SmartHawk

4.2

中危

55 个模型检测该样本为恶意！

重新分析

下载样本

4a36125e8a672710a0463832718e10bbce9fc7d83daeb5245fcaa7440ca1849f

087218c54216a626d5c871dec97a57f7.exe

分析耗时

81s

最近分析

文件大小

1014.0KB

静态报毒动态报毒 @KW@AUJ@YMHM ADMOKE AI SCORE=80 ATTRIBUTE BTTC1E CASDET CLOUD CONFIDENCE DELF DOWNLOADER33 DROPPEDADWARE FAREIT FORMBOOK GDSDA GENERICKD GENERICRXAA HIGHCONFIDENCE HLAPSC IGENT MALICIOUS MALWARE@#27MPQPR0G1M3O REMCOS SCORE UNSAFE VSNTFB20 YKDZK ZELPHIF ZUQG 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXAA-AA!087218C54216	20200620	6.0.6.653
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20200620	18.4.3895.0
Alibaba	TrojanDownloader:Win32/Casdet.ea4629c8	20190527	0.3.0.5
Tencent	Win32.Backdoor.Remcos.Fru	20200620	1.0.0.1
Kingsoft		20200620	2013.8.14.323
CrowdStrike	win/malicious_confidence_60% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.itext

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619143813.288875 __exception__	stacktrace: 0x33568aa 0x33568dd 0x33567fa 0x330f2c8 0x3357bc1 0x33599b2 0x331dfa2 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x775a7bca 0x3354424 0x3359d93 087218c54216a626d5c871dec97a57f7+0x79d25 @ 0x479d25 registers.esp: 1634436 registers.edi: 0 registers.eax: 1634436 registers.ebp: 1634516 registers.edx: 0 registers.ebx: 1636192 registers.esi: 54282380 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619143760.944875 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00530000	success	0	0
1619143770.835875 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020b0000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

103.252.115.165:443

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

MicroWorld-eScan	Trojan.GenericKD.43324418
FireEye	Trojan.GenericKD.43324418
CAT-QuickHeal	Trojan.Multi
McAfee	GenericRXAA-AA!087218C54216
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 005688111 )
BitDefender	Trojan.GenericKD.43324418
K7GW	Trojan ( 005688111 )
Arcabit	Trojan.Generic.D2951402
TrendMicro	TROJ_FRS.VSNTFB20
BitDefenderTheta	Gen:NN.ZelphiF.34128.@KW@auj@ymhm
F-Prot	W32/Injector.JEN
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/TrojanDownloader.Delf.CXY
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
Alibaba	TrojanDownloader:Win32/Casdet.ea4629c8
NANO-Antivirus	Trojan.Win32.Dwn.hlapsc
AegisLab	Trojan.Multi.Generic.4!c
Tencent	Win32.Backdoor.Remcos.Fru
Emsisoft	Trojan.GenericKD.43324418 (B)
Comodo	Malware@#27mpqpr0g1m3o
F-Secure	Trojan.TR/Injector.ykdzk
DrWeb	Trojan.DownLoader33.53246
Zillya	Trojan.Injector.Win32.742138
McAfee-GW-Edition	RDN/Generic.grp
Sophos	Mal/Generic-S
Ikarus	DroppedAdware.AdMoke.EK
Cyren	W32/Injector.ZUQG-8218
Jiangmin	Backdoor.Remcos.btc
Avira	TR/Injector.ykdzk
MAX	malware (ai score=80)
Antiy-AVL	Trojan[Backdoor]/Win32.Remcos
Microsoft	PWS:Win32/Fareit.ART!MTB
AhnLab-V3	Malware/Win32.Generic.C4123557
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Trojan.GenericKD.43324418
Cynet	Malicious (score: 85)
ALYac	Trojan.Agent.FormBook
VBA32	Trojan.Downloader
Malwarebytes	Trojan.Injector
Panda	Trj/GdSda.A
Zoner	Trojan.Win32.90227
TrendMicro-HouseCall	TROJ_FRS.VSNTFB20
Rising	Trojan.Injector!8.C4 (CLOUD)
Yandex	Trojan.Igent.bTTC1e.18
Fortinet	W32/Delf.BZL!tr

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library oleaut32.dll:

• 0x4ed7e0 SysFreeString

• 0x4ed7e4 SysReAllocStringLen

• 0x4ed7e8 SysAllocStringLen

Library advapi32.dll:

• 0x4ed7f0 RegQueryValueExA

• 0x4ed7f4 RegOpenKeyExA

• 0x4ed7f8 RegCloseKey

Library user32.dll:

• 0x4ed800 GetKeyboardType

• 0x4ed804 DestroyWindow

• 0x4ed808 LoadStringA

• 0x4ed80c MessageBoxA

• 0x4ed810 CharNextA

Library kernel32.dll:

• 0x4ed818 GetACP

• 0x4ed81c Sleep

• 0x4ed820 VirtualFree

• 0x4ed824 VirtualAlloc

• 0x4ed828 GetCurrentThreadId

• 0x4ed82c InterlockedDecrement

• 0x4ed830 InterlockedIncrement

• 0x4ed834 VirtualQuery

• 0x4ed838 WideCharToMultiByte

• 0x4ed83c MultiByteToWideChar

• 0x4ed840 lstrlenA

• 0x4ed844 lstrcpynA

• 0x4ed848 LoadLibraryExA

• 0x4ed84c GetThreadLocale

• 0x4ed850 GetStartupInfoA

• 0x4ed854 GetProcAddress

• 0x4ed858 GetModuleHandleA

• 0x4ed85c GetModuleFileNameA

• 0x4ed860 GetLocaleInfoA

• 0x4ed864 GetCommandLineA

• 0x4ed868 FreeLibrary

• 0x4ed86c FindFirstFileA

• 0x4ed870 FindClose

• 0x4ed874 ExitProcess

• 0x4ed878 CompareStringA

• 0x4ed87c WriteFile

• 0x4ed880 UnhandledExceptionFilter

• 0x4ed884 RtlUnwind

• 0x4ed888 RaiseException

• 0x4ed88c GetStdHandle

Library kernel32.dll:

• 0x4ed894 TlsSetValue

• 0x4ed898 TlsGetValue

• 0x4ed89c LocalAlloc

• 0x4ed8a0 GetModuleHandleA

Library user32.dll:

• 0x4ed8a8 CreateWindowExA

• 0x4ed8ac WindowFromPoint

• 0x4ed8b0 WaitMessage

• 0x4ed8b4 UpdateWindow

• 0x4ed8b8 UnregisterClassA

• 0x4ed8bc UnhookWindowsHookEx

• 0x4ed8c0 TranslateMessage

• 0x4ed8c4 TranslateMDISysAccel

• 0x4ed8c8 TrackPopupMenu

• 0x4ed8cc SystemParametersInfoA

• 0x4ed8d0 ShowWindow

• 0x4ed8d4 ShowScrollBar

• 0x4ed8d8 ShowOwnedPopups

• 0x4ed8dc SetWindowsHookExA

• 0x4ed8e0 SetWindowTextA

• 0x4ed8e4 SetWindowPos

• 0x4ed8e8 SetWindowPlacement

• 0x4ed8ec SetWindowLongW

• 0x4ed8f0 SetWindowLongA

• 0x4ed8f4 SetTimer

• 0x4ed8f8 SetScrollRange

• 0x4ed8fc SetScrollPos

• 0x4ed900 SetScrollInfo

• 0x4ed904 SetRect

• 0x4ed908 SetPropA

• 0x4ed90c SetParent

• 0x4ed910 SetMenuItemInfoA

• 0x4ed914 SetMenu

• 0x4ed918 SetForegroundWindow

• 0x4ed91c SetFocus

• 0x4ed920 SetCursor

• 0x4ed924 SetClipboardData

• 0x4ed928 SetClassLongA

• 0x4ed92c SetCapture

• 0x4ed930 SetActiveWindow

• 0x4ed934 SendMessageW

• 0x4ed938 SendMessageA

• 0x4ed93c ScrollWindow

• 0x4ed940 ScreenToClient

• 0x4ed944 RemovePropA

• 0x4ed948 RemoveMenu

• 0x4ed94c ReleaseDC

• 0x4ed950 ReleaseCapture

• 0x4ed954 RegisterWindowMessageA

• 0x4ed958 RegisterClipboardFormatA

• 0x4ed95c RegisterClassA

• 0x4ed960 RedrawWindow

• 0x4ed964 PtInRect

• 0x4ed968 PostQuitMessage

• 0x4ed96c PostMessageA

• 0x4ed970 PeekMessageW

• 0x4ed974 PeekMessageA

• 0x4ed978 OpenClipboard

• 0x4ed97c OffsetRect

• 0x4ed980 OemToCharA

• 0x4ed984 MessageBoxA

• 0x4ed988 MessageBeep

• 0x4ed98c MapWindowPoints

• 0x4ed990 MapVirtualKeyA

• 0x4ed994 LoadStringA

• 0x4ed998 LoadKeyboardLayoutA

• 0x4ed99c LoadIconA

• 0x4ed9a0 LoadCursorA

• 0x4ed9a4 LoadBitmapA

• 0x4ed9a8 KillTimer

• 0x4ed9ac IsZoomed

• 0x4ed9b0 IsWindowVisible

• 0x4ed9b4 IsWindowUnicode

• 0x4ed9b8 IsWindowEnabled

• 0x4ed9bc IsWindow

• 0x4ed9c0 IsRectEmpty

• 0x4ed9c4 IsIconic

• 0x4ed9c8 IsDialogMessageW

• 0x4ed9cc IsDialogMessageA

• 0x4ed9d0 IsChild

• 0x4ed9d4 InvalidateRect

• 0x4ed9d8 IntersectRect

• 0x4ed9dc InsertMenuItemA

• 0x4ed9e0 InsertMenuA

• 0x4ed9e4 InflateRect

• 0x4ed9e8 GetWindowThreadProcessId

• 0x4ed9ec GetWindowTextA

• 0x4ed9f0 GetWindowRect

• 0x4ed9f4 GetWindowPlacement

• 0x4ed9f8 GetWindowLongW

• 0x4ed9fc GetWindowLongA

• 0x4eda00 GetWindowDC

• 0x4eda04 GetTopWindow

• 0x4eda08 GetSystemMetrics

• 0x4eda0c GetSystemMenu

• 0x4eda10 GetSysColorBrush

• 0x4eda14 GetSysColor

• 0x4eda18 GetSubMenu

• 0x4eda1c GetScrollRange

• 0x4eda20 GetScrollPos

• 0x4eda24 GetScrollInfo

• 0x4eda28 GetPropA

• 0x4eda2c GetParent

• 0x4eda30 GetWindow

• 0x4eda34 GetMessagePos

• 0x4eda38 GetMenuStringA

• 0x4eda3c GetMenuState

• 0x4eda40 GetMenuItemInfoA

• 0x4eda44 GetMenuItemID

• 0x4eda48 GetMenuItemCount

• 0x4eda4c GetMenu

• 0x4eda50 GetLastActivePopup

• 0x4eda54 GetKeyboardState

• 0x4eda58 GetKeyboardLayoutNameA

• 0x4eda5c GetKeyboardLayoutList

• 0x4eda60 GetKeyboardLayout

• 0x4eda64 GetKeyState

• 0x4eda68 GetKeyNameTextA

• 0x4eda6c GetIconInfo

• 0x4eda70 GetForegroundWindow

• 0x4eda74 GetFocus

• 0x4eda78 GetDlgItem

• 0x4eda7c GetDesktopWindow

• 0x4eda80 GetDCEx

• 0x4eda84 GetDC

• 0x4eda88 GetCursorPos

• 0x4eda8c GetCursor

• 0x4eda90 GetClipboardData

• 0x4eda94 GetClientRect

• 0x4eda98 GetClassLongA

• 0x4eda9c GetClassInfoA

• 0x4edaa0 GetCapture

• 0x4edaa4 GetActiveWindow

• 0x4edaa8 FrameRect

• 0x4edaac FindWindowA

• 0x4edab0 FillRect

• 0x4edab4 EqualRect

• 0x4edab8 EnumWindows

• 0x4edabc EnumThreadWindows

• 0x4edac0 EnumChildWindows

• 0x4edac4 EndPaint

• 0x4edac8 EnableWindow

• 0x4edacc EnableScrollBar

• 0x4edad0 EnableMenuItem

• 0x4edad4 EmptyClipboard

• 0x4edad8 DrawTextA

• 0x4edadc DrawMenuBar

• 0x4edae0 DrawIconEx

• 0x4edae4 DrawIcon

• 0x4edae8 DrawFrameControl

• 0x4edaec DrawFocusRect

• 0x4edaf0 DrawEdge

• 0x4edaf4 DispatchMessageW

• 0x4edaf8 DispatchMessageA

• 0x4edafc DestroyWindow

• 0x4edb00 DestroyMenu

• 0x4edb04 DestroyIcon

• 0x4edb08 DestroyCursor

• 0x4edb0c DeleteMenu

• 0x4edb10 DefWindowProcA

• 0x4edb14 DefMDIChildProcA

• 0x4edb18 DefFrameProcA

• 0x4edb1c CreatePopupMenu

• 0x4edb20 CreateMenu

• 0x4edb24 CreateIcon

• 0x4edb28 CloseClipboard

• 0x4edb2c ClientToScreen

• 0x4edb30 CheckMenuItem

• 0x4edb34 CallWindowProcA

• 0x4edb38 CallNextHookEx

• 0x4edb3c BeginPaint

• 0x4edb40 CharNextA

• 0x4edb44 CharLowerBuffA

• 0x4edb48 CharLowerA

• 0x4edb4c CharUpperBuffA

• 0x4edb50 CharToOemA

• 0x4edb54 AdjustWindowRectEx

• 0x4edb58 ActivateKeyboardLayout

Library gdi32.dll:

• 0x4edb60 UnrealizeObject

• 0x4edb64 StretchBlt

• 0x4edb68 SetWindowOrgEx

• 0x4edb6c SetWinMetaFileBits

• 0x4edb70 SetViewportOrgEx

• 0x4edb74 SetTextColor

• 0x4edb78 SetStretchBltMode

• 0x4edb7c SetROP2

• 0x4edb80 SetPixel

• 0x4edb84 SetEnhMetaFileBits

• 0x4edb88 SetDIBColorTable

• 0x4edb8c SetBrushOrgEx

• 0x4edb90 SetBkMode

• 0x4edb94 SetBkColor

• 0x4edb98 SelectPalette

• 0x4edb9c SelectObject

• 0x4edba0 SaveDC

• 0x4edba4 RestoreDC

• 0x4edba8 Rectangle

• 0x4edbac RectVisible

• 0x4edbb0 RealizePalette

• 0x4edbb4 Polyline

• 0x4edbb8 PlayEnhMetaFile

• 0x4edbbc PatBlt

• 0x4edbc0 MoveToEx

• 0x4edbc4 MaskBlt

• 0x4edbc8 LineTo

• 0x4edbcc IntersectClipRect

• 0x4edbd0 GetWindowOrgEx

• 0x4edbd4 GetWinMetaFileBits

• 0x4edbd8 GetTextMetricsA

• 0x4edbdc GetTextExtentPointA

• 0x4edbe0 GetTextExtentPoint32A

• 0x4edbe4 GetSystemPaletteEntries

• 0x4edbe8 GetStockObject

• 0x4edbec GetRgnBox

• 0x4edbf0 GetPixel

• 0x4edbf4 GetPaletteEntries

• 0x4edbf8 GetObjectA

• 0x4edbfc GetEnhMetaFilePaletteEntries

• 0x4edc00 GetEnhMetaFileHeader

• 0x4edc04 GetEnhMetaFileBits

• 0x4edc08 GetDeviceCaps

• 0x4edc0c GetDIBits

• 0x4edc10 GetDIBColorTable

• 0x4edc14 GetDCOrgEx

• 0x4edc18 GetCurrentPositionEx

• 0x4edc1c GetClipBox

• 0x4edc20 GetBrushOrgEx

• 0x4edc24 GetBitmapBits

• 0x4edc28 GdiFlush

• 0x4edc2c ExtTextOutA

• 0x4edc30 ExcludeClipRect

• 0x4edc34 DeleteObject

• 0x4edc38 DeleteEnhMetaFile

• 0x4edc3c DeleteDC

• 0x4edc40 CreateSolidBrush

• 0x4edc44 CreatePenIndirect

• 0x4edc48 CreatePalette

• 0x4edc4c CreateHalftonePalette

• 0x4edc50 CreateFontIndirectA

• 0x4edc54 CreateDIBitmap

• 0x4edc58 CreateDIBSection

• 0x4edc5c CreateCompatibleDC

• 0x4edc60 CreateCompatibleBitmap

• 0x4edc64 CreateBrushIndirect

• 0x4edc68 CreateBitmap

• 0x4edc6c CopyEnhMetaFileA

• 0x4edc70 BitBlt

Library version.dll:

• 0x4edc78 VerQueryValueA

• 0x4edc7c GetFileVersionInfoSizeA

• 0x4edc80 GetFileVersionInfoA

Library kernel32.dll:

• 0x4edc88 lstrcpyA

• 0x4edc8c WriteFile

• 0x4edc90 WaitForSingleObject

• 0x4edc94 VirtualQuery

• 0x4edc98 VirtualProtect

• 0x4edc9c VirtualAlloc

• 0x4edca0 SizeofResource

• 0x4edca4 SetThreadLocale

• 0x4edca8 SetFilePointer

• 0x4edcac SetFileAttributesA

• 0x4edcb0 SetEvent

• 0x4edcb4 SetErrorMode

• 0x4edcb8 SetEndOfFile

• 0x4edcbc ResetEvent

• 0x4edcc0 ReadFile

• 0x4edcc4 MulDiv

• 0x4edcc8 MoveFileA

• 0x4edccc LockResource

• 0x4edcd0 LoadResource

• 0x4edcd4 LoadLibraryA

• 0x4edcd8 LeaveCriticalSection

• 0x4edcdc InitializeCriticalSection

• 0x4edce0 GlobalUnlock

• 0x4edce4 GlobalLock

• 0x4edce8 GlobalFree

• 0x4edcec GlobalFindAtomA

• 0x4edcf0 GlobalDeleteAtom

• 0x4edcf4 GlobalAlloc

• 0x4edcf8 GlobalAddAtomA

• 0x4edcfc GetVersionExA

• 0x4edd00 GetVersion

• 0x4edd04 GetTickCount

• 0x4edd08 GetThreadLocale

• 0x4edd0c GetStdHandle

• 0x4edd10 GetProcAddress

• 0x4edd14 GetModuleHandleA

• 0x4edd18 GetModuleFileNameA

• 0x4edd1c GetLocaleInfoA

• 0x4edd20 GetLocalTime

• 0x4edd24 GetLastError

• 0x4edd28 GetFullPathNameA

• 0x4edd2c GetFileAttributesA

• 0x4edd30 GetDiskFreeSpaceA

• 0x4edd34 GetDateFormatA

• 0x4edd38 GetCurrentThreadId

• 0x4edd3c GetCurrentProcessId

• 0x4edd40 GetCPInfo

• 0x4edd44 FreeResource

• 0x4edd48 InterlockedExchange

• 0x4edd4c FreeLibrary

• 0x4edd50 FormatMessageA

• 0x4edd54 FindResourceA

• 0x4edd58 FindFirstFileA

• 0x4edd5c FindClose

• 0x4edd60 FileTimeToLocalFileTime

• 0x4edd64 FileTimeToDosDateTime

• 0x4edd68 EnumCalendarInfoA

• 0x4edd6c EnterCriticalSection

• 0x4edd70 DeleteFileA

• 0x4edd74 DeleteCriticalSection

• 0x4edd78 CreateThread

• 0x4edd7c CreateFileA

• 0x4edd80 CreateEventA

• 0x4edd84 CompareStringA

• 0x4edd88 CloseHandle

Library advapi32.dll:

• 0x4edd90 RegQueryValueExA

• 0x4edd94 RegOpenKeyExA

• 0x4edd98 RegFlushKey

• 0x4edd9c RegCloseKey

Library kernel32.dll:

• 0x4edda4 Sleep

Library oleaut32.dll:

• 0x4eddac SafeArrayPtrOfIndex

• 0x4eddb0 SafeArrayGetUBound

• 0x4eddb4 SafeArrayGetLBound

• 0x4eddb8 SafeArrayCreate

• 0x4eddbc VariantChangeType

• 0x4eddc0 VariantCopy

• 0x4eddc4 VariantClear

• 0x4eddc8 VariantInit

Library comctl32.dll:

• 0x4eddd0 _TrackMouseEvent

• 0x4eddd4 ImageList_SetIconSize

• 0x4eddd8 ImageList_GetIconSize

• 0x4edddc ImageList_Write

• 0x4edde0 ImageList_Read

• 0x4edde4 ImageList_DragShowNolock

• 0x4edde8 ImageList_DragMove

• 0x4eddec ImageList_DragLeave

• 0x4eddf0 ImageList_DragEnter

• 0x4eddf4 ImageList_EndDrag

• 0x4eddf8 ImageList_BeginDrag

• 0x4eddfc ImageList_Remove

• 0x4ede00 ImageList_DrawEx

• 0x4ede04 ImageList_Draw

• 0x4ede08 ImageList_GetBkColor

• 0x4ede0c ImageList_SetBkColor

• 0x4ede10 ImageList_Add

• 0x4ede14 ImageList_GetImageCount

• 0x4ede18 ImageList_Destroy

• 0x4ede1c ImageList_Create

• 0x4ede20 InitCommonControls

Library shell32.dll:

• 0x4ede28 ShellExecuteA

Library comdlg32.dll:

• 0x4ede30 GetSaveFileNameA

• 0x4ede34 GetOpenFileNameA

Library URL.DLL:

• 0x4ede3c InetIsOffline

Library advapi32.dll:

• 0x4ede44 QueryServiceStatus

• 0x4ede48 OpenServiceA

• 0x4ede4c OpenSCManagerA

• 0x4ede50 CloseServiceHandle

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
drive.google.com	A 103.252.115.165	103.252.115.165
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49236	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.