SmartHawk

10.6

0-day

58 个模型检测该样本为恶意！

重新分析

下载样本

9e549b93e2fff7cf428717a2f453b933fa46e22c04345a853f881623df6b5d2a

04fe99ad8fb602df39daadb0d2624f57.exe

分析耗时

91s

最近分析

文件大小

688.0KB

静态报毒动态报毒 AGEN AI SCORE=83 AIDETECTVM ATTRIBUTE CLASSIC DOWNLOADER34 ELDORADO EMOTET EPAZ GDSDA GENCIRC GENERICKD GENKRYPTIK HFFH HIGH CONFIDENCE HIGHCONFIDENCE HPCGNB KCLOUD KRYPTIK MALWARE2 MALWARE@#2VVT8KAO8OD86 R + TROJ R346194 RQW@ASSXDKLJ SCORE SUSGEN THIAABO TROJANBANKER UNSAFE ZEUS ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRI!04FE99AD8FB6	20201211	6.0.6.653
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20201210	21.1.5827.0
Alibaba	Trojan:Win32/Emotet.968db8d9	20190527	0.3.0.5
Tencent	Malware.Win32.Gencirc.10cdfec7	20201211	1.0.0.1
Kingsoft	Win32.Troj.Banker.(kcloud)	20201211	2017.9.26.565
CrowdStrike		20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619136032.054124 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619136023.257124 CryptGenKey	crypto_handle: 0x005763f0 algorithm_identifier: 0x0000660e () provider_handle: 0x00575d60 flags: 1 key: f>aa"ø¿]Ûr±5	success	1
1619136032.085124 CryptExportKey	crypto_handle: 0x005763f0 crypto_export_handle: 0x005763b0 buffer: f¤0¢¢/[ÝÉ]dÖHHJSDó^HG©È ô$Z²L/íÐ÷o`ÞYêïÔ@DPJSiwsî];9Mê÷eQ¶y'Öá5èÎ¾§ blob_type: 1 flags: 64	success	1
1619136076.304124 CryptExportKey	crypto_handle: 0x005763f0 crypto_export_handle: 0x005763b0 buffer: f¤/ÈÒø×Ä¿ª©W¿úì÷FfÆïâ£ån8aø>5*°`¿AoÛ!-g17ÁÞ(:öíXúú¢ºÚ5¶§ÑPÉgæcÀ=®Á!Æ[sÜ ^ blob_type: 1 flags: 64	success	1

This executable has a PDB path (1 个事件)

pdb_path

c:\Users\User\Desktop\2005\27.7.20\custom_pattern_brush_src\BrushTool\Release\BrushTool.pdb

One or more processes crashed (6 个事件)

Time & API	Arguments	Status
1619135597.760395 __exception__	stacktrace: 0x27f1d04 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 registers.r14: 8791618826624 registers.r9: 0 registers.rcx: 48 registers.rsi: 0 registers.r10: 0 registers.rbx: 4510400 registers.rdi: 8791618826624 registers.r11: 1441664 registers.r8: 2009563532 registers.rdx: 8796092887632 registers.rbp: 1440592 registers.r15: 4279435264 registers.r12: 1 registers.rsp: 1440472 registers.rax: 41884928 registers.r13: 0 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 47 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x27f1d04	success
1619135597.760395 __exception__	stacktrace: 0x27f1d04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 registers.r14: 0 registers.r9: 0 registers.rcx: 48 registers.rsi: 0 registers.r10: 0 registers.rbx: 4510400 registers.rdi: 2492640 registers.r11: 58062944 registers.r8: 2009563532 registers.rdx: 8796092592720 registers.rbp: 58062560 registers.r15: 0 registers.r12: 0 registers.rsp: 58062440 registers.rax: 41884928 registers.r13: 4294967295 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 47 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x27f1d04	success
1619135598.868895 __exception__	stacktrace: 0x2771d04 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 registers.r14: 8791618826624 registers.r9: 0 registers.rcx: 48 registers.rsi: 0 registers.r10: 0 registers.rbx: 2399536 registers.rdi: 8791618826624 registers.r11: 2226112 registers.r8: 2009563532 registers.rdx: 8796092887632 registers.rbp: 2225040 registers.r15: 4279435264 registers.r12: 1 registers.rsp: 2224920 registers.rax: 41360640 registers.r13: 0 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 47 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2771d04	success
1619135598.884895 __exception__	stacktrace: 0x2771d04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 registers.r14: 0 registers.r9: 0 registers.rcx: 48 registers.rsi: 0 registers.r10: 0 registers.rbx: 2399536 registers.rdi: 2493781 registers.r11: 44433024 registers.r8: 2009563532 registers.rdx: 8796092592720 registers.rbp: 44432640 registers.r15: 0 registers.r12: 0 registers.rsp: 44432520 registers.rax: 41360640 registers.r13: 4294967295 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 47 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2771d04	success
1619135604.838395 __exception__	stacktrace: 0x2781d04 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 registers.r14: 8791618826624 registers.r9: 0 registers.rcx: 48 registers.rsi: 0 registers.r10: 0 registers.rbx: 1219136 registers.rdi: 8791618826624 registers.r11: 2750784 registers.r8: 2009563532 registers.rdx: 8796092887632 registers.rbp: 2749712 registers.r15: 4279435264 registers.r12: 1 registers.rsp: 2749592 registers.rax: 41426176 registers.r13: 0 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 47 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2781d04	success
1619135604.869395 __exception__	stacktrace: 0x2781d04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 registers.r14: 0 registers.r9: 0 registers.rcx: 48 registers.rsi: 0 registers.r10: 0 registers.rbx: 1219136 registers.rdi: 2499687 registers.r11: 53606592 registers.r8: 2009563532 registers.rdx: 8796092592720 registers.rbp: 53606208 registers.r15: 0 registers.r12: 0 registers.rsp: 53606088 registers.rax: 41426176 registers.r13: 4294967295 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 47 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2781d04	success

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619134510.708119 NtAllocateVirtualMemory	process_identifier: 2264 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00610000	success
1619135665.932145 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004060000	success
1619136022.913124 NtAllocateVirtualMemory	process_identifier: 1060 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00500000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Foreign language identified in PE resource (3 个事件)

name

RT_ICON

language

LANG_CHINESE

offset

0x000ad3bc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000128

name

RT_ICON

language

LANG_CHINESE

offset

0x000ad3bc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000128

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x000af34c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000022

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (11 个事件)

Time & API	Arguments	Status	Return
1619136023.007124 Process32NextW	process_name: pythonw.exe snapshot_handle: 0x0000016c process_identifier: 2256	success	1
1619136023.007124 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x0000016c process_identifier: 1068	success	1
1619136023.007124 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x0000016c process_identifier: 2344	success	1
1619136023.007124 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x0000016c process_identifier: 2196	success	1
1619136032.069124 Process32NextW	process_name: wmpnscfg.exe snapshot_handle: 0x00000178 process_identifier: 2340	success	1
1619136032.069124 Process32NextW	process_name: wmpnscfg.exe snapshot_handle: 0x00000178 process_identifier: 2368	success	1
1619136032.069124 Process32NextW	process_name: wmpnscfg.exe snapshot_handle: 0x00000178 process_identifier: 3112	success	1
1619136032.069124 Process32NextW	process_name: inject-x64.exe snapshot_handle: 0x00000178 process_identifier: 3208	success	1
1619136032.069124 Process32NextW	process_name: inject-x64.exe snapshot_handle: 0x00000178 process_identifier: 3260	success	1
1619136032.069124 Process32NextW	process_name: wmpnscfg.exe snapshot_handle: 0x00000178 process_identifier: 3308	success	1
1619136032.069124 Process32NextW	process_name: inject-x64.exe snapshot_handle: 0x00000178 process_identifier: 3432	success	1

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619134511.458119 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\04fe99ad8fb602df39daadb0d2624f57.exe newfilepath: C:\Windows\SysWOW64\TSWorkspace\msshooks.exe newfilepath_r: C:\Windows\SysWOW64\TSWorkspace\msshooks.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\04fe99ad8fb602df39daadb0d2624f57.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619136034.476124 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

7.267329213475829

section

{'size_of_data': '0x0000c000', 'virtual_address': '0x00098000', 'entropy': 7.267329213475829, 'name': '.data', 'virtual_size': '0x0000f508'}

description

A section with a high entropy has been found

Expresses interest in specific running processes (1 个事件)

process

msshooks.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619136032.257124 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	74.207.230.187
host	75.139.38.211

Installs itself for autorun at Windows startup (1 个事件)

service_name

msshooks

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\TSWorkspace\msshooks.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619134511.833119 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x029862e8 display_name: msshooks error_control: 0 service_name: msshooks filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\TSWorkspace\msshooks.exe" filepath_r: "C:\Windows\SysWOW64\TSWorkspace\msshooks.exe" service_manager_handle: 0x02985d20 desired_access: 2 service_type: 16 password:	success	43541224	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619136037.272124 RegSetValueExA	key_handle: 0x000003bc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619136037.272124 RegSetValueExA	key_handle: 0x000003bc value: q97× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619136037.272124 RegSetValueExA	key_handle: 0x000003bc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619136037.288124 RegSetValueExW	key_handle: 0x000003bc value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619136037.288124 RegSetValueExA	key_handle: 0x000003d4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619136037.288124 RegSetValueExA	key_handle: 0x000003d4 value: q97× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619136037.288124 RegSetValueExA	key_handle: 0x000003d4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619136037.351124 RegSetValueExW	key_handle: 0x000003b8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\TSWorkspace\msshooks.exe:Zone.Identifier

Zeus P2P (Banking Trojan) (50 out of 52 个事件)

mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:18
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:19
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:13
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:14
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:15
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:16
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:17
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:23
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:21
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:20
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:49
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:48
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:25
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:24
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:27
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:26
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:43
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:42
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:41
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:40
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:47
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:46
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:45
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:44
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:29
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:28
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:22
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:32
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:33
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:30
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:31
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:36
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:37
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:34
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:35
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:38
mutex	Global\{89fcecff-287c-445f-8dc3-446ec943d2df}:sqlce_se_lck:39
udp	{'src': '192.168.56.101', 'dst': '224.0.0.252', 'offset': 11082, 'time': 12.634706974029541, 'dport': 5355, 'sport': 51378}
udp	{'src': '192.168.56.101', 'dst': '224.0.0.252', 'offset': 11410, 'time': 9.681617021560669, 'dport': 5355, 'sport': 51808}
udp	{'src': '192.168.56.101', 'dst': '224.0.0.252', 'offset': 11738, 'time': 26.251487016677856, 'dport': 5355, 'sport': 53237}
udp	{'src': '192.168.56.101', 'dst': '224.0.0.252', 'offset': 12058, 'time': 6.696655988693237, 'dport': 5355, 'sport': 55368}
udp	{'src': '192.168.56.101', 'dst': '224.0.0.252', 'offset': 12394, 'time': 4.169368028640747, 'dport': 5355, 'sport': 56804}
udp	{'src': '192.168.56.101', 'dst': '224.0.0.252', 'offset': 12730, 'time': 6.694077968597412, 'dport': 5355, 'sport': 60123}
udp	{'src': '192.168.56.101', 'dst': '224.0.0.252', 'offset': 13058, 'time': 4.577656030654907, 'dport': 5355, 'sport': 62191}
udp	{'src': '192.168.56.101', 'dst': '224.0.0.252', 'offset': 13386, 'time': 84.23359513282776, 'dport': 5355, 'sport': 62318}
udp	{'src': '192.168.56.101', 'dst': '239.255.255.250', 'offset': 13706, 'time': 4.253582954406738, 'dport': 1900, 'sport': 1900}
udp	{'src': '192.168.56.101', 'dst': '239.255.255.250', 'offset': 33116, 'time': 9.330051183700562, 'dport': 3702, 'sport': 50535}
udp	{'src': '192.168.56.101', 'dst': '239.255.255.250', 'offset': 35972, 'time': 18.77391815185547, 'dport': 3702, 'sport': 51379}
udp	{'src': '192.168.56.101', 'dst': '239.255.255.250', 'offset': 38700, 'time': 29.711466073989868, 'dport': 3702, 'sport': 53238}
udp	{'src': '192.168.56.101', 'dst': '239.255.255.250', 'offset': 41428, 'time': 5.206292152404785, 'dport': 3702, 'sport': 56540}

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
FireEye	Generic.mg.04fe99ad8fb602df
McAfee	Emotet-FRI!04FE99AD8FB6
Cylance	Unsafe
Zillya	Trojan.Emotet.Win32.23027
Sangfor	Malware
K7AntiVirus	Trojan ( 0056d60b1 )
BitDefender	Trojan.GenericKD.43557919
K7GW	Trojan ( 0056d60b1 )
Cybereason	malicious.888a9c
Arcabit	Trojan.Generic.D298A41F
Cyren	W32/Kryptik.BRS.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.gen
Alibaba	Trojan:Win32/Emotet.968db8d9
NANO-Antivirus	Trojan.Win32.Emotet.hpcgnb
ViRobot	Trojan.Win32.Emotet.704512
AegisLab	Trojan.Win32.Emotet.L!c
MicroWorld-eScan	Trojan.GenericKD.43557919
Tencent	Malware.Win32.Gencirc.10cdfec7
Ad-Aware	Trojan.GenericKD.43557919
Sophos	Mal/Generic-R + Troj/Emotet-CKI
Comodo	Malware@#2vvt8kao8od86
F-Secure	Heuristic.HEUR/AGEN.1137820
DrWeb	Trojan.DownLoader34.9048
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.EMOTET.THIAABO
McAfee-GW-Edition	BehavesLike.Win32.Emotet.jh
Emsisoft	Trojan.Emotet (A)
Ikarus	Trojan-Banker.Emotet
Jiangmin	Trojan.Banker.Emotet.nzp
Avira	HEUR/AGEN.1137820
MAX	malware (ai score=83)
Antiy-AVL	Trojan[Banker]/Win32.Emotet
Kingsoft	Win32.Troj.Banker.(kcloud)
Gridinsoft	Trojan.Win32.Emotet.oa!s1
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.gen
GData	Trojan.GenericKD.43557919
AhnLab-V3	Trojan/Win32.Emotet.R346194
BitDefenderTheta	Gen:NN.ZexaF.34670.RqW@aSsXdKlj
ALYac	Trojan.GenericKD.43557919
TACHYON	Banker/W32.Emotet.704512.B
VBA32	TrojanBanker.Emotet
Malwarebytes	Trojan.MalPack.TRE
Panda	Trj/GdSda.A

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	74.207.230.187:8080
dead_host	75.139.38.211:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-28 05:26:59

Imports

Library KERNEL32.dll:

• 0x47a1ac SetFileTime

• 0x47a1b0 SetFileAttributesA

• 0x47a1b4 GetFileAttributesA

• 0x47a1b8 GetFileTime

• 0x47a1bc SetErrorMode

• 0x47a1c0 GetTickCount

• 0x47a1c4 RtlUnwind

• 0x47a1c8 RaiseException

• 0x47a1cc HeapAlloc

• 0x47a1d0 HeapFree

• 0x47a1d4 HeapReAlloc

• 0x47a1d8 VirtualProtect

• 0x47a1dc VirtualAlloc

• 0x47a1e0 GetSystemInfo

• 0x47a1e4 VirtualQuery

• 0x47a1e8 GetCommandLineA

• 0x47a1ec GetProcessHeap

• 0x47a1f0 GetStartupInfoA

• 0x47a1f4 ExitThread

• 0x47a1f8 CreateThread

• 0x47a1fc HeapSize

• 0x47a200 TerminateProcess

• 0x47a204 UnhandledExceptionFilter

• 0x47a208 SetUnhandledExceptionFilter

• 0x47a20c IsDebuggerPresent

• 0x47a210 Sleep

• 0x47a214 GetACP

• 0x47a218 FatalAppExitA

• 0x47a21c VirtualFree

• 0x47a220 HeapDestroy

• 0x47a224 LocalFileTimeToFileTime

• 0x47a228 GetStdHandle

• 0x47a22c FreeEnvironmentStringsA

• 0x47a230 GetEnvironmentStrings

• 0x47a234 FreeEnvironmentStringsW

• 0x47a238 GetEnvironmentStringsW

• 0x47a23c SetHandleCount

• 0x47a240 GetFileType

• 0x47a244 QueryPerformanceCounter

• 0x47a248 GetSystemTimeAsFileTime

• 0x47a24c SetConsoleCtrlHandler

• 0x47a250 GetStringTypeA

• 0x47a254 GetStringTypeW

• 0x47a258 GetTimeZoneInformation

• 0x47a25c GetConsoleCP

• 0x47a260 GetConsoleMode

• 0x47a264 LCMapStringA

• 0x47a268 LCMapStringW

• 0x47a26c GetTimeFormatA

• 0x47a270 GetDateFormatA

• 0x47a274 GetUserDefaultLCID

• 0x47a278 EnumSystemLocalesA

• 0x47a27c IsValidLocale

• 0x47a280 IsValidCodePage

• 0x47a284 GetLocaleInfoW

• 0x47a288 SetStdHandle

• 0x47a28c WriteConsoleA

• 0x47a290 GetConsoleOutputCP

• 0x47a294 WriteConsoleW

• 0x47a298 SetEnvironmentVariableA

• 0x47a29c FileTimeToLocalFileTime

• 0x47a2a0 SystemTimeToFileTime

• 0x47a2a4 FileTimeToSystemTime

• 0x47a2a8 GetAtomNameA

• 0x47a2ac GetOEMCP

• 0x47a2b0 GetCPInfo

• 0x47a2b4 CreateFileA

• 0x47a2b8 GetShortPathNameA

• 0x47a2bc GetFullPathNameA

• 0x47a2c0 GetVolumeInformationA

• 0x47a2c4 FindFirstFileA

• 0x47a2c8 FindClose

• 0x47a2cc DuplicateHandle

• 0x47a2d0 GetThreadLocale

• 0x47a2d4 GetFileSize

• 0x47a2d8 SetEndOfFile

• 0x47a2dc UnlockFile

• 0x47a2e0 LockFile

• 0x47a2e4 FlushFileBuffers

• 0x47a2e8 SetFilePointer

• 0x47a2ec WriteFile

• 0x47a2f0 ReadFile

• 0x47a2f4 DeleteFileA

• 0x47a2f8 MoveFileA

• 0x47a2fc InterlockedIncrement

• 0x47a300 TlsFree

• 0x47a304 DeleteCriticalSection

• 0x47a308 LocalReAlloc

• 0x47a30c TlsSetValue

• 0x47a310 TlsAlloc

• 0x47a314 InitializeCriticalSection

• 0x47a318 GlobalHandle

• 0x47a31c EnterCriticalSection

• 0x47a320 TlsGetValue

• 0x47a324 LeaveCriticalSection

• 0x47a328 LocalAlloc

• 0x47a32c GlobalFlags

• 0x47a330 GetCurrentDirectoryA

• 0x47a334 GetPrivateProfileStringA

• 0x47a338 WritePrivateProfileStringA

• 0x47a33c GetPrivateProfileIntA

• 0x47a340 GlobalReAlloc

• 0x47a344 InterlockedDecrement

• 0x47a348 GetModuleFileNameW

• 0x47a34c CopyFileA

• 0x47a350 GlobalSize

• 0x47a354 FormatMessageA

• 0x47a358 LocalFree

• 0x47a35c MulDiv

• 0x47a360 GlobalGetAtomNameA

• 0x47a364 GlobalFindAtomA

• 0x47a368 lstrcmpW

• 0x47a36c GetVersionExA

• 0x47a370 GlobalUnlock

• 0x47a374 GlobalFree

• 0x47a378 FreeResource

• 0x47a37c GetCurrentProcessId

• 0x47a380 SetLastError

• 0x47a384 GlobalAddAtomA

• 0x47a388 CreateEventA

• 0x47a38c SuspendThread

• 0x47a390 SetEvent

• 0x47a394 WaitForSingleObject

• 0x47a398 ResumeThread

• 0x47a39c SetThreadPriority

• 0x47a3a0 CloseHandle

• 0x47a3a4 GetCurrentThread

• 0x47a3a8 GetCurrentThreadId

• 0x47a3ac ConvertDefaultLocale

• 0x47a3b0 GetModuleFileNameA

• 0x47a3b4 EnumResourceLanguagesA

• 0x47a3b8 GetLocaleInfoA

• 0x47a3bc GlobalLock

• 0x47a3c0 lstrcmpA

• 0x47a3c4 GlobalAlloc

• 0x47a3c8 GlobalDeleteAtom

• 0x47a3cc GetModuleHandleA

• 0x47a3d0 GetStringTypeExW

• 0x47a3d4 GetStringTypeExA

• 0x47a3d8 GetEnvironmentVariableW

• 0x47a3dc GetEnvironmentVariableA

• 0x47a3e0 lstrlenA

• 0x47a3e4 lstrcmpiW

• 0x47a3e8 lstrcmpiA

• 0x47a3ec CompareStringW

• 0x47a3f0 CompareStringA

• 0x47a3f4 lstrlenW

• 0x47a3f8 GetVersion

• 0x47a3fc GetLastError

• 0x47a400 MultiByteToWideChar

• 0x47a404 InterlockedExchange

• 0x47a408 GetWindowsDirectoryA

• 0x47a40c LoadLibraryA

• 0x47a410 FreeLibrary

• 0x47a414 lstrcatA

• 0x47a418 CreateProcessA

• 0x47a41c ExitProcess

• 0x47a420 LoadLibraryExA

• 0x47a424 GetProcAddress

• 0x47a428 GetCurrentProcess

• 0x47a42c WideCharToMultiByte

• 0x47a430 WinExec

• 0x47a434 FindResourceA

• 0x47a438 LoadResource

• 0x47a43c LockResource

• 0x47a440 HeapCreate

• 0x47a444 SizeofResource

Library USER32.dll:

• 0x47a520 CopyAcceleratorTableA

• 0x47a524 IsRectEmpty

• 0x47a528 SetRect

• 0x47a52c InvalidateRgn

• 0x47a530 GetNextDlgGroupItem

• 0x47a534 UnregisterClassA

• 0x47a538 TranslateAcceleratorA

• 0x47a53c SetMenu

• 0x47a540 BringWindowToTop

• 0x47a544 CreatePopupMenu

• 0x47a548 InsertMenuItemA

• 0x47a54c LoadAcceleratorsA

• 0x47a550 LoadMenuA

• 0x47a554 ReuseDDElParam

• 0x47a558 UnpackDDElParam

• 0x47a55c RegisterClipboardFormatA

• 0x47a560 GetKeyNameTextA

• 0x47a564 MapVirtualKeyA

• 0x47a568 SetParent

• 0x47a56c UnionRect

• 0x47a570 PostThreadMessageA

• 0x47a574 SetTimer

• 0x47a578 KillTimer

• 0x47a57c GetDCEx

• 0x47a580 LockWindowUpdate

• 0x47a584 ClientToScreen

• 0x47a588 GrayStringA

• 0x47a58c DrawTextExA

• 0x47a590 DrawTextA

• 0x47a594 TabbedTextOutA

• 0x47a598 FillRect

• 0x47a59c GetMenuStringA

• 0x47a5a0 InsertMenuA

• 0x47a5a4 RemoveMenu

• 0x47a5a8 ScrollWindowEx

• 0x47a5ac ShowWindow

• 0x47a5b0 MoveWindow

• 0x47a5b4 SetWindowTextA

• 0x47a5b8 IsDialogMessageA

• 0x47a5bc IsDlgButtonChecked

• 0x47a5c0 SetDlgItemTextA

• 0x47a5c4 SetDlgItemInt

• 0x47a5c8 GetDlgItemTextA

• 0x47a5cc GetDlgItemInt

• 0x47a5d0 CheckRadioButton

• 0x47a5d4 CheckDlgButton

• 0x47a5d8 RegisterWindowMessageA

• 0x47a5dc SendDlgItemMessageA

• 0x47a5e0 WinHelpA

• 0x47a5e4 IsChild

• 0x47a5e8 GetCapture

• 0x47a5ec GetClassLongA

• 0x47a5f0 GetClassNameA

• 0x47a5f4 SetPropA

• 0x47a5f8 GetPropA

• 0x47a5fc RemovePropA

• 0x47a600 SetFocus

• 0x47a604 GetWindowTextLengthA

• 0x47a608 GetWindowTextA

• 0x47a60c GetForegroundWindow

• 0x47a610 BeginDeferWindowPos

• 0x47a614 EndDeferWindowPos

• 0x47a618 UnhookWindowsHookEx

• 0x47a61c GetMessageTime

• 0x47a620 GetMessagePos

• 0x47a624 MapWindowPoints

• 0x47a628 ScrollWindow

• 0x47a62c TrackPopupMenuEx

• 0x47a630 CharNextA

• 0x47a634 SetScrollRange

• 0x47a638 GetScrollRange

• 0x47a63c SetScrollPos

• 0x47a640 GetScrollPos

• 0x47a644 SetForegroundWindow

• 0x47a648 ShowScrollBar

• 0x47a64c UpdateWindow

• 0x47a650 GetMenu

• 0x47a654 GetSubMenu

• 0x47a658 GetMenuItemID

• 0x47a65c GetMenuItemCount

• 0x47a660 CreateWindowExA

• 0x47a664 GetClassInfoExA

• 0x47a668 GetClassInfoA

• 0x47a66c RegisterClassA

• 0x47a670 AdjustWindowRectEx

• 0x47a674 ScreenToClient

• 0x47a678 EqualRect

• 0x47a67c DeferWindowPos

• 0x47a680 CopyRect

• 0x47a684 GetScrollInfo

• 0x47a688 SetScrollInfo

• 0x47a68c SetWindowPlacement

• 0x47a690 GetDlgCtrlID

• 0x47a694 DefWindowProcA

• 0x47a698 CallWindowProcA

• 0x47a69c OffsetRect

• 0x47a6a0 IntersectRect

• 0x47a6a4 SystemParametersInfoA

• 0x47a6a8 GetWindowPlacement

• 0x47a6ac GetWindow

• 0x47a6b0 SetWindowContextHelpId

• 0x47a6b4 MapDialogRect

• 0x47a6b8 SetWindowPos

• 0x47a6bc GetDesktopWindow

• 0x47a6c0 SetActiveWindow

• 0x47a6c4 CreateDialogIndirectParamA

• 0x47a6c8 DestroyWindow

• 0x47a6cc GetDlgItem

• 0x47a6d0 GetNextDlgTabItem

• 0x47a6d4 EndDialog

• 0x47a6d8 GetWindowThreadProcessId

• 0x47a6dc GetWindowLongA

• 0x47a6e0 GetLastActivePopup

• 0x47a6e4 IsWindowEnabled

• 0x47a6e8 MessageBoxA

• 0x47a6ec ShowOwnedPopups

• 0x47a6f0 SetWindowsHookExA

• 0x47a6f4 CallNextHookEx

• 0x47a6f8 PtInRect

• 0x47a6fc SetRectEmpty

• 0x47a700 DrawIcon

• 0x47a704 AppendMenuA

• 0x47a708 SendMessageA

• 0x47a70c GetSystemMenu

• 0x47a710 GetMessageA

• 0x47a714 TranslateMessage

• 0x47a718 DispatchMessageA

• 0x47a71c GetActiveWindow

• 0x47a720 IsWindowVisible

• 0x47a724 GetKeyState

• 0x47a728 PeekMessageA

• 0x47a72c GetCursorPos

• 0x47a730 ValidateRect

• 0x47a734 SetMenuItemBitmaps

• 0x47a738 GetMenuCheckMarkDimensions

• 0x47a73c LoadBitmapA

• 0x47a740 GetFocus

• 0x47a744 ModifyMenuA

• 0x47a748 GetDialogBaseUnits

• 0x47a74c DestroyIcon

• 0x47a750 GetSysColorBrush

• 0x47a754 WaitMessage

• 0x47a758 DeleteMenu

• 0x47a75c WindowFromPoint

• 0x47a760 DestroyMenu

• 0x47a764 GetMenuItemInfoA

• 0x47a768 EndPaint

• 0x47a76c BeginPaint

• 0x47a770 TrackPopupMenu

• 0x47a774 GetWindowDC

• 0x47a778 IsIconic

• 0x47a77c GetWindowRect

• 0x47a780 GetClientRect

• 0x47a784 InvalidateRect

• 0x47a788 OpenClipboard

• 0x47a78c EnableWindow

• 0x47a790 LoadIconA

• 0x47a794 GetSystemMetrics

• 0x47a798 CloseClipboard

• 0x47a79c SetClipboardData

• 0x47a7a0 SetCursor

• 0x47a7a4 InflateRect

• 0x47a7a8 GetDC

• 0x47a7ac ReleaseDC

• 0x47a7b0 RedrawWindow

• 0x47a7b4 SetCapture

• 0x47a7b8 GetParent

• 0x47a7bc MessageBeep

• 0x47a7c0 ReleaseCapture

• 0x47a7c4 IsWindow

• 0x47a7c8 GetSysColor

• 0x47a7cc DestroyCursor

• 0x47a7d0 SetWindowLongA

• 0x47a7d4 CopyIcon

• 0x47a7d8 LoadCursorA

• 0x47a7dc CharLowerA

• 0x47a7e0 CharLowerW

• 0x47a7e4 CharUpperA

• 0x47a7e8 CharUpperW

• 0x47a7ec PostQuitMessage

• 0x47a7f0 PostMessageA

• 0x47a7f4 CheckMenuItem

• 0x47a7f8 EnableMenuItem

• 0x47a7fc GetMenuState

• 0x47a800 GetTopWindow

Library GDI32.dll:

• 0x47a038 SetWindowOrgEx

• 0x47a03c OffsetWindowOrgEx

• 0x47a040 SetWindowExtEx

• 0x47a044 ScaleWindowExtEx

• 0x47a048 GetCurrentPositionEx

• 0x47a04c ArcTo

• 0x47a050 PolyDraw

• 0x47a054 PolylineTo

• 0x47a058 PolyBezierTo

• 0x47a05c ExtSelectClipRgn

• 0x47a060 DeleteDC

• 0x47a064 CreateDIBPatternBrushPt

• 0x47a068 CreatePatternBrush

• 0x47a06c CreateCompatibleDC

• 0x47a070 SelectPalette

• 0x47a074 PlayMetaFileRecord

• 0x47a078 GetObjectType

• 0x47a07c EnumMetaFile

• 0x47a080 ScaleViewportExtEx

• 0x47a084 CreatePen

• 0x47a088 ExtCreatePen

• 0x47a08c CreateSolidBrush

• 0x47a090 CreateHatchBrush

• 0x47a094 CreateRectRgnIndirect

• 0x47a098 SetRectRgn

• 0x47a09c CombineRgn

• 0x47a0a0 GetMapMode

• 0x47a0a4 PatBlt

• 0x47a0a8 DPtoLP

• 0x47a0ac GetTextMetricsA

• 0x47a0b0 GetBkColor

• 0x47a0b4 GetTextColor

• 0x47a0b8 GetRgnBox

• 0x47a0bc CreateCompatibleBitmap

• 0x47a0c0 GetCharWidthA

• 0x47a0c4 CreateFontA

• 0x47a0c8 StretchDIBits

• 0x47a0cc SetViewportExtEx

• 0x47a0d0 OffsetViewportOrgEx

• 0x47a0d4 SetViewportOrgEx

• 0x47a0d8 SelectObject

• 0x47a0dc Escape

• 0x47a0e0 ExtTextOutA

• 0x47a0e4 TextOutA

• 0x47a0e8 RectVisible

• 0x47a0ec PtVisible

• 0x47a0f0 StartDocA

• 0x47a0f4 GetPixel

• 0x47a0f8 BitBlt

• 0x47a0fc PlayMetaFile

• 0x47a100 CreateBrushIndirect

• 0x47a104 GetViewportExtEx

• 0x47a108 SelectClipPath

• 0x47a10c CreateRectRgn

• 0x47a110 GetClipRgn

• 0x47a114 SelectClipRgn

• 0x47a118 DeleteObject

• 0x47a11c SetColorAdjustment

• 0x47a120 SetArcDirection

• 0x47a124 SetMapperFlags

• 0x47a128 SetTextCharacterExtra

• 0x47a12c SetTextJustification

• 0x47a130 SetTextAlign

• 0x47a134 MoveToEx

• 0x47a138 LineTo

• 0x47a13c OffsetClipRgn

• 0x47a140 IntersectClipRect

• 0x47a144 ExcludeClipRect

• 0x47a148 SetMapMode

• 0x47a14c ModifyWorldTransform

• 0x47a150 SetWorldTransform

• 0x47a154 SetGraphicsMode

• 0x47a158 SetStretchBltMode

• 0x47a15c SetROP2

• 0x47a160 SetPolyFillMode

• 0x47a164 SetBkMode

• 0x47a168 RestoreDC

• 0x47a16c SaveDC

• 0x47a170 CreateDCA

• 0x47a174 CopyMetaFileA

• 0x47a178 GetDeviceCaps

• 0x47a17c SetBkColor

• 0x47a180 SetTextColor

• 0x47a184 GetClipBox

• 0x47a188 GetDCOrgEx

• 0x47a18c GetTextExtentPoint32A

• 0x47a190 GetObjectA

• 0x47a194 CreateFontIndirectA

• 0x47a198 GetStockObject

• 0x47a19c Rectangle

• 0x47a1a0 CreateBitmap

• 0x47a1a4 GetWindowExtEx

Library comdlg32.dll:

• 0x47a818 GetFileTitleA

Library WINSPOOL.DRV:

• 0x47a808 DocumentPropertiesA

• 0x47a80c OpenPrinterA

• 0x47a810 ClosePrinter

Library ADVAPI32.dll:

• 0x47a000 RegDeleteValueA

• 0x47a004 RegSetValueExA

• 0x47a008 RegCreateKeyExA

• 0x47a00c RegSetValueA

• 0x47a010 RegOpenKeyA

• 0x47a014 RegEnumKeyA

• 0x47a018 RegDeleteKeyA

• 0x47a01c RegQueryValueA

• 0x47a020 CryptAcquireContextA

• 0x47a024 RegOpenKeyExA

• 0x47a028 RegQueryValueExA

• 0x47a02c RegCloseKey

• 0x47a030 RegCreateKeyA

Library SHELL32.dll:

• 0x47a4f0 ExtractIconA

• 0x47a4f4 SHGetFileInfoA

• 0x47a4f8 DragFinish

• 0x47a4fc DragQueryFileA

• 0x47a500 ShellExecuteA

Library SHLWAPI.dll:

• 0x47a508 PathRemoveExtensionA

• 0x47a50c PathFindFileNameA

• 0x47a510 PathStripToRootA

• 0x47a514 PathFindExtensionA

• 0x47a518 PathIsUNCA

Library oledlg.dll:

• 0x47a8a8

Library ole32.dll:

• 0x47a820 CoRegisterClassObject

• 0x47a824 OleInitialize

• 0x47a828 CoFreeUnusedLibraries

• 0x47a82c OleUninitialize

• 0x47a830 OleRun

• 0x47a834 StringFromGUID2

• 0x47a838 CoCreateInstance

• 0x47a83c CoDisconnectObject

• 0x47a840 CreateILockBytesOnHGlobal

• 0x47a844 StgCreateDocfileOnILockBytes

• 0x47a848 StgOpenStorageOnILockBytes

• 0x47a84c CoGetClassObject

• 0x47a850 OleDuplicateData

• 0x47a854 CoRevokeClassObject

• 0x47a858 ReleaseStgMedium

• 0x47a85c CreateBindCtx

• 0x47a860 CoTreatAsClass

• 0x47a864 StringFromCLSID

• 0x47a868 ReadClassStg

• 0x47a86c ReadFmtUserTypeStg

• 0x47a870 OleRegGetUserType

• 0x47a874 WriteClassStg

• 0x47a878 WriteFmtUserTypeStg

• 0x47a87c SetConvertStg

• 0x47a880 CoTaskMemFree

• 0x47a884 CLSIDFromString

• 0x47a888 CLSIDFromProgID

• 0x47a88c OleIsCurrentClipboard

• 0x47a890 OleSetClipboard

• 0x47a894 OleFlushClipboard

• 0x47a898 CoRegisterMessageFilter

• 0x47a89c CoTaskMemAlloc

• 0x47a8a0 CreateStreamOnHGlobal

Library OLEAUT32.dll:

• 0x47a44c SysAllocStringLen

• 0x47a450 VariantClear

• 0x47a454 VariantChangeType

• 0x47a458 VariantInit

• 0x47a45c SysStringLen

• 0x47a460 SysAllocStringByteLen

• 0x47a464 SysStringByteLen

• 0x47a468 OleCreateFontIndirect

• 0x47a46c VariantTimeToSystemTime

• 0x47a470 SystemTimeToVariantTime

• 0x47a474 SafeArrayDestroy

• 0x47a478 SysAllocString

• 0x47a47c SafeArrayUnaccessData

• 0x47a480 SafeArrayAccessData

• 0x47a484 SafeArrayGetUBound

• 0x47a488 SafeArrayGetLBound

• 0x47a48c SafeArrayGetElemsize

• 0x47a490 SafeArrayGetDim

• 0x47a494 SafeArrayCreate

• 0x47a498 SafeArrayRedim

• 0x47a49c VariantCopy

• 0x47a4a0 SafeArrayAllocData

• 0x47a4a4 SafeArrayAllocDescriptor

• 0x47a4a8 SafeArrayCopy

• 0x47a4ac SafeArrayGetElement

• 0x47a4b0 SafeArrayPtrOfIndex

• 0x47a4b4 SafeArrayPutElement

• 0x47a4b8 SafeArrayLock

• 0x47a4bc SafeArrayUnlock

• 0x47a4c0 SafeArrayDestroyData

• 0x47a4c4 SafeArrayDestroyDescriptor

• 0x47a4c8 SysReAllocStringLen

• 0x47a4cc VarDateFromStr

• 0x47a4d0 VarBstrFromCy

• 0x47a4d4 VarBstrFromDec

• 0x47a4d8 VarDecFromStr

• 0x47a4dc VarCyFromStr

• 0x47a4e0 VarBstrFromDate

• 0x47a4e4 LoadTypeLib

• 0x47a4e8 SysFreeString

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	53238	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.