SmartHawk

5.8

高危

58 个模型检测该样本为恶意！

重新分析

下载样本

bca55e158b112f5d776f4402d48cdfaf5ae42b4d8f2e063ac69ba2405bfcc60a

03f9ffea8cc879ec181c918152814554.exe

分析耗时

21s

最近分析

文件大小

1.1MB

静态报毒动态报毒 100% AGEN AGENTTESLA AI SCORE=80 AIDETECTVM ANDROM AUTO BSCOPE CLASSIC CONFIDENCE DELFINJECT DELPHILESS ELUT FAREIT FHX@AQZOMWFI GENERICKDZ HIGH CONFIDENCE HJZWUM KCLOUD KRYPTIK LOKIBOT MALICIOUS PE MALWARE2 MALWARE@#3N1EN8JM4X34I R066C0PIK20 SCORE SIMDA STATIC AI SUSGEN SWOTTER UNSAFE X2059 ZELPHIF ZTIA 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Backdoor:Win32/Androm.0cd13058	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201210	21.1.5827.0
Tencent	Win32.Trojan.Inject.Auto	20201211	1.0.0.1
Kingsoft	Win32.Hack.Undef.(kcloud)	20201211	2017.9.26.565
McAfee	Fareit-FSK!03F9FFEA8CC8	20201211	6.0.6.653

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619134515.319784 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34799424 registers.edi: 0 registers.eax: 0 registers.ebp: 34799496 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 c9 8f f4 exception.symbol: 03f9ffea8cc879ec181c918152814554+0xba866 exception.instruction: div eax exception.module: 03f9ffea8cc879ec181c918152814554.exe exception.exception_code: 0xc0000094 exception.offset: 764006 exception.address: 0x4ba866	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (4 个事件)

Time & API	Arguments	Status
1619134515.101784 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619134515.319784 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01ea0000	success
1619134515.351784 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f30000	success
1619152825.001125 NtAllocateVirtualMemory	process_identifier: 2064 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00950000	success

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.525709408351705

section

{'size_of_data': '0x0000bc00', 'virtual_address': '0x000bb000', 'entropy': 7.525709408351705, 'name': 'DATA', 'virtual_size': '0x0000bb8c'}

description

A section with a high entropy has been found

entropy

7.248788211094861

section

{'size_of_data': '0x0003c400', 'virtual_address': '0x000de000', 'entropy': 7.248788211094861, 'name': '.rsrc', 'virtual_size': '0x0003c24c'}

description

A section with a high entropy has been found

entropy

0.2607514712539611

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2996 called NtSetContextThread to modify thread in remote process 2064
1619134515.882784 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4306480 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2064	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2996 resumed a thread in remote process 2064
1619134516.413784 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 2064	success	0	0

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619134515.757784 CreateProcessInternalW	thread_identifier: 912 thread_handle: 0x000000ec process_identifier: 2064 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\03f9ffea8cc879ec181c918152814554.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000f0 inherit_handles: 0	success	1
1619134515.757784 NtUnmapViewOfSection	process_identifier: 2064 region_size: 4096 process_handle: 0x000000f0 base_address: 0x00400000	success	0
1619134515.757784 NtMapViewOfSection	section_handle: 0x000000f8 process_identifier: 2064 commit_size: 172032 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000f0 allocation_type: 0 () section_offset: 0 view_size: 172032 base_address: 0x00400000	success	0
1619134515.882784 NtGetContextThread	thread_handle: 0x000000ec	success	0
1619134515.882784 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4306480 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2064	success	0
1619134516.413784 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 2064	success	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.67027
FireEye	Generic.mg.03f9ffea8cc879ec
ALYac	Trojan.GenericKDZ.67027
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.728157
Sangfor	Malware
K7AntiVirus	Trojan ( 005663731 )
Alibaba	Backdoor:Win32/Androm.0cd13058
K7GW	Trojan ( 005663731 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D105D3
Cyren	W32/DelfInject.ZTIA-5306
Symantec	Trojan.Gen.MBT
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.LokiBot-7778274-0
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
BitDefender	Trojan.GenericKDZ.67027
NANO-Antivirus	Trojan.Win32.Stealer.hjzwum
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Trojan.GenericKDZ.67027
Emsisoft	Trojan.GenericKDZ.67027 (B)
Comodo	Malware@#3n1en8jm4x34i
F-Secure	Heuristic.HEUR/AGEN.1136364
DrWeb	Trojan.PWS.Stealer.28468
VIPRE	Trojan.Win32.Simda.ba (v)
TrendMicro	TROJ_GEN.R066C0PIK20
McAfee-GW-Edition	BehavesLike.Win32.Fareit.tc
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.Kryptik.ari
Avira	HEUR/AGEN.1136364
eGambit	Unsafe.AI_Score_99%
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	TrojanSpy:Win32/Swotter.A!bit
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Backdoor.Win32.Androm.gen
GData	Trojan.GenericKDZ.67027
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2059
McAfee	Fareit-FSK!03F9FFEA8CC8
MAX	malware (ai score=80)
VBA32	BScope.TrojanSpy.Swotter
Malwarebytes	Spyware.AgentTesla
ESET-NOD32	a variant of Win32/Injector.ELUT
TrendMicro-HouseCall	TROJ_GEN.R066C0PIK20
Rising	Trojan.Injector!1.CB27 (CLASSIC)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4c9140 DeleteCriticalSection

• 0x4c9144 LeaveCriticalSection

• 0x4c9148 EnterCriticalSection

• 0x4c914c InitializeCriticalSection

• 0x4c9150 VirtualFree

• 0x4c9154 VirtualAlloc

• 0x4c9158 LocalFree

• 0x4c915c LocalAlloc

• 0x4c9160 GetTickCount

• 0x4c9164 QueryPerformanceCounter

• 0x4c9168 GetVersion

• 0x4c916c GetCurrentThreadId

• 0x4c9170 InterlockedDecrement

• 0x4c9174 InterlockedIncrement

• 0x4c9178 VirtualQuery

• 0x4c917c WideCharToMultiByte

• 0x4c9180 MultiByteToWideChar

• 0x4c9184 lstrlenA

• 0x4c9188 lstrcpynA

• 0x4c918c LoadLibraryExA

• 0x4c9190 GetThreadLocale

• 0x4c9194 GetStartupInfoA

• 0x4c9198 GetProcAddress

• 0x4c919c GetModuleHandleA

• 0x4c91a0 GetModuleFileNameA

• 0x4c91a4 GetLocaleInfoA

• 0x4c91a8 GetCommandLineA

• 0x4c91ac FreeLibrary

• 0x4c91b0 FindFirstFileA

• 0x4c91b4 FindClose

• 0x4c91b8 ExitProcess

• 0x4c91bc ExitThread

• 0x4c91c0 CreateThread

• 0x4c91c4 WriteFile

• 0x4c91c8 UnhandledExceptionFilter

• 0x4c91cc RtlUnwind

• 0x4c91d0 RaiseException

• 0x4c91d4 GetStdHandle

Library user32.dll:

• 0x4c91dc GetKeyboardType

• 0x4c91e0 LoadStringA

• 0x4c91e4 MessageBoxA

• 0x4c91e8 CharNextA

Library advapi32.dll:

• 0x4c91f0 RegQueryValueExA

• 0x4c91f4 RegOpenKeyExA

• 0x4c91f8 RegCloseKey

Library oleaut32.dll:

• 0x4c9200 SysFreeString

• 0x4c9204 SysReAllocStringLen

• 0x4c9208 SysAllocStringLen

Library kernel32.dll:

• 0x4c9210 TlsSetValue

• 0x4c9214 TlsGetValue

• 0x4c9218 LocalAlloc

• 0x4c921c GetModuleHandleA

Library advapi32.dll:

• 0x4c9224 RegQueryValueExA

• 0x4c9228 RegQueryInfoKeyA

• 0x4c922c RegOpenKeyExA

• 0x4c9230 RegFlushKey

• 0x4c9234 RegEnumKeyExA

• 0x4c9238 RegCloseKey

Library kernel32.dll:

• 0x4c9240 lstrcpyA

• 0x4c9244 WriteFile

• 0x4c9248 WaitForSingleObject

• 0x4c924c VirtualQuery

• 0x4c9250 VirtualAlloc

• 0x4c9254 SuspendThread

• 0x4c9258 Sleep

• 0x4c925c SizeofResource

• 0x4c9260 SetThreadPriority

• 0x4c9264 SetThreadLocale

• 0x4c9268 SetFilePointer

• 0x4c926c SetEvent

• 0x4c9270 SetErrorMode

• 0x4c9274 SetEndOfFile

• 0x4c9278 SearchPathA

• 0x4c927c ResumeThread

• 0x4c9280 ResetEvent

• 0x4c9284 ReleaseMutex

• 0x4c9288 ReadFile

• 0x4c928c OpenFileMappingA

• 0x4c9290 MultiByteToWideChar

• 0x4c9294 MulDiv

• 0x4c9298 LockResource

• 0x4c929c LoadResource

• 0x4c92a0 LoadLibraryA

• 0x4c92a4 LeaveCriticalSection

• 0x4c92a8 IsDBCSLeadByte

• 0x4c92ac InitializeCriticalSection

• 0x4c92b0 GlobalUnlock

• 0x4c92b4 GlobalSize

• 0x4c92b8 GlobalReAlloc

• 0x4c92bc GlobalHandle

• 0x4c92c0 GlobalLock

• 0x4c92c4 GlobalFree

• 0x4c92c8 GlobalFindAtomA

• 0x4c92cc GlobalDeleteAtom

• 0x4c92d0 GlobalAlloc

• 0x4c92d4 GlobalAddAtomA

• 0x4c92d8 GetVersionExA

• 0x4c92dc GetVersion

• 0x4c92e0 GetUserDefaultLCID

• 0x4c92e4 GetTimeZoneInformation

• 0x4c92e8 GetTickCount

• 0x4c92ec GetThreadLocale

• 0x4c92f0 GetTempPathA

• 0x4c92f4 GetSystemTimeAsFileTime

• 0x4c92f8 GetSystemTime

• 0x4c92fc GetSystemInfo

• 0x4c9300 GetStringTypeExA

• 0x4c9304 GetStdHandle

• 0x4c9308 GetProcAddress

• 0x4c930c GetModuleHandleA

• 0x4c9310 GetModuleFileNameA

• 0x4c9314 GetLocaleInfoA

• 0x4c9318 GetLocalTime

• 0x4c931c GetLastError

• 0x4c9320 GetFullPathNameA

• 0x4c9324 GetFileSize

• 0x4c9328 GetExitCodeThread

• 0x4c932c GetDiskFreeSpaceA

• 0x4c9330 GetDateFormatA

• 0x4c9334 GetCurrentThreadId

• 0x4c9338 GetCurrentProcessId

• 0x4c933c GetCurrentDirectoryA

• 0x4c9340 GetComputerNameA

• 0x4c9344 GetCPInfo

• 0x4c9348 GetACP

• 0x4c934c FreeResource

• 0x4c9350 InterlockedIncrement

• 0x4c9354 InterlockedExchange

• 0x4c9358 InterlockedDecrement

• 0x4c935c FreeLibrary

• 0x4c9360 FormatMessageA

• 0x4c9364 FindResourceA

• 0x4c9368 FindFirstFileA

• 0x4c936c FindClose

• 0x4c9370 FileTimeToSystemTime

• 0x4c9374 FileTimeToLocalFileTime

• 0x4c9378 FileTimeToDosDateTime

• 0x4c937c FatalAppExitA

• 0x4c9380 ExitThread

• 0x4c9384 ExitProcess

• 0x4c9388 EnumCalendarInfoA

• 0x4c938c EnterCriticalSection

• 0x4c9390 DeleteCriticalSection

• 0x4c9394 CreateThread

• 0x4c9398 CreateMutexA

• 0x4c939c CreateFileA

• 0x4c93a0 CreateEventA

• 0x4c93a4 CompareStringA

• 0x4c93a8 CloseHandle

Library version.dll:

• 0x4c93b0 VerQueryValueA

• 0x4c93b4 GetFileVersionInfoSizeA

• 0x4c93b8 GetFileVersionInfoA

Library gdi32.dll:

• 0x4c93c0 UnrealizeObject

• 0x4c93c4 StretchBlt

• 0x4c93c8 SetWindowOrgEx

• 0x4c93cc SetWinMetaFileBits

• 0x4c93d0 SetViewportOrgEx

• 0x4c93d4 SetTextColor

• 0x4c93d8 SetStretchBltMode

• 0x4c93dc SetROP2

• 0x4c93e0 SetPixel

• 0x4c93e4 SetMapMode

• 0x4c93e8 SetEnhMetaFileBits

• 0x4c93ec SetDIBColorTable

• 0x4c93f0 SetBrushOrgEx

• 0x4c93f4 SetBkMode

• 0x4c93f8 SetBkColor

• 0x4c93fc SelectPalette

• 0x4c9400 SelectObject

• 0x4c9404 SelectClipRgn

• 0x4c9408 SaveDC

• 0x4c940c RestoreDC

• 0x4c9410 Rectangle

• 0x4c9414 RectVisible

• 0x4c9418 RealizePalette

• 0x4c941c Polyline

• 0x4c9420 PlayEnhMetaFile

• 0x4c9424 PatBlt

• 0x4c9428 MoveToEx

• 0x4c942c MaskBlt

• 0x4c9430 LineTo

• 0x4c9434 LPtoDP

• 0x4c9438 IntersectClipRect

• 0x4c943c GetWindowOrgEx

• 0x4c9440 GetWinMetaFileBits

• 0x4c9444 GetTextMetricsA

• 0x4c9448 GetTextExtentPoint32A

• 0x4c944c GetSystemPaletteEntries

• 0x4c9450 GetStockObject

• 0x4c9454 GetPixel

• 0x4c9458 GetPaletteEntries

• 0x4c945c GetObjectA

• 0x4c9460 GetEnhMetaFilePaletteEntries

• 0x4c9464 GetEnhMetaFileHeader

• 0x4c9468 GetEnhMetaFileDescriptionA

• 0x4c946c GetEnhMetaFileBits

• 0x4c9470 GetDeviceCaps

• 0x4c9474 GetDIBits

• 0x4c9478 GetDIBColorTable

• 0x4c947c GetDCOrgEx

• 0x4c9480 GetCurrentPositionEx

• 0x4c9484 GetClipBox

• 0x4c9488 GetBrushOrgEx

• 0x4c948c GetBitmapBits

• 0x4c9490 ExcludeClipRect

• 0x4c9494 DeleteObject

• 0x4c9498 DeleteEnhMetaFile

• 0x4c949c DeleteDC

• 0x4c94a0 CreateSolidBrush

• 0x4c94a4 CreatePenIndirect

• 0x4c94a8 CreatePalette

• 0x4c94ac CreateHalftonePalette

• 0x4c94b0 CreateFontIndirectA

• 0x4c94b4 CreateEnhMetaFileA

• 0x4c94b8 CreateDIBitmap

• 0x4c94bc CreateDIBSection

• 0x4c94c0 CreateCompatibleDC

• 0x4c94c4 CreateCompatibleBitmap

• 0x4c94c8 CreateBrushIndirect

• 0x4c94cc CreateBitmap

• 0x4c94d0 CopyEnhMetaFileA

• 0x4c94d4 CloseEnhMetaFile

• 0x4c94d8 BitBlt

Library user32.dll:

• 0x4c94e0 CreateWindowExA

• 0x4c94e4 WindowFromPoint

• 0x4c94e8 WinHelpA

• 0x4c94ec WaitMessage

• 0x4c94f0 UpdateWindow

• 0x4c94f4 UnregisterClassA

• 0x4c94f8 UnhookWindowsHookEx

• 0x4c94fc TranslateMessage

• 0x4c9500 TranslateMDISysAccel

• 0x4c9504 TrackPopupMenu

• 0x4c9508 SystemParametersInfoA

• 0x4c950c ShowWindow

• 0x4c9510 ShowScrollBar

• 0x4c9514 ShowOwnedPopups

• 0x4c9518 ShowCursor

• 0x4c951c SetWindowsHookExA

• 0x4c9520 SetWindowTextA

• 0x4c9524 SetWindowPos

• 0x4c9528 SetWindowPlacement

• 0x4c952c SetWindowLongA

• 0x4c9530 SetTimer

• 0x4c9534 SetScrollRange

• 0x4c9538 SetScrollPos

• 0x4c953c SetScrollInfo

• 0x4c9540 SetRect

• 0x4c9544 SetPropA

• 0x4c9548 SetParent

• 0x4c954c SetMenuItemInfoA

• 0x4c9550 SetMenu

• 0x4c9554 SetForegroundWindow

• 0x4c9558 SetFocus

• 0x4c955c SetCursor

• 0x4c9560 SetClassLongA

• 0x4c9564 SetCapture

• 0x4c9568 SetActiveWindow

• 0x4c956c SendMessageA

• 0x4c9570 ScrollWindow

• 0x4c9574 ScreenToClient

• 0x4c9578 RemovePropA

• 0x4c957c RemoveMenu

• 0x4c9580 ReleaseDC

• 0x4c9584 ReleaseCapture

• 0x4c9588 RegisterWindowMessageA

• 0x4c958c RegisterClipboardFormatA

• 0x4c9590 RegisterClassA

• 0x4c9594 RedrawWindow

• 0x4c9598 PtInRect

• 0x4c959c PostQuitMessage

• 0x4c95a0 PostMessageA

• 0x4c95a4 PeekMessageA

• 0x4c95a8 OffsetRect

• 0x4c95ac OemToCharBuffA

• 0x4c95b0 OemToCharA

• 0x4c95b4 MsgWaitForMultipleObjects

• 0x4c95b8 MessageBoxA

• 0x4c95bc MapWindowPoints

• 0x4c95c0 MapVirtualKeyA

• 0x4c95c4 LoadStringA

• 0x4c95c8 LoadKeyboardLayoutA

• 0x4c95cc LoadIconA

• 0x4c95d0 LoadCursorA

• 0x4c95d4 LoadBitmapA

• 0x4c95d8 KillTimer

• 0x4c95dc IsZoomed

• 0x4c95e0 IsWindowVisible

• 0x4c95e4 IsWindowEnabled

• 0x4c95e8 IsWindow

• 0x4c95ec IsRectEmpty

• 0x4c95f0 IsIconic

• 0x4c95f4 IsDialogMessageA

• 0x4c95f8 IsChild

• 0x4c95fc InvalidateRect

• 0x4c9600 IntersectRect

• 0x4c9604 InsertMenuItemA

• 0x4c9608 InsertMenuA

• 0x4c960c InflateRect

• 0x4c9610 GetWindowThreadProcessId

• 0x4c9614 GetWindowTextA

• 0x4c9618 GetWindowRect

• 0x4c961c GetWindowPlacement

• 0x4c9620 GetWindowLongA

• 0x4c9624 GetWindowDC

• 0x4c9628 GetTopWindow

• 0x4c962c GetSystemMetrics

• 0x4c9630 GetSystemMenu

• 0x4c9634 GetSysColorBrush

• 0x4c9638 GetSysColor

• 0x4c963c GetSubMenu

• 0x4c9640 GetScrollRange

• 0x4c9644 GetScrollPos

• 0x4c9648 GetScrollInfo

• 0x4c964c GetPropA

• 0x4c9650 GetParent

• 0x4c9654 GetWindow

• 0x4c9658 GetMessageTime

• 0x4c965c GetMenuStringA

• 0x4c9660 GetMenuState

• 0x4c9664 GetMenuItemInfoA

• 0x4c9668 GetMenuItemID

• 0x4c966c GetMenuItemCount

• 0x4c9670 GetMenu

• 0x4c9674 GetLastActivePopup

• 0x4c9678 GetKeyboardState

• 0x4c967c GetKeyboardLayoutList

• 0x4c9680 GetKeyboardLayout

• 0x4c9684 GetKeyState

• 0x4c9688 GetKeyNameTextA

• 0x4c968c GetIconInfo

• 0x4c9690 GetForegroundWindow

• 0x4c9694 GetFocus

• 0x4c9698 GetDesktopWindow

• 0x4c969c GetDCEx

• 0x4c96a0 GetDC

• 0x4c96a4 GetCursorPos

• 0x4c96a8 GetCursor

• 0x4c96ac GetClipboardData

• 0x4c96b0 GetClientRect

• 0x4c96b4 GetClassNameA

• 0x4c96b8 GetClassInfoA

• 0x4c96bc GetCapture

• 0x4c96c0 GetActiveWindow

• 0x4c96c4 FrameRect

• 0x4c96c8 FindWindowA

• 0x4c96cc FillRect

• 0x4c96d0 EqualRect

• 0x4c96d4 EnumWindows

• 0x4c96d8 EnumThreadWindows

• 0x4c96dc EndPaint

• 0x4c96e0 EnableWindow

• 0x4c96e4 EnableScrollBar

• 0x4c96e8 EnableMenuItem

• 0x4c96ec DrawTextA

• 0x4c96f0 DrawMenuBar

• 0x4c96f4 DrawIconEx

• 0x4c96f8 DrawIcon

• 0x4c96fc DrawFrameControl

• 0x4c9700 DrawEdge

• 0x4c9704 DispatchMessageA

• 0x4c9708 DestroyWindow

• 0x4c970c DestroyMenu

• 0x4c9710 DestroyIcon

• 0x4c9714 DestroyCursor

• 0x4c9718 DeleteMenu

• 0x4c971c DefWindowProcA

• 0x4c9720 DefMDIChildProcA

• 0x4c9724 DefFrameProcA

• 0x4c9728 CreatePopupMenu

• 0x4c972c CreateMenu

• 0x4c9730 CreateIcon

• 0x4c9734 ClientToScreen

• 0x4c9738 CheckMenuItem

• 0x4c973c CallWindowProcA

• 0x4c9740 CallNextHookEx

• 0x4c9744 BeginPaint

• 0x4c9748 CharNextA

• 0x4c974c CharLowerBuffA

• 0x4c9750 CharLowerA

• 0x4c9754 CharUpperBuffA

• 0x4c9758 CharToOemBuffA

• 0x4c975c CharToOemA

• 0x4c9760 AdjustWindowRectEx

• 0x4c9764 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4c976c Sleep

Library oleaut32.dll:

• 0x4c9774 SafeArrayPtrOfIndex

• 0x4c9778 SafeArrayPutElement

• 0x4c977c SafeArrayGetElement

• 0x4c9780 SafeArrayUnaccessData

• 0x4c9784 SafeArrayAccessData

• 0x4c9788 SafeArrayGetUBound

• 0x4c978c SafeArrayGetLBound

• 0x4c9790 SafeArrayCreate

• 0x4c9794 VariantChangeType

• 0x4c9798 VariantCopyInd

• 0x4c979c VariantCopy

• 0x4c97a0 VariantClear

• 0x4c97a4 VariantInit

Library ole32.dll:

• 0x4c97ac CreateStreamOnHGlobal

• 0x4c97b0 IsAccelerator

• 0x4c97b4 OleDraw

• 0x4c97b8 OleSetMenuDescriptor

• 0x4c97bc CoTaskMemFree

• 0x4c97c0 ProgIDFromCLSID

• 0x4c97c4 StringFromCLSID

• 0x4c97c8 CoCreateInstance

• 0x4c97cc CoGetClassObject

• 0x4c97d0 CoUninitialize

• 0x4c97d4 CoInitialize

• 0x4c97d8 IsEqualGUID

Library oleaut32.dll:

• 0x4c97e0 GetErrorInfo

• 0x4c97e4 GetActiveObject

• 0x4c97e8 SysFreeString

Library comctl32.dll:

• 0x4c97f0 ImageList_SetIconSize

• 0x4c97f4 ImageList_GetIconSize

• 0x4c97f8 ImageList_Write

• 0x4c97fc ImageList_Read

• 0x4c9800 ImageList_GetDragImage

• 0x4c9804 ImageList_DragShowNolock

• 0x4c9808 ImageList_SetDragCursorImage

• 0x4c980c ImageList_DragMove

• 0x4c9810 ImageList_DragLeave

• 0x4c9814 ImageList_DragEnter

• 0x4c9818 ImageList_EndDrag

• 0x4c981c ImageList_BeginDrag

• 0x4c9820 ImageList_Remove

• 0x4c9824 ImageList_DrawEx

• 0x4c9828 ImageList_Draw

• 0x4c982c ImageList_GetBkColor

• 0x4c9830 ImageList_SetBkColor

• 0x4c9834 ImageList_ReplaceIcon

• 0x4c9838 ImageList_Add

• 0x4c983c ImageList_GetImageCount

• 0x4c9840 ImageList_Destroy

• 0x4c9844 ImageList_Create

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702
192.168.56.101	65005	239.255.255.250	3702
192.168.56.101	65007	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.