SmartHawk

6.2

高危

43 个模型检测该样本为恶意！

重新分析

下载样本

c0729ae4d9809fe8cbabf58a8a8ef9d4678bed77c756604947ac5a19a0968cff

29980b1c36f1701499d9bfdbff3ecdbd.exe

分析耗时

94s

最近分析

文件大小

456.0KB

静态报毒动态报毒 AI SCORE=82 ATTRIBUTE BANKERX CLASSIC CQ0@AGKH ELDORADO EMOTET EMOTETPMF EPAZ FAMVT GENCIRC GENERICKD GENKRYPTIK HFGP HIGH CONFIDENCE HIGHCONFIDENCE HPMPIZ HTPOK KORBOLTN KRYPTIK MALWARE@#15KVM8OLIY968 R + TROJ R346459 S15290516 SUSGEN UNSAFE XPACK ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee		20201026	6.0.6.653
Baidu		20190318	1.0.0.2
Avast		20201026	18.4.3895.0
Alibaba	Trojan:Win32/Emotet.28167c52	20190527	0.3.0.5
Tencent	Malware.Win32.Gencirc.10cde542	20201025	1.0.0.1
Kingsoft		20201025	2013.8.14.323
CrowdStrike		20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619354149.478 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619354135.962 CryptGenKey	crypto_handle: 0x0067c7e0 algorithm_identifier: 0x0000660e () provider_handle: 0x005d3db0 flags: 1 key: fÖI4*.?_ 2h¹S\|lN	success	1
1619354149.509 CryptExportKey	crypto_handle: 0x0067c7e0 crypto_export_handle: 0x0067c760 buffer: f¤õª\|×ïzboX½05ñçÝÓÚÂiøÛ m ÛîCç}s%®&íÖÀºÁrá6¨íýÚ-]êÖ8L¬îYiR½-ÒV¶Þe$h§@X:mß{tH blob_type: 1 flags: 64	success	1
1619354177.118 CryptExportKey	crypto_handle: 0x0067c7e0 crypto_export_handle: 0x0067c760 buffer: f¤7Æ_íÙh:íî(TÄLOBïÐÒ¸Ä ®1¯´\6úû\«lõ=Ð°(wEËÝÞa$X5:ª#ß½0X©=§æòãÛEÞÝ!C¤i5b blob_type: 1 flags: 64	success	1

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619354135.306 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003d0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619354150.15 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

29980b1c36f1701499d9bfdbff3ecdbd.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619354149.837 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	185.94.252.13
host	24.249.135.121

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619354152.712 RegSetValueExA	key_handle: 0x000003b4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619354152.712 RegSetValueExA	key_handle: 0x000003b4 value: çÝ9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619354152.712 RegSetValueExA	key_handle: 0x000003b4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619354152.712 RegSetValueExW	key_handle: 0x000003b4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619354152.712 RegSetValueExA	key_handle: 0x000003cc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619354152.712 RegSetValueExA	key_handle: 0x000003cc value: çÝ9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619354152.712 RegSetValueExA	key_handle: 0x000003cc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619354152.728 RegSetValueExW	key_handle: 0x000003b0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 个事件)

Bkav	W32.FamVT.KorboLTN.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34266245
FireEye	Generic.mg.29980b1c36f17014
CAT-QuickHeal	Backdoor.EmotetPMF.S15290516
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0056ba551 )
BitDefender	Trojan.GenericKD.34266245
K7GW	Trojan ( 0056ba551 )
Cyren	W32/Emotet.AOL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.pef
Alibaba	Trojan:Win32/Emotet.28167c52
NANO-Antivirus	Trojan.Win32.Emotet.hpmpiz
Tencent	Malware.Win32.Gencirc.10cde542
Ad-Aware	Trojan.GenericKD.34266245
Comodo	Malware@#15kvm8oliy968
MaxSecure	Trojan.Malware.74690904.susgen
DrWeb	Trojan.Emotet.995
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-R + Troj/Emotet-CKL
McAfee-GW-Edition	BehavesLike.Win32.Emotet.gh
Sophos	Troj/Emotet-CKL
Ikarus	Trojan-Banker.Emotet
GData	Trojan.GenericKD.34266245
Jiangmin	Backdoor.Emotet.pe
Avira	TR/Crypt.XPACK.htpok
MAX	malware (ai score=82)
Arcabit	Trojan.Generic.D20ADC85
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.pef
AhnLab-V3	Trojan/Win32.Emotet.R346459
BitDefenderTheta	Gen:NN.ZexaF.34590.Cq0@aGkH!4mi
ALYac	Trojan.GenericKD.34266245
VBA32	Trojan.Emotet
Panda	Trj/Emotet.C
ESET-NOD32	a variant of Win32/Kryptik.HFGP
Rising	Trojan.Kryptik!1.C82B (CLASSIC)
Fortinet	W32/GenKryptik.EPAZ!tr
AVG	Win32:BankerX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	Trojan.Generic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 个事件)

dead_host	172.217.24.14:443
dead_host	216.58.200.238:443
dead_host	172.217.160.78:443
dead_host	185.94.252.13:443
dead_host	24.249.135.121:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-30 16:22:18

Imports

Library KERNEL32.dll:

• 0x44d1a0 HeapCreate

• 0x44d1a4 VirtualFree

• 0x44d1a8 IsBadWritePtr

• 0x44d1ac GetStdHandle

• 0x44d1b0 UnhandledExceptionFilter

• 0x44d1b4 FreeEnvironmentStringsA

• 0x44d1b8 GetEnvironmentStrings

• 0x44d1bc FreeEnvironmentStringsW

• 0x44d1c0 GetEnvironmentStringsW

• 0x44d1c4 SetHandleCount

• 0x44d1c8 GetFileType

• 0x44d1cc QueryPerformanceCounter

• 0x44d1d0 GetCurrentProcessId

• 0x44d1d4 GetSystemTimeAsFileTime

• 0x44d1d8 HeapDestroy

• 0x44d1dc LCMapStringW

• 0x44d1e0 GetTimeZoneInformation

• 0x44d1e4 IsBadReadPtr

• 0x44d1e8 IsBadCodePtr

• 0x44d1ec GetUserDefaultLCID

• 0x44d1f0 EnumSystemLocalesA

• 0x44d1f4 IsValidLocale

• 0x44d1f8 IsValidCodePage

• 0x44d1fc SetStdHandle

• 0x44d200 GetLocaleInfoW

• 0x44d204 SetEnvironmentVariableA

• 0x44d208 GetStringTypeW

• 0x44d20c GetStringTypeA

• 0x44d210 SetUnhandledExceptionFilter

• 0x44d214 HeapSize

• 0x44d218 TerminateProcess

• 0x44d21c HeapReAlloc

• 0x44d220 GetCommandLineA

• 0x44d224 GetStartupInfoA

• 0x44d228 VirtualQuery

• 0x44d22c GetSystemInfo

• 0x44d230 VirtualAlloc

• 0x44d234 VirtualProtect

• 0x44d238 HeapFree

• 0x44d23c HeapAlloc

• 0x44d240 RtlUnwind

• 0x44d244 GetTickCount

• 0x44d248 SetErrorMode

• 0x44d24c LocalFileTimeToFileTime

• 0x44d250 FileTimeToLocalFileTime

• 0x44d254 GetShortPathNameA

• 0x44d258 CreateFileA

• 0x44d25c GetVolumeInformationA

• 0x44d260 FindFirstFileA

• 0x44d264 FindClose

• 0x44d268 DuplicateHandle

• 0x44d26c GetFileSize

• 0x44d270 SetEndOfFile

• 0x44d274 UnlockFile

• 0x44d278 LockFile

• 0x44d27c FlushFileBuffers

• 0x44d280 SetFilePointer

• 0x44d284 WriteFile

• 0x44d288 ReadFile

• 0x44d28c DeleteFileA

• 0x44d290 MoveFileA

• 0x44d294 GetCurrentDirectoryA

• 0x44d298 RaiseException

• 0x44d29c GetOEMCP

• 0x44d2a0 GetCPInfo

• 0x44d2a4 InterlockedIncrement

• 0x44d2a8 GlobalFlags

• 0x44d2ac InterlockedDecrement

• 0x44d2b0 TlsFree

• 0x44d2b4 DeleteCriticalSection

• 0x44d2b8 LocalReAlloc

• 0x44d2bc TlsSetValue

• 0x44d2c0 TlsAlloc

• 0x44d2c4 InitializeCriticalSection

• 0x44d2c8 TlsGetValue

• 0x44d2cc EnterCriticalSection

• 0x44d2d0 GlobalHandle

• 0x44d2d4 GlobalReAlloc

• 0x44d2d8 LeaveCriticalSection

• 0x44d2dc LocalAlloc

• 0x44d2e0 SystemTimeToFileTime

• 0x44d2e4 FileTimeToSystemTime

• 0x44d2e8 GetDiskFreeSpaceA

• 0x44d2ec GetFullPathNameA

• 0x44d2f0 GetTempFileNameA

• 0x44d2f4 GetFileTime

• 0x44d2f8 SetFileTime

• 0x44d2fc GetFileAttributesA

• 0x44d300 GetPrivateProfileStringA

• 0x44d304 WritePrivateProfileStringA

• 0x44d308 GetPrivateProfileIntA

• 0x44d30c CloseHandle

• 0x44d310 GetCurrentThread

• 0x44d314 GetModuleFileNameA

• 0x44d318 ConvertDefaultLocale

• 0x44d31c EnumResourceLanguagesA

• 0x44d320 lstrcpyA

• 0x44d324 lstrcmpA

• 0x44d328 SetLastError

• 0x44d32c GlobalFree

• 0x44d330 MulDiv

• 0x44d334 GlobalAlloc

• 0x44d338 GlobalLock

• 0x44d33c GlobalUnlock

• 0x44d340 FormatMessageA

• 0x44d344 LocalFree

• 0x44d348 FreeResource

• 0x44d34c GetCurrentThreadId

• 0x44d350 GlobalGetAtomNameA

• 0x44d354 GlobalAddAtomA

• 0x44d358 GlobalFindAtomA

• 0x44d35c GlobalDeleteAtom

• 0x44d360 LoadLibraryA

• 0x44d364 FreeLibrary

• 0x44d368 lstrcatA

• 0x44d36c lstrcmpW

• 0x44d370 lstrcpynA

• 0x44d374 GetModuleHandleA

• 0x44d378 GetStringTypeExA

• 0x44d37c CompareStringW

• 0x44d380 CompareStringA

• 0x44d384 lstrlenA

• 0x44d388 GetVersion

• 0x44d38c GetLastError

• 0x44d390 MultiByteToWideChar

• 0x44d394 lstrcmpiA

• 0x44d398 LoadLibraryExW

• 0x44d39c ExitProcess

• 0x44d3a0 LoadLibraryExA

• 0x44d3a4 GetProcAddress

• 0x44d3a8 GetCurrentProcess

• 0x44d3ac WideCharToMultiByte

• 0x44d3b0 FindResourceA

• 0x44d3b4 LoadResource

• 0x44d3b8 LockResource

• 0x44d3bc SizeofResource

• 0x44d3c0 GetVersionExA

• 0x44d3c4 GetThreadLocale

• 0x44d3c8 GetLocaleInfoA

• 0x44d3cc GetACP

• 0x44d3d0 LCMapStringA

• 0x44d3d4 InterlockedExchange

Library USER32.dll:

• 0x44d438 IsZoomed

• 0x44d43c GetCursorPos

• 0x44d440 WindowFromPoint

• 0x44d444 KillTimer

• 0x44d448 SetTimer

• 0x44d44c ClientToScreen

• 0x44d450 SetRect

• 0x44d454 wsprintfA

• 0x44d458 LoadMenuA

• 0x44d45c DestroyMenu

• 0x44d460 GetActiveWindow

• 0x44d464 UnpackDDElParam

• 0x44d468 ReuseDDElParam

• 0x44d46c ReleaseCapture

• 0x44d470 LoadAcceleratorsA

• 0x44d474 InvalidateRect

• 0x44d478 InsertMenuItemA

• 0x44d47c CreatePopupMenu

• 0x44d480 SetRectEmpty

• 0x44d484 BringWindowToTop

• 0x44d488 SetMenu

• 0x44d48c GetDesktopWindow

• 0x44d490 TranslateAcceleratorA

• 0x44d494 GetMenuStringA

• 0x44d498 AppendMenuA

• 0x44d49c InsertMenuA

• 0x44d4a0 RemoveMenu

• 0x44d4a4 SetMenuItemBitmaps

• 0x44d4a8 ModifyMenuA

• 0x44d4ac GetMenuState

• 0x44d4b0 EnableMenuItem

• 0x44d4b4 CheckMenuItem

• 0x44d4b8 GetMenuCheckMarkDimensions

• 0x44d4bc LoadBitmapA

• 0x44d4c0 IsWindowEnabled

• 0x44d4c4 ShowWindow

• 0x44d4c8 MoveWindow

• 0x44d4cc SetWindowTextA

• 0x44d4d0 IsDialogMessageA

• 0x44d4d4 SetDlgItemTextA

• 0x44d4d8 RegisterWindowMessageA

• 0x44d4dc WinHelpA

• 0x44d4e0 GetCapture

• 0x44d4e4 CreateWindowExA

• 0x44d4e8 SetWindowsHookExA

• 0x44d4ec CallNextHookEx

• 0x44d4f0 GetClassLongA

• 0x44d4f4 GetClassInfoExA

• 0x44d4f8 GetClassNameA

• 0x44d4fc SetPropA

• 0x44d500 GetPropA

• 0x44d504 RemovePropA

• 0x44d508 SendDlgItemMessageA

• 0x44d50c GetFocus

• 0x44d510 SetFocus

• 0x44d514 IsChild

• 0x44d518 GetWindowTextLengthA

• 0x44d51c GetLastActivePopup

• 0x44d520 SetActiveWindow

• 0x44d524 DispatchMessageA

• 0x44d528 BeginDeferWindowPos

• 0x44d52c MessageBeep

• 0x44d530 GetDlgItem

• 0x44d534 GetTopWindow

• 0x44d538 DestroyWindow

• 0x44d53c UnhookWindowsHookEx

• 0x44d540 GetMessageTime

• 0x44d544 LoadIconA

• 0x44d548 PeekMessageA

• 0x44d54c MapWindowPoints

• 0x44d550 ScrollWindow

• 0x44d554 MessageBoxA

• 0x44d558 TrackPopupMenu

• 0x44d55c GetKeyState

• 0x44d560 SetScrollRange

• 0x44d564 GetScrollRange

• 0x44d568 SetScrollPos

• 0x44d56c GetScrollPos

• 0x44d570 SetForegroundWindow

• 0x44d574 ShowScrollBar

• 0x44d578 IsWindowVisible

• 0x44d57c GetClientRect

• 0x44d580 GetMenu

• 0x44d584 PostMessageA

• 0x44d588 GetSubMenu

• 0x44d58c GetMenuItemID

• 0x44d590 GetMenuItemCount

• 0x44d594 GetSysColor

• 0x44d598 AdjustWindowRectEx

• 0x44d59c ScreenToClient

• 0x44d5a0 EqualRect

• 0x44d5a4 DeferWindowPos

• 0x44d5a8 GetScrollInfo

• 0x44d5ac SetScrollInfo

• 0x44d5b0 GetClassInfoA

• 0x44d5b4 RegisterClassA

• 0x44d5b8 UnregisterClassA

• 0x44d5bc GetDlgCtrlID

• 0x44d5c0 DefWindowProcA

• 0x44d5c4 GetNextDlgGroupItem

• 0x44d5c8 InvalidateRgn

• 0x44d5cc CopyAcceleratorTableA

• 0x44d5d0 SetWindowContextHelpId

• 0x44d5d4 DestroyIcon

• 0x44d5d8 DeleteMenu

• 0x44d5dc LockWindowUpdate

• 0x44d5e0 GetDCEx

• 0x44d5e4 CharNextA

• 0x44d5e8 GetSysColorBrush

• 0x44d5ec EndPaint

• 0x44d5f0 CallWindowProcA

• 0x44d5f4 GetWindowLongA

• 0x44d5f8 SetWindowLongA

• 0x44d5fc SetWindowPos

• 0x44d600 OffsetRect

• 0x44d604 IntersectRect

• 0x44d608 SystemParametersInfoA

• 0x44d60c GetWindowPlacement

• 0x44d610 GetWindowRect

• 0x44d614 CopyRect

• 0x44d618 PtInRect

• 0x44d61c GetWindow

• 0x44d620 CharUpperA

• 0x44d624 RegisterClipboardFormatA

• 0x44d628 GetTabbedTextExtentA

• 0x44d62c LoadCursorA

• 0x44d630 SetCursor

• 0x44d634 GetSystemMetrics

• 0x44d638 GetForegroundWindow

• 0x44d63c GetWindowTextA

• 0x44d640 IsWindow

• 0x44d644 GetParent

• 0x44d648 IsIconic

• 0x44d64c SendMessageA

• 0x44d650 UpdateWindow

• 0x44d654 GetSystemMenu

• 0x44d658 EnableWindow

• 0x44d65c PostThreadMessageA

• 0x44d660 CreateMenu

• 0x44d664 SetParent

• 0x44d668 GetMessagePos

• 0x44d66c BeginPaint

• 0x44d670 GetWindowDC

• 0x44d674 GrayStringA

• 0x44d678 DrawTextExA

• 0x44d67c DrawTextA

• 0x44d680 TabbedTextOutA

• 0x44d684 GetMenuItemInfoA

• 0x44d688 InflateRect

• 0x44d68c SetCapture

• 0x44d690 SetWindowRgn

• 0x44d694 DrawIcon

• 0x44d698 FindWindowA

• 0x44d69c FillRect

• 0x44d6a0 DestroyCursor

• 0x44d6a4 ReleaseDC

• 0x44d6a8 MapDialogRect

• 0x44d6ac GetMessageA

• 0x44d6b0 TranslateMessage

• 0x44d6b4 ValidateRect

• 0x44d6b8 ShowOwnedPopups

• 0x44d6bc PostQuitMessage

• 0x44d6c0 CreateDialogIndirectParamA

• 0x44d6c4 GetNextDlgTabItem

• 0x44d6c8 EndDialog

• 0x44d6cc UnionRect

• 0x44d6d0 IsRectEmpty

• 0x44d6d4 EndDeferWindowPos

• 0x44d6d8 GetDC

Library GDI32.dll:

• 0x44d054 SetAbortProc

• 0x44d058 AbortDoc

• 0x44d05c EndDoc

• 0x44d060 CreateEllipticRgn

• 0x44d064 LPtoDP

• 0x44d068 Ellipse

• 0x44d06c CreateFontIndirectA

• 0x44d070 BitBlt

• 0x44d074 ExtTextOutA

• 0x44d078 SaveDC

• 0x44d07c RestoreDC

• 0x44d080 SetBkMode

• 0x44d084 SetPolyFillMode

• 0x44d088 SetROP2

• 0x44d08c SetStretchBltMode

• 0x44d090 SetMapMode

• 0x44d094 ExcludeClipRect

• 0x44d098 IntersectClipRect

• 0x44d09c LineTo

• 0x44d0a0 MoveToEx

• 0x44d0a4 SetTextAlign

• 0x44d0a8 SelectClipRgn

• 0x44d0ac CreateRectRgn

• 0x44d0b0 GetViewportExtEx

• 0x44d0b4 GetWindowExtEx

• 0x44d0b8 GetPixel

• 0x44d0bc PtVisible

• 0x44d0c0 RectVisible

• 0x44d0c4 TextOutA

• 0x44d0c8 Escape

• 0x44d0cc SetViewportOrgEx

• 0x44d0d0 EndPage

• 0x44d0d4 SetViewportExtEx

• 0x44d0d8 ScaleViewportExtEx

• 0x44d0dc SetWindowOrgEx

• 0x44d0e0 SetWindowExtEx

• 0x44d0e4 ScaleWindowExtEx

• 0x44d0e8 GetCurrentPositionEx

• 0x44d0ec ExtSelectClipRgn

• 0x44d0f0 CreatePatternBrush

• 0x44d0f4 CreateSolidBrush

• 0x44d0f8 GetTextColor

• 0x44d0fc CreateRectRgnIndirect

• 0x44d100 SetRectRgn

• 0x44d104 CombineRgn

• 0x44d108 GetMapMode

• 0x44d10c GetRgnBox

• 0x44d110 GetNearestColor

• 0x44d114 GetBkMode

• 0x44d118 GetPolyFillMode

• 0x44d11c GetROP2

• 0x44d120 GetStretchBltMode

• 0x44d124 GetTextAlign

• 0x44d128 GetTextFaceA

• 0x44d12c GetWindowOrgEx

• 0x44d130 StartPage

• 0x44d134 StartDocA

• 0x44d138 GetStockObject

• 0x44d13c PatBlt

• 0x44d140 Rectangle

• 0x44d144 DPtoLP

• 0x44d148 GetViewportOrgEx

• 0x44d14c CreatePen

• 0x44d150 CreateFontA

• 0x44d154 GetCharWidthA

• 0x44d158 DeleteObject

• 0x44d15c StretchDIBits

• 0x44d160 DeleteDC

• 0x44d164 GetTextExtentPoint32A

• 0x44d168 GetTextMetricsA

• 0x44d16c SelectObject

• 0x44d170 GetBkColor

• 0x44d174 CreateCompatibleDC

• 0x44d178 CreateCompatibleBitmap

• 0x44d17c CreateDCA

• 0x44d180 GetDeviceCaps

• 0x44d184 CreateBitmap

• 0x44d188 GetObjectA

• 0x44d18c SetBkColor

• 0x44d190 SetTextColor

• 0x44d194 OffsetViewportOrgEx

• 0x44d198 GetClipBox

Library comdlg32.dll:

• 0x44d6f4 GetFileTitleA

• 0x44d6f8 PrintDlgA

• 0x44d6fc GetSaveFileNameA

• 0x44d700 CommDlgExtendedError

• 0x44d704 GetOpenFileNameA

Library WINSPOOL.DRV:

• 0x44d6e0 OpenPrinterA

• 0x44d6e4 DocumentPropertiesA

• 0x44d6e8 ClosePrinter

• 0x44d6ec GetJobA

Library ADVAPI32.dll:

• 0x44d000 GetFileSecurityA

• 0x44d004 RegCloseKey

• 0x44d008 RegSetValueA

• 0x44d00c RegOpenKeyA

• 0x44d010 RegQueryValueExA

• 0x44d014 RegOpenKeyExA

• 0x44d018 RegDeleteKeyA

• 0x44d01c RegEnumKeyA

• 0x44d020 RegQueryValueA

• 0x44d024 RegCreateKeyExA

• 0x44d028 RegSetValueExA

• 0x44d02c RegCreateKeyA

• 0x44d030 CryptAcquireContextA

• 0x44d034 SetFileSecurityA

• 0x44d038 RegDeleteValueA

Library SHELL32.dll:

• 0x44d410 DragQueryFileA

• 0x44d414 ExtractIconA

• 0x44d418 SHGetFileInfoA

• 0x44d41c DragFinish

Library COMCTL32.dll:

• 0x44d040

• 0x44d044 ImageList_Draw

• 0x44d048 ImageList_GetImageInfo

• 0x44d04c ImageList_Destroy

Library SHLWAPI.dll:

• 0x44d424 PathFindFileNameA

• 0x44d428 PathStripToRootA

• 0x44d42c PathFindExtensionA

• 0x44d430 PathIsUNCA

Library oledlg.dll:

• 0x44d75c

Library ole32.dll:

• 0x44d70c CoRevokeClassObject

• 0x44d710 OleIsCurrentClipboard

• 0x44d714 OleFlushClipboard

• 0x44d718 CoRegisterMessageFilter

• 0x44d71c OleTranslateAccelerator

• 0x44d720 CreateILockBytesOnHGlobal

• 0x44d724 StgCreateDocfileOnILockBytes

• 0x44d728 StgOpenStorageOnILockBytes

• 0x44d72c CoGetClassObject

• 0x44d730 CoTaskMemAlloc

• 0x44d734 CoTaskMemFree

• 0x44d738 CLSIDFromString

• 0x44d73c CLSIDFromProgID

• 0x44d740 OleInitialize

• 0x44d744 CoFreeUnusedLibraries

• 0x44d748 OleUninitialize

• 0x44d74c OleDestroyMenuDescriptor

• 0x44d750 OleCreateMenuDescriptor

• 0x44d754 IsAccelerator

Library OLEAUT32.dll:

• 0x44d3dc VariantClear

• 0x44d3e0 VariantInit

• 0x44d3e4 SysAllocStringLen

• 0x44d3e8 SysFreeString

• 0x44d3ec SysAllocString

• 0x44d3f0 SysStringLen

• 0x44d3f4 SysAllocStringByteLen

• 0x44d3f8 VariantCopy

• 0x44d3fc SafeArrayDestroy

• 0x44d400 SystemTimeToVariantTime

• 0x44d404 OleCreateFontIndirect

• 0x44d408 VariantChangeType

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238 A 172.217.160.78	172.217.24.14
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.