SmartHawk

2.0

低危

4 个模型检测该样本为恶意！

重新分析

下载样本

5ecf92419486363bd8513fde8f51af0247da6b67498d5378e04ce2ee1a3def07

07d63134efb0dc409835b27c20eddd9f.exe

分析耗时

74s

查杀引擎	查杀时间	查杀版本
McAfee	20200617	6.0.6.653
Alibaba	20190527	0.3.0.5
CrowdStrike	20190702	1.0
Baidu	20190318	1.0.0.2
Avast	20200617	18.4.3895.0
Kingsoft	20200617	2013.8.14.323
Tencent	20200617	1.0.0.1

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2019-10-14 15:34:23

Imports

Library rtl120.bpl:

• 0x54e644 @System@initialization$qqrv

• 0x54e648 @System@Finalization$qqrv

• 0x54e64c @System@LoadResString$qqrp20System@TResStringRec

• 0x54e650 @System@UTF8Encode$qqrx20System@UnicodeString

• 0x54e654 @System@ReallocMemory$qpvi

• 0x54e658 @System@FreeMemory$qpv

• 0x54e65c @System@GetMemory$qi

• 0x54e660 @System@TInterfacedObject@_Release$qqsv

• 0x54e664 @System@TInterfacedObject@_AddRef$qqsv

• 0x54e668 @System@TInterfacedObject@QueryInterface$qqsrx5_GUIDpv

• 0x54e66c @System@TInterfacedObject@NewInstance$qqrv

• 0x54e670 @System@TInterfacedObject@BeforeDestruction$qqrv

• 0x54e674 @System@TInterfacedObject@AfterConstruction$qqrv

• 0x54e680 @System@RegisterModule$qqrp17System@TLibModule

• 0x54e684 @System@@DynArrayClear$qqrrpvpv

• 0x54e688 @System@@DynArraySetLength$qqrv

• 0x54e68c @System@@DynArrayHigh$qqrv

• 0x54e690 @System@@DynArrayLength$qqrv

• 0x54e694 @System@@_llmod$qqrv

• 0x54e698 @System@@_lludiv$qqrv

• 0x54e69c @System@@_lldiv$qqrv

• 0x54e6a0 @System@@_llmul$qqrv

• 0x54e6a4 @System@WideCharLenToStrVar$qqrpbir20System@UnicodeString

• 0x54e6a8 @System@@Dispose$qqrpvt1

• 0x54e6ac @System@@New$qqripv

• 0x54e6b0 @System@@CopyRecord$qqrv

• 0x54e6b4 @System@@AddRefArray$qqrv

• 0x54e6b8 @System@@FinalizeArray$qqrpvt1ui

• 0x54e6bc @System@@FinalizeRecord$qqrpvt1

• 0x54e6c0 @System@@InitializeRecord$qqrpvt1

• 0x54e6c4 @System@Pos$qqrx20System@UnicodeStringt1

• 0x54e6c8 @System@@UniqueStringU$qqrr20System@UnicodeString

• 0x54e6cc @System@UniqueString$qqrr20System@UnicodeString

• 0x54e6d0 @System@@UStrDelete$qqrr20System@UnicodeStringii

• 0x54e6d4 @System@@UStrCopy$qqrx20System@UnicodeStringii

• 0x54e6d8 @System@@UStrEqual$qqrv

• 0x54e6dc @System@@UStrCatN$qqrv

• 0x54e6e0 @System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2

• 0x54e6e4 @System@@UStrCat$qqrr20System@UnicodeStringx20System@UnicodeString

• 0x54e6e8 @System@@UStrSetLength$qqrr20System@UnicodeStringi

• 0x54e6ec @System@@UStrLen$qqrx20System@UnicodeString

• 0x54e6f4 @System@@WStrFromUStr$qqrr17System@WideStringx20System@UnicodeString

• 0x54e6f8 @System@@UStrFromWStr$qqrr20System@UnicodeStringx17System@WideString

• 0x54e704 @System@@UStrFromWArray$qqrr20System@UnicodeStringpbi

• 0x54e708 @System@@UStrFromArray$qqrr20System@UnicodeStringpci

• 0x54e70c @System@@UStrFromPWChar$qqrr20System@UnicodeStringpb

• 0x54e710 @System@@UStrFromWChar$qqrr20System@UnicodeStringb

• 0x54e714 @System@@UStrFromPWCharLen$qqrr20System@UnicodeStringpbi

• 0x54e718 @System@@UStrToPWChar$qqrx20System@UnicodeString

• 0x54e71c @System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString

• 0x54e720 @System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString

• 0x54e724 @System@@UStrArrayClr$qqrpvi

• 0x54e728 @System@@UStrClr$qqrpv

• 0x54e72c @System@@UStrAddRef$qqrpv

• 0x54e730 @System@@WStrSetLength$qqrr17System@WideStringi

• 0x54e734 @System@@WStrCat3$qqrr17System@WideStringx17System@WideStringt2

• 0x54e738 @System@@WStrCat$qqrr17System@WideStringx17System@WideString

• 0x54e73c @System@@WStrToPWChar$qqrx17System@WideString

• 0x54e740 @System@@WStrArrayClr$qqrpvi

• 0x54e744 @System@@WStrClr$qqrpv

• 0x54e748 @System@@LStrSetLength$qqrv

• 0x54e74c @System@@LStrCopy$qqrv

• 0x54e758 @System@@LStrAddRef$qqrpv

• 0x54e75c @System@@LStrEqual$qqrv

• 0x54e760 @System@@LStrCatN$qqrv

• 0x54e764 @System@@LStrCat$qqrv

• 0x54e77c @System@@EnsureUnicodeString$qqrr20System@UnicodeString

• 0x54e784 @System@@LStrLAsg$qqrpvpxv

• 0x54e788 @System@@LStrAsg$qqrpvpxv

• 0x54e78c @System@@LStrArrayClr$qqrpvi

• 0x54e790 @System@@LStrClr$qqrpv

• 0x54e794 @System@@Assert$qqrx20System@UnicodeStringt1i

• 0x54e798 @System@@RunError$qqruc

• 0x54e79c @System@@Halt0$qqrv

• 0x54e7a0 @System@@StartExe$qqrp23System@PackageInfoTablep17System@TLibModule

• 0x54e7a4 @System@@TryFinallyExit$qqrv

• 0x54e7a8 @System@@DoneExcept$qqrv

• 0x54e7ac @System@@RaiseAgain$qqrv

• 0x54e7b0 @System@@RaiseExcept$qqrv

• 0x54e7b4 @System@@HandleFinally$qqrv

• 0x54e7b8 @System@@HandleOnException$qqrv

• 0x54e7bc @System@@HandleAnyException$qqrv

• 0x54e7c0 @System@MonitorExit$qqrp14System@TObject

• 0x54e7c4 @System@MonitorEnter$qqrp14System@TObjectui

• 0x54e7c8 @System@TMonitor@GetMonitor$qqrp14System@TObject

• 0x54e7cc @System@TMonitor@GetFieldAddress$qqrp14System@TObject

• 0x54e7d0 @System@TMonitor@Exit$qqrp14System@TObject

• 0x54e7d4 @System@TMonitor@Enter$qqrp14System@TObject

• 0x54e7d8 @System@@BeforeDestruction$qqrp14System@TObjectzc

• 0x54e7dc @System@@AfterConstruction$qqrp14System@TObject

• 0x54e7e0 @System@@ClassDestroy$qqrp14System@TObject

• 0x54e7e4 @System@@ClassCreate$qqrp17System@TMetaClasso

• 0x54e7e8 @System@TObject@MethodAddress$qqrx20System@UnicodeString

• 0x54e7ec @System@TObject@Dispatch$qqrpv

• 0x54e7f0 @System@TObject@BeforeDestruction$qqrv

• 0x54e7f4 @System@TObject@AfterConstruction$qqrv

• 0x54e7f8 @System@TObject@DefaultHandler$qqrpv

• 0x54e7fc @System@TObject@ToString$qqrv

• 0x54e800 @System@TObject@SafeCallException$qqrp14System@TObjectpv

• 0x54e804 @System@TObject@ClassInfo$qqrv

• 0x54e808 @System@TObject@InheritsFrom$qqrp17System@TMetaClass

• 0x54e80c @System@@FindDynaInst$qqrv

• 0x54e810 @System@@CallDynaInst$qqrv

• 0x54e814 @System@@AsClass$qqrp14System@TObjectp17System@TMetaClass

• 0x54e818 @System@@IsClass$qqrp14System@TObjectp17System@TMetaClass

• 0x54e81c @System@TObject@UnitName$qqrv

• 0x54e820 @System@TObject@GetHashCode$qqrv

• 0x54e824 @System@TObject@Equals$qqrp14System@TObject

• 0x54e828 @System@TObject@CleanupInstance$qqrv

• 0x54e82c @System@TObject@InitInstance$qqrpv

• 0x54e830 @System@TObject@Free$qqrv

• 0x54e834 @System@TObject@$bdtr$qqrv

• 0x54e838 @System@TObject@$bctr$qqrv

• 0x54e83c @System@TObject@InstanceSize$qqrv

• 0x54e840 @System@TObject@FreeInstance$qqrv

• 0x54e844 @System@TObject@NewInstance$qqrv

• 0x54e848 @System@TObject@ClassName$qqrv

• 0x54e84c @System@TObject@ClassType$qqrv

• 0x54e850 @System@@SetElem$qqrv

• 0x54e854 @System@@ValLong$qqrx20System@UnicodeStringri

• 0x54e858 @System@@FillChar$qqrpvib

• 0x54e85c @System@@AStrCmp$qqrv

• 0x54e860 @System@@AbstractError$qqrv

• 0x54e864 @System@@TRUNC$qqrv

• 0x54e868 @System@@ROUND$qqrv

• 0x54e86c @System@Sqrt$qqrxg

• 0x54e870 @System@Ln$qqrxg

• 0x54e874 @System@Sin$qqrxg

• 0x54e878 @System@Cos$qqrxg

• 0x54e87c @System@Exp$qqrxg

• 0x54e880 @System@Int$qqrxg

• 0x54e884 @System@UpCase$qqrb

• 0x54e888 @System@ParamStr$qqri

• 0x54e88c @System@ParamCount$qqrv

• 0x54e890 @System@Move$qqrpxvpvi

• 0x54e894 @System@ExceptObject$qqrv

• 0x54e898 @System@@ReallocMem$qqrrpvi

• 0x54e89c @System@@FreeMem$qqrpv

• 0x54e8a0 @System@@GetMem$qqri

• 0x54e8a4 @System@AllocMem$qqrui

• 0x54e8a8 @System@ReportMemoryLeaksOnShutdown

• 0x54e8ac @System@DebugHook

• 0x54e8b0 @System@IsMultiThread

• 0x54e8b4 @System@IsLibrary

• 0x54e8b8 @System@MainThreadID

• 0x54e8bc @System@MainInstance

• 0x54e8c0 @$xp$17System@UTF8String

• 0x54e8c4 @System@TInterfacedObject@

• 0x54e8c8 @$xp$17System@IInterface

• 0x54e8cc @$xp$14System@TObject

• 0x54e8d0 @System@TObject@

• 0x54e8d4 @$xp$14System@Variant

• 0x54e8d8 @$xp$17System@WideString

• 0x54e8dc @$xp$13System@string

• 0x54e8e0 @$xp$6Single

• 0x54e8e4 @$xp$8Cardinal

• 0x54e8e8 @$xp$11System@Byte

• 0x54e8ec @$xp$7Integer

• 0x54e8f0 @$xp$11System@Char

• 0x54e8f4 @$xp$7Boolean

Library kernel32.dll:

• 0x54e8fc TlsSetValue

• 0x54e900 TlsGetValue

• 0x54e904 LocalAlloc

• 0x54e908 GetModuleHandleW

Library madExcept_.bpl:

• 0x54e910 @Madexcept@initialization$qqrv

• 0x54e914 @Madexcept@Finalization$qqrv

• 0x54e918 @Madexcept@HookThreads$qqrv

• 0x54e91c @Madexcept@UnregisterBugReportPlugin$qqrx20System@UnicodeString

• 0x54e920 @Madexcept@RegisterBugReportPlugin$qqrx20System@UnicodeStringt1pqqrv$20System@UnicodeStringo

• 0x54e928 @Madexcept@Plugins

Library user32.dll:

• 0x54e930 UpdateLayeredWindow

• 0x54e934 UpdateWindow

• 0x54e938 UnhookWindowsHookEx

• 0x54e93c SystemParametersInfoW

• 0x54e940 ShowWindow

• 0x54e944 SetWindowRgn

• 0x54e948 SetWindowsHookExW

• 0x54e94c SetWindowPos

• 0x54e950 SetWindowLongW

• 0x54e954 SetTimer

• 0x54e958 SetScrollInfo

• 0x54e95c SetRect

• 0x54e960 SetPropW

• 0x54e964 SetForegroundWindow

• 0x54e968 SetClassLongW

• 0x54e96c SetActiveWindow

• 0x54e970 SendMessageW

• 0x54e974 ScreenToClient

• 0x54e978 RemovePropW

• 0x54e97c ReleaseDC

• 0x54e980 ReleaseCapture

• 0x54e984 RedrawWindow

• 0x54e988 PostMessageW

• 0x54e98c MessageBoxW

• 0x54e990 MapWindowPoints

• 0x54e994 LoadCursorW

• 0x54e998 KillTimer

• 0x54e99c IsZoomed

• 0x54e9a0 IsWindowVisible

• 0x54e9a4 IsIconic

• 0x54e9a8 InvalidateRect

• 0x54e9ac InflateRect

• 0x54e9b0 GetWindowThreadProcessId

• 0x54e9b4 GetWindowTextLengthW

• 0x54e9b8 GetWindowTextW

• 0x54e9bc GetWindowRgn

• 0x54e9c0 GetWindowRect

• 0x54e9c4 GetWindowPlacement

• 0x54e9c8 GetWindowLongW

• 0x54e9cc GetWindowDC

• 0x54e9d0 GetSystemMetrics

• 0x54e9d4 GetSysColorBrush

• 0x54e9d8 GetSysColor

• 0x54e9dc GetScrollRange

• 0x54e9e0 GetScrollPos

• 0x54e9e4 GetScrollInfo

• 0x54e9e8 GetScrollBarInfo

• 0x54e9ec GetParent

• 0x54e9f0 GetKeyState

• 0x54e9f4 GetIconInfo

• 0x54e9f8 GetForegroundWindow

• 0x54e9fc GetDesktopWindow

• 0x54ea00 GetDC

• 0x54ea04 GetCursorPos

• 0x54ea08 GetCursor

• 0x54ea0c GetClipboardFormatNameW

• 0x54ea10 GetClientRect

• 0x54ea14 GetClassNameW

• 0x54ea18 GetClassLongW

• 0x54ea1c GetCapture

• 0x54ea20 FrameRect

• 0x54ea24 FindWindowExW

• 0x54ea28 FindWindowW

• 0x54ea2c FillRect

• 0x54ea30 EndPaint

• 0x54ea34 DrawTextExW

• 0x54ea38 DrawTextW

• 0x54ea3c DrawIconEx

• 0x54ea40 DrawFrameControl

• 0x54ea44 ClientToScreen

• 0x54ea48 CallWindowProcW

• 0x54ea4c CallNextHookEx

• 0x54ea50 BringWindowToTop

• 0x54ea54 BeginPaint

• 0x54ea58 AttachThreadInput

Library msimg32.dll:

• 0x54ea60 TransparentBlt

• 0x54ea64 AlphaBlend

Library gdi32.dll:

• 0x54ea6c StretchDIBits

• 0x54ea70 StretchBlt

• 0x54ea74 SetWindowOrgEx

• 0x54ea78 SetViewportOrgEx

• 0x54ea7c SetTextColor

• 0x54ea80 SetStretchBltMode

• 0x54ea84 SetROP2

• 0x54ea88 SetPixelV

• 0x54ea8c SetDIBits

• 0x54ea90 SetBkMode

• 0x54ea94 SetBkColor

• 0x54ea98 SetBitmapBits

• 0x54ea9c SelectPalette

• 0x54eaa0 SelectObject

• 0x54eaa4 SelectClipRgn

• 0x54eaa8 SaveDC

• 0x54eaac RestoreDC

• 0x54eab0 ResizePalette

• 0x54eab4 RectVisible

• 0x54eab8 RealizePalette

• 0x54eabc OffsetViewportOrgEx

• 0x54eac0 MoveToEx

• 0x54eac4 IntersectClipRect

• 0x54eac8 GetViewportOrgEx

• 0x54eacc GetTextMetricsW

• 0x54ead0 GetTextExtentPoint32W

• 0x54ead4 GetTextExtentExPointW

• 0x54ead8 GetTextColor

• 0x54eadc GetStockObject

• 0x54eae0 GetROP2

• 0x54eae4 GetPixel

• 0x54eae8 GetPaletteEntries

• 0x54eaec GetObjectType

• 0x54eaf0 GetObjectA

• 0x54eaf4 GetObjectW

• 0x54eaf8 GetNearestPaletteIndex

• 0x54eafc GetDeviceCaps

• 0x54eb00 GetDIBits

• 0x54eb04 GetCurrentPositionEx

• 0x54eb08 GetCurrentObject

• 0x54eb0c GetClipBox

• 0x54eb10 GetBkMode

• 0x54eb14 GetBkColor

• 0x54eb18 GetBitmapBits

• 0x54eb1c ExtSelectClipRgn

• 0x54eb20 ExcludeClipRect

• 0x54eb24 DeleteObject

• 0x54eb28 DeleteDC

• 0x54eb2c CreateSolidBrush

• 0x54eb30 CreateRoundRectRgn

• 0x54eb34 CreateRectRgn

• 0x54eb38 CreatePolyPolygonRgn

• 0x54eb3c CreatePenIndirect

• 0x54eb40 CreatePalette

• 0x54eb44 CreateHalftonePalette

• 0x54eb48 CreateFontIndirectW

• 0x54eb4c CreateDIBSection

• 0x54eb50 CreateCompatibleDC

• 0x54eb54 CreateCompatibleBitmap

• 0x54eb58 CreateBrushIndirect

• 0x54eb5c BitBlt

Library version.dll:

• 0x54eb64 VerQueryValueW

• 0x54eb68 GetFileVersionInfoSizeW

• 0x54eb6c GetFileVersionInfoW

Library kernel32.dll:

• 0x54eb74 lstrcmpiW

• 0x54eb78 lstrcmpW

• 0x54eb7c WriteProcessMemory

• 0x54eb80 WritePrivateProfileStringW

• 0x54eb84 WriteFile

• 0x54eb88 WinExec

• 0x54eb8c WaitForSingleObject

• 0x54eb90 VirtualQuery

• 0x54eb94 VirtualProtect

• 0x54eb98 TerminateProcess

• 0x54eb9c SystemTimeToFileTime

• 0x54eba0 Sleep

• 0x54eba4 ReadProcessMemory

• 0x54eba8 QueryDosDeviceW

• 0x54ebac OutputDebugStringW

• 0x54ebb0 OpenProcess

• 0x54ebb4 MulDiv

• 0x54ebb8 LocalFree

• 0x54ebbc LocalAlloc

• 0x54ebc0 LoadLibraryW

• 0x54ebc4 IsBadWritePtr

• 0x54ebc8 IsBadReadPtr

• 0x54ebcc IsBadCodePtr

• 0x54ebd0 HeapFree

• 0x54ebd4 HeapDestroy

• 0x54ebd8 HeapAlloc

• 0x54ebdc GlobalUnlock

• 0x54ebe0 GlobalMemoryStatus

• 0x54ebe4 GlobalHandle

• 0x54ebe8 GlobalLock

• 0x54ebec GlobalGetAtomNameW

• 0x54ebf0 GlobalFree

• 0x54ebf4 GlobalFindAtomW

• 0x54ebf8 GlobalAlloc

• 0x54ebfc GetWindowsDirectoryW

• 0x54ec00 GetVersionExW

• 0x54ec04 GetVersion

• 0x54ec08 GetTickCount

• 0x54ec0c GetTempPathW

• 0x54ec10 GetSystemTime

• 0x54ec14 GetSystemDirectoryW

• 0x54ec18 GetSystemDefaultLangID

• 0x54ec1c GetProcessTimes

• 0x54ec20 GetProcAddress

• 0x54ec24 GetPrivateProfileStringW

• 0x54ec28 GetPriorityClass

• 0x54ec2c GetModuleHandleW

• 0x54ec30 GetModuleFileNameW

• 0x54ec34 GetLogicalDriveStringsW

• 0x54ec38 GetLastError

• 0x54ec3c GetFileAttributesExW

• 0x54ec40 GetDiskFreeSpaceExW

• 0x54ec44 GetCurrentThreadId

• 0x54ec48 GetCurrentProcessId

• 0x54ec4c GetCurrentProcess

• 0x54ec50 GetCommandLineW

• 0x54ec54 InterlockedIncrement

• 0x54ec58 InterlockedExchangeAdd

• 0x54ec5c InterlockedExchange

• 0x54ec60 InterlockedDecrement

• 0x54ec64 InterlockedCompareExchange

• 0x54ec68 FreeLibrary

• 0x54ec6c FlushInstructionCache

• 0x54ec70 FileTimeToSystemTime

• 0x54ec74 FileTimeToLocalFileTime

• 0x54ec78 CreateProcessW

• 0x54ec7c CreateMutexW

• 0x54ec80 CreateFileW

• 0x54ec84 CopyFileW

• 0x54ec88 CloseHandle

Library advapi32.dll:

• 0x54ec90 RegQueryValueExW

• 0x54ec94 RegQueryInfoKeyW

• 0x54ec98 RegOpenKeyExW

• 0x54ec9c RegFlushKey

• 0x54eca0 RegEnumKeyExW

• 0x54eca4 RegCloseKey

• 0x54eca8 OpenProcessToken

• 0x54ecac LookupPrivilegeValueW

• 0x54ecb0 GetUserNameW

• 0x54ecb4 AdjustTokenPrivileges

Library rtl120.bpl:

• 0x54ecbc @Types@Bounds$qqriiii

• 0x54ecc0 @Types@OffsetRect$qqrr11Types@TRectii

• 0x54ecc4 @Types@IsRectEmpty$qqrrx11Types@TRect

• 0x54ecc8 @Types@IntersectRect$qqrr11Types@TRectrx11Types@TRectt2

• 0x54eccc @Types@PtInRect$qqrrx11Types@TRectrx12Types@TPoint

• 0x54ecd0 @Types@Point$qqrii

• 0x54ecd4 @Types@RectHeight$qqrrx11Types@TRect

• 0x54ecd8 @Types@RectWidth$qqrrx11Types@TRect

• 0x54ecdc @Types@Rect$qqriiii

• 0x54ece0 @Types@EqualRect$qqrrx11Types@TRectt1

Library madBasic_.bpl:

• 0x54ece8 @Madstrings@initialization$qqrv

• 0x54ecec @Madstrings@Finalization$qqrv

• 0x54ecf0 @Madstrings@MsToStr$qqrui

• 0x54ecf4 @Madstrings@SizeToStr$qqrj

• 0x54ecf8 @Madstrings@IntToHexEx$qqruiic

• 0x54ecfc @Madstrings@IntToStrEx$qqrjic

• 0x54ed00 @Madstrings@IntToStrEx$qqruiic

• 0x54ed04 @Madstrings@IntToHexEx$qqriic

• 0x54ed08 @Madstrings@IntToStrEx$qqriic

• 0x54ed0c @Madstrings@FillStr$qqrx20System@UnicodeStringib

• 0x54ed14 @Madstrings@PosTextIs1$qqrx20System@UnicodeStringt1

• 0x54ed18 @Madstrings@PosStrIs1$qqrx20System@UnicodeStringt1

• 0x54ed1c @Madstrings@RetDelete$qqrx20System@UnicodeStringuiui

Library madBasic_.bpl:

• 0x54ed24 @Madzip@GetUncompressedFileInfo$qqrx20System@UnicodeStringrjrui

Library madBasic_.bpl:

• 0x54ed2c @Madtools@initialization$qqrv

• 0x54ed30 @Madtools@Finalization$qqrv

• 0x54ed34 @Madtools@GetFileVersionStr$qqrx20System@UnicodeString

Library madExcept_.bpl:

• 0x54ed3c @Madmapfile@initialization$qqrv

• 0x54ed40 @Madmapfile@Finalization$qqrv

Library madDisAsm_.bpl:

• 0x54ed48 @Maddisasm@initialization$qqrv

• 0x54ed4c @Maddisasm@Finalization$qqrv

Library madExcept_.bpl:

• 0x54ed54 @Madstacktrace@initialization$qqrv

• 0x54ed58 @Madstacktrace@Finalization$qqrv

Library shell32.dll:

• 0x54ed60 ShellExecuteW

• 0x54ed64 SHGetFileInfoW

• 0x54ed68 ExtractIconW

Library shell32.dll:

• 0x54ed70 SHGetSpecialFolderPathW

• 0x54ed74 SHGetDesktopFolder

Library ole32.dll:

• 0x54ed7c CreateStreamOnHGlobal

• 0x54ed80 CoTaskMemFree

Library comctl32.dll:

• 0x54ed88 _TrackMouseEvent

• 0x54ed8c ImageList_GetIconSize

• 0x54ed90 ImageList_Draw

• 0x54ed94 ImageList_GetImageCount

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

GData	Win32.Application.iObit.B
DrWeb	Program.Unwanted.2520
MaxSecure	Trojan.Malware.74717947.susgen
eGambit	PUP.Optional.IObit