SmartHawk

6.8

高危

52 个模型检测该样本为恶意！

重新分析

下载样本

c56f06b243fd756699f5e23eaea459ca67a3a72279a3f7dd2b130c2af38b5de9

247d5759c3eed61e7357a564b48b54b2.exe

分析耗时

79s

最近分析

文件大小

392.0KB

静态报毒动态报毒 AI SCORE=99 AIDETECTVM ATTRIBUTE BSCOPE CLOUD DOWNLOADER34 DTIFD ELDORADO EMOTET EPAZ GENCIRC GENERICKDZ GENETIC GENKRYPTIK HFHN HIGH CONFIDENCE HIGHCONFIDENCE HPNOPH KRYPTIK MALWARE2 R002C0DH220 R346631 S15302857 SCORE SGENERIC SUSGEN UNCLASSIFIEDMALWARE@0 UNSAFE WACATACPMF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRO!247D5759C3EE	20200824	6.0.6.653
Alibaba	Trojan:Win32/Emotet.44838d23	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Tencent	Malware.Win32.Gencirc.10cde567	20200824	1.0.0.1
Kingsoft		20200824	2013.8.14.323
CrowdStrike		20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620827972.99875 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1620827964.26375 CryptGenKey	crypto_handle: 0x005849a8 algorithm_identifier: 0x0000660e () provider_handle: 0x005845a0 flags: 1 key: f»Þ I·¶âÄÌÝB	success	1
1620827973.01375 CryptExportKey	crypto_handle: 0x005849a8 crypto_export_handle: 0x00584968 buffer: f¤Ð;¹GèÚ¾¡@ûÎgäÄáWóZÒÓ¼FW¼ïÖ¬y#mÉð·±X{)L3}©(! ²GBOßtÊykÓmS¨@¶ð ÀÞÏ×u{uï# blob_type: 1 flags: 64	success	1
1620828009.02975 CryptExportKey	crypto_handle: 0x005849a8 crypto_export_handle: 0x00584968 buffer: f¤Wå²i ©ù6cÞ¸A^Ú ªïþp2r3joÝB¸ù3£@a¾ÎÂggËPeÇè^-(Ñ4¨,2«Ñ¯núFÇúã¢Hç(^jÕí°X¨*"d~:7E" blob_type: 1 flags: 64	success	1

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620827963.73275 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003d0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620827973.57675 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

247d5759c3eed61e7357a564b48b54b2.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620827973.20175 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	187.64.128.197
host	198.57.203.63

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1620827976.12375 RegSetValueExA	key_handle: 0x000003ac value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620827976.12375 RegSetValueExA	key_handle: 0x000003ac value: °hFG× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620827976.13875 RegSetValueExA	key_handle: 0x000003ac value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620827976.13875 RegSetValueExW	key_handle: 0x000003ac value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620827976.13875 RegSetValueExA	key_handle: 0x000003c4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620827976.13875 RegSetValueExA	key_handle: 0x000003c4 value: °hFG× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620827976.13875 RegSetValueExA	key_handle: 0x000003c4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620827976.16975 RegSetValueExW	key_handle: 0x000003a8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Generates some ICMP traffic

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69173
FireEye	Generic.mg.247d5759c3eed61e
CAT-QuickHeal	Trojan.WacatacPMF.S15302857
McAfee	Emotet-FRO!247D5759C3EE
Cylance	Unsafe
Zillya	Backdoor.Emotet.Win32.847
K7AntiVirus	Trojan ( 0056bee11 )
Alibaba	Trojan:Win32/Emotet.44838d23
K7GW	Trojan ( 0056bee11 )
Arcabit	Trojan.Generic.D10E35
Invincea	heuristic
Cyren	W32/Emotet.AOG.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.pef
BitDefender	Trojan.GenericKDZ.69173
NANO-Antivirus	Trojan.Win32.Kryptik.hpnoph
ViRobot	Trojan.Win32.Z.Emotet.401408.CAR
Tencent	Malware.Win32.Gencirc.10cde567
Ad-Aware	Trojan.GenericKDZ.69173
TACHYON	Banker/W32.Emotet.401408.R
Comodo	.UnclassifiedMalware@0
F-Secure	Trojan.TR/Crypt.Agent.dtifd
DrWeb	Trojan.DownLoader34.14215
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DH220
Sophos	Troj/Emotet-CKO
Jiangmin	Backdoor.Emotet.pm
Webroot	W32.Trojan.Emotet
Avira	TR/Crypt.Agent.dtifd
Antiy-AVL	Trojan/Win32.SGeneric
Microsoft	Trojan:Win32/Emotet.DGM!MTB
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.pef
GData	Trojan.GenericKDZ.69173
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Emotet.R346631
ALYac	Trojan.GenericKDZ.69173
MAX	malware (ai score=99)
VBA32	BScope.Trojan.Emotet
Malwarebytes	Trojan.Emotet
ESET-NOD32	a variant of Win32/Kryptik.HFHN
TrendMicro-HouseCall	TROJ_GEN.R002C0DH220
Rising	Trojan.Kryptik!1.C82B (CLOUD)
Ikarus	Trojan-Banker.Emotet
Fortinet	W32/GenKryptik.EPAZ!tr
MaxSecure	Trojan.Malware.73767892.susgen
AVG	Win32:Malware-gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	198.57.203.63:8080
dead_host	187.64.128.197:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-31 22:42:29

Imports

Library KERNEL32.dll:

• 0x43e12c HeapFree

• 0x43e130 VirtualProtect

• 0x43e134 VirtualAlloc

• 0x43e138 GetSystemInfo

• 0x43e13c VirtualQuery

• 0x43e140 GetStartupInfoA

• 0x43e144 GetCommandLineA

• 0x43e148 HeapReAlloc

• 0x43e14c TerminateProcess

• 0x43e150 HeapSize

• 0x43e154 SetUnhandledExceptionFilter

• 0x43e158 HeapDestroy

• 0x43e15c HeapCreate

• 0x43e160 VirtualFree

• 0x43e164 IsBadWritePtr

• 0x43e168 GetStdHandle

• 0x43e16c UnhandledExceptionFilter

• 0x43e170 FreeEnvironmentStringsA

• 0x43e174 GetEnvironmentStrings

• 0x43e178 FreeEnvironmentStringsW

• 0x43e17c HeapAlloc

• 0x43e180 SetHandleCount

• 0x43e184 GetFileType

• 0x43e188 QueryPerformanceCounter

• 0x43e18c GetCurrentProcessId

• 0x43e190 GetSystemTimeAsFileTime

• 0x43e194 LCMapStringA

• 0x43e198 LCMapStringW

• 0x43e19c GetStringTypeA

• 0x43e1a0 GetStringTypeW

• 0x43e1a4 GetTimeZoneInformation

• 0x43e1a8 IsBadReadPtr

• 0x43e1ac IsBadCodePtr

• 0x43e1b0 SetStdHandle

• 0x43e1b4 SetEnvironmentVariableA

• 0x43e1b8 RtlUnwind

• 0x43e1bc GetTickCount

• 0x43e1c0 SetErrorMode

• 0x43e1c4 LocalFileTimeToFileTime

• 0x43e1c8 FileTimeToLocalFileTime

• 0x43e1cc GetShortPathNameA

• 0x43e1d0 CreateFileA

• 0x43e1d4 GetVolumeInformationA

• 0x43e1d8 DuplicateHandle

• 0x43e1dc GetFileSize

• 0x43e1e0 SetEndOfFile

• 0x43e1e4 UnlockFile

• 0x43e1e8 LockFile

• 0x43e1ec FlushFileBuffers

• 0x43e1f0 SetFilePointer

• 0x43e1f4 WriteFile

• 0x43e1f8 ReadFile

• 0x43e1fc DeleteFileA

• 0x43e200 MoveFileA

• 0x43e204 GetCurrentDirectoryA

• 0x43e208 SystemTimeToFileTime

• 0x43e20c FileTimeToSystemTime

• 0x43e210 GetOEMCP

• 0x43e214 GetCPInfo

• 0x43e218 InterlockedIncrement

• 0x43e21c GlobalFlags

• 0x43e220 TlsFree

• 0x43e224 LocalReAlloc

• 0x43e228 TlsSetValue

• 0x43e22c TlsAlloc

• 0x43e230 TlsGetValue

• 0x43e234 EnterCriticalSection

• 0x43e238 GlobalHandle

• 0x43e23c GlobalReAlloc

• 0x43e240 LeaveCriticalSection

• 0x43e244 LocalAlloc

• 0x43e248 DeleteCriticalSection

• 0x43e24c InitializeCriticalSection

• 0x43e250 RaiseException

• 0x43e254 GetDiskFreeSpaceA

• 0x43e258 GetFullPathNameA

• 0x43e25c GetTempFileNameA

• 0x43e260 GetFileTime

• 0x43e264 SetFileTime

• 0x43e268 GetFileAttributesA

• 0x43e26c GetPrivateProfileStringA

• 0x43e270 WritePrivateProfileStringA

• 0x43e274 GetPrivateProfileIntA

• 0x43e278 CloseHandle

• 0x43e27c GetCurrentThread

• 0x43e280 GetModuleFileNameA

• 0x43e284 ConvertDefaultLocale

• 0x43e288 EnumResourceLanguagesA

• 0x43e28c lstrcpyA

• 0x43e290 lstrcmpA

• 0x43e294 InterlockedDecrement

• 0x43e298 SetLastError

• 0x43e29c GlobalFree

• 0x43e2a0 MulDiv

• 0x43e2a4 GlobalAlloc

• 0x43e2a8 GlobalLock

• 0x43e2ac GlobalUnlock

• 0x43e2b0 FormatMessageA

• 0x43e2b4 LocalFree

• 0x43e2b8 FreeResource

• 0x43e2bc GetCurrentThreadId

• 0x43e2c0 GlobalGetAtomNameA

• 0x43e2c4 GlobalAddAtomA

• 0x43e2c8 GlobalFindAtomA

• 0x43e2cc GlobalDeleteAtom

• 0x43e2d0 LoadLibraryA

• 0x43e2d4 FreeLibrary

• 0x43e2d8 lstrcatA

• 0x43e2dc lstrcmpW

• 0x43e2e0 lstrcpynA

• 0x43e2e4 GetModuleHandleA

• 0x43e2e8 GetStringTypeExA

• 0x43e2ec CompareStringW

• 0x43e2f0 CompareStringA

• 0x43e2f4 lstrlenA

• 0x43e2f8 lstrcmpiA

• 0x43e2fc GetVersion

• 0x43e300 GetLastError

• 0x43e304 MultiByteToWideChar

• 0x43e308 ExitProcess

• 0x43e30c LoadLibraryExW

• 0x43e310 GetProcAddress

• 0x43e314 LoadLibraryExA

• 0x43e318 GetCurrentProcess

• 0x43e31c FindNextFileA

• 0x43e320 GetLogicalDrives

• 0x43e324 GetDriveTypeA

• 0x43e328 FindFirstFileA

• 0x43e32c FindClose

• 0x43e330 WideCharToMultiByte

• 0x43e334 FindResourceA

• 0x43e338 LoadResource

• 0x43e33c LockResource

• 0x43e340 SizeofResource

• 0x43e344 GetVersionExA

• 0x43e348 GetThreadLocale

• 0x43e34c GetLocaleInfoA

• 0x43e350 GetACP

• 0x43e354 GetEnvironmentStringsW

• 0x43e358 InterlockedExchange

Library USER32.dll:

• 0x43e3c0 GetDCEx

• 0x43e3c4 LockWindowUpdate

• 0x43e3c8 RegisterClipboardFormatA

• 0x43e3cc PostThreadMessageA

• 0x43e3d0 GetMenuItemInfoA

• 0x43e3d4 InflateRect

• 0x43e3d8 EndPaint

• 0x43e3dc BeginPaint

• 0x43e3e0 GetWindowDC

• 0x43e3e4 ClientToScreen

• 0x43e3e8 GrayStringA

• 0x43e3ec DrawTextExA

• 0x43e3f0 DrawTextA

• 0x43e3f4 TabbedTextOutA

• 0x43e3f8 FillRect

• 0x43e3fc LoadCursorA

• 0x43e400 GetSysColorBrush

• 0x43e404 SetParent

• 0x43e408 DeleteMenu

• 0x43e40c IsRectEmpty

• 0x43e410 IsZoomed

• 0x43e414 LoadMenuA

• 0x43e418 DestroyMenu

• 0x43e41c UnpackDDElParam

• 0x43e420 ReuseDDElParam

• 0x43e424 ReleaseCapture

• 0x43e428 LoadAcceleratorsA

• 0x43e42c InsertMenuItemA

• 0x43e430 CreatePopupMenu

• 0x43e434 SetRectEmpty

• 0x43e438 BringWindowToTop

• 0x43e43c SetMenu

• 0x43e440 TranslateAcceleratorA

• 0x43e444 SetWindowContextHelpId

• 0x43e448 MapDialogRect

• 0x43e44c wsprintfA

• 0x43e450 GetMessageA

• 0x43e454 TranslateMessage

• 0x43e458 GetCursorPos

• 0x43e45c ValidateRect

• 0x43e460 ShowOwnedPopups

• 0x43e464 SetCursor

• 0x43e468 PostQuitMessage

• 0x43e46c GetDesktopWindow

• 0x43e470 GetActiveWindow

• 0x43e474 CreateDialogIndirectParamA

• 0x43e478 EndDialog

• 0x43e47c ReleaseDC

• 0x43e480 GetDC

• 0x43e484 GetMenuStringA

• 0x43e488 AppendMenuA

• 0x43e48c InsertMenuA

• 0x43e490 SetMenuItemBitmaps

• 0x43e494 ModifyMenuA

• 0x43e498 GetMenuState

• 0x43e49c EnableMenuItem

• 0x43e4a0 CheckMenuItem

• 0x43e4a4 GetMenuCheckMarkDimensions

• 0x43e4a8 LoadBitmapA

• 0x43e4ac IsWindowEnabled

• 0x43e4b0 ShowWindow

• 0x43e4b4 MoveWindow

• 0x43e4b8 WindowFromPoint

• 0x43e4bc IsDialogMessageA

• 0x43e4c0 RegisterWindowMessageA

• 0x43e4c4 WinHelpA

• 0x43e4c8 GetCapture

• 0x43e4cc CreateWindowExA

• 0x43e4d0 SetWindowsHookExA

• 0x43e4d4 CallNextHookEx

• 0x43e4d8 GetClassLongA

• 0x43e4dc GetClassInfoExA

• 0x43e4e0 GetClassNameA

• 0x43e4e4 SetPropA

• 0x43e4e8 GetPropA

• 0x43e4ec RemovePropA

• 0x43e4f0 SendDlgItemMessageA

• 0x43e4f4 IsWindow

• 0x43e4f8 SetFocus

• 0x43e4fc GetWindowTextLengthA

• 0x43e500 GetWindowTextA

• 0x43e504 GetForegroundWindow

• 0x43e508 GetLastActivePopup

• 0x43e50c SetActiveWindow

• 0x43e510 DispatchMessageA

• 0x43e514 EnableWindow

• 0x43e518 LoadIconA

• 0x43e51c SendMessageA

• 0x43e520 UpdateWindow

• 0x43e524 GetSystemMenu

• 0x43e528 CharUpperA

• 0x43e52c GetNextDlgTabItem

• 0x43e530 AdjustWindowRectEx

• 0x43e534 IsIconic

• 0x43e538 InvalidateRect

• 0x43e53c GetParent

• 0x43e540 BeginDeferWindowPos

• 0x43e544 EndDeferWindowPos

• 0x43e548 GetDlgItem

• 0x43e54c GetTopWindow

• 0x43e550 DestroyWindow

• 0x43e554 UnhookWindowsHookEx

• 0x43e558 GetMessageTime

• 0x43e55c GetMessagePos

• 0x43e560 PeekMessageA

• 0x43e564 MapWindowPoints

• 0x43e568 MessageBoxA

• 0x43e56c TrackPopupMenu

• 0x43e570 GetKeyState

• 0x43e574 KillTimer

• 0x43e578 SetTimer

• 0x43e57c MessageBeep

• 0x43e580 GetNextDlgGroupItem

• 0x43e584 SetCapture

• 0x43e588 SetForegroundWindow

• 0x43e58c IsWindowVisible

• 0x43e590 GetClientRect

• 0x43e594 GetMenu

• 0x43e598 PostMessageA

• 0x43e59c GetSubMenu

• 0x43e5a0 GetMenuItemID

• 0x43e5a4 GetMenuItemCount

• 0x43e5a8 InvalidateRgn

• 0x43e5ac CopyAcceleratorTableA

• 0x43e5b0 SetRect

• 0x43e5b4 CharNextA

• 0x43e5b8 SetWindowTextA

• 0x43e5bc DestroyIcon

• 0x43e5c0 IsChild

• 0x43e5c4 GetFocus

• 0x43e5c8 GetDlgCtrlID

• 0x43e5cc GetWindow

• 0x43e5d0 PtInRect

• 0x43e5d4 CopyRect

• 0x43e5d8 GetSystemMetrics

• 0x43e5dc GetWindowRect

• 0x43e5e0 GetWindowPlacement

• 0x43e5e4 SystemParametersInfoA

• 0x43e5e8 IntersectRect

• 0x43e5ec OffsetRect

• 0x43e5f0 SetWindowPos

• 0x43e5f4 SetWindowLongA

• 0x43e5f8 GetWindowLongA

• 0x43e5fc CallWindowProcA

• 0x43e600 DefWindowProcA

• 0x43e604 UnregisterClassA

• 0x43e608 RegisterClassA

• 0x43e60c GetClassInfoA

• 0x43e610 DeferWindowPos

• 0x43e614 EqualRect

• 0x43e618 ScreenToClient

• 0x43e61c GetSysColor

Library GDI32.dll:

• 0x43e058 GetStockObject

• 0x43e05c CreateSolidBrush

• 0x43e060 CreateFontIndirectA

• 0x43e064 CreatePatternBrush

• 0x43e068 CombineRgn

• 0x43e06c GetMapMode

• 0x43e070 GetBkColor

• 0x43e074 GetTextColor

• 0x43e078 GetRgnBox

• 0x43e07c ExtSelectClipRgn

• 0x43e080 ScaleWindowExtEx

• 0x43e084 SetWindowExtEx

• 0x43e088 ScaleViewportExtEx

• 0x43e08c SetViewportExtEx

• 0x43e090 OffsetViewportOrgEx

• 0x43e094 SetViewportOrgEx

• 0x43e098 Escape

• 0x43e09c ExtTextOutA

• 0x43e0a0 TextOutA

• 0x43e0a4 RectVisible

• 0x43e0a8 PtVisible

• 0x43e0ac GetPixel

• 0x43e0b0 BitBlt

• 0x43e0b4 GetWindowExtEx

• 0x43e0b8 GetViewportExtEx

• 0x43e0bc CreateRectRgn

• 0x43e0c0 SetRectRgn

• 0x43e0c4 SelectClipRgn

• 0x43e0c8 IntersectClipRect

• 0x43e0cc ExcludeClipRect

• 0x43e0d0 SetMapMode

• 0x43e0d4 SetBkMode

• 0x43e0d8 RestoreDC

• 0x43e0dc SaveDC

• 0x43e0e0 CreateFontA

• 0x43e0e4 GetCharWidthA

• 0x43e0e8 DeleteObject

• 0x43e0ec StretchDIBits

• 0x43e0f0 DeleteDC

• 0x43e0f4 GetTextExtentPoint32A

• 0x43e0f8 GetTextMetricsA

• 0x43e0fc SelectObject

• 0x43e100 CreateCompatibleDC

• 0x43e104 CreateCompatibleBitmap

• 0x43e108 PatBlt

• 0x43e10c CreateRectRgnIndirect

• 0x43e110 GetDeviceCaps

• 0x43e114 CreateBitmap

• 0x43e118 GetObjectA

• 0x43e11c SetBkColor

• 0x43e120 SetTextColor

• 0x43e124 GetClipBox

Library comdlg32.dll:

• 0x43e634 GetOpenFileNameA

• 0x43e638 GetSaveFileNameA

• 0x43e63c GetFileTitleA

• 0x43e640 CommDlgExtendedError

• 0x43e644 PrintDlgA

Library WINSPOOL.DRV:

• 0x43e624 ClosePrinter

• 0x43e628 OpenPrinterA

• 0x43e62c DocumentPropertiesA

Library ADVAPI32.dll:

• 0x43e000 RegCreateKeyA

• 0x43e004 RegSetValueA

• 0x43e008 RegOpenKeyA

• 0x43e00c RegQueryValueExA

• 0x43e010 RegOpenKeyExA

• 0x43e014 RegDeleteKeyA

• 0x43e018 RegEnumKeyA

• 0x43e01c RegQueryValueA

• 0x43e020 RegCreateKeyExA

• 0x43e024 RegSetValueExA

• 0x43e028 RegDeleteValueA

• 0x43e02c SetFileSecurityA

• 0x43e030 RegCloseKey

• 0x43e034 GetFileSecurityA

Library SHELL32.dll:

• 0x43e394 DragFinish

• 0x43e398 DragQueryFileA

• 0x43e39c ExtractIconA

• 0x43e3a0 SHGetFileInfoA

• 0x43e3a4 ShellAboutA

Library COMCTL32.dll:

• 0x43e03c ImageList_ReplaceIcon

• 0x43e040

• 0x43e044 ImageList_Destroy

• 0x43e048 ImageList_Create

• 0x43e04c ImageList_Draw

• 0x43e050 ImageList_GetImageInfo

Library SHLWAPI.dll:

• 0x43e3ac PathFindFileNameA

• 0x43e3b0 PathStripToRootA

• 0x43e3b4 PathFindExtensionA

• 0x43e3b8 PathIsUNCA

Library oledlg.dll:

• 0x43e68c

Library ole32.dll:

• 0x43e64c StgOpenStorageOnILockBytes

• 0x43e650 CoGetClassObject

• 0x43e654 CLSIDFromString

• 0x43e658 CLSIDFromProgID

• 0x43e65c StgCreateDocfileOnILockBytes

• 0x43e660 CoTaskMemFree

• 0x43e664 CreateILockBytesOnHGlobal

• 0x43e668 OleUninitialize

• 0x43e66c CoFreeUnusedLibraries

• 0x43e670 CoRegisterMessageFilter

• 0x43e674 OleFlushClipboard

• 0x43e678 OleIsCurrentClipboard

• 0x43e67c CoRevokeClassObject

• 0x43e680 CoTaskMemAlloc

• 0x43e684 OleInitialize

Library OLEAUT32.dll:

• 0x43e360 VariantClear

• 0x43e364 VariantChangeType

• 0x43e368 VariantInit

• 0x43e36c SysAllocStringLen

• 0x43e370 SysFreeString

• 0x43e374 SysStringLen

• 0x43e378 SysAllocStringByteLen

• 0x43e37c VariantCopy

• 0x43e380 SafeArrayDestroy

• 0x43e384 SystemTimeToVariantTime

• 0x43e388 SysAllocString

• 0x43e38c OleCreateFontIndirect

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51809	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	60124	239.255.255.250	3702
192.168.56.101	62194	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.