SmartHawk

6.6

高危

43 个模型检测该样本为恶意！

重新分析

下载样本

6269fd417f93e7c0d7cab576b35dc3b6f6a58c0f04e75533bad84987c228f0e6

1f0613891576c43e4202cb678a2a4a01.exe

分析耗时

83s

最近分析

文件大小

701.7KB

静态报毒动态报毒 100% A VARIANT OF GENERIK AI SCORE=82 ARTEMIS ATTRIBUTE CLASSIC CONFIDENCE ETDRIOY FBQVJ GENCIRC GENERICKD HIGHCONFIDENCE MALWARE@#19V8DB4UYNYS3 SCORE SCRIPTRUNNER SIGGEN5 TNSB TORJOK UNSAFE VSNTHE20 YMACCO 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!1F0613891576	20200920	6.0.6.653
Alibaba	Trojan:Win32/TorJok.b9cc8364	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Other:Malware-gen [Trj]	20200921	18.4.3895.0
Tencent	Malware.Win32.Gencirc.10cdebd2	20200921	1.0.0.1
Kingsoft		20200921	2013.8.14.323

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269222.547567 IsDebuggerPresent		failed	0	0
1619275629.677626 IsDebuggerPresent		failed	0	0

Command line console output was observed (50 out of 171 个事件)

Time & API	Arguments	Status	Return
1619275628.036751 WriteConsoleA	buffer: --2021-04-24 19:47:08-- https://nodejs.org/dist/latest-carbon/win-x86/node.exe console_handle: 0x0000000b	success	1
1619275629.052751 WriteConsoleA	buffer: Resolving nodejs.org... console_handle: 0x0000000b	success	1
1619275629.568751 WriteConsoleA	buffer: Connecting to nodejs.org\|104.20.23.46\|:443... console_handle: 0x0000000b	success	1
1619275630.318751 WriteConsoleA	buffer: WARNING: cannot verify nodejs.org's certificate, issued by `/C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Domain Validation Secure Server CA': console_handle: 0x0000000b	success	1
1619275630.318751 WriteConsoleA	buffer: Unable to locally verify the issuer's authority. console_handle: 0x0000000b	success	1
1619275630.318751 WriteConsoleA	buffer: WARNING: certificate common name `*.nodejs.org' doesn't match requested host name `nodejs.org'. console_handle: 0x0000000b	success	1
1619275630.318751 WriteConsoleA	buffer: HTTP request sent, awaiting response... console_handle: 0x0000000b	success	1
1619275630.693751 WriteConsoleA	buffer: Length: console_handle: 0x0000000b	success	1
1619275630.693751 WriteConsoleA	buffer: (18M) console_handle: 0x0000000b	success	1
1619275630.693751 WriteConsoleA	buffer: [application/octet-stream] console_handle: 0x0000000b	success	1
1619275630.693751 WriteConsoleA	buffer: Saving to: `node.exe' console_handle: 0x0000000b	success	1
1619275630.708751 WriteConsoleA	buffer: 0% [ ] 0 --.-K/s console_handle: 0x0000000b	success	1
1619275631.114751 WriteConsoleA	buffer: 0% [ ] 53,945 182K/s console_handle: 0x0000000b	success	1
1619275632.083751 WriteConsoleA	buffer: 0% [ ] 85,954 85.3K/s console_handle: 0x0000000b	success	1
1619275632.427751 WriteConsoleA	buffer: 0% [ ] 114,493 90.7K/s console_handle: 0x0000000b	success	1
1619275632.771751 WriteConsoleA	buffer: 0% [ ] 147,261 97.1K/s console_handle: 0x0000000b	success	1
1619275633.052751 WriteConsoleA	buffer: 1% [ ] 188,487 109K/s console_handle: 0x0000000b	success	1
1619275633.349751 WriteConsoleA	buffer: 1% [ ] 228,649 118K/s console_handle: 0x0000000b	success	1
1619275633.896751 WriteConsoleA	buffer: 1% [ ] 245,033 104K/s console_handle: 0x0000000b	success	1
1619275634.271751 WriteConsoleA	buffer: 1% [ ] 294,185 112K/s console_handle: 0x0000000b	success	1
1619275635.005751 WriteConsoleA	buffer: 1% [ ] 343,337 109K/s eta 2m 43s console_handle: 0x0000000b	success	1
1619275635.333751 WriteConsoleA	buffer: 2% [ ] 392,489 115K/s eta 2m 43s console_handle: 0x0000000b	success	1
1619275635.693751 WriteConsoleA	buffer: 2% [ ] 425,257 116K/s eta 2m 43s console_handle: 0x0000000b	success	1
1619275636.068751 WriteConsoleA	buffer: 2% [ ] 458,025 116K/s eta 2m 43s console_handle: 0x0000000b	success	1
1619275636.427751 WriteConsoleA	buffer: 2% [> ] 490,793 117K/s eta 2m 30s console_handle: 0x0000000b	success	1
1619275636.786751 WriteConsoleA	buffer: 2% [> ] 523,561 117K/s eta 2m 30s console_handle: 0x0000000b	success	1
1619275637.161751 WriteConsoleA	buffer: 2% [> ] 539,945 114K/s eta 2m 30s console_handle: 0x0000000b	success	1
1619275637.521751 WriteConsoleA	buffer: 3% [> ] 589,097 117K/s eta 2m 30s console_handle: 0x0000000b	success	1
1619275637.896751 WriteConsoleA	buffer: 3% [> ] 621,865 117K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275638.239751 WriteConsoleA	buffer: 3% [> ] 654,633 113K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275638.818751 WriteConsoleA	buffer: 3% [> ] 687,401 112K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275639.161751 WriteConsoleA	buffer: 3% [> ] 736,553 125K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275639.489751 WriteConsoleA	buffer: 4% [> ] 752,937 123K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275639.896751 WriteConsoleA	buffer: 4% [> ] 802,089 126K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275640.271751 WriteConsoleA	buffer: 4% [> ] 818,473 120K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275640.896751 WriteConsoleA	buffer: 4% [> ] 867,625 117K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275641.193751 WriteConsoleA	buffer: 4% [> ] 916,777 119K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275641.646751 WriteConsoleA	buffer: 5% [=> ] 949,545 123K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275641.927751 WriteConsoleA	buffer: 5% [=> ] 982,313 123K/s eta 2m 28s console_handle: 0x0000000b	success	1
1619275642.443751 WriteConsoleA	buffer: 5% [=> ] 1,015,081 118K/s eta 2m 25s console_handle: 0x0000000b	success	1
1619275642.849751 WriteConsoleA	buffer: 5% [=> ] 1,064,233 125K/s eta 2m 25s console_handle: 0x0000000b	success	1
1619275643.208751 WriteConsoleA	buffer: 5% [=> ] 1,097,001 121K/s eta 2m 25s console_handle: 0x0000000b	success	1
1619275643.568751 WriteConsoleA	buffer: 6% [=> ] 1,129,769 122K/s eta 2m 25s console_handle: 0x0000000b	success	1
1619275643.958751 WriteConsoleA	buffer: 6% [=> ] 1,146,153 118K/s eta 2m 24s console_handle: 0x0000000b	success	1
1619275644.318751 WriteConsoleA	buffer: 6% [=> ] 1,195,305 121K/s eta 2m 24s console_handle: 0x0000000b	success	1
1619275644.693751 WriteConsoleA	buffer: 6% [=> ] 1,228,073 121K/s eta 2m 24s console_handle: 0x0000000b	success	1
1619275645.036751 WriteConsoleA	buffer: 6% [=> ] 1,260,841 124K/s eta 2m 24s console_handle: 0x0000000b	success	1
1619275645.396751 WriteConsoleA	buffer: 7% [=> ] 1,293,609 121K/s eta 2m 20s console_handle: 0x0000000b	success	1
1619275645.755751 WriteConsoleA	buffer: 7% [=> ] 1,326,377 122K/s eta 2m 20s console_handle: 0x0000000b	success	1
1619275646.333751 WriteConsoleA	buffer: 7% [=> ] 1,359,145 118K/s eta 2m 20s console_handle: 0x0000000b	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269223.047567 GlobalMemoryStatusEx		success	1	0

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (4 个事件)

Time & API	Arguments	Status
1619275629.677626 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75110000	success
1619275629.693626 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x755e1000	success
1619275629.708626 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74f81000	success
1619275629.739626 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75391000	success

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269223.079567 GetDiskFreeSpaceExW	root_path: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator free_bytes_available: 19607986176 total_number_of_free_bytes: 0 total_number_of_bytes: 0	success	1	0

Creates (office) documents on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\document.doc

Creates executable files on the filesystem (3 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\wget.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\7za.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\node.exe

Creates a suspicious process (1 个事件)

cmdline

"C:\Windows\System32\cmd.exe" /c document.doc

Drops a binary and executes it (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\wget.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\document.doc

Drops an executable to the user AppData folder (3 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\node.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\wget.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\7za.exe

A process created a hidden window (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269224.579567 ShellExecuteExW	parameters: /c document.doc filepath: cmd filepath_r: cmd show_type: 0	success	1	0
1619269226.016567 ShellExecuteExW	parameters: --no-check-certificate https://nodejs.org/dist/latest-carbon/win-x86/node.exe filepath: wget filepath_r: wget show_type: 0	success	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (4 个事件)

Time & API	Arguments	Status	Return
1619275628.739751 Process32NextW	process_name: 1f0613891576c43e4202cb678a2a4a01.exe snapshot_handle: 0x00000090 process_identifier: 3040	success	1
1619275628.739751 Process32NextW	process_name: wget.exe snapshot_handle: 0x00000090 process_identifier: 2196	success	1
1619275628.739751 Process32NextW	process_name: conhost.exe snapshot_handle: 0x00000090 process_identifier: 1176	success	1
1619275628.739751 Process32NextW	process_name: ť搀nh❸V례VÄVܨ snapshot_handle: 0x00000090 process_identifier: 1024	failed	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 368 resumed a thread in remote process 2856
1619275629.318374 NtResumeThread	thread_handle: 0x0000024c suspend_count: 1 process_identifier: 2856	success	0	0

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 个事件)

MicroWorld-eScan	Trojan.GenericKD.34358576
CAT-QuickHeal	Trojan.Torjok
McAfee	Artemis!1F0613891576
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/TorJok.b9cc8364
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
TrendMicro	TROJ_FRS.VSNTHE20
Cyren	W32/Trojan.TNSB-2842
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.ETDRIOY
TrendMicro-HouseCall	TROJ_FRS.VSNTHE20
Cynet	Malicious (score: 85)
Kaspersky	Trojan.Win32.TorJok.lr
BitDefender	Trojan.GenericKD.34358576
Avast	Other:Malware-gen [Trj]
Tencent	Malware.Win32.Gencirc.10cdebd2
Ad-Aware	Trojan.GenericKD.34358576
Comodo	Malware@#19v8db4uynys3
F-Secure	Trojan.TR/Torjok.fbqvj
DrWeb	JS.Siggen5.40263
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Dropper.bc
FireEye	Trojan.GenericKD.34358576
Sophos	Mal/Generic-S
APEX	Malicious
GData	Trojan.GenericKD.34358576
Avira	TR/Torjok.fbqvj
MAX	malware (ai score=82)
Arcabit	Trojan.Generic.D20C4530
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	Trojan.Win32.TorJok.lr
Microsoft	Trojan:Win32/Ymacco.AA62
VBA32	Trojan.TorJok
ALYac	Trojan.Torjok.gen
Rising	Trojan.ScriptRunner!1.CA86 (CLASSIC)
Ikarus	Trojan.Script
Fortinet	W32/TorJok.LR!tr
AVG	Other:Malware-gen [Trj]
Panda	Trj/CI.A
Qihoo-360	Win32/Trojan.98d

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2012-12-31 08:38:32

Imports

Library COMCTL32.dll:

• 0x417010

Library SHELL32.dll:

• 0x41725c SHGetSpecialFolderPathW

• 0x417260 ShellExecuteW

• 0x417264 SHGetMalloc

• 0x417268 SHGetPathFromIDListW

• 0x41726c SHBrowseForFolderW

• 0x417270 SHGetFileInfoW

• 0x417274 ShellExecuteExW

Library GDI32.dll:

• 0x417018 CreateCompatibleDC

• 0x41701c CreateFontIndirectW

• 0x417020 DeleteObject

• 0x417024 DeleteDC

• 0x417028 GetCurrentObject

• 0x41702c StretchBlt

• 0x417030 GetDeviceCaps

• 0x417034 CreateCompatibleBitmap

• 0x417038 SelectObject

• 0x41703c SetStretchBltMode

• 0x417040 GetObjectW

Library ADVAPI32.dll:

• 0x417000 FreeSid

• 0x417004 AllocateAndInitializeSid

• 0x417008 CheckTokenMembership

Library USER32.dll:

• 0x41727c GetWindowLongW

• 0x417280 GetMenu

• 0x417284 SetWindowPos

• 0x417288 GetWindowDC

• 0x41728c ReleaseDC

• 0x417290 GetDlgItem

• 0x417294 GetParent

• 0x417298 GetWindowRect

• 0x41729c GetClassNameA

• 0x4172a0 CreateWindowExW

• 0x4172a4 SetTimer

• 0x4172a8 GetMessageW

• 0x4172ac DispatchMessageW

• 0x4172b0 KillTimer

• 0x4172b4 DestroyWindow

• 0x4172b8 SendMessageW

• 0x4172bc EndDialog

• 0x4172c0 wsprintfW

• 0x4172c4 GetWindowTextW

• 0x4172c8 GetWindowTextLengthW

• 0x4172cc GetSysColor

• 0x4172d0 wsprintfA

• 0x4172d4 SetWindowTextW

• 0x4172d8 MessageBoxA

• 0x4172dc ScreenToClient

• 0x4172e0 GetClientRect

• 0x4172e4 SetWindowLongW

• 0x4172e8 UnhookWindowsHookEx

• 0x4172ec SetFocus

• 0x4172f0 GetSystemMetrics

• 0x4172f4 SystemParametersInfoW

• 0x4172f8 ShowWindow

• 0x4172fc DrawTextW

• 0x417300 GetDC

• 0x417304 ClientToScreen

• 0x417308 GetWindow

• 0x41730c DialogBoxIndirectParamW

• 0x417310 DrawIconEx

• 0x417314 CallWindowProcW

• 0x417318 DefWindowProcW

• 0x41731c CallNextHookEx

• 0x417320 PtInRect

• 0x417324 SetWindowsHookExW

• 0x417328 LoadImageW

• 0x41732c LoadIconW

• 0x417330 MessageBeep

• 0x417334 EnableWindow

• 0x417338 IsWindow

• 0x41733c EnableMenuItem

• 0x417340 GetSystemMenu

• 0x417344 CreateWindowExA

• 0x417348 wvsprintfW

• 0x41734c CharUpperW

• 0x417350 GetKeyState

• 0x417354 CopyImage

Library ole32.dll:

• 0x41735c CreateStreamOnHGlobal

• 0x417360 CoCreateInstance

• 0x417364 CoInitialize

Library OLEAUT32.dll:

• 0x417248 VariantClear

• 0x41724c SysFreeString

• 0x417250 OleLoadPicture

• 0x417254 SysAllocString

Library KERNEL32.dll:

• 0x417048 GetFileSize

• 0x41704c SetFilePointer

• 0x417050 ReadFile

• 0x417054 WaitForMultipleObjects

• 0x417058 GetModuleHandleA

• 0x41705c SetFileTime

• 0x417060 SetEndOfFile

• 0x417064 LeaveCriticalSection

• 0x417068 EnterCriticalSection

• 0x41706c DeleteCriticalSection

• 0x417070 FormatMessageW

• 0x417074 lstrcpyW

• 0x417078 LocalFree

• 0x41707c IsBadReadPtr

• 0x417080 GetSystemDirectoryW

• 0x417084 GetCurrentThreadId

• 0x417088 SuspendThread

• 0x41708c TerminateThread

• 0x417090 InitializeCriticalSection

• 0x417094 ResetEvent

• 0x417098 SetEvent

• 0x41709c CreateEventW

• 0x4170a0 GetVersionExW

• 0x4170a4 GetModuleFileNameW

• 0x4170a8 GetCurrentProcess

• 0x4170ac SetProcessWorkingSetSize

• 0x4170b0 SetCurrentDirectoryW

• 0x4170b4 GetDriveTypeW

• 0x4170b8 CreateFileW

• 0x4170bc GetCommandLineW

• 0x4170c0 GetStartupInfoW

• 0x4170c4 CreateProcessW

• 0x4170c8 CreateJobObjectW

• 0x4170cc ResumeThread

• 0x4170d0 AssignProcessToJobObject

• 0x4170d4 CreateIoCompletionPort

• 0x4170d8 SetInformationJobObject

• 0x4170dc GetQueuedCompletionStatus

• 0x4170e0 GetExitCodeProcess

• 0x4170e4 CloseHandle

• 0x4170e8 SetEnvironmentVariableW

• 0x4170ec GetTempPathW

• 0x4170f0 GetSystemTimeAsFileTime

• 0x4170f4 lstrlenW

• 0x4170f8 CompareFileTime

• 0x4170fc SetThreadLocale

• 0x417100 FindFirstFileW

• 0x417104 DeleteFileW

• 0x417108 FindNextFileW

• 0x41710c FindClose

• 0x417110 RemoveDirectoryW

• 0x417114 ExpandEnvironmentStringsW

• 0x417118 WideCharToMultiByte

• 0x41711c VirtualAlloc

• 0x417120 GlobalMemoryStatusEx

• 0x417124 lstrcmpW

• 0x417128 GetEnvironmentVariableW

• 0x41712c lstrcmpiW

• 0x417130 lstrlenA

• 0x417134 GetLocaleInfoW

• 0x417138 MultiByteToWideChar

• 0x41713c GetUserDefaultUILanguage

• 0x417140 GetSystemDefaultUILanguage

• 0x417144 GetSystemDefaultLCID

• 0x417148 lstrcmpiA

• 0x41714c GlobalAlloc

• 0x417150 GlobalFree

• 0x417154 MulDiv

• 0x417158 FindResourceExA

• 0x41715c SizeofResource

• 0x417160 LoadResource

• 0x417164 LockResource

• 0x417168 LoadLibraryA

• 0x41716c GetProcAddress

• 0x417170 GetModuleHandleW

• 0x417174 ExitProcess

• 0x417178 lstrcatW

• 0x41717c GetDiskFreeSpaceExW

• 0x417180 SetFileAttributesW

• 0x417184 SetLastError

• 0x417188 Sleep

• 0x41718c GetExitCodeThread

• 0x417190 WaitForSingleObject

• 0x417194 CreateThread

• 0x417198 GetLastError

• 0x41719c SystemTimeToFileTime

• 0x4171a0 GetLocalTime

• 0x4171a4 GetFileAttributesW

• 0x4171a8 CreateDirectoryW

• 0x4171ac WriteFile

• 0x4171b0 GetStdHandle

• 0x4171b4 VirtualFree

• 0x4171b8 GetStartupInfoA

Library MSVCRT.dll:

• 0x4171c0 ??3@YAXPAX@Z

• 0x4171c4 ??2@YAPAXI@Z

• 0x4171c8 memcmp

• 0x4171cc free

• 0x4171d0 memcpy

• 0x4171d4 _wtol

• 0x4171d8 _controlfp

• 0x4171dc _except_handler3

• 0x4171e0 __set_app_type

• 0x4171e4 __p__fmode

• 0x4171e8 __p__commode

• 0x4171ec _adjust_fdiv

• 0x4171f0 __setusermatherr

• 0x4171f4 _initterm

• 0x4171f8 __getmainargs

• 0x4171fc _acmdln

• 0x417200 exit

• 0x417204 _XcptFilter

• 0x417208 _exit

• 0x41720c ??1type_info@@UAE@XZ

• 0x417210 _onexit

• 0x417214 __dllonexit

• 0x417218 _CxxThrowException

• 0x41721c _beginthreadex

• 0x417220 _EH_prolog

• 0x417224 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z

• 0x417228 memset

• 0x41722c _wcsnicmp

• 0x417230 strncmp

• 0x417234 wcsncmp

• 0x417238 malloc

• 0x41723c memmove

• 0x417240 _purecall

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
nodejs.org	A 104.20.22.46 A 104.20.23.46	104.20.22.46
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.24.14
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49177	104.20.23.46 nodejs.org	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.