SmartHawk

6.6

高危

58 个模型检测该样本为恶意！

重新分析

下载样本

7dd02ed6230b0adde343aca84f8693a1c0d3ade225679849bf72849ad84107ca

29752eef5f5a7a3a6c9d0bbd473d0576.exe

分析耗时

33s

最近分析

文件大小

627.5KB

静态报毒动态报毒 100% AI SCORE=83 AIDETECTVM ALI2000015 ANOXR BT7LUW BXXJ CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMOY FAREIT HIGH CONFIDENCE HOACQX IGENT KCLOUD KRYPTIK LOKI MALWARE2 MALWARE@#21HG0ZW55EB2I NGW@AYH0AODI PWSX REMCOS SCORE SMAD1 SPYBOTNET SUSGEN TSCOPE UNSAFE X2094 ZELPHIF ZUSY 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Avast	Win32:PWSX-gen [Trj]	20201210	21.1.5827.0
Baidu		20190318	1.0.0.2
Kingsoft	Win32.Troj.Undef.(kcloud)	20201211	2017.9.26.565
McAfee	Fareit-FVZ!29752EEF5F5A	20201211	6.0.6.653
Tencent		20201211	1.0.0.1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619344639.972501 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a 29752eef5f5a7a3a6c9d0bbd473d0576+0x2a3f8 @ 0x42a3f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe7514ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619344639.972501
__exception__

stacktrace:

RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
29752eef5f5a7a3a6c9d0bbd473d0576+0x2a3f8 @ 0x42a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe7514ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (28 个事件)

Time & API	Arguments	Status
1619344638.832249 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00360000	success
1619344638.894249 NtProtectVirtualMemory	process_identifier: 912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0046f000	success
1619344638.910249 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00870000	success
1619344639.347501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619344639.363501 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01d70000	success
1619344639.363501 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e60000	success
1619344639.363501 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 139264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00460000	success
1619344639.363501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 110592 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00462000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f32000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f32000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f32000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f32000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f32000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f32000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f32000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f32000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f32000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f32000	success
1619344639.941501 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 个事件)

Time & API	Arguments	Status	Return
1619344638.910249 Process32NextW	process_name: wsqmcons.exe snapshot_handle: 0x000000f8 process_identifier: 2868	success	1
1619344638.910249 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x000000f8 process_identifier: 2120	success	1
1619344638.910249 Process32NextW	process_name: taskhost.exe snapshot_handle: 0x000000f8 process_identifier: 1476	success	1
1619344638.910249 Process32NextW	process_name: pythonw.exe snapshot_handle: 0x000000f8 process_identifier: 2056	success	1
1619344638.910249 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x000000f8 process_identifier: 2476	success	1
1619344638.910249 Process32NextW	process_name: 29752eef5f5a7a3a6c9d0bbd473d0576.exe snapshot_handle: 0x000000f8 process_identifier: 912	success	1

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

6.906369333784788

section

{'size_of_data': '0x00018a00', 'virtual_address': '0x0008a000', 'entropy': 6.906369333784788, 'name': '.rsrc', 'virtual_size': '0x000188ac'}

description

A section with a high entropy has been found

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 912 called NtSetContextThread to modify thread in remote process 2456
1619344639.128249 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4515200 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2456	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 912 resumed a thread in remote process 2456
1619344639.191249 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2456	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619344639.113249 CreateProcessInternalW	thread_identifier: 196 thread_handle: 0x000000fc process_identifier: 2456 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\29752eef5f5a7a3a6c9d0bbd473d0576.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619344639.113249 NtUnmapViewOfSection	process_identifier: 2456 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619344639.113249 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 2456 commit_size: 327680 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 327680 base_address: 0x00400000	success	0
1619344639.128249 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619344639.128249 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4515200 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2456	success	0
1619344639.191249 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2456	success	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	BackDoor.SpyBotNET.25
MicroWorld-eScan	Gen:Variant.Zusy.308923
FireEye	Generic.mg.29752eef5f5a7a3a
Qihoo-360	Win32/Trojan.469
ALYac	Gen:Variant.Zusy.308923
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2257361
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Zusy.D4B6BB
BitDefenderTheta	Gen:NN.ZelphiF.34670.NGW@ayh0Aodi
Cyren	W32/Injector.BXXJ-4480
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Malware.Remcos-8987122-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Gen:Variant.Zusy.308923
NANO-Antivirus	Trojan.Win32.Kryptik.hoacqx
Paloalto	generic.ml
Rising	Trojan.Injector!1.C99D (CLASSIC)
Ad-Aware	Gen:Variant.Zusy.308923
Emsisoft	Gen:Variant.Zusy.308923 (B)
Comodo	Malware@#21hg0zw55eb2i
F-Secure	Trojan.TR/Spy.Fareit.anoxr
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.LOKI.SMAD1.hp
McAfee-GW-Edition	BehavesLike.Win32.Trojan.jh
Sophos	Mal/Generic-S
Jiangmin	Trojan.Kryptik.bwt
Avira	TR/Spy.Fareit.anoxr
Antiy-AVL	Trojan/Win32.Kryptik
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	PWS:Win32/Fareit.AQ!MTB
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Gen:Variant.Zusy.308923
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2094
McAfee	Fareit-FVZ!29752EEF5F5A
MAX	malware (ai score=83)
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
Zoner	Trojan.Win32.94576
ESET-NOD32	Win32/TrojanDropper.Agent.RBR

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47d154 DeleteCriticalSection

• 0x47d158 LeaveCriticalSection

• 0x47d15c EnterCriticalSection

• 0x47d160 InitializeCriticalSection

• 0x47d164 VirtualFree

• 0x47d168 VirtualAlloc

• 0x47d16c LocalFree

• 0x47d170 LocalAlloc

• 0x47d174 GetVersion

• 0x47d178 GetCurrentThreadId

• 0x47d17c InterlockedDecrement

• 0x47d180 InterlockedIncrement

• 0x47d184 VirtualQuery

• 0x47d188 WideCharToMultiByte

• 0x47d18c MultiByteToWideChar

• 0x47d190 lstrlenA

• 0x47d194 lstrcpynA

• 0x47d198 LoadLibraryExA

• 0x47d19c GetThreadLocale

• 0x47d1a0 GetStartupInfoA

• 0x47d1a4 GetProcAddress

• 0x47d1a8 GetModuleHandleA

• 0x47d1ac GetModuleFileNameA

• 0x47d1b0 GetLocaleInfoA

• 0x47d1b4 GetCommandLineA

• 0x47d1b8 FreeLibrary

• 0x47d1bc FindFirstFileA

• 0x47d1c0 FindClose

• 0x47d1c4 ExitProcess

• 0x47d1c8 WriteFile

• 0x47d1cc UnhandledExceptionFilter

• 0x47d1d0 RtlUnwind

• 0x47d1d4 RaiseException

• 0x47d1d8 GetStdHandle

Library user32.dll:

• 0x47d1e0 GetKeyboardType

• 0x47d1e4 LoadStringA

• 0x47d1e8 MessageBoxA

• 0x47d1ec CharNextA

Library advapi32.dll:

• 0x47d1f4 RegQueryValueExA

• 0x47d1f8 RegOpenKeyExA

• 0x47d1fc RegCloseKey

Library oleaut32.dll:

• 0x47d204 SysFreeString

• 0x47d208 SysReAllocStringLen

• 0x47d20c SysAllocStringLen

Library kernel32.dll:

• 0x47d214 TlsSetValue

• 0x47d218 TlsGetValue

• 0x47d21c LocalAlloc

• 0x47d220 GetModuleHandleA

Library advapi32.dll:

• 0x47d228 RegQueryValueExA

• 0x47d22c RegOpenKeyExA

• 0x47d230 RegCloseKey

Library kernel32.dll:

• 0x47d238 lstrcpyA

• 0x47d23c WriteFile

• 0x47d240 WaitForSingleObject

• 0x47d244 VirtualQuery

• 0x47d248 VirtualProtect

• 0x47d24c VirtualAlloc

• 0x47d250 Sleep

• 0x47d254 SizeofResource

• 0x47d258 SetThreadLocale

• 0x47d25c SetFilePointer

• 0x47d260 SetEvent

• 0x47d264 SetErrorMode

• 0x47d268 SetEndOfFile

• 0x47d26c ResetEvent

• 0x47d270 ReadFile

• 0x47d274 MultiByteToWideChar

• 0x47d278 MulDiv

• 0x47d27c LockResource

• 0x47d280 LoadResource

• 0x47d284 LoadLibraryA

• 0x47d288 LeaveCriticalSection

• 0x47d28c InitializeCriticalSection

• 0x47d290 GlobalUnlock

• 0x47d294 GlobalReAlloc

• 0x47d298 GlobalHandle

• 0x47d29c GlobalLock

• 0x47d2a0 GlobalFree

• 0x47d2a4 GlobalFindAtomA

• 0x47d2a8 GlobalDeleteAtom

• 0x47d2ac GlobalAlloc

• 0x47d2b0 GlobalAddAtomA

• 0x47d2b4 GetVersionExA

• 0x47d2b8 GetVersion

• 0x47d2bc GetTickCount

• 0x47d2c0 GetThreadLocale

• 0x47d2c4 GetSystemInfo

• 0x47d2c8 GetStringTypeExA

• 0x47d2cc GetStdHandle

• 0x47d2d0 GetProcAddress

• 0x47d2d4 GetModuleHandleA

• 0x47d2d8 GetModuleFileNameA

• 0x47d2dc GetLocaleInfoA

• 0x47d2e0 GetLocalTime

• 0x47d2e4 GetLastError

• 0x47d2e8 GetFullPathNameA

• 0x47d2ec GetFileAttributesA

• 0x47d2f0 GetDiskFreeSpaceA

• 0x47d2f4 GetDateFormatA

• 0x47d2f8 GetCurrentThreadId

• 0x47d2fc GetCurrentProcessId

• 0x47d300 GetCPInfo

• 0x47d304 GetACP

• 0x47d308 FreeResource

• 0x47d30c InterlockedIncrement

• 0x47d310 InterlockedExchange

• 0x47d314 InterlockedDecrement

• 0x47d318 FreeLibrary

• 0x47d31c FormatMessageA

• 0x47d320 FindResourceA

• 0x47d324 FindFirstFileA

• 0x47d328 FindClose

• 0x47d32c FileTimeToLocalFileTime

• 0x47d330 FileTimeToDosDateTime

• 0x47d334 EnumCalendarInfoA

• 0x47d338 EnterCriticalSection

• 0x47d33c DeleteCriticalSection

• 0x47d340 CreateThread

• 0x47d344 CreateFileA

• 0x47d348 CreateEventA

• 0x47d34c CompareStringA

• 0x47d350 CloseHandle

Library version.dll:

• 0x47d358 VerQueryValueA

• 0x47d35c GetFileVersionInfoSizeA

• 0x47d360 GetFileVersionInfoA

Library gdi32.dll:

• 0x47d368 UnrealizeObject

• 0x47d36c StretchBlt

• 0x47d370 SetWindowOrgEx

• 0x47d374 SetWinMetaFileBits

• 0x47d378 SetViewportOrgEx

• 0x47d37c SetTextColor

• 0x47d380 SetStretchBltMode

• 0x47d384 SetROP2

• 0x47d388 SetPixel

• 0x47d38c SetEnhMetaFileBits

• 0x47d390 SetDIBColorTable

• 0x47d394 SetBrushOrgEx

• 0x47d398 SetBkMode

• 0x47d39c SetBkColor

• 0x47d3a0 SelectPalette

• 0x47d3a4 SelectObject

• 0x47d3a8 SaveDC

• 0x47d3ac RestoreDC

• 0x47d3b0 Rectangle

• 0x47d3b4 RectVisible

• 0x47d3b8 RealizePalette

• 0x47d3bc Polyline

• 0x47d3c0 PlayEnhMetaFile

• 0x47d3c4 PatBlt

• 0x47d3c8 MoveToEx

• 0x47d3cc MaskBlt

• 0x47d3d0 LineTo

• 0x47d3d4 IntersectClipRect

• 0x47d3d8 GetWindowOrgEx

• 0x47d3dc GetWinMetaFileBits

• 0x47d3e0 GetTextMetricsA

• 0x47d3e4 GetTextExtentPoint32A

• 0x47d3e8 GetSystemPaletteEntries

• 0x47d3ec GetStockObject

• 0x47d3f0 GetPixel

• 0x47d3f4 GetPaletteEntries

• 0x47d3f8 GetObjectA

• 0x47d3fc GetEnhMetaFilePaletteEntries

• 0x47d400 GetEnhMetaFileHeader

• 0x47d404 GetEnhMetaFileBits

• 0x47d408 GetDeviceCaps

• 0x47d40c GetDIBits

• 0x47d410 GetDIBColorTable

• 0x47d414 GetDCOrgEx

• 0x47d418 GetCurrentPositionEx

• 0x47d41c GetClipBox

• 0x47d420 GetBrushOrgEx

• 0x47d424 GetBitmapBits

• 0x47d428 ExcludeClipRect

• 0x47d42c DeleteObject

• 0x47d430 DeleteEnhMetaFile

• 0x47d434 DeleteDC

• 0x47d438 CreateSolidBrush

• 0x47d43c CreatePenIndirect

• 0x47d440 CreatePalette

• 0x47d444 CreateHalftonePalette

• 0x47d448 CreateFontIndirectA

• 0x47d44c CreateDIBitmap

• 0x47d450 CreateDIBSection

• 0x47d454 CreateCompatibleDC

• 0x47d458 CreateCompatibleBitmap

• 0x47d45c CreateBrushIndirect

• 0x47d460 CreateBitmap

• 0x47d464 CopyEnhMetaFileA

• 0x47d468 BitBlt

Library user32.dll:

• 0x47d470 CreateWindowExA

• 0x47d474 WindowFromPoint

• 0x47d478 WinHelpA

• 0x47d47c WaitMessage

• 0x47d480 UpdateWindow

• 0x47d484 UnregisterClassA

• 0x47d488 UnhookWindowsHookEx

• 0x47d48c TranslateMessage

• 0x47d490 TranslateMDISysAccel

• 0x47d494 TrackPopupMenu

• 0x47d498 SystemParametersInfoA

• 0x47d49c ShowWindow

• 0x47d4a0 ShowScrollBar

• 0x47d4a4 ShowOwnedPopups

• 0x47d4a8 ShowCursor

• 0x47d4ac SetWindowsHookExA

• 0x47d4b0 SetWindowPos

• 0x47d4b4 SetWindowPlacement

• 0x47d4b8 SetWindowLongA

• 0x47d4bc SetTimer

• 0x47d4c0 SetScrollRange

• 0x47d4c4 SetScrollPos

• 0x47d4c8 SetScrollInfo

• 0x47d4cc SetRect

• 0x47d4d0 SetPropA

• 0x47d4d4 SetParent

• 0x47d4d8 SetMenuItemInfoA

• 0x47d4dc SetMenu

• 0x47d4e0 SetForegroundWindow

• 0x47d4e4 SetFocus

• 0x47d4e8 SetCursor

• 0x47d4ec SetClassLongA

• 0x47d4f0 SetCapture

• 0x47d4f4 SetActiveWindow

• 0x47d4f8 SendMessageA

• 0x47d4fc ScrollWindow

• 0x47d500 ScreenToClient

• 0x47d504 RemovePropA

• 0x47d508 RemoveMenu

• 0x47d50c ReleaseDC

• 0x47d510 ReleaseCapture

• 0x47d514 RegisterWindowMessageA

• 0x47d518 RegisterClipboardFormatA

• 0x47d51c RegisterClassA

• 0x47d520 RedrawWindow

• 0x47d524 PtInRect

• 0x47d528 PostQuitMessage

• 0x47d52c PostMessageA

• 0x47d530 PeekMessageA

• 0x47d534 OffsetRect

• 0x47d538 OemToCharA

• 0x47d53c MessageBoxA

• 0x47d540 MapWindowPoints

• 0x47d544 MapVirtualKeyA

• 0x47d548 LoadStringA

• 0x47d54c LoadKeyboardLayoutA

• 0x47d550 LoadIconA

• 0x47d554 LoadCursorA

• 0x47d558 LoadBitmapA

• 0x47d55c KillTimer

• 0x47d560 IsZoomed

• 0x47d564 IsWindowVisible

• 0x47d568 IsWindowEnabled

• 0x47d56c IsWindow

• 0x47d570 IsRectEmpty

• 0x47d574 IsIconic

• 0x47d578 IsDialogMessageA

• 0x47d57c IsChild

• 0x47d580 InvalidateRect

• 0x47d584 IntersectRect

• 0x47d588 InsertMenuItemA

• 0x47d58c InsertMenuA

• 0x47d590 InflateRect

• 0x47d594 GetWindowThreadProcessId

• 0x47d598 GetWindowTextA

• 0x47d59c GetWindowRect

• 0x47d5a0 GetWindowPlacement

• 0x47d5a4 GetWindowLongA

• 0x47d5a8 GetWindowDC

• 0x47d5ac GetTopWindow

• 0x47d5b0 GetSystemMetrics

• 0x47d5b4 GetSystemMenu

• 0x47d5b8 GetSysColorBrush

• 0x47d5bc GetSysColor

• 0x47d5c0 GetSubMenu

• 0x47d5c4 GetScrollRange

• 0x47d5c8 GetScrollPos

• 0x47d5cc GetScrollInfo

• 0x47d5d0 GetPropA

• 0x47d5d4 GetParent

• 0x47d5d8 GetWindow

• 0x47d5dc GetMenuStringA

• 0x47d5e0 GetMenuState

• 0x47d5e4 GetMenuItemInfoA

• 0x47d5e8 GetMenuItemID

• 0x47d5ec GetMenuItemCount

• 0x47d5f0 GetMenu

• 0x47d5f4 GetLastActivePopup

• 0x47d5f8 GetKeyboardState

• 0x47d5fc GetKeyboardLayoutList

• 0x47d600 GetKeyboardLayout

• 0x47d604 GetKeyState

• 0x47d608 GetKeyNameTextA

• 0x47d60c GetIconInfo

• 0x47d610 GetForegroundWindow

• 0x47d614 GetFocus

• 0x47d618 GetDlgItem

• 0x47d61c GetDesktopWindow

• 0x47d620 GetDCEx

• 0x47d624 GetDC

• 0x47d628 GetCursorPos

• 0x47d62c GetCursor

• 0x47d630 GetClipboardData

• 0x47d634 GetClientRect

• 0x47d638 GetClassNameA

• 0x47d63c GetClassInfoA

• 0x47d640 GetCapture

• 0x47d644 GetActiveWindow

• 0x47d648 FrameRect

• 0x47d64c FindWindowA

• 0x47d650 FillRect

• 0x47d654 EqualRect

• 0x47d658 EnumWindows

• 0x47d65c EnumThreadWindows

• 0x47d660 EndPaint

• 0x47d664 EnableWindow

• 0x47d668 EnableScrollBar

• 0x47d66c EnableMenuItem

• 0x47d670 DrawTextA

• 0x47d674 DrawMenuBar

• 0x47d678 DrawIconEx

• 0x47d67c DrawIcon

• 0x47d680 DrawFrameControl

• 0x47d684 DrawEdge

• 0x47d688 DispatchMessageA

• 0x47d68c DestroyWindow

• 0x47d690 DestroyMenu

• 0x47d694 DestroyIcon

• 0x47d698 DestroyCursor

• 0x47d69c DeleteMenu

• 0x47d6a0 DefWindowProcA

• 0x47d6a4 DefMDIChildProcA

• 0x47d6a8 DefFrameProcA

• 0x47d6ac CreatePopupMenu

• 0x47d6b0 CreateMenu

• 0x47d6b4 CreateIcon

• 0x47d6b8 ClientToScreen

• 0x47d6bc CheckMenuItem

• 0x47d6c0 CallWindowProcA

• 0x47d6c4 CallNextHookEx

• 0x47d6c8 BeginPaint

• 0x47d6cc CharNextA

• 0x47d6d0 CharLowerBuffA

• 0x47d6d4 CharLowerA

• 0x47d6d8 CharToOemA

• 0x47d6dc AdjustWindowRectEx

• 0x47d6e0 ActivateKeyboardLayout

Library kernel32.dll:

• 0x47d6e8 Sleep

Library oleaut32.dll:

• 0x47d6f0 SafeArrayPtrOfIndex

• 0x47d6f4 SafeArrayGetUBound

• 0x47d6f8 SafeArrayGetLBound

• 0x47d6fc SafeArrayCreate

• 0x47d700 VariantChangeType

• 0x47d704 VariantCopy

• 0x47d708 VariantClear

• 0x47d70c VariantInit

Library ole32.dll:

• 0x47d714 CoCreateInstance

• 0x47d718 CoUninitialize

• 0x47d71c CoInitialize

Library oleaut32.dll:

• 0x47d724 CreateErrorInfo

• 0x47d728 GetErrorInfo

• 0x47d72c SetErrorInfo

• 0x47d730 SysFreeString

Library comctl32.dll:

• 0x47d738 ImageList_SetIconSize

• 0x47d73c ImageList_GetIconSize

• 0x47d740 ImageList_Write

• 0x47d744 ImageList_Read

• 0x47d748 ImageList_GetDragImage

• 0x47d74c ImageList_DragShowNolock

• 0x47d750 ImageList_SetDragCursorImage

• 0x47d754 ImageList_DragMove

• 0x47d758 ImageList_DragLeave

• 0x47d75c ImageList_DragEnter

• 0x47d760 ImageList_EndDrag

• 0x47d764 ImageList_BeginDrag

• 0x47d768 ImageList_Remove

• 0x47d76c ImageList_DrawEx

• 0x47d770 ImageList_Replace

• 0x47d774 ImageList_Draw

• 0x47d778 ImageList_GetBkColor

• 0x47d77c ImageList_SetBkColor

• 0x47d780 ImageList_ReplaceIcon

• 0x47d784 ImageList_Add

• 0x47d788 ImageList_GetImageCount

• 0x47d78c ImageList_Destroy

• 0x47d790 ImageList_Create

Library comdlg32.dll:

• 0x47d798 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900
192.168.56.101	49240	239.255.255.250	3702
192.168.56.101	49242	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.