3.2

可疑的

• DebuggerTiming__PerformanceCounter ()
• DebuggerTiming__Ticks (Detected timing ticks function)
• vmdetect (Possibly employs anti-virtualization techniques)
• anti_dbg (Checks if being debugged)
• network_tcp_listen (Listen for incoming communication)
• network_tcp_socket (Communications over RAW socket)
• spreading_file (Malware can spread east-west file)
• screenshot (Detected take screenshot function)
• create_process (Detection function for creating a new process)
• persistence (Install itself for autorun at Windows startup)
• keylogger (Detected keylogger function)
• win_registry (Detected system registries modification function)
• change_win_registry (Change registries to affect system)
• win_files_operation (Affect private profile)
• win_hook (Detected hook table access function)
• win_private_profile (Detected private profile access function)
• Maldun_Anomoly_Combined_Activities_Logging_Persistence (Spotted postential abnormal behaviors, like logging and persistenc3)
• Maldun_Anomoly_Combined_Activities_5 (Spotted potential mallicious behaviors like logging and network communication)
• Maldun_Anomoly_Combined_Activities_7 (Spotted potential malicious behaviors from a small size target, like process manipultion, privilege, token and files)
• with_images (Detected the presence of an or several images)
• with_urls (Detected the presence of an or several urls)
• UPX (Detected UPX. Commonly used by RAT!)
• CRC32_poly_Constant (Look for CRC32 [poly])
• CRC32_table (Look for CRC32 table)
• MD5_Constants (Look for MD5 constants)
• UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ()
• IsPE32 (Detected 32bit PE signature)
• IsWindowsGUI (Detected Windows GUI signature)
• HasRichSignature (Detected Rich Signature)