通过进程尝试延迟分析任务
Process: tpbsn_______v1.7.exe tried to sleep 75 seconds, actually delayed analysis time by 0 seconds
魔盾安全Yara检测结果 - 普通
Informational: Detected DOS Message
二进制文件可能包含加密或压缩数据
section: name: lnln, entropy: 7.99, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00af2000, virtual_size: 0x00af1990
section: name: lnln, entropy: 7.77, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00002000, virtual_size: 0x00001e2a
section: name: lnln, entropy: 7.76, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x001a8000, virtual_size: 0x001a7004
section: name: lnln, entropy: 6.81, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0008a000, virtual_size: 0x00089720
从文件自身的二进制镜像中读取数据
self_read: process: tpbsn_______v1.7.exe, pid: 2664, offset: 0x00000000, length: 0x00000040
self_read: process: tpbsn_______v1.7.exe, pid: 2664, offset: 0x00000000, length: 0x00d2b000
self_read: process: tpbsn_______v1.7.exe, pid: 2664, offset: 0x00000060, length: 0x00000020
self_read: process: tpbsn_______v1.7.exe, pid: 2664, offset: 0x000000e3, length: 0x00080000
创建一个隐藏文件或系统文件
file: C:\Users\test\AppData\Local\Temp\krnln.dll
异常的二进制特征
anomaly: Found duplicated section names
尝试阻止沙箱线程以防止恶意行为被记录
尝试断开连接或更改沙箱进程监控的Windows功能
unhook: function_name: NtQuerySystemInformation, type: modification
unhook: function_name: SetWindowLongA, type: modification
unhook: function_name: SetWindowLongW, type: modification
检测到勒索软件文件更改行为特征
file_modifications: Performs 2507 file moves indicative of a potential file encryption process
检测到样本尝试模糊或欺骗文件类型
运行截图
网络分析
HTTP请求
URL |
HTTP数据 |
http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip |
GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1
Accept: */*
If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT
User-Agent: IPM
Host: acroipm.adobe.com
Connection: Keep-Alive
Cache-Control: no-cache
|
静态分析
版本信息
LegalCopyright: |
\xe4\xe4\xe5\xe5\xe9 \xe7\xe6\xe6\xe6 |
FileVersion: |
1.0.0.0 |
CompanyName: |
\xe4\xe4\xe5\xe5\xe9 |
Comments: |
\xe6\xe7\xe5\xe4\xe7\xe6\xe8\xe8\xe7\xe5(http://www.eyuyan.com) |
ProductName: |
\xe6\xe5 |
ProductVersion: |
1.0.0.0 |
FileDescription: |
\xe5\xe6\xe7\xef633825478 |
Translation: |
0x0804 0x04b0 |
PE数据组成
名称 |
虚拟地址 |
虚拟大小 |
原始数据大小 |
特征 |
熵(Entropy) |
lnln |
0x00001000 |
0x000db4da |
0x00000000 |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ |
0.00 |
lnln |
0x000dd000 |
0x005c547a |
0x00000000 |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ |
0.00 |
lnln |
0x006a3000 |
0x00084aeb |
0x00000000 |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE |
0.00 |
lnln |
0x00728000 |
0x0033327c |
0x00000000 |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ |
0.00 |
lnln |
0x00a5c000 |
0x00000a70 |
0x00001000 |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE |
0.23 |
lnln |
0x00a5d000 |
0x00af1990 |
0x00af2000 |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE |
7.99 |
lnln |
0x0154f000 |
0x00001e2a |
0x00002000 |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ |
7.77 |
lnln |
0x01551000 |
0x001a7004 |
0x001a8000 |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE |
7.76 |
lnln |
0x016f9000 |
0x00001000 |
0x00001000 |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ |
5.84 |
lnln |
0x016fa000 |
0x00089720 |
0x0008a000 |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ |
6.81 |
lnln |
0x01784000 |
0x00001e2a |
0x00002000 |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ |
5.47 |
资源
名称 |
偏移量 |
大小 |
语言 |
子语言 |
熵(Entropy) |
文件类型 |
RT_ICON |
0x0178461c |
0x000010a8 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
5.50 |
dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967295, next used block 4294967295 |
RT_ICON |
0x0178461c |
0x000010a8 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
5.50 |
dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967295, next used block 4294967295 |
RT_ICON |
0x0178461c |
0x000010a8 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
5.50 |
dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967295, next used block 4294967295 |
RT_GROUP_ICON |
0x017856ec |
0x00000014 |
LANG_CHINESE |
SUBLANG_CHINESE_SIMPLIFIED |
2.02 |
MS Windows icon resource - 1 icon, 16x16, 16 colors |
RT_GROUP_ICON |
0x017856ec |
0x00000014 |
LANG_CHINESE |
SUBLANG_CHINESE_SIMPLIFIED |
2.02 |
MS Windows icon resource - 1 icon, 16x16, 16 colors |
RT_GROUP_ICON |
0x017856ec |
0x00000014 |
LANG_CHINESE |
SUBLANG_CHINESE_SIMPLIFIED |
2.02 |
MS Windows icon resource - 1 icon, 16x16, 16 colors |
RT_VERSION |
0x01785700 |
0x00000270 |
LANG_CHINESE |
SUBLANG_CHINESE_SIMPLIFIED |
3.79 |
data |
RT_MANIFEST |
0x01785970 |
0x000004ba |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
5.20 |
XML 1.0 document, ASCII text, with CRLF line terminators |
导入
库 WINMM.dll:
• 0xe5c000 - midiStreamOut
库 WS2_32.dll:
• 0xe5c008 - WSAAsyncSelect
库 RASAPI32.dll:
• 0xe5c010 - RasHangUpA
库 KERNEL32.dll:
• 0xe5c018 - GetVersion
• 0xe5c01c - GetVersionExA
库 USER32.dll:
• 0xe5c024 - GetMessagePos
库 GDI32.dll:
• 0xe5c02c - ExtSelectClipRgn
库 WINSPOOL.DRV:
• 0xe5c034 - OpenPrinterA
库 ADVAPI32.dll:
• 0xe5c03c - RegQueryValueExA
库 SHELL32.dll:
• 0xe5c044 - SHGetSpecialFolderPathA
库 ole32.dll:
• 0xe5c04c - CLSIDFromString
库 OLEAUT32.dll:
• 0xe5c054 - LoadTypeLib
库 COMCTL32.dll:
• 0xe5c05c - None
库 WININET.dll:
• 0xe5c064 - InternetCloseHandle
库 comdlg32.dll:
• 0xe5c06c - ChooseColorA
库 KERNEL32.dll:
• 0xe5c074 - GetSystemTimeAsFileTime
库 USER32.dll:
• 0xe5c07c - CharUpperBuffW
库 KERNEL32.dll:
• 0xe5c084 - LocalAlloc
• 0xe5c088 - LocalFree
• 0xe5c08c - GetModuleFileNameW
• 0xe5c090 - ExitProcess
• 0xe5c094 - LoadLibraryA
• 0xe5c098 - GetModuleHandleA
• 0xe5c09c - GetProcAddress