SmartHawk

5.8

高危

62 个模型检测该样本为恶意！

重新分析

下载样本

fc03d41d9bac8d78e1d829039f24f2f7066ded44a70c4126045c553015bbe957

382276d6658a59ab571cf5c314733990.exe

分析耗时

24s

最近分析

文件大小

1.0MB

静态报毒动态报毒 AGEN AGENTTESLA AHW@AG3S6FAI AI SCORE=86 AIDETECTVM CLASSIC CONFIDENCE DELF DELPHILESS ENAR EQGR FAREIT GENERICKDZ GENETIC GENKRYPTIK HIGH CONFIDENCE HSFJLL HULP LIQK LOKIBOT MALWARE1 MALWARE@#3H1SDV6SSQY89 NOON NOONIH R011C0DHJ20 RATNET S15481576 SCORE SUSGEN SUSPICIOUS PE TLPB+N6UOSE TSCOPE UNSAFE X2094 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanSpy:Win32/Fareit.6ae689a4	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201024	18.4.3895.0
Tencent	Win32.Trojan-spy.Noon.Liqk	20201024	1.0.0.1
Kingsoft		20201024	2013.8.14.323
McAfee	Fareit-FPQ!382276D6658A	20201024	6.0.6.653

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619368481.043999 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7485d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a 382276d6658a59ab571cf5c314733990+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75164b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75165d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfead14ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619368481.043999
__exception__

stacktrace:

RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7485d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
382276d6658a59ab571cf5c314733990+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75164b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75165d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfead14ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (28 个事件)

Time & API	Arguments	Status
1619345036.741262 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02340000	success
1619345036.819262 NtProtectVirtualMemory	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 77824 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00467000	success
1619345036.819262 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x024a0000	success
1619368480.403999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619368480.481999 NtAllocateVirtualMemory	process_identifier: 200 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01fd0000	success
1619368480.481999 NtAllocateVirtualMemory	process_identifier: 200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02150000	success
1619368480.481999 NtAllocateVirtualMemory	process_identifier: 200 region_size: 630784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01fd0000	success
1619368480.496999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 602112 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fd2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fc2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fc2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fc2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fc2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fc2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fc2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fc2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fc2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fc2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fc2000	success
1619368481.028999 NtProtectVirtualMemory	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.502353915192296

section

{'size_of_data': '0x0007ea00', 'virtual_address': '0x0008b000', 'entropy': 7.502353915192296, 'name': '.rsrc', 'virtual_size': '0x0007e93c'}

description

A section with a high entropy has been found

entropy

0.4886637723106609

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 732 called NtSetContextThread to modify thread in remote process 200
1619345037.022262 NtSetContextThread	thread_handle: 0x00000120 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5503232 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 200	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 732 resumed a thread in remote process 200
1619345037.710262 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 200	success	0	0

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619345036.960262 CreateProcessInternalW	thread_identifier: 2740 thread_handle: 0x00000120 process_identifier: 200 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\382276d6658a59ab571cf5c314733990.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000124 inherit_handles: 0	success	1
1619345036.960262 NtUnmapViewOfSection	process_identifier: 200 region_size: 4096 process_handle: 0x00000124 base_address: 0x00400000	success	0
1619345036.975262 NtMapViewOfSection	section_handle: 0x0000012c process_identifier: 200 commit_size: 1314816 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000124 allocation_type: 0 () section_offset: 0 view_size: 1314816 base_address: 0x00400000	success	0
1619345037.022262 NtGetContextThread	thread_handle: 0x00000120	success	0
1619345037.022262 NtSetContextThread	thread_handle: 0x00000120 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5503232 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 200	success	0
1619345037.710262 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 200	success	0

File has been identified by 62 AntiVirus engines on VirusTotal as malicious (50 out of 62 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69532
FireEye	Generic.mg.382276d6658a59ab
CAT-QuickHeal	Trojan.NoonIH.S15481576
ALYac	Trojan.GenericKDZ.69532
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.762359
Sangfor	Malware
K7AntiVirus	Trojan ( 0056c99c1 )
Alibaba	TrojanSpy:Win32/Fareit.6ae689a4
K7GW	Trojan ( 0056c99c1 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Generic.D10F9C
Invincea	Mal/Generic-S
Cyren	W32/Injector.HULP-8842
Symantec	Infostealer.Lokibot!43
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.AgentTesla-9375297-1
Kaspersky	HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender	Trojan.GenericKDZ.69532
NANO-Antivirus	Trojan.Win32.Noon.hsfjll
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan-spy.Noon.Liqk
Ad-Aware	Trojan.GenericKDZ.69532
Emsisoft	Trojan.Injector (A)
Comodo	Malware@#3h1sdv6ssqy89
F-Secure	Heuristic.HEUR/AGEN.1137568
DrWeb	BackDoor.RatNET.2
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R011C0DHJ20
McAfee-GW-Edition	BehavesLike.Win32.Fareit.tc
MaxSecure	Trojan.Malware.73698928.susgen
Sophos	Mal/Generic-S
SentinelOne	DFI - Suspicious PE
Jiangmin	TrojanSpy.Noon.qcf
Avira	HEUR/AGEN.1137568
Antiy-AVL	Trojan/Win32.Injector
Microsoft	Trojan:Win32/Fareit.VD!MTB
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan-Spy.Win32.Noon.gen
GData	Trojan.GenericKDZ.69532
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2094
Acronis	suspicious
McAfee	Fareit-FPQ!382276D6658A
MAX	malware (ai score=86)
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47e168 DeleteCriticalSection

• 0x47e16c LeaveCriticalSection

• 0x47e170 EnterCriticalSection

• 0x47e174 InitializeCriticalSection

• 0x47e178 VirtualFree

• 0x47e17c VirtualAlloc

• 0x47e180 LocalFree

• 0x47e184 LocalAlloc

• 0x47e188 GetVersion

• 0x47e18c GetCurrentThreadId

• 0x47e190 InterlockedDecrement

• 0x47e194 InterlockedIncrement

• 0x47e198 VirtualQuery

• 0x47e19c WideCharToMultiByte

• 0x47e1a0 SetCurrentDirectoryA

• 0x47e1a4 MultiByteToWideChar

• 0x47e1a8 lstrlenA

• 0x47e1ac lstrcpynA

• 0x47e1b0 LoadLibraryExA

• 0x47e1b4 GetThreadLocale

• 0x47e1b8 GetStartupInfoA

• 0x47e1bc GetProcAddress

• 0x47e1c0 GetModuleHandleA

• 0x47e1c4 GetModuleFileNameA

• 0x47e1c8 GetLocaleInfoA

• 0x47e1cc GetLastError

• 0x47e1d0 GetCurrentDirectoryA

• 0x47e1d4 GetCommandLineA

• 0x47e1d8 FreeLibrary

• 0x47e1dc FindFirstFileA

• 0x47e1e0 FindClose

• 0x47e1e4 ExitProcess

• 0x47e1e8 WriteFile

• 0x47e1ec UnhandledExceptionFilter

• 0x47e1f0 RtlUnwind

• 0x47e1f4 RaiseException

• 0x47e1f8 GetStdHandle

Library user32.dll:

• 0x47e200 GetKeyboardType

• 0x47e204 LoadStringA

• 0x47e208 MessageBoxA

• 0x47e20c CharNextA

Library advapi32.dll:

• 0x47e214 RegQueryValueExA

• 0x47e218 RegOpenKeyExA

• 0x47e21c RegCloseKey

Library oleaut32.dll:

• 0x47e224 SysFreeString

• 0x47e228 SysReAllocStringLen

• 0x47e22c SysAllocStringLen

Library kernel32.dll:

• 0x47e234 TlsSetValue

• 0x47e238 TlsGetValue

• 0x47e23c LocalAlloc

• 0x47e240 GetModuleHandleA

Library advapi32.dll:

• 0x47e248 RegQueryValueExA

• 0x47e24c RegOpenKeyExA

• 0x47e250 RegCloseKey

Library kernel32.dll:

• 0x47e258 lstrcpyA

• 0x47e25c WriteFile

• 0x47e260 WinExec

• 0x47e264 WaitForSingleObject

• 0x47e268 VirtualQuery

• 0x47e26c VirtualProtect

• 0x47e270 VirtualAlloc

• 0x47e274 Sleep

• 0x47e278 SizeofResource

• 0x47e27c SetThreadLocale

• 0x47e280 SetFilePointer

• 0x47e284 SetEvent

• 0x47e288 SetErrorMode

• 0x47e28c SetEndOfFile

• 0x47e290 ResetEvent

• 0x47e294 ReadFile

• 0x47e298 MulDiv

• 0x47e29c LockResource

• 0x47e2a0 LoadResource

• 0x47e2a4 LoadLibraryA

• 0x47e2a8 LeaveCriticalSection

• 0x47e2ac InitializeCriticalSection

• 0x47e2b0 GlobalUnlock

• 0x47e2b4 GlobalReAlloc

• 0x47e2b8 GlobalHandle

• 0x47e2bc GlobalLock

• 0x47e2c0 GlobalFree

• 0x47e2c4 GlobalFindAtomA

• 0x47e2c8 GlobalDeleteAtom

• 0x47e2cc GlobalAlloc

• 0x47e2d0 GlobalAddAtomA

• 0x47e2d4 GetVolumeInformationA

• 0x47e2d8 GetVersionExA

• 0x47e2dc GetVersion

• 0x47e2e0 GetTickCount

• 0x47e2e4 GetThreadLocale

• 0x47e2e8 GetSystemTimeAsFileTime

• 0x47e2ec GetSystemInfo

• 0x47e2f0 GetStringTypeExA

• 0x47e2f4 GetStdHandle

• 0x47e2f8 GetProcAddress

• 0x47e2fc GetModuleHandleA

• 0x47e300 GetModuleFileNameA

• 0x47e304 GetLogicalDrives

• 0x47e308 GetLocaleInfoA

• 0x47e30c GetLocalTime

• 0x47e310 GetLastError

• 0x47e314 GetFullPathNameA

• 0x47e318 GetFileAttributesA

• 0x47e31c GetDriveTypeA

• 0x47e320 GetDiskFreeSpaceA

• 0x47e324 GetDateFormatA

• 0x47e328 GetCurrentThreadId

• 0x47e32c GetCurrentProcessId

• 0x47e330 GetCPInfo

• 0x47e334 GetACP

• 0x47e338 FreeResource

• 0x47e33c InterlockedExchange

• 0x47e340 FreeLibrary

• 0x47e344 FormatMessageA

• 0x47e348 FindResourceA

• 0x47e34c FindNextFileA

• 0x47e350 FindFirstFileA

• 0x47e354 FindClose

• 0x47e358 FileTimeToSystemTime

• 0x47e35c FileTimeToLocalFileTime

• 0x47e360 FileTimeToDosDateTime

• 0x47e364 EnumCalendarInfoA

• 0x47e368 EnterCriticalSection

• 0x47e36c DeleteCriticalSection

• 0x47e370 CreateThread

• 0x47e374 CreateFileA

• 0x47e378 CreateEventA

• 0x47e37c CompareStringA

• 0x47e380 CloseHandle

Library mpr.dll:

• 0x47e388 WNetGetConnectionA

Library version.dll:

• 0x47e390 VerQueryValueA

• 0x47e394 GetFileVersionInfoSizeA

• 0x47e398 GetFileVersionInfoA

Library gdi32.dll:

• 0x47e3a0 UnrealizeObject

• 0x47e3a4 StretchBlt

• 0x47e3a8 SetWindowOrgEx

• 0x47e3ac SetWinMetaFileBits

• 0x47e3b0 SetViewportOrgEx

• 0x47e3b4 SetTextColor

• 0x47e3b8 SetStretchBltMode

• 0x47e3bc SetROP2

• 0x47e3c0 SetPixel

• 0x47e3c4 SetEnhMetaFileBits

• 0x47e3c8 SetDIBColorTable

• 0x47e3cc SetBrushOrgEx

• 0x47e3d0 SetBkMode

• 0x47e3d4 SetBkColor

• 0x47e3d8 SelectPalette

• 0x47e3dc SelectObject

• 0x47e3e0 SaveDC

• 0x47e3e4 RestoreDC

• 0x47e3e8 Rectangle

• 0x47e3ec RectVisible

• 0x47e3f0 RealizePalette

• 0x47e3f4 Polyline

• 0x47e3f8 PlayEnhMetaFile

• 0x47e3fc PatBlt

• 0x47e400 MoveToEx

• 0x47e404 MaskBlt

• 0x47e408 LineTo

• 0x47e40c IntersectClipRect

• 0x47e410 GetWindowOrgEx

• 0x47e414 GetWinMetaFileBits

• 0x47e418 GetTextMetricsA

• 0x47e41c GetTextExtentPoint32A

• 0x47e420 GetSystemPaletteEntries

• 0x47e424 GetStockObject

• 0x47e428 GetPixel

• 0x47e42c GetPaletteEntries

• 0x47e430 GetObjectA

• 0x47e434 GetEnhMetaFilePaletteEntries

• 0x47e438 GetEnhMetaFileHeader

• 0x47e43c GetEnhMetaFileBits

• 0x47e440 GetDeviceCaps

• 0x47e444 GetDIBits

• 0x47e448 GetDIBColorTable

• 0x47e44c GetDCOrgEx

• 0x47e450 GetCurrentPositionEx

• 0x47e454 GetClipBox

• 0x47e458 GetBrushOrgEx

• 0x47e45c GetBitmapBits

• 0x47e460 ExtTextOutA

• 0x47e464 ExcludeClipRect

• 0x47e468 DeleteObject

• 0x47e46c DeleteEnhMetaFile

• 0x47e470 DeleteDC

• 0x47e474 CreateSolidBrush

• 0x47e478 CreatePenIndirect

• 0x47e47c CreatePalette

• 0x47e480 CreateHalftonePalette

• 0x47e484 CreateFontIndirectA

• 0x47e488 CreateDIBitmap

• 0x47e48c CreateDIBSection

• 0x47e490 CreateCompatibleDC

• 0x47e494 CreateCompatibleBitmap

• 0x47e498 CreateBrushIndirect

• 0x47e49c CreateBitmap

• 0x47e4a0 CopyEnhMetaFileA

• 0x47e4a4 BitBlt

Library opengl32.dll:

• 0x47e4ac wglCreateContext

Library user32.dll:

• 0x47e4b4 CreateWindowExA

• 0x47e4b8 WindowFromPoint

• 0x47e4bc WinHelpA

• 0x47e4c0 WaitMessage

• 0x47e4c4 UpdateWindow

• 0x47e4c8 UnregisterClassA

• 0x47e4cc UnhookWindowsHookEx

• 0x47e4d0 TranslateMessage

• 0x47e4d4 TranslateMDISysAccel

• 0x47e4d8 TrackPopupMenu

• 0x47e4dc SystemParametersInfoA

• 0x47e4e0 ShowWindow

• 0x47e4e4 ShowScrollBar

• 0x47e4e8 ShowOwnedPopups

• 0x47e4ec ShowCursor

• 0x47e4f0 SetWindowsHookExA

• 0x47e4f4 SetWindowTextA

• 0x47e4f8 SetWindowPos

• 0x47e4fc SetWindowPlacement

• 0x47e500 SetWindowLongA

• 0x47e504 SetTimer

• 0x47e508 SetScrollRange

• 0x47e50c SetScrollPos

• 0x47e510 SetScrollInfo

• 0x47e514 SetRect

• 0x47e518 SetPropA

• 0x47e51c SetParent

• 0x47e520 SetMenuItemInfoA

• 0x47e524 SetMenu

• 0x47e528 SetForegroundWindow

• 0x47e52c SetFocus

• 0x47e530 SetCursor

• 0x47e534 SetClassLongA

• 0x47e538 SetCapture

• 0x47e53c SetActiveWindow

• 0x47e540 SendMessageA

• 0x47e544 ScrollWindow

• 0x47e548 ScreenToClient

• 0x47e54c RemovePropA

• 0x47e550 RemoveMenu

• 0x47e554 ReleaseDC

• 0x47e558 ReleaseCapture

• 0x47e55c RegisterWindowMessageA

• 0x47e560 RegisterClipboardFormatA

• 0x47e564 RegisterClassA

• 0x47e568 RedrawWindow

• 0x47e56c PtInRect

• 0x47e570 PostQuitMessage

• 0x47e574 PostMessageA

• 0x47e578 PeekMessageA

• 0x47e57c OffsetRect

• 0x47e580 OemToCharA

• 0x47e584 MessageBoxA

• 0x47e588 MapWindowPoints

• 0x47e58c MapVirtualKeyA

• 0x47e590 LoadStringA

• 0x47e594 LoadKeyboardLayoutA

• 0x47e598 LoadIconA

• 0x47e59c LoadCursorA

• 0x47e5a0 LoadBitmapA

• 0x47e5a4 KillTimer

• 0x47e5a8 IsZoomed

• 0x47e5ac IsWindowVisible

• 0x47e5b0 IsWindowEnabled

• 0x47e5b4 IsWindow

• 0x47e5b8 IsRectEmpty

• 0x47e5bc IsIconic

• 0x47e5c0 IsDialogMessageA

• 0x47e5c4 IsChild

• 0x47e5c8 InvalidateRect

• 0x47e5cc IntersectRect

• 0x47e5d0 InsertMenuItemA

• 0x47e5d4 InsertMenuA

• 0x47e5d8 InflateRect

• 0x47e5dc GetWindowThreadProcessId

• 0x47e5e0 GetWindowTextA

• 0x47e5e4 GetWindowRect

• 0x47e5e8 GetWindowPlacement

• 0x47e5ec GetWindowLongA

• 0x47e5f0 GetWindowDC

• 0x47e5f4 GetTopWindow

• 0x47e5f8 GetSystemMetrics

• 0x47e5fc GetSystemMenu

• 0x47e600 GetSysColorBrush

• 0x47e604 GetSysColor

• 0x47e608 GetSubMenu

• 0x47e60c GetScrollRange

• 0x47e610 GetScrollPos

• 0x47e614 GetScrollInfo

• 0x47e618 GetPropA

• 0x47e61c GetParent

• 0x47e620 GetWindow

• 0x47e624 GetMenuStringA

• 0x47e628 GetMenuState

• 0x47e62c GetMenuItemInfoA

• 0x47e630 GetMenuItemID

• 0x47e634 GetMenuItemCount

• 0x47e638 GetMenu

• 0x47e63c GetLastActivePopup

• 0x47e640 GetKeyboardState

• 0x47e644 GetKeyboardLayoutList

• 0x47e648 GetKeyboardLayout

• 0x47e64c GetKeyState

• 0x47e650 GetKeyNameTextA

• 0x47e654 GetIconInfo

• 0x47e658 GetForegroundWindow

• 0x47e65c GetFocus

• 0x47e660 GetDlgItem

• 0x47e664 GetDesktopWindow

• 0x47e668 GetDCEx

• 0x47e66c GetDC

• 0x47e670 GetCursorPos

• 0x47e674 GetCursor

• 0x47e678 GetClipboardData

• 0x47e67c GetClientRect

• 0x47e680 GetClassNameA

• 0x47e684 GetClassInfoA

• 0x47e688 GetCapture

• 0x47e68c GetActiveWindow

• 0x47e690 FrameRect

• 0x47e694 FindWindowA

• 0x47e698 FillRect

• 0x47e69c EqualRect

• 0x47e6a0 EnumWindows

• 0x47e6a4 EnumThreadWindows

• 0x47e6a8 EndPaint

• 0x47e6ac EnableWindow

• 0x47e6b0 EnableScrollBar

• 0x47e6b4 EnableMenuItem

• 0x47e6b8 DrawTextA

• 0x47e6bc DrawMenuBar

• 0x47e6c0 DrawIconEx

• 0x47e6c4 DrawIcon

• 0x47e6c8 DrawFrameControl

• 0x47e6cc DrawFocusRect

• 0x47e6d0 DrawEdge

• 0x47e6d4 DispatchMessageA

• 0x47e6d8 DestroyWindow

• 0x47e6dc DestroyMenu

• 0x47e6e0 DestroyIcon

• 0x47e6e4 DestroyCursor

• 0x47e6e8 DeleteMenu

• 0x47e6ec DefWindowProcA

• 0x47e6f0 DefMDIChildProcA

• 0x47e6f4 DefFrameProcA

• 0x47e6f8 CreatePopupMenu

• 0x47e6fc CreateMenu

• 0x47e700 CreateIcon

• 0x47e704 ClientToScreen

• 0x47e708 CheckMenuItem

• 0x47e70c CallWindowProcA

• 0x47e710 CallNextHookEx

• 0x47e714 BeginPaint

• 0x47e718 CharNextA

• 0x47e71c CharLowerBuffA

• 0x47e720 CharLowerA

• 0x47e724 CharUpperBuffA

• 0x47e728 CharToOemA

• 0x47e72c AdjustWindowRectEx

• 0x47e730 ActivateKeyboardLayout

Library kernel32.dll:

• 0x47e738 Sleep

Library oleaut32.dll:

• 0x47e740 SafeArrayPtrOfIndex

• 0x47e744 SafeArrayGetUBound

• 0x47e748 SafeArrayGetLBound

• 0x47e74c SafeArrayCreate

• 0x47e750 VariantChangeType

• 0x47e754 VariantCopy

• 0x47e758 VariantClear

• 0x47e75c VariantInit

Library comctl32.dll:

• 0x47e764 ImageList_SetIconSize

• 0x47e768 ImageList_GetIconSize

• 0x47e76c ImageList_Write

• 0x47e770 ImageList_Read

• 0x47e774 ImageList_GetDragImage

• 0x47e778 ImageList_DragShowNolock

• 0x47e77c ImageList_SetDragCursorImage

• 0x47e780 ImageList_DragMove

• 0x47e784 ImageList_DragLeave

• 0x47e788 ImageList_DragEnter

• 0x47e78c ImageList_EndDrag

• 0x47e790 ImageList_BeginDrag

• 0x47e794 ImageList_Remove

• 0x47e798 ImageList_DrawEx

• 0x47e79c ImageList_Replace

• 0x47e7a0 ImageList_Draw

• 0x47e7a4 ImageList_GetBkColor

• 0x47e7a8 ImageList_SetBkColor

• 0x47e7ac ImageList_ReplaceIcon

• 0x47e7b0 ImageList_Add

• 0x47e7b4 ImageList_GetImageCount

• 0x47e7b8 ImageList_Destroy

• 0x47e7bc ImageList_Create

Library comdlg32.dll:

• 0x47e7c4 GetOpenFileNameA

Library user32.dll:

• 0x47e7cc DdeCmpStringHandles

• 0x47e7d0 DdeFreeStringHandle

• 0x47e7d4 DdeQueryStringA

• 0x47e7d8 DdeCreateStringHandleA

• 0x47e7dc DdeGetLastError

• 0x47e7e0 DdeFreeDataHandle

• 0x47e7e4 DdeUnaccessData

• 0x47e7e8 DdeAccessData

• 0x47e7ec DdeCreateDataHandle

• 0x47e7f0 DdeClientTransaction

• 0x47e7f4 DdeNameService

• 0x47e7f8 DdePostAdvise

• 0x47e7fc DdeSetUserHandle

• 0x47e800 DdeQueryConvInfo

• 0x47e804 DdeDisconnect

• 0x47e808 DdeConnect

• 0x47e80c DdeUninitialize

• 0x47e810 DdeInitializeA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.