SmartHawk

10.4

0-day

57 个模型检测该样本为恶意！

重新分析

下载样本

66d9fdca33bb8e2bf6a63bbab3ee87f31dd95b041b24ac391a340edeabfa613f

2446ea1b5db9378fb800223f41bb3008.exe

分析耗时

74s

最近分析

文件大小

589.0KB

静态报毒动态报毒 100% AGEN AGENTTESLA AI SCORE=80 ANDROM BSCOPE BTGCW7 CLOUD CONFIDENCE DELF DELPHILESS ELTZ FAREIT GBXX HIGH CONFIDENCE HJZDDN HOYG IGENT KGW@ASLPI3DI LOKI LOKIBOT MALWARE@#1XNTT3N7UUTXT MODERATE PUTTY SCORE SIMDA SUSGEN SUSPICIOUS PE THEOIBO UNSAFE X2059 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FSK!2446EA1B5DB9	20200516	6.0.6.653
Alibaba	Backdoor:Win32/Lokibot.43d8d990	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20200516	18.4.3895.0
Tencent	Win32.Backdoor.Androm.Hoyg	20200516	1.0.0.1
Kingsoft		20200516	2013.8.14.323

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619283677.042375 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619283675.151375 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269226.351784 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 33750848 registers.edi: 0 registers.eax: 0 registers.ebp: 33750920 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 1968582153 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 50 e9 66 37 fa exception.symbol: 2446ea1b5db9378fb800223f41bb3008+0x5fe25 exception.instruction: div eax exception.module: 2446ea1b5db9378fb800223f41bb3008.exe exception.exception_code: 0xc0000094 exception.offset: 392741 exception.address: 0x45fe25	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619269226.148784 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619269226.351784 NtAllocateVirtualMemory	process_identifier: 648 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x005c0000	success
1619269226.367784 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x020a0000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.714394897164579

section

{'size_of_data': '0x0000aa00', 'virtual_address': '0x00061000', 'entropy': 7.714394897164579, 'name': 'DATA', 'virtual_size': '0x0000a838'}

description

A section with a high entropy has been found

entropy

7.4082493416854325

section

{'size_of_data': '0x0001fc00', 'virtual_address': '0x0007a000', 'entropy': 7.4082493416854325, 'name': '.rsrc', 'virtual_size': '0x0001fa48'}

description

A section with a high entropy has been found

entropy

0.288265306122449

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 648 called NtSetContextThread to modify thread in remote process 428
1619269226.507784 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 428	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 648 resumed a thread in remote process 428
1619269227.070784 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 428	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

72.52.178.23:80

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619269226.429784 CreateProcessInternalW	thread_identifier: 2288 thread_handle: 0x00000100 process_identifier: 428 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2446ea1b5db9378fb800223f41bb3008.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000104 inherit_handles: 0	success	1
1619269226.429784 NtUnmapViewOfSection	process_identifier: 428 region_size: 4096 process_handle: 0x00000104 base_address: 0x00400000	success	0
1619269226.429784 NtMapViewOfSection	section_handle: 0x0000010c process_identifier: 428 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000104 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619269226.507784 NtGetContextThread	thread_handle: 0x00000100	success	0
1619269226.507784 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 428	success	0
1619269227.070784 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 428	success	0
1619283675.651375 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 428	success	0

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

MicroWorld-eScan	Trojan.Delf.FareIt.Gen.6
FireEye	Generic.mg.2446ea1b5db9378f
CAT-QuickHeal	Trojan.Multi
McAfee	Fareit-FSK!2446EA1B5DB9
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.728056
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Backdoor:Win32/Lokibot.43d8d990
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Delf.FareIt.Gen.6
Invincea	heuristic
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
BitDefender	Trojan.Delf.FareIt.Gen.6
NANO-Antivirus	Trojan.Win32.Stealer.hjzddn
Paloalto	generic.ml
AegisLab	Trojan.Win32.Androm.m!c
Tencent	Win32.Backdoor.Androm.Hoyg
Endgame	malicious (high confidence)
Emsisoft	Trojan.Delf.FareIt.Gen.6 (B)
Comodo	Malware@#1xntt3n7uutxt
F-Secure	Heuristic.HEUR/AGEN.1133569
DrWeb	Trojan.PWS.Stealer.27790
VIPRE	Trojan.Win32.Simda.ba (v)
TrendMicro	TrojanSpy.Win32.LOKI.THEOIBO
McAfee-GW-Edition	BehavesLike.Win32.Fareit.hc
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Fareit-AA
SentinelOne	DFI - Suspicious PE
Cyren	W32/Trojan.GBXX-1124
Avira	HEUR/AGEN.1133569
eGambit	Unsafe.AI_Score_99%
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Win32.Lokibot
Microsoft	Trojan:Win32/Lokibot.VD!MTB
ZoneAlarm	HEUR:Backdoor.Win32.Androm.gen
GData	Trojan.Delf.FareIt.Gen.6
AhnLab-V3	Suspicious/Win.Delphiless.X2059
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZelphiF.34110.KGW@aSLPi3di
ALYac	Trojan.Delf.FareIt.Gen.6
VBA32	BScope.Trojan.Crypt
Malwarebytes	Spyware.AgentTesla
ESET-NOD32	a variant of Win32/Injector.ELTZ
TrendMicro-HouseCall	TrojanSpy.Win32.LOKI.THEOIBO
Rising	Trojan.Lokibot!8.F1B5 (CLOUD)
Yandex	Trojan.Igent.bTGcW7.57

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x46d140 DeleteCriticalSection

• 0x46d144 LeaveCriticalSection

• 0x46d148 EnterCriticalSection

• 0x46d14c InitializeCriticalSection

• 0x46d150 VirtualFree

• 0x46d154 VirtualAlloc

• 0x46d158 LocalFree

• 0x46d15c LocalAlloc

• 0x46d160 GetVersion

• 0x46d164 GetCurrentThreadId

• 0x46d168 InterlockedDecrement

• 0x46d16c InterlockedIncrement

• 0x46d170 VirtualQuery

• 0x46d174 WideCharToMultiByte

• 0x46d178 MultiByteToWideChar

• 0x46d17c lstrlenA

• 0x46d180 lstrcpynA

• 0x46d184 LoadLibraryExA

• 0x46d188 GetThreadLocale

• 0x46d18c GetStartupInfoA

• 0x46d190 GetProcAddress

• 0x46d194 GetModuleHandleA

• 0x46d198 GetModuleFileNameA

• 0x46d19c GetLocaleInfoA

• 0x46d1a0 GetCommandLineA

• 0x46d1a4 FreeLibrary

• 0x46d1a8 FindFirstFileA

• 0x46d1ac FindClose

• 0x46d1b0 ExitProcess

• 0x46d1b4 WriteFile

• 0x46d1b8 UnhandledExceptionFilter

• 0x46d1bc RtlUnwind

• 0x46d1c0 RaiseException

• 0x46d1c4 GetStdHandle

Library user32.dll:

• 0x46d1cc GetKeyboardType

• 0x46d1d0 LoadStringA

• 0x46d1d4 MessageBoxA

• 0x46d1d8 CharNextA

Library advapi32.dll:

• 0x46d1e0 RegQueryValueExA

• 0x46d1e4 RegOpenKeyExA

• 0x46d1e8 RegCloseKey

Library oleaut32.dll:

• 0x46d1f0 SysFreeString

• 0x46d1f4 SysReAllocStringLen

• 0x46d1f8 SysAllocStringLen

Library kernel32.dll:

• 0x46d200 TlsSetValue

• 0x46d204 TlsGetValue

• 0x46d208 LocalAlloc

• 0x46d20c GetModuleHandleA

Library advapi32.dll:

• 0x46d214 RegQueryValueExA

• 0x46d218 RegOpenKeyExA

• 0x46d21c RegCloseKey

Library kernel32.dll:

• 0x46d224 lstrcpyA

• 0x46d228 lstrcmpA

• 0x46d22c WriteFile

• 0x46d230 WaitForSingleObjectEx

• 0x46d234 WaitForSingleObject

• 0x46d238 VirtualQuery

• 0x46d23c VirtualAlloc

• 0x46d240 Sleep

• 0x46d244 SizeofResource

• 0x46d248 SetThreadLocale

• 0x46d24c SetFilePointer

• 0x46d250 SetEvent

• 0x46d254 SetErrorMode

• 0x46d258 SetEndOfFile

• 0x46d25c ResetEvent

• 0x46d260 ReadFile

• 0x46d264 MulDiv

• 0x46d268 LockResource

• 0x46d26c LoadResource

• 0x46d270 LoadLibraryA

• 0x46d274 LeaveCriticalSection

• 0x46d278 InitializeCriticalSection

• 0x46d27c GlobalUnlock

• 0x46d280 GlobalReAlloc

• 0x46d284 GlobalHandle

• 0x46d288 GlobalLock

• 0x46d28c GlobalFree

• 0x46d290 GlobalFindAtomA

• 0x46d294 GlobalDeleteAtom

• 0x46d298 GlobalAlloc

• 0x46d29c GlobalAddAtomA

• 0x46d2a0 GetVersionExA

• 0x46d2a4 GetVersion

• 0x46d2a8 GetTickCount

• 0x46d2ac GetThreadLocale

• 0x46d2b0 GetSystemTimeAsFileTime

• 0x46d2b4 GetSystemTime

• 0x46d2b8 GetSystemInfo

• 0x46d2bc GetStringTypeExA

• 0x46d2c0 GetStdHandle

• 0x46d2c4 GetProcAddress

• 0x46d2c8 GetModuleHandleA

• 0x46d2cc GetModuleFileNameA

• 0x46d2d0 GetLocaleInfoA

• 0x46d2d4 GetLocalTime

• 0x46d2d8 GetLastError

• 0x46d2dc GetFullPathNameA

• 0x46d2e0 GetFileAttributesA

• 0x46d2e4 GetDiskFreeSpaceA

• 0x46d2e8 GetDateFormatA

• 0x46d2ec GetCurrentThreadId

• 0x46d2f0 GetCurrentProcessId

• 0x46d2f4 GetCPInfo

• 0x46d2f8 GetACP

• 0x46d2fc FreeResource

• 0x46d300 InterlockedExchange

• 0x46d304 FreeLibrary

• 0x46d308 FormatMessageA

• 0x46d30c FindResourceA

• 0x46d310 FindFirstFileA

• 0x46d314 FindClose

• 0x46d318 FileTimeToSystemTime

• 0x46d31c FileTimeToLocalFileTime

• 0x46d320 FileTimeToDosDateTime

• 0x46d324 ExitThread

• 0x46d328 ExitProcess

• 0x46d32c EnumCalendarInfoA

• 0x46d330 EnterCriticalSection

• 0x46d334 DeleteCriticalSection

• 0x46d338 CreateThread

• 0x46d33c CreateFileA

• 0x46d340 CreateEventA

• 0x46d344 CompareStringA

• 0x46d348 CloseHandle

Library version.dll:

• 0x46d350 VerQueryValueA

• 0x46d354 GetFileVersionInfoSizeA

• 0x46d358 GetFileVersionInfoA

Library gdi32.dll:

• 0x46d360 UnrealizeObject

• 0x46d364 StretchBlt

• 0x46d368 SetWindowOrgEx

• 0x46d36c SetWinMetaFileBits

• 0x46d370 SetViewportOrgEx

• 0x46d374 SetTextColor

• 0x46d378 SetStretchBltMode

• 0x46d37c SetROP2

• 0x46d380 SetPixel

• 0x46d384 SetEnhMetaFileBits

• 0x46d388 SetDIBColorTable

• 0x46d38c SetBrushOrgEx

• 0x46d390 SetBkMode

• 0x46d394 SetBkColor

• 0x46d398 SelectPalette

• 0x46d39c SelectObject

• 0x46d3a0 SaveDC

• 0x46d3a4 RestoreDC

• 0x46d3a8 Rectangle

• 0x46d3ac RectVisible

• 0x46d3b0 RealizePalette

• 0x46d3b4 Polyline

• 0x46d3b8 PlayEnhMetaFile

• 0x46d3bc PatBlt

• 0x46d3c0 MoveToEx

• 0x46d3c4 MaskBlt

• 0x46d3c8 LineTo

• 0x46d3cc IntersectClipRect

• 0x46d3d0 GetWindowOrgEx

• 0x46d3d4 GetWinMetaFileBits

• 0x46d3d8 GetTextMetricsA

• 0x46d3dc GetTextExtentPoint32A

• 0x46d3e0 GetSystemPaletteEntries

• 0x46d3e4 GetStockObject

• 0x46d3e8 GetPixel

• 0x46d3ec GetPaletteEntries

• 0x46d3f0 GetObjectA

• 0x46d3f4 GetEnhMetaFilePaletteEntries

• 0x46d3f8 GetEnhMetaFileHeader

• 0x46d3fc GetEnhMetaFileBits

• 0x46d400 GetDeviceCaps

• 0x46d404 GetDIBits

• 0x46d408 GetDIBColorTable

• 0x46d40c GetDCOrgEx

• 0x46d410 GetCurrentPositionEx

• 0x46d414 GetClipBox

• 0x46d418 GetBrushOrgEx

• 0x46d41c GetBitmapBits

• 0x46d420 ExcludeClipRect

• 0x46d424 DeleteObject

• 0x46d428 DeleteEnhMetaFile

• 0x46d42c DeleteDC

• 0x46d430 CreateSolidBrush

• 0x46d434 CreatePenIndirect

• 0x46d438 CreatePalette

• 0x46d43c CreateHalftonePalette

• 0x46d440 CreateFontIndirectA

• 0x46d444 CreateDIBitmap

• 0x46d448 CreateDIBSection

• 0x46d44c CreateCompatibleDC

• 0x46d450 CreateCompatibleBitmap

• 0x46d454 CreateBrushIndirect

• 0x46d458 CreateBitmap

• 0x46d45c CopyEnhMetaFileA

• 0x46d460 BitBlt

Library user32.dll:

• 0x46d468 CreateWindowExA

• 0x46d46c WindowFromPoint

• 0x46d470 WinHelpA

• 0x46d474 WaitMessage

• 0x46d478 UpdateWindow

• 0x46d47c UnregisterClassA

• 0x46d480 UnhookWindowsHookEx

• 0x46d484 TranslateMessage

• 0x46d488 TranslateMDISysAccel

• 0x46d48c TrackPopupMenu

• 0x46d490 SystemParametersInfoA

• 0x46d494 ShowWindow

• 0x46d498 ShowScrollBar

• 0x46d49c ShowOwnedPopups

• 0x46d4a0 ShowCursor

• 0x46d4a4 SetWindowsHookExA

• 0x46d4a8 SetWindowTextA

• 0x46d4ac SetWindowPos

• 0x46d4b0 SetWindowPlacement

• 0x46d4b4 SetWindowLongA

• 0x46d4b8 SetTimer

• 0x46d4bc SetScrollRange

• 0x46d4c0 SetScrollPos

• 0x46d4c4 SetScrollInfo

• 0x46d4c8 SetRect

• 0x46d4cc SetPropA

• 0x46d4d0 SetParent

• 0x46d4d4 SetMenuItemInfoA

• 0x46d4d8 SetMenu

• 0x46d4dc SetForegroundWindow

• 0x46d4e0 SetFocus

• 0x46d4e4 SetCursor

• 0x46d4e8 SetClassLongA

• 0x46d4ec SetCapture

• 0x46d4f0 SetActiveWindow

• 0x46d4f4 SendMessageA

• 0x46d4f8 ScrollWindow

• 0x46d4fc ScreenToClient

• 0x46d500 RemovePropA

• 0x46d504 RemoveMenu

• 0x46d508 ReleaseDC

• 0x46d50c ReleaseCapture

• 0x46d510 RegisterWindowMessageA

• 0x46d514 RegisterClipboardFormatA

• 0x46d518 RegisterClassA

• 0x46d51c RedrawWindow

• 0x46d520 PtInRect

• 0x46d524 PostQuitMessage

• 0x46d528 PostMessageA

• 0x46d52c PeekMessageA

• 0x46d530 OffsetRect

• 0x46d534 OemToCharA

• 0x46d538 MessageBoxA

• 0x46d53c MapWindowPoints

• 0x46d540 MapVirtualKeyA

• 0x46d544 LoadStringA

• 0x46d548 LoadKeyboardLayoutA

• 0x46d54c LoadIconA

• 0x46d550 LoadCursorA

• 0x46d554 LoadBitmapA

• 0x46d558 KillTimer

• 0x46d55c IsZoomed

• 0x46d560 IsWindowVisible

• 0x46d564 IsWindowEnabled

• 0x46d568 IsWindow

• 0x46d56c IsRectEmpty

• 0x46d570 IsIconic

• 0x46d574 IsDialogMessageA

• 0x46d578 IsChild

• 0x46d57c InvalidateRect

• 0x46d580 IntersectRect

• 0x46d584 InsertMenuItemA

• 0x46d588 InsertMenuA

• 0x46d58c InflateRect

• 0x46d590 GetWindowThreadProcessId

• 0x46d594 GetWindowTextA

• 0x46d598 GetWindowRect

• 0x46d59c GetWindowPlacement

• 0x46d5a0 GetWindowLongA

• 0x46d5a4 GetWindowDC

• 0x46d5a8 GetTopWindow

• 0x46d5ac GetSystemMetrics

• 0x46d5b0 GetSystemMenu

• 0x46d5b4 GetSysColorBrush

• 0x46d5b8 GetSysColor

• 0x46d5bc GetSubMenu

• 0x46d5c0 GetScrollRange

• 0x46d5c4 GetScrollPos

• 0x46d5c8 GetScrollInfo

• 0x46d5cc GetPropA

• 0x46d5d0 GetParent

• 0x46d5d4 GetWindow

• 0x46d5d8 GetMenuStringA

• 0x46d5dc GetMenuState

• 0x46d5e0 GetMenuItemInfoA

• 0x46d5e4 GetMenuItemID

• 0x46d5e8 GetMenuItemCount

• 0x46d5ec GetMenu

• 0x46d5f0 GetLastActivePopup

• 0x46d5f4 GetKeyboardState

• 0x46d5f8 GetKeyboardLayoutList

• 0x46d5fc GetKeyboardLayout

• 0x46d600 GetKeyState

• 0x46d604 GetKeyNameTextA

• 0x46d608 GetInputState

• 0x46d60c GetIconInfo

• 0x46d610 GetForegroundWindow

• 0x46d614 GetFocus

• 0x46d618 GetDlgItem

• 0x46d61c GetDesktopWindow

• 0x46d620 GetDCEx

• 0x46d624 GetDC

• 0x46d628 GetCursorPos

• 0x46d62c GetCursor

• 0x46d630 GetClipboardData

• 0x46d634 GetClientRect

• 0x46d638 GetClassNameA

• 0x46d63c GetClassInfoA

• 0x46d640 GetCapture

• 0x46d644 GetActiveWindow

• 0x46d648 FrameRect

• 0x46d64c FindWindowA

• 0x46d650 FillRect

• 0x46d654 EqualRect

• 0x46d658 EnumWindows

• 0x46d65c EnumThreadWindows

• 0x46d660 EndPaint

• 0x46d664 EnableWindow

• 0x46d668 EnableScrollBar

• 0x46d66c EnableMenuItem

• 0x46d670 DrawTextA

• 0x46d674 DrawMenuBar

• 0x46d678 DrawIconEx

• 0x46d67c DrawIcon

• 0x46d680 DrawFrameControl

• 0x46d684 DrawEdge

• 0x46d688 DispatchMessageA

• 0x46d68c DestroyWindow

• 0x46d690 DestroyMenu

• 0x46d694 DestroyIcon

• 0x46d698 DestroyCursor

• 0x46d69c DeleteMenu

• 0x46d6a0 DefWindowProcA

• 0x46d6a4 DefMDIChildProcA

• 0x46d6a8 DefFrameProcA

• 0x46d6ac CreatePopupMenu

• 0x46d6b0 CreateMenu

• 0x46d6b4 CreateIcon

• 0x46d6b8 ClientToScreen

• 0x46d6bc CheckMenuItem

• 0x46d6c0 CallWindowProcA

• 0x46d6c4 CallNextHookEx

• 0x46d6c8 BeginPaint

• 0x46d6cc CharNextA

• 0x46d6d0 CharLowerBuffA

• 0x46d6d4 CharLowerA

• 0x46d6d8 CharToOemA

• 0x46d6dc AdjustWindowRectEx

• 0x46d6e0 ActivateKeyboardLayout

Library kernel32.dll:

• 0x46d6e8 Sleep

Library oleaut32.dll:

• 0x46d6f0 SafeArrayPtrOfIndex

• 0x46d6f4 SafeArrayGetUBound

• 0x46d6f8 SafeArrayGetLBound

• 0x46d6fc SafeArrayCreate

• 0x46d700 VariantChangeType

• 0x46d704 VariantCopy

• 0x46d708 VariantClear

• 0x46d70c VariantInit

Library ole32.dll:

• 0x46d714 CoTaskMemAlloc

• 0x46d718 CoCreateInstance

• 0x46d71c CoUninitialize

• 0x46d720 CoInitialize

Library comctl32.dll:

• 0x46d728 ImageList_SetIconSize

• 0x46d72c ImageList_GetIconSize

• 0x46d730 ImageList_Write

• 0x46d734 ImageList_Read

• 0x46d738 ImageList_GetDragImage

• 0x46d73c ImageList_DragShowNolock

• 0x46d740 ImageList_SetDragCursorImage

• 0x46d744 ImageList_DragMove

• 0x46d748 ImageList_DragLeave

• 0x46d74c ImageList_DragEnter

• 0x46d750 ImageList_EndDrag

• 0x46d754 ImageList_BeginDrag

• 0x46d758 ImageList_Remove

• 0x46d75c ImageList_DrawEx

• 0x46d760 ImageList_Replace

• 0x46d764 ImageList_Draw

• 0x46d768 ImageList_GetBkColor

• 0x46d76c ImageList_SetBkColor

• 0x46d770 ImageList_ReplaceIcon

• 0x46d774 ImageList_Add

• 0x46d778 ImageList_GetImageCount

• 0x46d77c ImageList_Destroy

• 0x46d780 ImageList_Create

• 0x46d784 InitCommonControls

Library comdlg32.dll:

• 0x46d78c GetSaveFileNameA

• 0x46d790 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
www.peamachinerylltd.com	CNAME peamachinerylltd.com A 72.52.178.23	72.52.178.23
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51809	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.