SmartHawk

12.0

0-day

58 个模型检测该样本为恶意！

重新分析

下载样本

4b914a1d29402382b5e2c4b978092c152679a20023e0ad67d9af6fafa075a862

2a4bd2f05ae0e9a5867cd1f3eb6ca847.exe

分析耗时

85s

最近分析

文件大小

641.5KB

静态报毒动态报毒 100% 1IQEFBZ AI SCORE=85 AIDETECTVM BUCQDA CLASSIC CONFIDENCE DELF DELPHILESS EMVR EMZL FAREIT GENERICKDZ HIGH CONFIDENCE HQFRFD IGENT ILPP KCLOUD KRYPTIK LOKIBOT MALREP MALWARE1 MALWARE@#327UBUBZSZM87 MJFQG OGW@AQ4H5ZFI PUTTY SCORE THIBABO TSCOPE UNSAFE X2094 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20201210	21.1.5827.0
Alibaba	Trojan:Win32/LokiBot.b7c502b5	20190527	0.3.0.5
Tencent		20201211	1.0.0.1
Kingsoft	Win32.Troj.Undef.(kcloud)	20201211	2017.9.26.565
McAfee	Fareit-FPQ!2A4BD2F05AE0	20201211	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619359366.257625 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619359409.882625 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619359360.866625 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619359359.352 NtAllocateVirtualMemory	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00350000	success
1619359359.446 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 73728 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00462000	success
1619359359.461 NtAllocateVirtualMemory	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x005f0000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.470949961887202

section

{'size_of_data': '0x00022c00', 'virtual_address': '0x00083000', 'entropy': 7.470949961887202, 'name': '.rsrc', 'virtual_size': '0x00022a68'}

description

A section with a high entropy has been found

entropy

0.21701795472287275

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619359409.679625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	195.69.140.147

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2316 called NtSetContextThread to modify thread in remote process 1752
1619359359.93 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1752	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2316 resumed a thread in remote process 1752
1619359360.289 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 1752	success	0	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619359359.571 CreateProcessInternalW	thread_identifier: 1108 thread_handle: 0x000000f8 process_identifier: 1752 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2a4bd2f05ae0e9a5867cd1f3eb6ca847.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000fc inherit_handles: 0	success	1
1619359359.571 NtUnmapViewOfSection	process_identifier: 1752 region_size: 4096 process_handle: 0x000000fc base_address: 0x00400000	success	0
1619359359.571 NtMapViewOfSection	section_handle: 0x00000104 process_identifier: 1752 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000fc allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619359359.93 NtGetContextThread	thread_handle: 0x000000f8	success	0
1619359359.93 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1752	success	0
1619359360.289 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 1752	success	0
1619359361.882625 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1752	success	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69199
FireEye	Generic.mg.2a4bd2f05ae0e9a5
ALYac	Trojan.GenericKDZ.69199
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056bd5d1 )
BitDefender	Trojan.GenericKDZ.69199
K7GW	Trojan ( 0056bd5d1 )
Cybereason	malicious.cd30a0
Cyren	W32/Trojan.ILPP-0994
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Generic-9203567-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
Alibaba	Trojan:Win32/LokiBot.b7c502b5
NANO-Antivirus	Trojan.Win32.Kryptik.hqfrfd
AegisLab	Trojan.Win32.Kryptik.4!c
Ad-Aware	Trojan.GenericKDZ.69199
Emsisoft	Trojan.GenericKDZ.69199 (B)
Comodo	Malware@#327ububzszm87
F-Secure	Trojan.TR/Kryptik.mjfqg
DrWeb	Trojan.PWS.Stealer.29000
TrendMicro	Trojan.Win32.MALREP.THIBABO
McAfee-GW-Edition	BehavesLike.Win32.Fareit.jh
Sophos	Mal/Generic-S
Ikarus	Trojan.Inject
Jiangmin	Trojan.Kryptik.bzr
Avira	TR/Kryptik.mjfqg
MAX	malware (ai score=85)
Antiy-AVL	Trojan/Win32.Kryptik
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/LokiBot.MB!MTB
Gridinsoft	Trojan.Win32.Kryptik.oa
Arcabit	Trojan.Generic.D10E4F
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Win32.Trojan.PSE.1IQEFBZ
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2094
McAfee	Fareit-FPQ!2A4BD2F05AE0
TACHYON	Trojan-PWS/W32.DP-LokiBot.656896.M
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/CI.A
Zoner	Trojan.Win32.94645
ESET-NOD32	a variant of Win32/Injector.EMVR
TrendMicro-HouseCall	Trojan.Win32.MALREP.THIBABO

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	216.58.200.238:443
dead_host	195.69.140.147:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x477140 DeleteCriticalSection

• 0x477144 LeaveCriticalSection

• 0x477148 EnterCriticalSection

• 0x47714c InitializeCriticalSection

• 0x477150 VirtualFree

• 0x477154 VirtualAlloc

• 0x477158 LocalFree

• 0x47715c LocalAlloc

• 0x477160 GetVersion

• 0x477164 GetCurrentThreadId

• 0x477168 InterlockedDecrement

• 0x47716c InterlockedIncrement

• 0x477170 VirtualQuery

• 0x477174 WideCharToMultiByte

• 0x477178 MultiByteToWideChar

• 0x47717c lstrlenA

• 0x477180 lstrcpynA

• 0x477184 LoadLibraryExA

• 0x477188 GetThreadLocale

• 0x47718c GetStartupInfoA

• 0x477190 GetProcAddress

• 0x477194 GetModuleHandleA

• 0x477198 GetModuleFileNameA

• 0x47719c GetLocaleInfoA

• 0x4771a0 GetCommandLineA

• 0x4771a4 FreeLibrary

• 0x4771a8 FindFirstFileA

• 0x4771ac FindClose

• 0x4771b0 ExitProcess

• 0x4771b4 WriteFile

• 0x4771b8 UnhandledExceptionFilter

• 0x4771bc RtlUnwind

• 0x4771c0 RaiseException

• 0x4771c4 GetStdHandle

Library user32.dll:

• 0x4771cc GetKeyboardType

• 0x4771d0 LoadStringA

• 0x4771d4 MessageBoxA

• 0x4771d8 CharNextA

Library advapi32.dll:

• 0x4771e0 RegQueryValueExA

• 0x4771e4 RegOpenKeyExA

• 0x4771e8 RegCloseKey

Library oleaut32.dll:

• 0x4771f0 SysFreeString

• 0x4771f4 SysReAllocStringLen

• 0x4771f8 SysAllocStringLen

Library kernel32.dll:

• 0x477200 TlsSetValue

• 0x477204 TlsGetValue

• 0x477208 LocalAlloc

• 0x47720c GetModuleHandleA

Library advapi32.dll:

• 0x477214 RegQueryValueExA

• 0x477218 RegOpenKeyExA

• 0x47721c RegCloseKey

Library kernel32.dll:

• 0x477224 lstrcpyA

• 0x477228 WriteFile

• 0x47722c WinExec

• 0x477230 WaitForSingleObject

• 0x477234 VirtualQuery

• 0x477238 VirtualProtect

• 0x47723c VirtualAlloc

• 0x477240 Sleep

• 0x477244 SizeofResource

• 0x477248 SetThreadLocale

• 0x47724c SetFilePointer

• 0x477250 SetEvent

• 0x477254 SetErrorMode

• 0x477258 SetEndOfFile

• 0x47725c ResetEvent

• 0x477260 ReadFile

• 0x477264 MulDiv

• 0x477268 LockResource

• 0x47726c LoadResource

• 0x477270 LoadLibraryA

• 0x477274 LeaveCriticalSection

• 0x477278 InitializeCriticalSection

• 0x47727c GlobalUnlock

• 0x477280 GlobalReAlloc

• 0x477284 GlobalHandle

• 0x477288 GlobalLock

• 0x47728c GlobalFree

• 0x477290 GlobalFindAtomA

• 0x477294 GlobalDeleteAtom

• 0x477298 GlobalAlloc

• 0x47729c GlobalAddAtomA

• 0x4772a0 GetVersionExA

• 0x4772a4 GetVersion

• 0x4772a8 GetTickCount

• 0x4772ac GetThreadLocale

• 0x4772b0 GetSystemTimeAsFileTime

• 0x4772b4 GetSystemInfo

• 0x4772b8 GetStringTypeExA

• 0x4772bc GetStdHandle

• 0x4772c0 GetProcAddress

• 0x4772c4 GetModuleHandleA

• 0x4772c8 GetModuleFileNameA

• 0x4772cc GetLocaleInfoA

• 0x4772d0 GetLocalTime

• 0x4772d4 GetLastError

• 0x4772d8 GetFullPathNameA

• 0x4772dc GetDiskFreeSpaceA

• 0x4772e0 GetDateFormatA

• 0x4772e4 GetCurrentThreadId

• 0x4772e8 GetCurrentProcessId

• 0x4772ec GetCPInfo

• 0x4772f0 GetACP

• 0x4772f4 FreeResource

• 0x4772f8 InterlockedExchange

• 0x4772fc FreeLibrary

• 0x477300 FormatMessageA

• 0x477304 FindResourceA

• 0x477308 FileTimeToSystemTime

• 0x47730c EnumCalendarInfoA

• 0x477310 EnterCriticalSection

• 0x477314 DeleteCriticalSection

• 0x477318 CreateThread

• 0x47731c CreateFileA

• 0x477320 CreateEventA

• 0x477324 CompareStringA

• 0x477328 CloseHandle

Library version.dll:

• 0x477330 VerQueryValueA

• 0x477334 GetFileVersionInfoSizeA

• 0x477338 GetFileVersionInfoA

Library gdi32.dll:

• 0x477340 UnrealizeObject

• 0x477344 StretchBlt

• 0x477348 SetWindowOrgEx

• 0x47734c SetWinMetaFileBits

• 0x477350 SetViewportOrgEx

• 0x477354 SetTextColor

• 0x477358 SetStretchBltMode

• 0x47735c SetROP2

• 0x477360 SetPixel

• 0x477364 SetEnhMetaFileBits

• 0x477368 SetDIBColorTable

• 0x47736c SetBrushOrgEx

• 0x477370 SetBkMode

• 0x477374 SetBkColor

• 0x477378 SelectPalette

• 0x47737c SelectObject

• 0x477380 SelectClipRgn

• 0x477384 SaveDC

• 0x477388 RestoreDC

• 0x47738c Rectangle

• 0x477390 RectVisible

• 0x477394 RealizePalette

• 0x477398 PlayEnhMetaFile

• 0x47739c PatBlt

• 0x4773a0 MoveToEx

• 0x4773a4 MaskBlt

• 0x4773a8 LineTo

• 0x4773ac IntersectClipRect

• 0x4773b0 GetWindowOrgEx

• 0x4773b4 GetWinMetaFileBits

• 0x4773b8 GetTextMetricsA

• 0x4773bc GetTextExtentPoint32A

• 0x4773c0 GetSystemPaletteEntries

• 0x4773c4 GetStockObject

• 0x4773c8 GetPixel

• 0x4773cc GetPaletteEntries

• 0x4773d0 GetObjectA

• 0x4773d4 GetEnhMetaFilePaletteEntries

• 0x4773d8 GetEnhMetaFileHeader

• 0x4773dc GetEnhMetaFileBits

• 0x4773e0 GetDeviceCaps

• 0x4773e4 GetDIBits

• 0x4773e8 GetDIBColorTable

• 0x4773ec GetDCOrgEx

• 0x4773f0 GetCurrentPositionEx

• 0x4773f4 GetClipRgn

• 0x4773f8 GetClipBox

• 0x4773fc GetBrushOrgEx

• 0x477400 GetBitmapBits

• 0x477404 ExcludeClipRect

• 0x477408 DeleteObject

• 0x47740c DeleteEnhMetaFile

• 0x477410 DeleteDC

• 0x477414 CreateSolidBrush

• 0x477418 CreateRectRgn

• 0x47741c CreatePenIndirect

• 0x477420 CreatePalette

• 0x477424 CreateHalftonePalette

• 0x477428 CreateFontIndirectA

• 0x47742c CreateDIBitmap

• 0x477430 CreateDIBSection

• 0x477434 CreateCompatibleDC

• 0x477438 CreateCompatibleBitmap

• 0x47743c CreateBrushIndirect

• 0x477440 CreateBitmap

• 0x477444 CopyEnhMetaFileA

• 0x477448 BitBlt

Library user32.dll:

• 0x477450 CreateWindowExA

• 0x477454 WindowFromPoint

• 0x477458 WinHelpA

• 0x47745c WaitMessage

• 0x477460 UpdateWindow

• 0x477464 UnregisterClassA

• 0x477468 UnhookWindowsHookEx

• 0x47746c TranslateMessage

• 0x477470 TranslateMDISysAccel

• 0x477474 TrackPopupMenu

• 0x477478 SystemParametersInfoA

• 0x47747c ShowWindow

• 0x477480 ShowScrollBar

• 0x477484 ShowOwnedPopups

• 0x477488 ShowCursor

• 0x47748c SetWindowsHookExA

• 0x477490 SetWindowTextA

• 0x477494 SetWindowPos

• 0x477498 SetWindowPlacement

• 0x47749c SetWindowLongA

• 0x4774a0 SetTimer

• 0x4774a4 SetScrollRange

• 0x4774a8 SetScrollPos

• 0x4774ac SetScrollInfo

• 0x4774b0 SetRect

• 0x4774b4 SetPropA

• 0x4774b8 SetParent

• 0x4774bc SetMenuItemInfoA

• 0x4774c0 SetMenu

• 0x4774c4 SetKeyboardState

• 0x4774c8 SetForegroundWindow

• 0x4774cc SetFocus

• 0x4774d0 SetCursor

• 0x4774d4 SetClipboardData

• 0x4774d8 SetClassLongA

• 0x4774dc SetCapture

• 0x4774e0 SetActiveWindow

• 0x4774e4 SendMessageA

• 0x4774e8 ScrollWindow

• 0x4774ec ScreenToClient

• 0x4774f0 RemovePropA

• 0x4774f4 RemoveMenu

• 0x4774f8 ReleaseDC

• 0x4774fc ReleaseCapture

• 0x477500 RegisterWindowMessageA

• 0x477504 RegisterClipboardFormatA

• 0x477508 RegisterClassA

• 0x47750c RedrawWindow

• 0x477510 PtInRect

• 0x477514 PostQuitMessage

• 0x477518 PostMessageA

• 0x47751c PeekMessageA

• 0x477520 OpenClipboard

• 0x477524 OffsetRect

• 0x477528 OemToCharA

• 0x47752c MessageBoxA

• 0x477530 MessageBeep

• 0x477534 MapWindowPoints

• 0x477538 MapVirtualKeyA

• 0x47753c LoadStringA

• 0x477540 LoadKeyboardLayoutA

• 0x477544 LoadIconA

• 0x477548 LoadCursorA

• 0x47754c LoadBitmapA

• 0x477550 KillTimer

• 0x477554 IsZoomed

• 0x477558 IsWindowVisible

• 0x47755c IsWindowEnabled

• 0x477560 IsWindow

• 0x477564 IsRectEmpty

• 0x477568 IsIconic

• 0x47756c IsDialogMessageA

• 0x477570 IsChild

• 0x477574 IsCharAlphaNumericA

• 0x477578 IsCharAlphaA

• 0x47757c InvalidateRect

• 0x477580 IntersectRect

• 0x477584 InsertMenuItemA

• 0x477588 InsertMenuA

• 0x47758c InflateRect

• 0x477590 GetWindowThreadProcessId

• 0x477594 GetWindowTextA

• 0x477598 GetWindowRect

• 0x47759c GetWindowPlacement

• 0x4775a0 GetWindowLongA

• 0x4775a4 GetWindowDC

• 0x4775a8 GetTopWindow

• 0x4775ac GetSystemMetrics

• 0x4775b0 GetSystemMenu

• 0x4775b4 GetSysColorBrush

• 0x4775b8 GetSysColor

• 0x4775bc GetSubMenu

• 0x4775c0 GetScrollRange

• 0x4775c4 GetScrollPos

• 0x4775c8 GetScrollInfo

• 0x4775cc GetPropA

• 0x4775d0 GetParent

• 0x4775d4 GetWindow

• 0x4775d8 GetMenuStringA

• 0x4775dc GetMenuState

• 0x4775e0 GetMenuItemInfoA

• 0x4775e4 GetMenuItemID

• 0x4775e8 GetMenuItemCount

• 0x4775ec GetMenu

• 0x4775f0 GetLastActivePopup

• 0x4775f4 GetKeyboardState

• 0x4775f8 GetKeyboardLayoutList

• 0x4775fc GetKeyboardLayout

• 0x477600 GetKeyState

• 0x477604 GetKeyNameTextA

• 0x477608 GetIconInfo

• 0x47760c GetForegroundWindow

• 0x477610 GetFocus

• 0x477614 GetDlgItem

• 0x477618 GetDesktopWindow

• 0x47761c GetDCEx

• 0x477620 GetDC

• 0x477624 GetCursorPos

• 0x477628 GetCursor

• 0x47762c GetClipboardData

• 0x477630 GetClientRect

• 0x477634 GetClassNameA

• 0x477638 GetClassInfoA

• 0x47763c GetCapture

• 0x477640 GetActiveWindow

• 0x477644 FrameRect

• 0x477648 FindWindowA

• 0x47764c FillRect

• 0x477650 EqualRect

• 0x477654 EnumWindows

• 0x477658 EnumThreadWindows

• 0x47765c EnumClipboardFormats

• 0x477660 EndPaint

• 0x477664 EnableWindow

• 0x477668 EnableScrollBar

• 0x47766c EnableMenuItem

• 0x477670 EmptyClipboard

• 0x477674 DrawTextA

• 0x477678 DrawMenuBar

• 0x47767c DrawIconEx

• 0x477680 DrawIcon

• 0x477684 DrawFrameControl

• 0x477688 DrawFocusRect

• 0x47768c DrawEdge

• 0x477690 DispatchMessageA

• 0x477694 DestroyWindow

• 0x477698 DestroyMenu

• 0x47769c DestroyIcon

• 0x4776a0 DestroyCursor

• 0x4776a4 DeleteMenu

• 0x4776a8 DefWindowProcA

• 0x4776ac DefMDIChildProcA

• 0x4776b0 DefFrameProcA

• 0x4776b4 CreatePopupMenu

• 0x4776b8 CreateMenu

• 0x4776bc CreateIcon

• 0x4776c0 CloseClipboard

• 0x4776c4 ClientToScreen

• 0x4776c8 CheckMenuItem

• 0x4776cc CallWindowProcA

• 0x4776d0 CallNextHookEx

• 0x4776d4 BeginPaint

• 0x4776d8 CharNextA

• 0x4776dc CharLowerBuffA

• 0x4776e0 CharLowerA

• 0x4776e4 CharUpperBuffA

• 0x4776e8 CharToOemA

• 0x4776ec AdjustWindowRectEx

• 0x4776f0 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4776f8 Sleep

Library oleaut32.dll:

• 0x477700 SafeArrayPtrOfIndex

• 0x477704 SafeArrayGetUBound

• 0x477708 SafeArrayGetLBound

• 0x47770c SafeArrayCreate

• 0x477710 VariantChangeType

• 0x477714 VariantCopy

• 0x477718 VariantClear

• 0x47771c VariantInit

Library comctl32.dll:

• 0x477724 ImageList_SetIconSize

• 0x477728 ImageList_GetIconSize

• 0x47772c ImageList_Write

• 0x477730 ImageList_Read

• 0x477734 ImageList_GetDragImage

• 0x477738 ImageList_DragShowNolock

• 0x47773c ImageList_SetDragCursorImage

• 0x477740 ImageList_DragMove

• 0x477744 ImageList_DragLeave

• 0x477748 ImageList_DragEnter

• 0x47774c ImageList_EndDrag

• 0x477750 ImageList_BeginDrag

• 0x477754 ImageList_Remove

• 0x477758 ImageList_DrawEx

• 0x47775c ImageList_Replace

• 0x477760 ImageList_Draw

• 0x477764 ImageList_GetBkColor

• 0x477768 ImageList_SetBkColor

• 0x47776c ImageList_ReplaceIcon

• 0x477770 ImageList_Add

• 0x477774 ImageList_GetImageCount

• 0x477778 ImageList_Destroy

• 0x47777c ImageList_Create

• 0x477780 InitCommonControls

Library comdlg32.dll:

• 0x477788 GetOpenFileNameA

Library user32.dll:

• 0x477790 DdeCmpStringHandles

• 0x477794 DdeFreeStringHandle

• 0x477798 DdeQueryStringA

• 0x47779c DdeCreateStringHandleA

• 0x4777a0 DdeGetLastError

• 0x4777a4 DdeFreeDataHandle

• 0x4777a8 DdeUnaccessData

• 0x4777ac DdeAccessData

• 0x4777b0 DdeCreateDataHandle

• 0x4777b4 DdeClientTransaction

• 0x4777b8 DdeNameService

• 0x4777bc DdePostAdvise

• 0x4777c0 DdeSetUserHandle

• 0x4777c4 DdeQueryConvInfo

• 0x4777c8 DdeDisconnect

• 0x4777cc DdeConnect

• 0x4777d0 DdeUninitialize

• 0x4777d4 DdeInitializeA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.