SmartHawk

6.6

高危

57 个模型检测该样本为恶意！

重新分析

下载样本

1b0e17e568860f443d28cd430f26925fbb7bc31ee55e287dd16be90274ed33c9

2a3545f4dfeba61a015cca0f4598b010.exe

分析耗时

41s

最近分析

文件大小

1.1MB

静态报毒动态报毒 100% AGENTTESLA AI SCORE=88 ALI2000015 AUTOG AUTOIT BUBKLQ CLASSIC CONFIDENCE DATASTEALER DELF DELFINJECT DELPHI DELPHILESS DTDJ EMVB FAREIT GENERICKD GENERICRXLP GRANDSTEALNET HHW@AQ3OUSJI HIGH CONFIDENCE HPRNFS HQVL IGENT JRFYD MALWARE@#3DCMZSTV9G2VF S + TROJ SCORE STATIC AI SUSGEN SUSPICIOUS PE TSCOPE UNSAFE X2094 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXLP-FB!2A3545F4DFEB	20201211	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201210	21.1.5827.0
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Tencent	Win32.Trojan.Crypt.Hqvl	20201211	1.0.0.1
Kingsoft		20201211	2017.9.26.565

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619348554.911001 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a 2a3545f4dfeba61a015cca0f4598b010+0xcc3f8 @ 0x4cc3f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d 2a3545f4dfeba61a015cca0f4598b010+0x17005c @ 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfcbd14ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619348554.911001
__exception__

stacktrace:

RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
2a3545f4dfeba61a015cca0f4598b010+0xcc3f8 @ 0x4cc3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d
2a3545f4dfeba61a015cca0f4598b010+0x17005c @ 0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcbd14ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (28 个事件)

Time & API	Arguments	Status
1619348551.818124 NtAllocateVirtualMemory	process_identifier: 1128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619348551.911124 NtAllocateVirtualMemory	process_identifier: 1128 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00820000	success
1619348551.927124 NtAllocateVirtualMemory	process_identifier: 1128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00850000	success
1619348553.552001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619348553.599001 NtAllocateVirtualMemory	process_identifier: 2236 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02130000	success
1619348553.599001 NtAllocateVirtualMemory	process_identifier: 2236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02270000	success
1619348553.599001 NtAllocateVirtualMemory	process_identifier: 2236 region_size: 802816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02010000	success
1619348553.599001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 778240 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02012000	success
1619348554.833001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003b2000	success
1619348554.833001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619348554.833001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003b2000	success
1619348554.833001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619348554.833001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003b2000	success
1619348554.833001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619348554.833001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003b2000	success
1619348554.833001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003b2000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003b2000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003b2000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003b2000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003b2000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003b2000	success
1619348554.849001 NtProtectVirtualMemory	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (4 个事件)

Time & API	Arguments	Status	Return
1619348551.927124 Process32NextW	process_name: wsqmcons.exe snapshot_handle: 0x000000f4 process_identifier: 3044	success	1
1619348551.927124 Process32NextW	process_name: taskhost.exe snapshot_handle: 0x000000f4 process_identifier: 648	success	1
1619348551.927124 Process32NextW	process_name: 2a3545f4dfeba61a015cca0f4598b010.exe snapshot_handle: 0x000000f4 process_identifier: 1128	success	1
1619348551.927124 Process32NextW	process_name: conhost.exe snapshot_handle: 0x000000f4 process_identifier: 1108	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.649327050381617

section

{'size_of_data': '0x000a2000', 'virtual_address': '0x00082000', 'entropy': 7.649327050381617, 'name': '.rsrc', 'virtual_size': '0x000a1e6c'}

description

A section with a high entropy has been found

entropy

0.5676741130091985

description

Overall entropy of this PE file is high

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1128 called NtSetContextThread to modify thread in remote process 2236
1619348551.989124 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5877584 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2236	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1128 resumed a thread in remote process 2236
1619348553.255124 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 2236	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619348551.974124 CreateProcessInternalW	thread_identifier: 2120 thread_handle: 0x000000f8 process_identifier: 2236 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2a3545f4dfeba61a015cca0f4598b010.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000fc inherit_handles: 0	success	1
1619348551.974124 NtUnmapViewOfSection	process_identifier: 2236 region_size: 4096 process_handle: 0x000000fc base_address: 0x00400000	success	0
1619348551.974124 NtMapViewOfSection	section_handle: 0x00000104 process_identifier: 2236 commit_size: 1691648 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000fc allocation_type: 0 () section_offset: 0 view_size: 1691648 base_address: 0x00400000	success	0
1619348551.989124 NtGetContextThread	thread_handle: 0x000000f8	success	0
1619348551.989124 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5877584 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2236	success	0
1619348553.255124 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 2236	success	0

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43573204
FireEye	Generic.mg.2a3545f4dfeba61a
McAfee	GenericRXLP-FB!2A3545F4DFEB
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056baa21 )
BitDefender	Trojan.GenericKD.43573204
K7GW	Trojan ( 0056baa21 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZelphiF.34670.hHW@aq3oUsji
Cyren	W32/Trojan.DTDJ-8082
Symantec	Trojan Horse
ESET-NOD32	a variant of Win32/Injector.EMVB
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan.Win32.Crypt.gen
Alibaba	Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus	Trojan.Win32.Crypt.hprnfs
ViRobot	Trojan.Win32.S.Agent.1169920.N
AegisLab	Trojan.Win32.Malicious.4!c
Tencent	Win32.Trojan.Crypt.Hqvl
Ad-Aware	Trojan.GenericKD.43573204
Emsisoft	Trojan.GenericKD.43573204 (B)
Comodo	Malware@#3dcmzstv9g2vf
F-Secure	Dropper.DR/Delphi.jrfyd
DrWeb	Trojan.PWS.GrandStealNET.2
Zillya	Trojan.Crypt.Win32.64238
McAfee-GW-Edition	BehavesLike.Win32.Fareit.tc
Sophos	Mal/Generic-S + Troj/AutoG-IR
SentinelOne	Static AI - Suspicious PE
GData	Trojan.GenericKD.43573204
Jiangmin	Trojan.Crypt.dux
Avira	DR/Delphi.jrfyd
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Crypt
Gridinsoft	Trojan.Win32.Packed.oa
Arcabit	Trojan.Generic.D298DFD4
AhnLab-V3	Suspicious/Win.Delphiless.X2094
ZoneAlarm	HEUR:Trojan.Win32.Crypt.gen
Microsoft	Trojan:Win32/DataStealer.VD!MTB
Cynet	Malicious (score: 100)
Acronis	suspicious
ALYac	Spyware.AgentTesla
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/CI.A
Rising	Trojan.Injector!1.C99D (CLASSIC)
Yandex	Trojan.Igent.bUbKLQ.3

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47512c DeleteCriticalSection

• 0x475130 LeaveCriticalSection

• 0x475134 EnterCriticalSection

• 0x475138 InitializeCriticalSection

• 0x47513c VirtualFree

• 0x475140 VirtualAlloc

• 0x475144 LocalFree

• 0x475148 LocalAlloc

• 0x47514c GetVersion

• 0x475150 GetCurrentThreadId

• 0x475154 InterlockedDecrement

• 0x475158 InterlockedIncrement

• 0x47515c VirtualQuery

• 0x475160 WideCharToMultiByte

• 0x475164 MultiByteToWideChar

• 0x475168 lstrlenA

• 0x47516c lstrcpynA

• 0x475170 LoadLibraryExA

• 0x475174 GetThreadLocale

• 0x475178 GetStartupInfoA

• 0x47517c GetProcAddress

• 0x475180 GetModuleHandleA

• 0x475184 GetModuleFileNameA

• 0x475188 GetLocaleInfoA

• 0x47518c GetCommandLineA

• 0x475190 FreeLibrary

• 0x475194 FindFirstFileA

• 0x475198 FindClose

• 0x47519c ExitProcess

• 0x4751a0 WriteFile

• 0x4751a4 UnhandledExceptionFilter

• 0x4751a8 RtlUnwind

• 0x4751ac RaiseException

• 0x4751b0 GetStdHandle

Library user32.dll:

• 0x4751b8 GetKeyboardType

• 0x4751bc LoadStringA

• 0x4751c0 MessageBoxA

• 0x4751c4 CharNextA

Library advapi32.dll:

• 0x4751cc RegQueryValueExA

• 0x4751d0 RegOpenKeyExA

• 0x4751d4 RegCloseKey

Library oleaut32.dll:

• 0x4751dc SysFreeString

• 0x4751e0 SysReAllocStringLen

• 0x4751e4 SysAllocStringLen

Library kernel32.dll:

• 0x4751ec TlsSetValue

• 0x4751f0 TlsGetValue

• 0x4751f4 LocalAlloc

• 0x4751f8 GetModuleHandleA

Library advapi32.dll:

• 0x475200 RegQueryValueExA

• 0x475204 RegOpenKeyExA

• 0x475208 RegCloseKey

Library kernel32.dll:

• 0x475210 lstrcpyA

• 0x475214 WriteFile

• 0x475218 WaitForSingleObject

• 0x47521c VirtualQuery

• 0x475220 VirtualAlloc

• 0x475224 Sleep

• 0x475228 SizeofResource

• 0x47522c SetThreadLocale

• 0x475230 SetFilePointer

• 0x475234 SetEvent

• 0x475238 SetErrorMode

• 0x47523c SetEndOfFile

• 0x475240 ResetEvent

• 0x475244 ReadFile

• 0x475248 MulDiv

• 0x47524c LockResource

• 0x475250 LoadResource

• 0x475254 LoadLibraryA

• 0x475258 LeaveCriticalSection

• 0x47525c InitializeCriticalSection

• 0x475260 GlobalUnlock

• 0x475264 GlobalReAlloc

• 0x475268 GlobalHandle

• 0x47526c GlobalLock

• 0x475270 GlobalFree

• 0x475274 GlobalFindAtomA

• 0x475278 GlobalDeleteAtom

• 0x47527c GlobalAlloc

• 0x475280 GlobalAddAtomA

• 0x475284 GetVersionExA

• 0x475288 GetVersion

• 0x47528c GetTickCount

• 0x475290 GetThreadLocale

• 0x475294 GetSystemInfo

• 0x475298 GetStringTypeExA

• 0x47529c GetStdHandle

• 0x4752a0 GetProcAddress

• 0x4752a4 GetModuleHandleA

• 0x4752a8 GetModuleFileNameA

• 0x4752ac GetLocaleInfoA

• 0x4752b0 GetLocalTime

• 0x4752b4 GetLastError

• 0x4752b8 GetFullPathNameA

• 0x4752bc GetFileAttributesA

• 0x4752c0 GetDiskFreeSpaceA

• 0x4752c4 GetDateFormatA

• 0x4752c8 GetCurrentThreadId

• 0x4752cc GetCurrentProcessId

• 0x4752d0 GetCPInfo

• 0x4752d4 GetACP

• 0x4752d8 FreeResource

• 0x4752dc InterlockedExchange

• 0x4752e0 FreeLibrary

• 0x4752e4 FormatMessageA

• 0x4752e8 FindResourceA

• 0x4752ec FindFirstFileA

• 0x4752f0 FindClose

• 0x4752f4 FileTimeToLocalFileTime

• 0x4752f8 FileTimeToDosDateTime

• 0x4752fc EnumCalendarInfoA

• 0x475300 EnterCriticalSection

• 0x475304 DeleteCriticalSection

• 0x475308 CreateThread

• 0x47530c CreateFileA

• 0x475310 CreateEventA

• 0x475314 CompareStringA

• 0x475318 CloseHandle

Library version.dll:

• 0x475320 VerQueryValueA

• 0x475324 GetFileVersionInfoSizeA

• 0x475328 GetFileVersionInfoA

Library gdi32.dll:

• 0x475330 UnrealizeObject

• 0x475334 StretchBlt

• 0x475338 SetWindowOrgEx

• 0x47533c SetWinMetaFileBits

• 0x475340 SetViewportOrgEx

• 0x475344 SetTextColor

• 0x475348 SetStretchBltMode

• 0x47534c SetROP2

• 0x475350 SetPixel

• 0x475354 SetEnhMetaFileBits

• 0x475358 SetDIBColorTable

• 0x47535c SetColorSpace

• 0x475360 SetBrushOrgEx

• 0x475364 SetBkMode

• 0x475368 SetBkColor

• 0x47536c SelectPalette

• 0x475370 SelectObject

• 0x475374 SaveDC

• 0x475378 RestoreDC

• 0x47537c Rectangle

• 0x475380 RectVisible

• 0x475384 RealizePalette

• 0x475388 Polyline

• 0x47538c PlayEnhMetaFile

• 0x475390 PatBlt

• 0x475394 MoveToEx

• 0x475398 MaskBlt

• 0x47539c LineTo

• 0x4753a0 IntersectClipRect

• 0x4753a4 GetWindowOrgEx

• 0x4753a8 GetWinMetaFileBits

• 0x4753ac GetTextMetricsA

• 0x4753b0 GetTextExtentPoint32A

• 0x4753b4 GetSystemPaletteEntries

• 0x4753b8 GetStockObject

• 0x4753bc GetPixel

• 0x4753c0 GetPaletteEntries

• 0x4753c4 GetObjectA

• 0x4753c8 GetEnhMetaFilePaletteEntries

• 0x4753cc GetEnhMetaFileHeader

• 0x4753d0 GetEnhMetaFileBits

• 0x4753d4 GetDeviceCaps

• 0x4753d8 GetDIBits

• 0x4753dc GetDIBColorTable

• 0x4753e0 GetDCOrgEx

• 0x4753e4 GetCurrentPositionEx

• 0x4753e8 GetClipBox

• 0x4753ec GetBrushOrgEx

• 0x4753f0 GetBitmapBits

• 0x4753f4 ExcludeClipRect

• 0x4753f8 DeleteObject

• 0x4753fc DeleteEnhMetaFile

• 0x475400 DeleteDC

• 0x475404 CreateSolidBrush

• 0x475408 CreatePenIndirect

• 0x47540c CreatePalette

• 0x475410 CreateHalftonePalette

• 0x475414 CreateFontIndirectA

• 0x475418 CreateDIBitmap

• 0x47541c CreateDIBSection

• 0x475420 CreateCompatibleDC

• 0x475424 CreateCompatibleBitmap

• 0x475428 CreateBrushIndirect

• 0x47542c CreateBitmap

• 0x475430 CopyEnhMetaFileA

• 0x475434 BitBlt

Library user32.dll:

• 0x47543c CreateWindowExA

• 0x475440 WindowFromPoint

• 0x475444 WinHelpA

• 0x475448 WaitMessage

• 0x47544c UpdateWindow

• 0x475450 UnregisterClassA

• 0x475454 UnhookWindowsHookEx

• 0x475458 TranslateMessage

• 0x47545c TranslateMDISysAccel

• 0x475460 TrackPopupMenu

• 0x475464 SystemParametersInfoA

• 0x475468 ShowWindow

• 0x47546c ShowScrollBar

• 0x475470 ShowOwnedPopups

• 0x475474 ShowCursor

• 0x475478 SetWindowsHookExA

• 0x47547c SetWindowTextA

• 0x475480 SetWindowPos

• 0x475484 SetWindowPlacement

• 0x475488 SetWindowLongA

• 0x47548c SetTimer

• 0x475490 SetScrollRange

• 0x475494 SetScrollPos

• 0x475498 SetScrollInfo

• 0x47549c SetRect

• 0x4754a0 SetPropA

• 0x4754a4 SetParent

• 0x4754a8 SetMenuItemInfoA

• 0x4754ac SetMenu

• 0x4754b0 SetForegroundWindow

• 0x4754b4 SetFocus

• 0x4754b8 SetCursor

• 0x4754bc SetClassLongA

• 0x4754c0 SetCapture

• 0x4754c4 SetActiveWindow

• 0x4754c8 SendMessageA

• 0x4754cc ScrollWindow

• 0x4754d0 ScreenToClient

• 0x4754d4 RemovePropA

• 0x4754d8 RemoveMenu

• 0x4754dc ReleaseDC

• 0x4754e0 ReleaseCapture

• 0x4754e4 RegisterWindowMessageA

• 0x4754e8 RegisterClipboardFormatA

• 0x4754ec RegisterClassA

• 0x4754f0 RedrawWindow

• 0x4754f4 PtInRect

• 0x4754f8 PostQuitMessage

• 0x4754fc PostMessageA

• 0x475500 PeekMessageA

• 0x475504 OffsetRect

• 0x475508 OemToCharA

• 0x47550c MessageBoxA

• 0x475510 MessageBeep

• 0x475514 MapWindowPoints

• 0x475518 MapVirtualKeyA

• 0x47551c LoadStringA

• 0x475520 LoadKeyboardLayoutA

• 0x475524 LoadIconA

• 0x475528 LoadCursorA

• 0x47552c LoadBitmapA

• 0x475530 KillTimer

• 0x475534 IsZoomed

• 0x475538 IsWindowVisible

• 0x47553c IsWindowEnabled

• 0x475540 IsWindow

• 0x475544 IsRectEmpty

• 0x475548 IsIconic

• 0x47554c IsDialogMessageA

• 0x475550 IsChild

• 0x475554 InvalidateRect

• 0x475558 IntersectRect

• 0x47555c InsertMenuItemA

• 0x475560 InsertMenuA

• 0x475564 InflateRect

• 0x475568 GetWindowThreadProcessId

• 0x47556c GetWindowTextA

• 0x475570 GetWindowRect

• 0x475574 GetWindowPlacement

• 0x475578 GetWindowLongA

• 0x47557c GetWindowDC

• 0x475580 GetTopWindow

• 0x475584 GetSystemMetrics

• 0x475588 GetSystemMenu

• 0x47558c GetSysColorBrush

• 0x475590 GetSysColor

• 0x475594 GetSubMenu

• 0x475598 GetScrollRange

• 0x47559c GetScrollPos

• 0x4755a0 GetScrollInfo

• 0x4755a4 GetPropA

• 0x4755a8 GetParent

• 0x4755ac GetWindow

• 0x4755b0 GetMenuStringA

• 0x4755b4 GetMenuState

• 0x4755b8 GetMenuItemInfoA

• 0x4755bc GetMenuItemID

• 0x4755c0 GetMenuItemCount

• 0x4755c4 GetMenu

• 0x4755c8 GetLastActivePopup

• 0x4755cc GetKeyboardState

• 0x4755d0 GetKeyboardLayoutList

• 0x4755d4 GetKeyboardLayout

• 0x4755d8 GetKeyState

• 0x4755dc GetKeyNameTextA

• 0x4755e0 GetIconInfo

• 0x4755e4 GetForegroundWindow

• 0x4755e8 GetFocus

• 0x4755ec GetDlgItem

• 0x4755f0 GetDesktopWindow

• 0x4755f4 GetDCEx

• 0x4755f8 GetDC

• 0x4755fc GetCursorPos

• 0x475600 GetCursor

• 0x475604 GetClipboardData

• 0x475608 GetClientRect

• 0x47560c GetClassNameA

• 0x475610 GetClassInfoA

• 0x475614 GetCapture

• 0x475618 GetActiveWindow

• 0x47561c FrameRect

• 0x475620 FindWindowA

• 0x475624 FillRect

• 0x475628 EqualRect

• 0x47562c EnumWindows

• 0x475630 EnumThreadWindows

• 0x475634 EndPaint

• 0x475638 EnableWindow

• 0x47563c EnableScrollBar

• 0x475640 EnableMenuItem

• 0x475644 DrawTextA

• 0x475648 DrawMenuBar

• 0x47564c DrawIconEx

• 0x475650 DrawIcon

• 0x475654 DrawFrameControl

• 0x475658 DrawFocusRect

• 0x47565c DrawEdge

• 0x475660 DispatchMessageA

• 0x475664 DestroyWindow

• 0x475668 DestroyMenu

• 0x47566c DestroyIcon

• 0x475670 DestroyCursor

• 0x475674 DeleteMenu

• 0x475678 DefWindowProcA

• 0x47567c DefMDIChildProcA

• 0x475680 DefFrameProcA

• 0x475684 CreatePopupMenu

• 0x475688 CreateMenu

• 0x47568c CreateIcon

• 0x475690 ClientToScreen

• 0x475694 CheckMenuItem

• 0x475698 CallWindowProcA

• 0x47569c CallNextHookEx

• 0x4756a0 BeginPaint

• 0x4756a4 CharNextA

• 0x4756a8 CharLowerBuffA

• 0x4756ac CharLowerA

• 0x4756b0 CharToOemA

• 0x4756b4 AdjustWindowRectEx

• 0x4756b8 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4756c0 Sleep

Library oleaut32.dll:

• 0x4756c8 SafeArrayPtrOfIndex

• 0x4756cc SafeArrayGetUBound

• 0x4756d0 SafeArrayGetLBound

• 0x4756d4 SafeArrayCreate

• 0x4756d8 VariantChangeType

• 0x4756dc VariantCopy

• 0x4756e0 VariantClear

• 0x4756e4 VariantInit

Library comctl32.dll:

• 0x4756ec ImageList_SetIconSize

• 0x4756f0 ImageList_GetIconSize

• 0x4756f4 ImageList_Write

• 0x4756f8 ImageList_Read

• 0x4756fc ImageList_GetDragImage

• 0x475700 ImageList_DragShowNolock

• 0x475704 ImageList_SetDragCursorImage

• 0x475708 ImageList_DragMove

• 0x47570c ImageList_DragLeave

• 0x475710 ImageList_DragEnter

• 0x475714 ImageList_EndDrag

• 0x475718 ImageList_BeginDrag

• 0x47571c ImageList_Remove

• 0x475720 ImageList_DrawEx

• 0x475724 ImageList_Replace

• 0x475728 ImageList_Draw

• 0x47572c ImageList_GetBkColor

• 0x475730 ImageList_SetBkColor

• 0x475734 ImageList_ReplaceIcon

• 0x475738 ImageList_Add

• 0x47573c ImageList_GetImageCount

• 0x475740 ImageList_Destroy

• 0x475744 ImageList_Create

• 0x475748 InitCommonControls

Library comdlg32.dll:

• 0x475750 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com		127.0.0.1
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.160.78

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.