x10780540 - OffsetViewportOrgEx

• 0x10780544 - SetViewportOrgEx

• 0x10780548 - SetMapMode

• 0x1078054c - SetTextColor

• 0x10780550 - SetROP2

• 0x10780554 - SetBkColor

• 0x10780558 - CreateRectRgnIndirect

• 0x1078055c - SetStretchBltMode

• 0x10780560 - GetClipRgn

• 0x10780564 - CreatePolygonRgn

• 0x10780568 - SelectClipRgn

• 0x1078056c - DeleteObject

• 0x10780570 - CreateDIBitmap

• 0x10780574 - GetSystemPaletteEntries

• 0x10780578 - CreatePalette

• 0x1078057c - StretchBlt

• 0x10780580 - SelectPalette

• 0x10780584 - RealizePalette

• 0x10780588 - GetDIBits

• 0x1078058c - GetWindowExtEx

• 0x10780590 - GetViewportOrgEx

• 0x10780594 - GetWindowOrgEx

• 0x10780598 - BeginPath

• 0x1078059c - EndPath

• 0x107805a0 - PathToRegion

• 0x107805a4 - CreateEllipticRgn

• 0x107805a8 - CreateRoundRectRgn

• 0x107805ac - GetTextColor

• 0x107805b0 - GetBkMode

• 0x107805b4 - GetBkColor

• 0x107805b8 - GetROP2

• 0x107805bc - GetStretchBltMode

• 0x107805c0 - GetPolyFillMode

• 0x107805c4 - CreateCompatibleBitmap

• 0x107805c8 - CreateDCA

• 0x107805cc - CreateBitmap

• 0x107805d0 - SelectObject

• 0x107805d4 - GetObjectA

• 0x107805d8 - CreatePen

• 0x107805dc - PatBlt

• 0x107805e0 - CombineRgn

• 0x107805e4 - CreateRectRgn

• 0x107805e8 - FillRgn

• 0x107805ec - CreateSolidBrush

• 0x107805f0 - GetStockObject

• 0x107805f4 - CreateFontIndirectA

• 0x107805f8 - EndPage

• 0x107805fc - EndDoc

• 0x10780600 - DeleteDC

• 0x10780604 - StartDocA

• 0x10780608 - StartPage

• 0x1078060c - BitBlt

• 0x10780610 - CreateCompatibleDC

• 0x10780614 - Ellipse

• 0x10780618 - Rectangle

• 0x1078061c - LPtoDP

• 0x10780620 - DPtoLP

• 0x10780624 - GetCurrentObject

• 0x10780628 - RoundRect

• 0x1078062c - GetTextExtentPoint32A

• 0x10780630 - GetDeviceCaps

• 0x10780634 - GetViewportExtEx

• 0x10780638 - PtVisible

• 0x1078063c - RectVisible

• 0x10780640 - TextOutA

• 0x10780644 - ExtTextOutA

• 0x10780648 - Escape

• 0x1078064c - GetTextMetricsA

• 0x10780650 - SaveDC

• 0x10780654 - RestoreDC

• 0x10780658 - SetBkMode

• 0x1078065c - SetPolyFillMode

库 WINSPOOL.DRV:

• 0x10780664 - ClosePrinter

• 0x10780668 - DocumentPropertiesA

• 0x1078066c - OpenPrinterA

库 ADVAPI32.dll:

• 0x10780674 - RegQueryValueA

• 0x10780678 - RegDeleteKeyA

• 0x1078067c - RegDeleteValueA

• 0x10780680 - RegSetValueExA

• 0x10780684 - RegOpenKeyExA

• 0x10780688 - RegCloseKey

• 0x1078068c - RegCreateKeyExA

库 SHELL32.dll:

• 0x10780694 - ShellExecuteA

• 0x10780698 - Shell_NotifyIconA

• 0x1078069c - SHGetSpecialFolderPathA

库 ole32.dll:

• 0x107806a4 - OleUninitialize

• 0x107806a8 - OleInitialize

• 0x107806ac - CLSIDFromString

库 OLEAUT32.dll:

• 0x107806b4 - UnRegisterTypeLib

• 0x107806b8 - LoadTypeLib

• 0x107806bc - RegisterTypeLib

库 COMCTL32.dll:

• 0x107806c4 - ImageList_Destroy

• 0x107806c8 - None

库 WININET.dll:

• 0x107806d0 - InternetCanonicalizeUrlA

• 0x107806d4 - InternetCrackUrlA

• 0x107806d8 - HttpOpenRequestA

• 0x107806dc - HttpSendRequestA

• 0x107806e0 - HttpQueryInfoA

• 0x107806e4 - InternetReadFile

• 0x107806e8 - InternetConnectA

• 0x107806ec - InternetSetOptionA

• 0x107806f0 - InternetCloseHandle

• 0x107806f4 - InternetOpenA

库 comdlg32.dll:

• 0x107806fc - ChooseColorA

• 0x10780700 - GetFileTitleA

• 0x10780704 - GetSaveFileNameA

• 0x10780708 - GetOpenFileNameA

库 WTSAPI32.dll:

• 0x10780710 - WTSSendMessageW

库 KERNEL32.dll:

• 0x10780718 - VirtualQuery

• 0x1078071c - GetSystemTimeAsFileTime

• 0x10780720 - GetModuleHandleA

• 0x10780724 - CreateEventA

• 0x10780728 - GetModuleFileNameW

• 0x1078072c - LoadLibraryA

• 0x10780730 - TerminateProcess

• 0x10780734 - GetCurrentProcess

• 0x10780738 - CreateToolhelp32Snapshot

• 0x1078073c - Thread32First

• 0x10780740 - GetCurrentProcessId

• 0x10780744 - GetCurrentThreadId

• 0x10780748 - OpenThread

• 0x1078074c - Thread32Next

• 0x10780750 - CloseHandle

• 0x10780754 - SuspendThread

• 0x10780758 - ResumeThread

• 0x1078075c - WriteProcessMemory

• 0x10780760 - GetSystemInfo

• 0x10780764 - VirtualAlloc

• 0x10780768 - VirtualProtect

• 0x1078076c - VirtualFree

• 0x10780770 - GetProcessAffinityMask

• 0x10780774 - SetProcessAffinityMask

• 0x10780778 - GetCurrentThread

• 0x1078077c - SetThreadAffinityMask

• 0x10780780 - Sleep

• 0x10780784 - FreeLibrary

• 0x10780788 - GetTickCount

• 0x1078078c - GlobalFree

• 0x10780790 - GetProcAddress

• 0x10780794 - LocalAlloc

• 0x10780798 - LocalFree

• 0x1078079c - ExitProcess

• 0x107807a0 - EnterCriticalSection

• 0x107807a4 - LeaveCriticalSection

• 0x107807a8 - InitializeCriticalSection

• 0x107807ac - DeleteCriticalSection

• 0x107807b0 - GetModuleHandleW

• 0x107807b4 - LoadResource

• 0x107807b8 - MultiByteToWideChar

• 0x107807bc - FindResourceExW

• 0x107807c0 - FindResourceExA

• 0x107807c4 - WideCharToMultiByte

• 0x107807c8 - GetThreadLocale

• 0x107807cc - GetUserDefaultLCID

• 0x107807d0 - GetSystemDefaultLCID

• 0x107807d4 - EnumResourceNamesA

• 0x107807d8 - EnumResourceNamesW

• 0x107807dc - EnumResourceLanguagesA

• 0x107807e0 - EnumResourceLanguagesW

• 0x107807e4 - EnumResourceTypesA

• 0x107807e8 - EnumResourceTypesW

• 0x107807ec - CreateFileW

• 0x107807f0 - LoadLibraryW

• 0x107807f4 - GetLastError

• 0x107807f8 - FlushFileBuffers

• 0x107807fc - CreateFileA

• 0x10780800 - WriteConsoleW

• 0x10780804 - GetConsoleOutputCP

• 0x10780808 - WriteConsoleA

• 0x1078080c - GetCommandLineA

• 0x10780810 - RaiseException

• 0x10780814 - RtlUnwind

• 0x10780818 - HeapFree

• 0x1078081c - GetCPInfo

• 0x10780820 - InterlockedIncrement

• 0x10780824 - InterlockedDecrement

• 0x10780828 - GetACP

• 0x1078082c - GetOEMCP

• 0x10780830 - IsValidCodePage

• 0x10780834 - TlsGetValue

• 0x10780838 - TlsAlloc

• 0x1078083c - TlsSetValue

• 0x10780840 - TlsFree

• 0x10780844 - SetLastError

• 0x10780848 - UnhandledExceptionFilter

• 0x1078084c - SetUnhandledExceptionFilter

• 0x10780850 - IsDebuggerPresent

• 0x10780854 - HeapAlloc

• 0x10780858 - LCMapStringA

• 0x1078085c - LCMapStringW

• 0x10780860 - SetHandleCount

• 0x10780864 - GetStdHandle

• 0x10780868 - GetFileType

• 0x1078086c - GetStartupInfoA

• 0x10780870 - GetModuleFileNameA

• 0x10780874 - FreeEnvironmentStringsA

• 0x10780878 - GetEnvironmentStrings

• 0x1078087c - FreeEnvironmentStringsW

• 0x10780880 - GetEnvironmentStringsW

• 0x10780884 - HeapCreate

• 0x10780888 - HeapDestroy

• 0x1078088c - QueryPerformanceCounter

• 0x10780890 - HeapReAlloc

• 0x10780894 - GetStringTypeA

• 0x10780898 - GetStringTypeW

• 0x1078089c - GetLocaleInfoA

• 0x107808a0 - HeapSize

• 0x107808a4 - WriteFile

• 0x107808a8 - SetFilePointer

• 0x107808ac - GetConsoleCP

• 0x107808b0 - GetConsoleMode

• 0x107808b4 - InitializeCriticalSectionAndSpinCount

• 0x107808b8 - SetStdHandle

库 USER32.dll:

• 0x107808c0 - GetUserObjectInformationW

• 0x107808c4 - CharUpperBuffW

• 0x107808c8 - MessageBoxW

• 0x107808cc - GetProcessWindowStation

库 KERNEL32.dll:

• 0x107808d4 - LocalAlloc

• 0x107808d8 - LocalFree

• 0x107808dc - GetModuleFileNameW

• 0x107808e0 - GetProcessAffinityMask

• 0x107808e4 - SetProcessAffinityMask

• 0x107808e8 - SetThreadAffinityMask

• 0x107808ec - Sleep

• 0x107808f0 - ExitProcess

• 0x107808f4 - FreeLibrary

• 0x107808f8 - LoadLibraryA

• 0x107808fc - GetModuleHandleA

• 0x10780900 - GetProcAddress

库 USER32.dll:

• 0x10780908 - GetProcessWindowStation

• 0x1078090c - GetUserObjectInformationW

导出

序列	地址	名称
1	0x100028b6	InstallDriver
2	0x10002900	InstallDriverSn
3	0x1000294a	UnstallDriver

投放文件

无信息

行为分析

互斥量(Mutexes) 无信息

执行的命令 无信息

创建的服务 无信息

启动的服务 无信息

进程

无信息

访问的文件 无信息

读取的文件 无信息

修改的文件 无信息

删除的文件 无信息

注册表键 无信息

读取的注册表键 无信息

修改的注册表键 无信息

删除的注册表键 无信息

API解析 无信息

魔盾安全分析报告

8.15

恶意的

文件详细信息

特征

运行截图

网络分析

静态分析

PE 信息

PE数据组成

导入

导出

投放文件

行为分析

进程