7.0
高危
58 个模型检测该样本为恶意！
重新分析
更多

aaa969de94835c4f59740b9bc3463693142db72d094969962d353c6466c10cd5

370af9b902fe03abb7e6ac0d10f71750.exe

分析耗时

131s

最近分析

文件大小

938.5KB
静态报毒 动态报毒 100% 6GW@A0AGHUOI AI SCORE=80 AIDETECTVM ALI2000015 ANDROM AWYG BT78GE CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMOY FAREIT GDSDA HIGH CONFIDENCE HNWJNU IGENT KCLOUD KRYPT LOKI LOKIBOT MALWARE1 MALWARE@#369QSCETLNMNH PWSX SCORE SMAD1 STATIC AI SUSGEN SUSPICIOUS PE THAE TSCOPE UNSAFE X2094 YDDNV ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:PWSX-gen [Trj] 20201210 21.1.5827.0
Kingsoft Win32.Hack.Undef.(kcloud) 20201211 2017.9.26.565
McAfee Fareit-FTB!370AF9B902FE 20201211 6.0.6.653
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (10 个事件)
Time & API Arguments Status Return Repeated
1619369303.07025
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34471748
registers.edi: 0
registers.eax: 0
registers.ebp: 34471816
registers.edx: 28
registers.ebx: 0
registers.esi: 0
registers.ecx: 54
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: 370af9b902fe03abb7e6ac0d10f71750+0x947fb
exception.instruction: div eax
exception.module: 370af9b902fe03abb7e6ac0d10f71750.exe
exception.exception_code: 0xc0000094
exception.offset: 608251
exception.address: 0x4947fb
success 0 0
1619369305.320125
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
370af9b902fe03abb7e6ac0d10f71750+0x40a4d @ 0x440a4d
370af9b902fe03abb7e6ac0d10f71750+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4d14ad
success 0 0
1619369304.366625
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35127108
registers.edi: 0
registers.eax: 0
registers.ebp: 35127176
registers.edx: 28
registers.ebx: 0
registers.esi: 0
registers.ecx: 366
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: 370af9b902fe03abb7e6ac0d10f71750+0x947fb
exception.instruction: div eax
exception.module: 370af9b902fe03abb7e6ac0d10f71750.exe
exception.exception_code: 0xc0000094
exception.offset: 608251
exception.address: 0x4947fb
success 0 0
1619369312.788375
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35454788
registers.edi: 0
registers.eax: 0
registers.ebp: 35454856
registers.edx: 28
registers.ebx: 0
registers.esi: 0
registers.ecx: 773
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: 370af9b902fe03abb7e6ac0d10f71750+0x947fb
exception.instruction: div eax
exception.module: 370af9b902fe03abb7e6ac0d10f71750.exe
exception.exception_code: 0xc0000094
exception.offset: 608251
exception.address: 0x4947fb
success 0 0
1619369316.304875
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7510e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7510ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7510b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7510b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7510ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7510aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75105511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7510559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x751c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x751c4de3
370af9b902fe03abb7e6ac0d10f71750+0x40a4d @ 0x440a4d
370af9b902fe03abb7e6ac0d10f71750+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff2d14ad
success 0 0
1619369315.569375
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34799428
registers.edi: 0
registers.eax: 0
registers.ebp: 34799496
registers.edx: 28
registers.ebx: 0
registers.esi: 0
registers.ecx: 554
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: 370af9b902fe03abb7e6ac0d10f71750+0x947fb
exception.instruction: div eax
exception.module: 370af9b902fe03abb7e6ac0d10f71750.exe
exception.exception_code: 0xc0000094
exception.offset: 608251
exception.address: 0x4947fb
success 0 0
1619369320.91375
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34996036
registers.edi: 0
registers.eax: 0
registers.ebp: 34996104
registers.edx: 28
registers.ebx: 0
registers.esi: 0
registers.ecx: 913
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: 370af9b902fe03abb7e6ac0d10f71750+0x947fb
exception.instruction: div eax
exception.module: 370af9b902fe03abb7e6ac0d10f71750.exe
exception.exception_code: 0xc0000094
exception.offset: 608251
exception.address: 0x4947fb
success 0 0
1619369324.772875
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
370af9b902fe03abb7e6ac0d10f71750+0x40a4d @ 0x440a4d
370af9b902fe03abb7e6ac0d10f71750+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff5d14ad
success 0 0
1619369325.085625
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49479492
registers.edi: 0
registers.eax: 0
registers.ebp: 49479560
registers.edx: 28
registers.ebx: 0
registers.esi: 0
registers.ecx: 70
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: 370af9b902fe03abb7e6ac0d10f71750+0x947fb
exception.instruction: div eax
exception.module: 370af9b902fe03abb7e6ac0d10f71750.exe
exception.exception_code: 0xc0000094
exception.offset: 608251
exception.address: 0x4947fb
success 0 0
1619369331.054875
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49872708
registers.edi: 0
registers.eax: 0
registers.ebp: 49872776
registers.edx: 28
registers.ebx: 0
registers.esi: 0
registers.ecx: 54
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: 370af9b902fe03abb7e6ac0d10f71750+0x947fb
exception.instruction: div eax
exception.module: 370af9b902fe03abb7e6ac0d10f71750.exe
exception.exception_code: 0xc0000094
exception.offset: 608251
exception.address: 0x4947fb
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 102 个事件)
Time & API Arguments Status Return Repeated
1619369302.93025
NtAllocateVirtualMemory
process_identifier: 2740
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619369303.07025
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00494000
success 0 0
1619369303.07025
NtAllocateVirtualMemory
process_identifier: 2740
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x020e0000
success 0 0
1619369304.258125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619369304.289125
NtAllocateVirtualMemory
process_identifier: 472
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x004c0000
success 0 0
1619369304.289125
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f0000
success 0 0
1619369304.289125
NtAllocateVirtualMemory
process_identifier: 472
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d90000
success 0 0
1619369304.289125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 118784
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619369304.633125
NtAllocateVirtualMemory
process_identifier: 472
region_size: 2031616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02160000
success 0 0
1619369304.633125
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02310000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619369305.305125
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619369304.335625
NtAllocateVirtualMemory
process_identifier: 3068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619369304.366625
NtProtectVirtualMemory
process_identifier: 3068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00494000
success 0 0
1619369304.366625
NtAllocateVirtualMemory
process_identifier: 3068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ef0000
success 0 0
1619369312.679375
NtAllocateVirtualMemory
process_identifier: 2824
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00370000
success 0 0
1619369312.804375
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00494000
success 0 0
1619369312.804375
NtAllocateVirtualMemory
process_identifier: 2824
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x008c0000
success 0 0
1619369315.163875
NtProtectVirtualMemory
process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619369315.194875
NtAllocateVirtualMemory
process_identifier: 1908
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01d80000
success 0 0
1619369315.194875
NtAllocateVirtualMemory
process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e50000
success 0 0
1619369315.194875
NtAllocateVirtualMemory
process_identifier: 1908
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d00000
success 0 0
1619369315.194875
NtProtectVirtualMemory
process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 118784
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d02000
success 0 0
1619369315.319875
NtAllocateVirtualMemory
process_identifier: 1908
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e90000
success 0 0
1619369315.319875
NtAllocateVirtualMemory
process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f20000
success 0 0
1619369315.835875
NtProtectVirtualMemory
process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d72000
success 0 0
1619369315.835875
NtProtectVirtualMemory
process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619369315.835875
NtProtectVirtualMemory
process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d72000
success 0 0
1619369315.835875
NtProtectVirtualMemory
process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619369315.835875
NtProtectVirtualMemory
process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d72000
success 0 0
1619369315.835875
NtProtectVirtualMemory
process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619369315.835875
NtProtectVirtualMemory
process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d72000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.384635490492476 section {'size_of_data': '0x0003f000', 'virtual_address': '0x000b1000', 'entropy': 7.384635490492476, 'name': '.rsrc', 'virtual_size': '0x0003efdc'} description A section with a high entropy has been found
entropy 0.2688 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process 370af9b902fe03abb7e6ac0d10f71750.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (7 个事件)
Time & API Arguments Status Return Repeated
1619369303.07025
Process32NextW
process_name: 370af9b902fe03abb7e6ac0d10f71750.exe
snapshot_handle: 0x000000f8
process_identifier: 2740
failed 0 0
1619369312.163625
Process32NextW
process_name: 370af9b902fe03abb7e6ac0d10f71750.exe
snapshot_handle: 0x000001f4
process_identifier: 3068
failed 0 0
1619369312.975375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3056
failed 0 0
1619369320.272375
Process32NextW
process_name: 370af9b902fe03abb7e6ac0d10f71750.exe
snapshot_handle: 0x0000015c
process_identifier: 2864
failed 0 0
1619369320.94475
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2260
failed 0 0
1619369330.069625
Process32NextW
process_name: 370af9b902fe03abb7e6ac0d10f71750.exe
snapshot_handle: 0x00000150
process_identifier: 2964
failed 0 0
1619369331.116875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2040
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (6 个事件)
Process injection Process 2740 called NtSetContextThread to modify thread in remote process 472
Process injection Process 2824 called NtSetContextThread to modify thread in remote process 1908
Process injection Process 2984 called NtSetContextThread to modify thread in remote process 1932
Time & API Arguments Status Return Repeated
1619369303.72625
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4708112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 472
success 0 0
1619369313.507375
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4708112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1908
success 0 0
1619369321.28875
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4708112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1932
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (6 个事件)
Process injection Process 2740 resumed a thread in remote process 472
Process injection Process 2824 resumed a thread in remote process 1908
Process injection Process 2984 resumed a thread in remote process 1932
Time & API Arguments Status Return Repeated
1619369304.07025
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 472
success 0 0
1619369314.866375
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1908
success 0 0
1619369324.14775
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1932
success 0 0
Executed a process and injected code into it, probably while unpacking (24 个事件)
Time & API Arguments Status Return Repeated
1619369303.55525
CreateProcessInternalW
thread_identifier: 368
thread_handle: 0x000000fc
process_identifier: 472
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619369303.57025
NtUnmapViewOfSection
process_identifier: 472
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619369303.57025
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 472
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619369303.72625
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619369303.72625
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4708112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 472
success 0 0
1619369304.07025
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 472
success 0 0
1619369304.13325
CreateProcessInternalW
thread_identifier: 2452
thread_handle: 0x00000104
process_identifier: 3068
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe" 2 472 31288640
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619369312.335625
CreateProcessInternalW
thread_identifier: 2424
thread_handle: 0x000001f8
process_identifier: 2824
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000001fc
inherit_handles: 0
success 1 0
1619369313.444375
CreateProcessInternalW
thread_identifier: 1916
thread_handle: 0x000000fc
process_identifier: 1908
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619369313.444375
NtUnmapViewOfSection
process_identifier: 1908
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619369313.460375
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 1908
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619369313.507375
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619369313.507375
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4708112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1908
success 0 0
1619369314.866375
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1908
success 0 0
1619369315.100375
CreateProcessInternalW
thread_identifier: 2528
thread_handle: 0x00000104
process_identifier: 2864
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe" 2 1908 31299437
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619369320.382375
CreateProcessInternalW
thread_identifier: 2636
thread_handle: 0x00000160
process_identifier: 2984
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000164
inherit_handles: 0
success 1 0
1619369321.22575
CreateProcessInternalW
thread_identifier: 1688
thread_handle: 0x000000fc
process_identifier: 1932
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619369321.22575
NtUnmapViewOfSection
process_identifier: 1932
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619369321.22575
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 1932
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619369321.28875
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619369321.28875
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4708112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1932
success 0 0
1619369324.14775
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1932
success 0 0
1619369324.21075
CreateProcessInternalW
thread_identifier: 2968
thread_handle: 0x00000104
process_identifier: 2964
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe" 2 1932 31308718
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619369330.272625
CreateProcessInternalW
thread_identifier: 1704
thread_handle: 0x00000154
process_identifier: 1752
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\370af9b902fe03abb7e6ac0d10f71750.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000158
inherit_handles: 0
success 1 0
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.370af9b902fe03ab
ALYac Trojan.Delf.FareIt.Gen.7
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 0056a59a1 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 0056a59a1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Delf.FareIt.Gen.7
BitDefenderTheta Gen:NN.ZelphiF.34670.6GW@a0aghuoi
Cyren W32/Trojan.THAE-8097
Symantec Trojan Horse
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.SMAD1.hp
Avast Win32:PWSX-gen [Trj]
Kaspersky HEUR:Backdoor.Win32.Androm.gen
BitDefender Trojan.Delf.FareIt.Gen.7
NANO-Antivirus Trojan.Win32.Androm.hnwjnu
Paloalto generic.ml
APEX Malicious
Ad-Aware Trojan.Delf.FareIt.Gen.7
Sophos Mal/Generic-S
Comodo Malware@#369qscetlnmnh
F-Secure Trojan.TR/Injector.yddnv
DrWeb Trojan.PWS.Stealer.28815
Zillya Trojan.Injector.Win32.750302
TrendMicro TrojanSpy.Win32.LOKI.SMAD1.hp
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
Ikarus Trojan.Win32.Krypt
Jiangmin Backdoor.Androm.awyg
Avira TR/Injector.yddnv
Antiy-AVL Trojan[Backdoor]/Win32.Androm
Kingsoft Win32.Hack.Undef.(kcloud)
Microsoft PWS:Win32/Fareit.AQ!MTB
AegisLab Trojan.Win32.Androm.m!c
ZoneAlarm HEUR:Backdoor.Win32.Androm.gen
GData Trojan.Delf.FareIt.Gen.7
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
McAfee Fareit-FTB!370AF9B902FE
MAX malware (ai score=80)
VBA32 TScope.Trojan.Delf
Malwarebytes Spyware.LokiBot
Zoner Trojan.Win32.91536
ESET-NOD32 a variant of Win32/Injector.EMOY
Rising Trojan.Injector!1.C99D (CLASSIC)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4a1164 VirtualFree
• 0x4a1168 VirtualAlloc
• 0x4a116c LocalFree
• 0x4a1170 LocalAlloc
• 0x4a1174 GetVersion
• 0x4a1178 GetCurrentThreadId
• 0x4a1184 VirtualQuery
• 0x4a1188 WideCharToMultiByte
• 0x4a118c MultiByteToWideChar
• 0x4a1190 lstrlenA
• 0x4a1194 lstrcpynA
• 0x4a1198 LoadLibraryExA
• 0x4a119c GetThreadLocale
• 0x4a11a0 GetStartupInfoA
• 0x4a11a4 GetProcAddress
• 0x4a11a8 GetModuleHandleA
• 0x4a11ac GetModuleFileNameA
• 0x4a11b0 GetLocaleInfoA
• 0x4a11b4 GetCommandLineA
• 0x4a11b8 FreeLibrary
• 0x4a11bc FindFirstFileA
• 0x4a11c0 FindClose
• 0x4a11c4 ExitProcess
• 0x4a11c8 WriteFile
• 0x4a11d0 RtlUnwind
• 0x4a11d4 RaiseException
• 0x4a11d8 GetStdHandle
Library user32.dll:
• 0x4a11e0 GetKeyboardType
• 0x4a11e4 LoadStringA
• 0x4a11e8 MessageBoxA
• 0x4a11ec CharNextA
Library advapi32.dll:
• 0x4a11f4 RegQueryValueExA
• 0x4a11f8 RegOpenKeyExA
• 0x4a11fc RegCloseKey
Library oleaut32.dll:
• 0x4a1204 SysFreeString
• 0x4a1208 SysReAllocStringLen
• 0x4a120c SysAllocStringLen
Library kernel32.dll:
• 0x4a1214 TlsSetValue
• 0x4a1218 TlsGetValue
• 0x4a121c LocalAlloc
• 0x4a1220 GetModuleHandleA
Library advapi32.dll:
• 0x4a1228 RegQueryValueExA
• 0x4a122c RegOpenKeyExA
• 0x4a1230 RegCloseKey
Library kernel32.dll:
• 0x4a1238 lstrcpyA
• 0x4a123c WriteFile
• 0x4a1240 WideCharToMultiByte
• 0x4a1244 WaitForSingleObject
• 0x4a1248 VirtualQuery
• 0x4a124c VirtualProtectEx
• 0x4a1250 VirtualAlloc
• 0x4a1254 Sleep
• 0x4a1258 SizeofResource
• 0x4a125c SetThreadLocale
• 0x4a1260 SetFilePointer
• 0x4a1264 SetEvent
• 0x4a1268 SetErrorMode
• 0x4a126c SetEndOfFile
• 0x4a1270 ResetEvent
• 0x4a1274 ReadFile
• 0x4a1278 MultiByteToWideChar
• 0x4a127c MulDiv
• 0x4a1280 LockResource
• 0x4a1284 LoadResource
• 0x4a1288 LoadLibraryA
• 0x4a1294 GlobalUnlock
• 0x4a1298 GlobalReAlloc
• 0x4a129c GlobalHandle
• 0x4a12a0 GlobalLock
• 0x4a12a4 GlobalFree
• 0x4a12a8 GlobalFindAtomA
• 0x4a12ac GlobalDeleteAtom
• 0x4a12b0 GlobalAlloc
• 0x4a12b4 GlobalAddAtomA
• 0x4a12b8 GetVersionExA
• 0x4a12bc GetVersion
• 0x4a12c0 GetTickCount
• 0x4a12c4 GetThreadLocale
• 0x4a12c8 GetSystemInfo
• 0x4a12cc GetStringTypeExA
• 0x4a12d0 GetStdHandle
• 0x4a12d4 GetProcAddress
• 0x4a12d8 GetModuleHandleA
• 0x4a12dc GetModuleFileNameA
• 0x4a12e0 GetLocaleInfoA
• 0x4a12e4 GetLocalTime
• 0x4a12e8 GetLastError
• 0x4a12ec GetFullPathNameA
• 0x4a12f0 GetFileAttributesA
• 0x4a12f4 GetDiskFreeSpaceA
• 0x4a12f8 GetDateFormatA
• 0x4a12fc GetCurrentThreadId
• 0x4a1300 GetCurrentProcessId
• 0x4a1304 GetCurrentProcess
• 0x4a1308 GetCPInfo
• 0x4a130c GetACP
• 0x4a1310 FreeResource
• 0x4a1314 InterlockedExchange
• 0x4a1318 FreeLibrary
• 0x4a131c FormatMessageA
• 0x4a1320 FindResourceA
• 0x4a1324 FindFirstFileA
• 0x4a1328 FindClose
• 0x4a1334 EnumCalendarInfoA
• 0x4a1340 CreateThread
• 0x4a1344 CreateFileA
• 0x4a1348 CreateEventA
• 0x4a134c CompareStringA
• 0x4a1350 CloseHandle
Library version.dll:
• 0x4a1358 VerQueryValueA
• 0x4a1360 GetFileVersionInfoA
Library gdi32.dll:
• 0x4a1368 UnrealizeObject
• 0x4a136c StretchBlt
• 0x4a1370 SetWindowOrgEx
• 0x4a1374 SetWinMetaFileBits
• 0x4a1378 SetViewportOrgEx
• 0x4a137c SetTextColor
• 0x4a1380 SetStretchBltMode
• 0x4a1384 SetROP2
• 0x4a1388 SetPixel
• 0x4a138c SetEnhMetaFileBits
• 0x4a1390 SetDIBColorTable
• 0x4a1394 SetBrushOrgEx
• 0x4a1398 SetBkMode
• 0x4a139c SetBkColor
• 0x4a13a0 SelectPalette
• 0x4a13a4 SelectObject
• 0x4a13a8 SaveDC
• 0x4a13ac RestoreDC
• 0x4a13b0 Rectangle
• 0x4a13b4 RectVisible
• 0x4a13b8 RealizePalette
• 0x4a13bc Polyline
• 0x4a13c0 PlayEnhMetaFile
• 0x4a13c4 PatBlt
• 0x4a13c8 MoveToEx
• 0x4a13cc MaskBlt
• 0x4a13d0 LineTo
• 0x4a13d4 IntersectClipRect
• 0x4a13d8 GetWindowOrgEx
• 0x4a13dc GetWinMetaFileBits
• 0x4a13e0 GetTextMetricsA
• 0x4a13ec GetStockObject
• 0x4a13f0 GetPixel
• 0x4a13f4 GetPaletteEntries
• 0x4a13f8 GetObjectA
• 0x4a1404 GetEnhMetaFileBits
• 0x4a1408 GetDeviceCaps
• 0x4a140c GetDIBits
• 0x4a1410 GetDIBColorTable
• 0x4a1414 GetDCOrgEx
• 0x4a141c GetClipBox
• 0x4a1420 GetBrushOrgEx
• 0x4a1424 GetBitmapBits
• 0x4a1428 ExtTextOutA
• 0x4a142c ExcludeClipRect
• 0x4a1430 DeleteObject
• 0x4a1434 DeleteEnhMetaFile
• 0x4a1438 DeleteDC
• 0x4a143c CreateSolidBrush
• 0x4a1440 CreatePenIndirect
• 0x4a1444 CreatePen
• 0x4a1448 CreatePalette
• 0x4a1450 CreateFontIndirectA
• 0x4a1454 CreateDIBitmap
• 0x4a1458 CreateDIBSection
• 0x4a145c CreateCompatibleDC
• 0x4a1464 CreateBrushIndirect
• 0x4a1468 CreateBitmap
• 0x4a146c CopyEnhMetaFileA
• 0x4a1470 BitBlt
Library user32.dll:
• 0x4a1478 CreateWindowExA
• 0x4a147c WindowFromPoint
• 0x4a1480 WinHelpA
• 0x4a1484 WaitMessage
• 0x4a1488 ValidateRect
• 0x4a148c UpdateWindow
• 0x4a1490 UnregisterClassA
• 0x4a1494 UnhookWindowsHookEx
• 0x4a1498 TranslateMessage
• 0x4a14a0 TrackPopupMenu
• 0x4a14a8 ShowWindow
• 0x4a14ac ShowScrollBar
• 0x4a14b0 ShowOwnedPopups
• 0x4a14b4 ShowCursor
• 0x4a14b8 SetWindowsHookExA
• 0x4a14bc SetWindowPos
• 0x4a14c0 SetWindowPlacement
• 0x4a14c4 SetWindowLongA
• 0x4a14c8 SetTimer
• 0x4a14cc SetScrollRange
• 0x4a14d0 SetScrollPos
• 0x4a14d4 SetScrollInfo
• 0x4a14d8 SetRect
• 0x4a14dc SetPropA
• 0x4a14e0 SetParent
• 0x4a14e4 SetMenuItemInfoA
• 0x4a14e8 SetMenu
• 0x4a14ec SetForegroundWindow
• 0x4a14f0 SetFocus
• 0x4a14f4 SetCursor
• 0x4a14f8 SetClassLongA
• 0x4a14fc SetCapture
• 0x4a1500 SetActiveWindow
• 0x4a1504 SendMessageA
• 0x4a1508 ScrollWindow
• 0x4a150c ScreenToClient
• 0x4a1510 RemovePropA
• 0x4a1514 RemoveMenu
• 0x4a1518 ReleaseDC
• 0x4a151c ReleaseCapture
• 0x4a1528 RegisterClassA
• 0x4a152c RedrawWindow
• 0x4a1530 PtInRect
• 0x4a1534 PostQuitMessage
• 0x4a1538 PostMessageA
• 0x4a153c PeekMessageA
• 0x4a1540 OffsetRect
• 0x4a1544 OemToCharA
• 0x4a1548 MessageBoxA
• 0x4a154c MapWindowPoints
• 0x4a1550 MapVirtualKeyA
• 0x4a1554 LoadStringA
• 0x4a1558 LoadKeyboardLayoutA
• 0x4a155c LoadIconA
• 0x4a1560 LoadCursorA
• 0x4a1564 LoadBitmapA
• 0x4a1568 KillTimer
• 0x4a156c IsZoomed
• 0x4a1570 IsWindowVisible
• 0x4a1574 IsWindowEnabled
• 0x4a1578 IsWindow
• 0x4a157c IsRectEmpty
• 0x4a1580 IsIconic
• 0x4a1584 IsDialogMessageA
• 0x4a1588 IsChild
• 0x4a158c InvalidateRect
• 0x4a1590 IntersectRect
• 0x4a1594 InsertMenuItemA
• 0x4a1598 InsertMenuA
• 0x4a159c InflateRect
• 0x4a15a4 GetWindowTextA
• 0x4a15a8 GetWindowRect
• 0x4a15ac GetWindowPlacement
• 0x4a15b0 GetWindowLongA
• 0x4a15b4 GetWindowDC
• 0x4a15b8 GetTopWindow
• 0x4a15bc GetSystemMetrics
• 0x4a15c0 GetSystemMenu
• 0x4a15c4 GetSysColorBrush
• 0x4a15c8 GetSysColor
• 0x4a15cc GetSubMenu
• 0x4a15d0 GetScrollRange
• 0x4a15d4 GetScrollPos
• 0x4a15d8 GetScrollInfo
• 0x4a15dc GetPropA
• 0x4a15e0 GetParent
• 0x4a15e4 GetWindow
• 0x4a15e8 GetMenuStringA
• 0x4a15ec GetMenuState
• 0x4a15f0 GetMenuItemInfoA
• 0x4a15f4 GetMenuItemID
• 0x4a15f8 GetMenuItemCount
• 0x4a15fc GetMenu
• 0x4a1600 GetLastActivePopup
• 0x4a1604 GetKeyboardState
• 0x4a160c GetKeyboardLayout
• 0x4a1610 GetKeyState
• 0x4a1614 GetKeyNameTextA
• 0x4a1618 GetInputState
• 0x4a161c GetIconInfo
• 0x4a1620 GetForegroundWindow
• 0x4a1624 GetFocus
• 0x4a1628 GetDlgItem
• 0x4a162c GetDesktopWindow
• 0x4a1630 GetDCEx
• 0x4a1634 GetDC
• 0x4a1638 GetCursorPos
• 0x4a163c GetCursor
• 0x4a1640 GetClipboardData
• 0x4a1644 GetClientRect
• 0x4a1648 GetClassNameA
• 0x4a164c GetClassInfoA
• 0x4a1650 GetCapture
• 0x4a1654 GetActiveWindow
• 0x4a1658 FrameRect
• 0x4a165c FindWindowA
• 0x4a1660 FillRect
• 0x4a1664 EqualRect
• 0x4a1668 EnumWindows
• 0x4a166c EnumThreadWindows
• 0x4a1670 EndPaint
• 0x4a1674 EnableWindow
• 0x4a1678 EnableScrollBar
• 0x4a167c EnableMenuItem
• 0x4a1680 DrawTextA
• 0x4a1684 DrawMenuBar
• 0x4a1688 DrawIconEx
• 0x4a168c DrawIcon
• 0x4a1690 DrawFrameControl
• 0x4a1694 DrawEdge
• 0x4a1698 DispatchMessageA
• 0x4a169c DestroyWindow
• 0x4a16a0 DestroyMenu
• 0x4a16a4 DestroyIcon
• 0x4a16a8 DestroyCursor
• 0x4a16ac DeleteMenu
• 0x4a16b0 DefWindowProcA
• 0x4a16b4 DefMDIChildProcA
• 0x4a16b8 DefFrameProcA
• 0x4a16bc CreatePopupMenu
• 0x4a16c0 CreateMenu
• 0x4a16c4 CreateIcon
• 0x4a16c8 ClientToScreen
• 0x4a16cc CheckMenuItem
• 0x4a16d0 CallWindowProcA
• 0x4a16d4 CallNextHookEx
• 0x4a16d8 BeginPaint
• 0x4a16dc CharNextA
• 0x4a16e0 CharLowerBuffA
• 0x4a16e4 CharLowerA
• 0x4a16e8 CharUpperBuffA
• 0x4a16ec CharToOemA
• 0x4a16f0 AdjustWindowRectEx
Library kernel32.dll:
• 0x4a16fc Sleep
Library oleaut32.dll:
• 0x4a1704 SafeArrayPtrOfIndex
• 0x4a1708 SafeArrayPutElement
• 0x4a170c SafeArrayGetElement
• 0x4a1714 SafeArrayAccessData
• 0x4a1718 SafeArrayGetUBound
• 0x4a171c SafeArrayGetLBound
• 0x4a1720 SafeArrayRedim
• 0x4a1724 SafeArrayCreate
• 0x4a1728 VariantChangeType
• 0x4a172c VariantCopyInd
• 0x4a1730 VariantCopy
• 0x4a1734 VariantClear
• 0x4a1738 VariantInit
Library ole32.dll:
• 0x4a1740 CoCreateInstance
• 0x4a1744 CoGetMalloc
• 0x4a1748 CoUninitialize
• 0x4a174c CoInitialize
Library oleaut32.dll:
• 0x4a1754 GetErrorInfo
• 0x4a1758 SysStringLen
• 0x4a175c SysFreeString
Library comctl32.dll:
• 0x4a176c ImageList_Write
• 0x4a1770 ImageList_Read
• 0x4a1780 ImageList_DragMove
• 0x4a1784 ImageList_DragLeave
• 0x4a1788 ImageList_DragEnter
• 0x4a178c ImageList_EndDrag
• 0x4a1790 ImageList_BeginDrag
• 0x4a1794 ImageList_Remove
• 0x4a1798 ImageList_DrawEx
• 0x4a179c ImageList_Replace
• 0x4a17a0 ImageList_Draw
• 0x4a17b0 ImageList_Add
• 0x4a17b8 ImageList_Destroy
• 0x4a17bc ImageList_Create
• 0x4a17c0 InitCommonControls
Library comdlg32.dll:
• 0x4a17c8 GetSaveFileNameA
• 0x4a17cc GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.