SmartHawk

10.6

0-day

55 个模型检测该样本为恶意！

重新分析

下载样本

97e6fd03f9586bc8efd90595bef86e593506eb78198cf709428bc7788765774a

36d9a32e28df6ec5f1c5869965072c4d.exe

分析耗时

73s

最近分析

文件大小

838.5KB

静态报毒动态报毒 0GW@AUOIO6OI 100% AI SCORE=88 AIDETECTVM ALI2000015 ANDROM AWYG BT6NDM CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMOY FAREIT GDSDA HIGH CONFIDENCE HNWJNU HWVWT IGENT KCLOUD KRYPT LOKI LOKIBOT MALWARE1 MALWARE@#19HCMUTVASKNX PUTTY PWSX SCORE SMAD1 STATIC AI SUSPICIOUS PE THAE TSCOPE X2094 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Avast		20201210	21.1.5827.0
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft	Win32.Hack.Undef.(kcloud)	20201211	2017.9.26.565
McAfee	Fareit-FTB!36D9A32E28DF	20201211	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619345463.202374 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619345468.233374 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619345472.858374 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345461.530374 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345029.817436 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48299844 registers.edi: 0 registers.eax: 0 registers.ebp: 48299912 registers.edx: 23 registers.ebx: 0 registers.esi: 0 registers.ecx: 756 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 36d9a32e28df6ec5f1c5869965072c4d+0x947fb exception.instruction: div eax exception.module: 36d9a32e28df6ec5f1c5869965072c4d.exe exception.exception_code: 0xc0000094 exception.offset: 608251 exception.address: 0x4947fb	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619345029.645436 NtAllocateVirtualMemory	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619345029.817436 NtProtectVirtualMemory	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00494000	success
1619345029.817436 NtAllocateVirtualMemory	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02e40000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 个事件)

Time & API	Arguments	Status	Return
1619345029.848436 Process32NextW	process_name: pythonw.exe snapshot_handle: 0x000000f8 process_identifier: 1316	success	1
1619345029.848436 Process32NextW	process_name: taskhost.exe snapshot_handle: 0x000000f8 process_identifier: 2476	success	1
1619345029.848436 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x000000f8 process_identifier: 2528	success	1
1619345029.848436 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x000000f8 process_identifier: 2104	success	1
1619345029.848436 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x000000f8 process_identifier: 2636	success	1
1619345029.848436 Process32NextW	process_name: 36d9a32e28df6ec5f1c5869965072c4d.exe snapshot_handle: 0x000000f8 process_identifier: 2296	success	1

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345472.827374 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\36d9a32e28df6ec5f1c5869965072c4d.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\36d9a32e28df6ec5f1c5869965072c4d.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

7.1065593153264475

section

{'size_of_data': '0x00026000', 'virtual_address': '0x000b1000', 'entropy': 7.1065593153264475, 'name': '.rsrc', 'virtual_size': '0x00025e8c'}

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345468.140374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2296 called NtSetContextThread to modify thread in remote process 472
1619345030.332436 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 472	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2296 resumed a thread in remote process 472
1619345030.973436 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 472	success	0	0

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619345030.067436 CreateProcessInternalW	thread_identifier: 368 thread_handle: 0x000000fc process_identifier: 472 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\36d9a32e28df6ec5f1c5869965072c4d.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619345030.067436 NtUnmapViewOfSection	process_identifier: 472 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619345030.129436 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 472 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619345030.332436 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619345030.332436 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 472	success	0
1619345030.973436 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 472	success	0
1619345462.046374 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 472	success	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.28815
MicroWorld-eScan	Trojan.Delf.FareIt.Gen.7
FireEye	Generic.mg.36d9a32e28df6ec5
Qihoo-360	Win32/Backdoor.650
ALYac	Trojan.Delf.FareIt.Gen.7
Malwarebytes	Spyware.LokiBot
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056a59a1 )
BitDefender	Trojan.Delf.FareIt.Gen.7
K7GW	Trojan ( 0056a59a1 )
Cybereason	malicious.e9d00e
BitDefenderTheta	Gen:NN.ZelphiF.34670.0GW@auoio6oi
Cyren	W32/Trojan.THAE-8097
Symantec	Infostealer.Lokibot
APEX	Malicious
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
Alibaba	Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus	Trojan.Win32.Androm.hnwjnu
AegisLab	Trojan.Win32.Androm.m!c
Ad-Aware	Trojan.Delf.FareIt.Gen.7
Emsisoft	Trojan.Delf.FareIt.Gen.7 (B)
Comodo	Malware@#19hcmutvasknx
Zillya	Trojan.Injector.Win32.750302
TrendMicro	TrojanSpy.Win32.LOKI.SMAD1.hp
McAfee-GW-Edition	BehavesLike.Win32.Fareit.ch
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Jiangmin	Backdoor.Androm.awyg
Webroot	W32.Loki.Smad1
Avira	TR/Injector.hwvwt
Antiy-AVL	Trojan[Backdoor]/Win32.Androm
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	PWS:Win32/Fareit.AQ!MTB
Arcabit	Trojan.Delf.FareIt.Gen.7
ZoneAlarm	HEUR:Backdoor.Win32.Androm.gen
GData	Trojan.Delf.FareIt.Gen.7
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2094
McAfee	Fareit-FTB!36D9A32E28DF
MAX	malware (ai score=88)
VBA32	TScope.Trojan.Delf
Panda	Trj/GdSda.A
Zoner	Trojan.Win32.91536
ESET-NOD32	a variant of Win32/Injector.EMOY
TrendMicro-HouseCall	TrojanSpy.Win32.LOKI.SMAD1.hp
Rising	Trojan.Injector!1.C99D (CLASSIC)
Yandex	Trojan.Igent.bT6ndM.67

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4a1154 DeleteCriticalSection

• 0x4a1158 LeaveCriticalSection

• 0x4a115c EnterCriticalSection

• 0x4a1160 InitializeCriticalSection

• 0x4a1164 VirtualFree

• 0x4a1168 VirtualAlloc

• 0x4a116c LocalFree

• 0x4a1170 LocalAlloc

• 0x4a1174 GetVersion

• 0x4a1178 GetCurrentThreadId

• 0x4a117c InterlockedDecrement

• 0x4a1180 InterlockedIncrement

• 0x4a1184 VirtualQuery

• 0x4a1188 WideCharToMultiByte

• 0x4a118c MultiByteToWideChar

• 0x4a1190 lstrlenA

• 0x4a1194 lstrcpynA

• 0x4a1198 LoadLibraryExA

• 0x4a119c GetThreadLocale

• 0x4a11a0 GetStartupInfoA

• 0x4a11a4 GetProcAddress

• 0x4a11a8 GetModuleHandleA

• 0x4a11ac GetModuleFileNameA

• 0x4a11b0 GetLocaleInfoA

• 0x4a11b4 GetCommandLineA

• 0x4a11b8 FreeLibrary

• 0x4a11bc FindFirstFileA

• 0x4a11c0 FindClose

• 0x4a11c4 ExitProcess

• 0x4a11c8 WriteFile

• 0x4a11cc UnhandledExceptionFilter

• 0x4a11d0 RtlUnwind

• 0x4a11d4 RaiseException

• 0x4a11d8 GetStdHandle

Library user32.dll:

• 0x4a11e0 GetKeyboardType

• 0x4a11e4 LoadStringA

• 0x4a11e8 MessageBoxA

• 0x4a11ec CharNextA

Library advapi32.dll:

• 0x4a11f4 RegQueryValueExA

• 0x4a11f8 RegOpenKeyExA

• 0x4a11fc RegCloseKey

Library oleaut32.dll:

• 0x4a1204 SysFreeString

• 0x4a1208 SysReAllocStringLen

• 0x4a120c SysAllocStringLen

Library kernel32.dll:

• 0x4a1214 TlsSetValue

• 0x4a1218 TlsGetValue

• 0x4a121c LocalAlloc

• 0x4a1220 GetModuleHandleA

Library advapi32.dll:

• 0x4a1228 RegQueryValueExA

• 0x4a122c RegOpenKeyExA

• 0x4a1230 RegCloseKey

Library kernel32.dll:

• 0x4a1238 lstrcpyA

• 0x4a123c WriteFile

• 0x4a1240 WideCharToMultiByte

• 0x4a1244 WaitForSingleObject

• 0x4a1248 VirtualQuery

• 0x4a124c VirtualProtectEx

• 0x4a1250 VirtualAlloc

• 0x4a1254 Sleep

• 0x4a1258 SizeofResource

• 0x4a125c SetThreadLocale

• 0x4a1260 SetFilePointer

• 0x4a1264 SetEvent

• 0x4a1268 SetErrorMode

• 0x4a126c SetEndOfFile

• 0x4a1270 ResetEvent

• 0x4a1274 ReadFile

• 0x4a1278 MultiByteToWideChar

• 0x4a127c MulDiv

• 0x4a1280 LockResource

• 0x4a1284 LoadResource

• 0x4a1288 LoadLibraryA

• 0x4a128c LeaveCriticalSection

• 0x4a1290 InitializeCriticalSection

• 0x4a1294 GlobalUnlock

• 0x4a1298 GlobalReAlloc

• 0x4a129c GlobalHandle

• 0x4a12a0 GlobalLock

• 0x4a12a4 GlobalFree

• 0x4a12a8 GlobalFindAtomA

• 0x4a12ac GlobalDeleteAtom

• 0x4a12b0 GlobalAlloc

• 0x4a12b4 GlobalAddAtomA

• 0x4a12b8 GetVersionExA

• 0x4a12bc GetVersion

• 0x4a12c0 GetTickCount

• 0x4a12c4 GetThreadLocale

• 0x4a12c8 GetSystemInfo

• 0x4a12cc GetStringTypeExA

• 0x4a12d0 GetStdHandle

• 0x4a12d4 GetProcAddress

• 0x4a12d8 GetModuleHandleA

• 0x4a12dc GetModuleFileNameA

• 0x4a12e0 GetLocaleInfoA

• 0x4a12e4 GetLocalTime

• 0x4a12e8 GetLastError

• 0x4a12ec GetFullPathNameA

• 0x4a12f0 GetFileAttributesA

• 0x4a12f4 GetDiskFreeSpaceA

• 0x4a12f8 GetDateFormatA

• 0x4a12fc GetCurrentThreadId

• 0x4a1300 GetCurrentProcessId

• 0x4a1304 GetCurrentProcess

• 0x4a1308 GetCPInfo

• 0x4a130c GetACP

• 0x4a1310 FreeResource

• 0x4a1314 InterlockedExchange

• 0x4a1318 FreeLibrary

• 0x4a131c FormatMessageA

• 0x4a1320 FindResourceA

• 0x4a1324 FindFirstFileA

• 0x4a1328 FindClose

• 0x4a132c FileTimeToLocalFileTime

• 0x4a1330 FileTimeToDosDateTime

• 0x4a1334 EnumCalendarInfoA

• 0x4a1338 EnterCriticalSection

• 0x4a133c DeleteCriticalSection

• 0x4a1340 CreateThread

• 0x4a1344 CreateFileA

• 0x4a1348 CreateEventA

• 0x4a134c CompareStringA

• 0x4a1350 CloseHandle

Library version.dll:

• 0x4a1358 VerQueryValueA

• 0x4a135c GetFileVersionInfoSizeA

• 0x4a1360 GetFileVersionInfoA

Library gdi32.dll:

• 0x4a1368 UnrealizeObject

• 0x4a136c StretchBlt

• 0x4a1370 SetWindowOrgEx

• 0x4a1374 SetWinMetaFileBits

• 0x4a1378 SetViewportOrgEx

• 0x4a137c SetTextColor

• 0x4a1380 SetStretchBltMode

• 0x4a1384 SetROP2

• 0x4a1388 SetPixel

• 0x4a138c SetEnhMetaFileBits

• 0x4a1390 SetDIBColorTable

• 0x4a1394 SetBrushOrgEx

• 0x4a1398 SetBkMode

• 0x4a139c SetBkColor

• 0x4a13a0 SelectPalette

• 0x4a13a4 SelectObject

• 0x4a13a8 SaveDC

• 0x4a13ac RestoreDC

• 0x4a13b0 Rectangle

• 0x4a13b4 RectVisible

• 0x4a13b8 RealizePalette

• 0x4a13bc Polyline

• 0x4a13c0 PlayEnhMetaFile

• 0x4a13c4 PatBlt

• 0x4a13c8 MoveToEx

• 0x4a13cc MaskBlt

• 0x4a13d0 LineTo

• 0x4a13d4 IntersectClipRect

• 0x4a13d8 GetWindowOrgEx

• 0x4a13dc GetWinMetaFileBits

• 0x4a13e0 GetTextMetricsA

• 0x4a13e4 GetTextExtentPoint32A

• 0x4a13e8 GetSystemPaletteEntries

• 0x4a13ec GetStockObject

• 0x4a13f0 GetPixel

• 0x4a13f4 GetPaletteEntries

• 0x4a13f8 GetObjectA

• 0x4a13fc GetEnhMetaFilePaletteEntries

• 0x4a1400 GetEnhMetaFileHeader

• 0x4a1404 GetEnhMetaFileBits

• 0x4a1408 GetDeviceCaps

• 0x4a140c GetDIBits

• 0x4a1410 GetDIBColorTable

• 0x4a1414 GetDCOrgEx

• 0x4a1418 GetCurrentPositionEx

• 0x4a141c GetClipBox

• 0x4a1420 GetBrushOrgEx

• 0x4a1424 GetBitmapBits

• 0x4a1428 ExtTextOutA

• 0x4a142c ExcludeClipRect

• 0x4a1430 DeleteObject

• 0x4a1434 DeleteEnhMetaFile

• 0x4a1438 DeleteDC

• 0x4a143c CreateSolidBrush

• 0x4a1440 CreatePenIndirect

• 0x4a1444 CreatePen

• 0x4a1448 CreatePalette

• 0x4a144c CreateHalftonePalette

• 0x4a1450 CreateFontIndirectA

• 0x4a1454 CreateDIBitmap

• 0x4a1458 CreateDIBSection

• 0x4a145c CreateCompatibleDC

• 0x4a1460 CreateCompatibleBitmap

• 0x4a1464 CreateBrushIndirect

• 0x4a1468 CreateBitmap

• 0x4a146c CopyEnhMetaFileA

• 0x4a1470 BitBlt

Library user32.dll:

• 0x4a1478 CreateWindowExA

• 0x4a147c WindowFromPoint

• 0x4a1480 WinHelpA

• 0x4a1484 WaitMessage

• 0x4a1488 ValidateRect

• 0x4a148c UpdateWindow

• 0x4a1490 UnregisterClassA

• 0x4a1494 UnhookWindowsHookEx

• 0x4a1498 TranslateMessage

• 0x4a149c TranslateMDISysAccel

• 0x4a14a0 TrackPopupMenu

• 0x4a14a4 SystemParametersInfoA

• 0x4a14a8 ShowWindow

• 0x4a14ac ShowScrollBar

• 0x4a14b0 ShowOwnedPopups

• 0x4a14b4 ShowCursor

• 0x4a14b8 SetWindowsHookExA

• 0x4a14bc SetWindowPos

• 0x4a14c0 SetWindowPlacement

• 0x4a14c4 SetWindowLongA

• 0x4a14c8 SetTimer

• 0x4a14cc SetScrollRange

• 0x4a14d0 SetScrollPos

• 0x4a14d4 SetScrollInfo

• 0x4a14d8 SetRect

• 0x4a14dc SetPropA

• 0x4a14e0 SetParent

• 0x4a14e4 SetMenuItemInfoA

• 0x4a14e8 SetMenu

• 0x4a14ec SetForegroundWindow

• 0x4a14f0 SetFocus

• 0x4a14f4 SetCursor

• 0x4a14f8 SetClassLongA

• 0x4a14fc SetCapture

• 0x4a1500 SetActiveWindow

• 0x4a1504 SendMessageA

• 0x4a1508 ScrollWindow

• 0x4a150c ScreenToClient

• 0x4a1510 RemovePropA

• 0x4a1514 RemoveMenu

• 0x4a1518 ReleaseDC

• 0x4a151c ReleaseCapture

• 0x4a1520 RegisterWindowMessageA

• 0x4a1524 RegisterClipboardFormatA

• 0x4a1528 RegisterClassA

• 0x4a152c RedrawWindow

• 0x4a1530 PtInRect

• 0x4a1534 PostQuitMessage

• 0x4a1538 PostMessageA

• 0x4a153c PeekMessageA

• 0x4a1540 OffsetRect

• 0x4a1544 OemToCharA

• 0x4a1548 MessageBoxA

• 0x4a154c MapWindowPoints

• 0x4a1550 MapVirtualKeyA

• 0x4a1554 LoadStringA

• 0x4a1558 LoadKeyboardLayoutA

• 0x4a155c LoadIconA

• 0x4a1560 LoadCursorA

• 0x4a1564 LoadBitmapA

• 0x4a1568 KillTimer

• 0x4a156c IsZoomed

• 0x4a1570 IsWindowVisible

• 0x4a1574 IsWindowEnabled

• 0x4a1578 IsWindow

• 0x4a157c IsRectEmpty

• 0x4a1580 IsIconic

• 0x4a1584 IsDialogMessageA

• 0x4a1588 IsChild

• 0x4a158c InvalidateRect

• 0x4a1590 IntersectRect

• 0x4a1594 InsertMenuItemA

• 0x4a1598 InsertMenuA

• 0x4a159c InflateRect

• 0x4a15a0 GetWindowThreadProcessId

• 0x4a15a4 GetWindowTextA

• 0x4a15a8 GetWindowRect

• 0x4a15ac GetWindowPlacement

• 0x4a15b0 GetWindowLongA

• 0x4a15b4 GetWindowDC

• 0x4a15b8 GetTopWindow

• 0x4a15bc GetSystemMetrics

• 0x4a15c0 GetSystemMenu

• 0x4a15c4 GetSysColorBrush

• 0x4a15c8 GetSysColor

• 0x4a15cc GetSubMenu

• 0x4a15d0 GetScrollRange

• 0x4a15d4 GetScrollPos

• 0x4a15d8 GetScrollInfo

• 0x4a15dc GetPropA

• 0x4a15e0 GetParent

• 0x4a15e4 GetWindow

• 0x4a15e8 GetMenuStringA

• 0x4a15ec GetMenuState

• 0x4a15f0 GetMenuItemInfoA

• 0x4a15f4 GetMenuItemID

• 0x4a15f8 GetMenuItemCount

• 0x4a15fc GetMenu

• 0x4a1600 GetLastActivePopup

• 0x4a1604 GetKeyboardState

• 0x4a1608 GetKeyboardLayoutList

• 0x4a160c GetKeyboardLayout

• 0x4a1610 GetKeyState

• 0x4a1614 GetKeyNameTextA

• 0x4a1618 GetInputState

• 0x4a161c GetIconInfo

• 0x4a1620 GetForegroundWindow

• 0x4a1624 GetFocus

• 0x4a1628 GetDlgItem

• 0x4a162c GetDesktopWindow

• 0x4a1630 GetDCEx

• 0x4a1634 GetDC

• 0x4a1638 GetCursorPos

• 0x4a163c GetCursor

• 0x4a1640 GetClipboardData

• 0x4a1644 GetClientRect

• 0x4a1648 GetClassNameA

• 0x4a164c GetClassInfoA

• 0x4a1650 GetCapture

• 0x4a1654 GetActiveWindow

• 0x4a1658 FrameRect

• 0x4a165c FindWindowA

• 0x4a1660 FillRect

• 0x4a1664 EqualRect

• 0x4a1668 EnumWindows

• 0x4a166c EnumThreadWindows

• 0x4a1670 EndPaint

• 0x4a1674 EnableWindow

• 0x4a1678 EnableScrollBar

• 0x4a167c EnableMenuItem

• 0x4a1680 DrawTextA

• 0x4a1684 DrawMenuBar

• 0x4a1688 DrawIconEx

• 0x4a168c DrawIcon

• 0x4a1690 DrawFrameControl

• 0x4a1694 DrawEdge

• 0x4a1698 DispatchMessageA

• 0x4a169c DestroyWindow

• 0x4a16a0 DestroyMenu

• 0x4a16a4 DestroyIcon

• 0x4a16a8 DestroyCursor

• 0x4a16ac DeleteMenu

• 0x4a16b0 DefWindowProcA

• 0x4a16b4 DefMDIChildProcA

• 0x4a16b8 DefFrameProcA

• 0x4a16bc CreatePopupMenu

• 0x4a16c0 CreateMenu

• 0x4a16c4 CreateIcon

• 0x4a16c8 ClientToScreen

• 0x4a16cc CheckMenuItem

• 0x4a16d0 CallWindowProcA

• 0x4a16d4 CallNextHookEx

• 0x4a16d8 BeginPaint

• 0x4a16dc CharNextA

• 0x4a16e0 CharLowerBuffA

• 0x4a16e4 CharLowerA

• 0x4a16e8 CharUpperBuffA

• 0x4a16ec CharToOemA

• 0x4a16f0 AdjustWindowRectEx

• 0x4a16f4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4a16fc Sleep

Library oleaut32.dll:

• 0x4a1704 SafeArrayPtrOfIndex

• 0x4a1708 SafeArrayPutElement

• 0x4a170c SafeArrayGetElement

• 0x4a1710 SafeArrayUnaccessData

• 0x4a1714 SafeArrayAccessData

• 0x4a1718 SafeArrayGetUBound

• 0x4a171c SafeArrayGetLBound

• 0x4a1720 SafeArrayRedim

• 0x4a1724 SafeArrayCreate

• 0x4a1728 VariantChangeType

• 0x4a172c VariantCopyInd

• 0x4a1730 VariantCopy

• 0x4a1734 VariantClear

• 0x4a1738 VariantInit

Library ole32.dll:

• 0x4a1740 CoCreateInstance

• 0x4a1744 CoGetMalloc

• 0x4a1748 CoUninitialize

• 0x4a174c CoInitialize

Library oleaut32.dll:

• 0x4a1754 GetErrorInfo

• 0x4a1758 SysStringLen

• 0x4a175c SysFreeString

Library comctl32.dll:

• 0x4a1764 ImageList_SetIconSize

• 0x4a1768 ImageList_GetIconSize

• 0x4a176c ImageList_Write

• 0x4a1770 ImageList_Read

• 0x4a1774 ImageList_GetDragImage

• 0x4a1778 ImageList_DragShowNolock

• 0x4a177c ImageList_SetDragCursorImage

• 0x4a1780 ImageList_DragMove

• 0x4a1784 ImageList_DragLeave

• 0x4a1788 ImageList_DragEnter

• 0x4a178c ImageList_EndDrag

• 0x4a1790 ImageList_BeginDrag

• 0x4a1794 ImageList_Remove

• 0x4a1798 ImageList_DrawEx

• 0x4a179c ImageList_Replace

• 0x4a17a0 ImageList_Draw

• 0x4a17a4 ImageList_GetBkColor

• 0x4a17a8 ImageList_SetBkColor

• 0x4a17ac ImageList_ReplaceIcon

• 0x4a17b0 ImageList_Add

• 0x4a17b4 ImageList_GetImageCount

• 0x4a17b8 ImageList_Destroy

• 0x4a17bc ImageList_Create

• 0x4a17c0 InitCommonControls

Library comdlg32.dll:

• 0x4a17c8 GetSaveFileNameA

• 0x4a17cc GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
flexpak-th.com
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.