10.6
0-day
55 个模型检测该样本为恶意！
重新分析
更多

d4d803a83e2c4c348972b6b8e5fce93416b0c60977a447818f592795505fdff1

39d0d40e446b827da5a4d109068182f1.exe

分析耗时

74s

最近分析

文件大小

668.0KB
静态报毒 动态报毒 AIDETECTVM BTNSSI CLOUD CONFIDENCE DELF DELPHILESS ELZG EMHC FAREIT FORMBOOK GENERICKD GENETIC HHAP HIGH CONFIDENCE HKOMRH IGENT KRYPTIK LNEM MALWAREB NANOCORE PGW@A8ZPARAI R023C0DEQ20 REMCOS SCORE SUSPICIOUS PE TSCOPE UNSAFE WACATAC X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!39D0D40E446B 20200616 6.0.6.653
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
Alibaba Trojan:Win32/FormBook.f1b55366 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20200616 18.4.3895.0
Kingsoft 20200616 2013.8.14.323
Tencent Win32.Trojan.Kryptik.Lnem 20200616 1.0.0.1
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619349817.543626
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x751c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x751c4de3
dfghjklkjhg+0x40a4d @ 0x440a4d
dfghjklkjhg+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb11495
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (39 个事件)
Time & API Arguments Status Return Repeated
1619345030.505119
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01cb0000
success 0 0
1619345030.661119
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00454000
success 0 0
1619345030.677119
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fa0000
success 0 0
1619349794.917999
NtAllocateVirtualMemory
process_identifier: 2988
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619349794.948999
NtProtectVirtualMemory
process_identifier: 2988
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00454000
success 0 0
1619349794.948999
NtAllocateVirtualMemory
process_identifier: 2988
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005a0000
success 0 0
1619349815.496626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619349815.512626
NtAllocateVirtualMemory
process_identifier: 2796
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01d70000
success 0 0
1619349815.512626
NtAllocateVirtualMemory
process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ed0000
success 0 0
1619349815.527626
NtAllocateVirtualMemory
process_identifier: 2796
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005c0000
success 0 0
1619349815.527626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 118784
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619349815.980626
NtAllocateVirtualMemory
process_identifier: 2796
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f10000
success 0 0
1619349815.996626
NtAllocateVirtualMemory
process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02080000
success 0 0
1619349817.402626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1619349817.402626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619349817.433626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1619349817.433626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619349817.449626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1619349817.449626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619349817.449626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1619349817.449626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619349817.449626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1619349817.449626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619349817.480626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1619349817.480626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619349817.480626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1619349817.480626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619349817.480626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1619349817.480626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619349817.480626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1619349817.480626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619349817.480626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1619349817.480626
NtProtectVirtualMemory
process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619349815.746249
NtAllocateVirtualMemory
process_identifier: 2032
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619349815.824249
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00454000
success 0 0
1619349815.824249
NtAllocateVirtualMemory
process_identifier: 2032
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00740000
success 0 0
1619349821.668124
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00360000
success 0 0
1619349821.746124
NtProtectVirtualMemory
process_identifier: 2984
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00454000
success 0 0
1619349821.762124
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00670000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BT.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (11 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.438007103332526 section {'size_of_data': '0x00040a00', 'virtual_address': '0x0006d000', 'entropy': 7.438007103332526, 'name': '.rsrc', 'virtual_size': '0x00040908'} description A section with a high entropy has been found
entropy 0.3875562218890555 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process dfghjklkjhg.exe
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\hgjdfggxdg\dfghjklkjhg.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619345050.895119
NtAllocateVirtualMemory
process_identifier: 3056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000104
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BT.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\hgjdfggxdg\dfghjklkjhg.exe
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2316 created a thread in remote process 3056
Time & API Arguments Status Return Repeated
1619345050.895119
NtQueueApcThread
thread_handle: 0x0000010c
process_identifier: 3056
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619345050.895119
WriteProcessMemory
process_identifier: 3056
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000104
base_address: 0x000b0000
success 1 0
1619345050.895119
WriteProcessMemory
process_identifier: 3056
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\39d0d40e446b827da5a4d109068182f1.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\hgjdfggxdg\dfghjklkjhg.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\39d0d40e446b827da5a4d109068182f1.exe" BTset WtAx = cREatEoBject("wsCRipt.sHeLl") wtax.RUn """%ls""", 0, False
process_handle: 0x00000104
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2988 called NtSetContextThread to modify thread in remote process 2796
Time & API Arguments Status Return Repeated
1619349815.136999
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4708128
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2796
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2988 resumed a thread in remote process 2796
Time & API Arguments Status Return Repeated
1619349815.339999
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2796
success 0 0
Executed a process and injected code into it, probably while unpacking (14 个事件)
Time & API Arguments Status Return Repeated
1619345050.895119
CreateProcessInternalW
thread_identifier: 3004
thread_handle: 0x0000010c
process_identifier: 3056
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619345050.895119
NtAllocateVirtualMemory
process_identifier: 3056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000104
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619345050.895119
NtAllocateVirtualMemory
process_identifier: 3056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000104
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619345050.895119
WriteProcessMemory
process_identifier: 3056
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000104
base_address: 0x000b0000
success 1 0
1619345050.895119
WriteProcessMemory
process_identifier: 3056
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\39d0d40e446b827da5a4d109068182f1.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\hgjdfggxdg\dfghjklkjhg.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\39d0d40e446b827da5a4d109068182f1.exe" BTset WtAx = cREatEoBject("wsCRipt.sHeLl") wtax.RUn """%ls""", 0, False
process_handle: 0x00000104
base_address: 0x000c0000
success 1 0
1619349794.683499
CreateProcessInternalW
thread_identifier: 2764
thread_handle: 0x000000d0
process_identifier: 2988
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\hgjdfggxdg\dfghjklkjhg.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\hgjdfggxdg\dfghjklkjhg.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619349815.120999
CreateProcessInternalW
thread_identifier: 3008
thread_handle: 0x00000108
process_identifier: 2796
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\hgjdfggxdg\dfghjklkjhg.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619349815.120999
NtUnmapViewOfSection
process_identifier: 2796
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619349815.120999
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 2796
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619349815.136999
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619349815.136999
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4708128
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2796
success 0 0
1619349815.339999
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2796
success 0 0
1619349815.432999
CreateProcessInternalW
thread_identifier: 2412
thread_handle: 0x0000010c
process_identifier: 2032
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\hgjdfggxdg\dfghjklkjhg.exe" 2 2796 36128078
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619349821.387249
CreateProcessInternalW
thread_identifier: 2456
thread_handle: 0x00000194
process_identifier: 2984
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\hgjdfggxdg\dfghjklkjhg.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\hgjdfggxdg\dfghjklkjhg.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000198
inherit_handles: 0
success 1 0
File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)
Bkav W32.AIDetectVM.malwareB
MicroWorld-eScan Trojan.GenericKD.43219101
FireEye Generic.mg.39d0d40e446b827d
CAT-QuickHeal Trojan.Multi
McAfee Fareit-FTB!39D0D40E446B
Cylance Unsafe
Zillya Trojan.Injector.Win32.740058
CrowdStrike win/malicious_confidence_90% (W)
Alibaba Trojan:Win32/FormBook.f1b55366
K7GW Trojan ( 0056739d1 )
K7AntiVirus Trojan ( 0056739d1 )
Invincea heuristic
Symantec Trojan Horse
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Dropper.Remcos-7878921-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKD.43219101
NANO-Antivirus Trojan.Win32.Nanocore.hkomrh
Paloalto generic.ml
Rising Trojan.Injector!1.C6FA (CLOUD)
Endgame malicious (high confidence)
Sophos Mal/Fareit-AA
DrWeb Trojan.Nanocore.23
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R023C0DEQ20
McAfee-GW-Edition BehavesLike.Win32.Fareit.jc
Trapmine suspicious.low.ml.score
Emsisoft Trojan.GenericKD.43219101 (B)
SentinelOne DFI - Suspicious PE
Cyren W32/Trojan.HHAP-0185
Webroot W32.Injector.Gen
Antiy-AVL Trojan/Win32.Wacatac
Microsoft PWS:Win32/Fareit.AKK!MTB
Arcabit Trojan.Generic.D293789D
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.GenericKD.43219101
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
VBA32 TScope.Trojan.Delf
ALYac Backdoor.RAT.MSIL.NanoCore
Ad-Aware Trojan.GenericKD.43219101
Malwarebytes Trojan.MalPack.DLF
ESET-NOD32 a variant of Win32/Injector.EMHC
TrendMicro-HouseCall TROJ_GEN.R023C0DEQ20
Tencent Win32.Trojan.Kryptik.Lnem
Yandex Trojan.Igent.bTNsSi.19
Ikarus Trojan.Inject
eGambit Unsafe.AI_Score_99%
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46113c VirtualFree
• 0x461140 VirtualAlloc
• 0x461144 LocalFree
• 0x461148 LocalAlloc
• 0x46114c GetVersion
• 0x461150 GetCurrentThreadId
• 0x46115c VirtualQuery
• 0x461160 WideCharToMultiByte
• 0x461164 MultiByteToWideChar
• 0x461168 lstrlenA
• 0x46116c lstrcpynA
• 0x461170 LoadLibraryExA
• 0x461174 GetThreadLocale
• 0x461178 GetStartupInfoA
• 0x46117c GetProcAddress
• 0x461180 GetModuleHandleA
• 0x461184 GetModuleFileNameA
• 0x461188 GetLocaleInfoA
• 0x46118c GetCommandLineA
• 0x461190 FreeLibrary
• 0x461194 FindFirstFileA
• 0x461198 FindClose
• 0x46119c ExitProcess
• 0x4611a0 WriteFile
• 0x4611a8 RtlUnwind
• 0x4611ac RaiseException
• 0x4611b0 GetStdHandle
Library user32.dll:
• 0x4611b8 GetKeyboardType
• 0x4611bc LoadStringA
• 0x4611c0 MessageBoxA
• 0x4611c4 CharNextA
Library advapi32.dll:
• 0x4611cc RegQueryValueExA
• 0x4611d0 RegOpenKeyExA
• 0x4611d4 RegCloseKey
Library oleaut32.dll:
• 0x4611dc SysFreeString
• 0x4611e0 SysReAllocStringLen
• 0x4611e4 SysAllocStringLen
Library kernel32.dll:
• 0x4611ec TlsSetValue
• 0x4611f0 TlsGetValue
• 0x4611f4 LocalAlloc
• 0x4611f8 GetModuleHandleA
Library advapi32.dll:
• 0x461200 RegQueryValueExA
• 0x461204 RegOpenKeyExA
• 0x461208 RegCloseKey
Library kernel32.dll:
• 0x461210 lstrcpyA
• 0x461214 WriteFile
• 0x46121c WaitForSingleObject
• 0x461220 VirtualQuery
• 0x461224 VirtualAlloc
• 0x461228 Sleep
• 0x46122c SizeofResource
• 0x461230 SetThreadLocale
• 0x461234 SetFilePointer
• 0x461238 SetEvent
• 0x46123c SetErrorMode
• 0x461240 SetEndOfFile
• 0x461244 ResetEvent
• 0x461248 ReadFile
• 0x46124c MulDiv
• 0x461250 LockResource
• 0x461254 LoadResource
• 0x461258 LoadLibraryA
• 0x461264 GlobalUnlock
• 0x461268 GlobalReAlloc
• 0x46126c GlobalHandle
• 0x461270 GlobalLock
• 0x461274 GlobalFree
• 0x461278 GlobalFindAtomA
• 0x46127c GlobalDeleteAtom
• 0x461280 GlobalAlloc
• 0x461284 GlobalAddAtomA
• 0x461288 GetVersionExA
• 0x46128c GetVersion
• 0x461290 GetTickCount
• 0x461294 GetThreadLocale
• 0x46129c GetSystemTime
• 0x4612a0 GetSystemInfo
• 0x4612a4 GetStringTypeExA
• 0x4612a8 GetStdHandle
• 0x4612ac GetProcAddress
• 0x4612b0 GetModuleHandleA
• 0x4612b4 GetModuleFileNameA
• 0x4612b8 GetLocaleInfoA
• 0x4612bc GetLocalTime
• 0x4612c0 GetLastError
• 0x4612c4 GetFullPathNameA
• 0x4612c8 GetDiskFreeSpaceA
• 0x4612cc GetDateFormatA
• 0x4612d0 GetCurrentThreadId
• 0x4612d4 GetCurrentProcessId
• 0x4612d8 GetCPInfo
• 0x4612dc GetACP
• 0x4612e0 FreeResource
• 0x4612e4 InterlockedExchange
• 0x4612e8 FreeLibrary
• 0x4612ec FormatMessageA
• 0x4612f0 FindResourceA
• 0x4612f4 ExitThread
• 0x4612f8 EnumCalendarInfoA
• 0x461304 CreateThread
• 0x461308 CreateFileA
• 0x46130c CreateEventA
• 0x461310 CompareStringA
• 0x461314 CloseHandle
Library version.dll:
• 0x46131c VerQueryValueA
• 0x461324 GetFileVersionInfoA
Library gdi32.dll:
• 0x46132c UnrealizeObject
• 0x461330 StretchBlt
• 0x461334 SetWindowOrgEx
• 0x461338 SetViewportOrgEx
• 0x46133c SetTextColor
• 0x461340 SetStretchBltMode
• 0x461344 SetROP2
• 0x461348 SetPixel
• 0x46134c SetDIBColorTable
• 0x461350 SetBrushOrgEx
• 0x461354 SetBkMode
• 0x461358 SetBkColor
• 0x46135c SelectPalette
• 0x461360 SelectObject
• 0x461364 SelectClipPath
• 0x461368 SaveDC
• 0x46136c RestoreDC
• 0x461370 RectVisible
• 0x461374 RealizePalette
• 0x461378 PatBlt
• 0x46137c MoveToEx
• 0x461380 MaskBlt
• 0x461384 LineTo
• 0x461388 IntersectClipRect
• 0x46138c GetWindowOrgEx
• 0x461390 GetTextMetricsA
• 0x46139c GetStockObject
• 0x4613a0 GetPixel
• 0x4613a4 GetPaletteEntries
• 0x4613a8 GetObjectA
• 0x4613ac GetDeviceCaps
• 0x4613b0 GetDIBits
• 0x4613b4 GetDIBColorTable
• 0x4613b8 GetDCOrgEx
• 0x4613c0 GetClipBox
• 0x4613c4 GetBrushOrgEx
• 0x4613c8 GetBitmapBits
• 0x4613cc ExcludeClipRect
• 0x4613d0 DeleteObject
• 0x4613d4 DeleteDC
• 0x4613d8 CreateSolidBrush
• 0x4613dc CreatePenIndirect
• 0x4613e0 CreatePalette
• 0x4613e8 CreateFontIndirectA
• 0x4613ec CreateDIBitmap
• 0x4613f0 CreateDIBSection
• 0x4613f4 CreateCompatibleDC
• 0x4613fc CreateBrushIndirect
• 0x461400 CreateBitmap
• 0x461404 BitBlt
Library user32.dll:
• 0x46140c CreateWindowExA
• 0x461410 WindowFromPoint
• 0x461414 WinHelpA
• 0x461418 WaitMessage
• 0x46141c UpdateWindow
• 0x461420 UnregisterClassA
• 0x461424 UnhookWindowsHookEx
• 0x461428 TranslateMessage
• 0x461430 TrackPopupMenu
• 0x461438 ShowWindow
• 0x46143c ShowScrollBar
• 0x461440 ShowOwnedPopups
• 0x461444 ShowCursor
• 0x461448 SetWindowsHookExA
• 0x46144c SetWindowPos
• 0x461450 SetWindowPlacement
• 0x461454 SetWindowLongA
• 0x461458 SetTimer
• 0x46145c SetScrollRange
• 0x461460 SetScrollPos
• 0x461464 SetScrollInfo
• 0x461468 SetRect
• 0x46146c SetPropA
• 0x461470 SetParent
• 0x461474 SetMenuItemInfoA
• 0x461478 SetMenu
• 0x46147c SetForegroundWindow
• 0x461480 SetFocus
• 0x461484 SetCursor
• 0x461488 SetClassLongA
• 0x46148c SetCapture
• 0x461490 SetActiveWindow
• 0x461494 SendMessageA
• 0x461498 ScrollWindow
• 0x46149c ScreenToClient
• 0x4614a0 RemovePropA
• 0x4614a4 RemoveMenu
• 0x4614a8 ReleaseDC
• 0x4614ac ReleaseCapture
• 0x4614b8 RegisterClassA
• 0x4614bc RedrawWindow
• 0x4614c0 PtInRect
• 0x4614c4 PostQuitMessage
• 0x4614c8 PostMessageA
• 0x4614cc PeekMessageA
• 0x4614d0 OffsetRect
• 0x4614d4 OemToCharA
• 0x4614d8 MessageBoxA
• 0x4614dc MapWindowPoints
• 0x4614e0 MapVirtualKeyA
• 0x4614e4 LoadStringA
• 0x4614e8 LoadKeyboardLayoutA
• 0x4614ec LoadIconA
• 0x4614f0 LoadCursorA
• 0x4614f4 LoadBitmapA
• 0x4614f8 KillTimer
• 0x4614fc IsZoomed
• 0x461500 IsWindowVisible
• 0x461504 IsWindowEnabled
• 0x461508 IsWindow
• 0x46150c IsRectEmpty
• 0x461510 IsIconic
• 0x461514 IsDialogMessageA
• 0x461518 IsChild
• 0x46151c InvalidateRect
• 0x461520 IntersectRect
• 0x461524 InsertMenuItemA
• 0x461528 InsertMenuA
• 0x46152c InflateRect
• 0x461534 GetWindowTextA
• 0x461538 GetWindowRect
• 0x46153c GetWindowPlacement
• 0x461540 GetWindowLongA
• 0x461544 GetWindowDC
• 0x461548 GetTopWindow
• 0x46154c GetSystemMetrics
• 0x461550 GetSystemMenu
• 0x461554 GetSysColorBrush
• 0x461558 GetSysColor
• 0x46155c GetSubMenu
• 0x461560 GetScrollRange
• 0x461564 GetScrollPos
• 0x461568 GetScrollInfo
• 0x46156c GetPropA
• 0x461570 GetParent
• 0x461574 GetWindow
• 0x461578 GetMenuStringA
• 0x46157c GetMenuState
• 0x461580 GetMenuItemInfoA
• 0x461584 GetMenuItemID
• 0x461588 GetMenuItemCount
• 0x46158c GetMenu
• 0x461590 GetLastActivePopup
• 0x461594 GetKeyboardState
• 0x46159c GetKeyboardLayout
• 0x4615a0 GetKeyState
• 0x4615a4 GetKeyNameTextA
• 0x4615a8 GetIconInfo
• 0x4615ac GetForegroundWindow
• 0x4615b0 GetFocus
• 0x4615b4 GetDlgItem
• 0x4615b8 GetDesktopWindow
• 0x4615bc GetDCEx
• 0x4615c0 GetDC
• 0x4615c4 GetCursorPos
• 0x4615c8 GetCursor
• 0x4615cc GetClientRect
• 0x4615d0 GetClassNameA
• 0x4615d4 GetClassInfoA
• 0x4615d8 GetCapture
• 0x4615dc GetActiveWindow
• 0x4615e0 FrameRect
• 0x4615e4 FindWindowA
• 0x4615e8 FillRect
• 0x4615ec EqualRect
• 0x4615f0 EnumWindows
• 0x4615f4 EnumThreadWindows
• 0x4615f8 EndPaint
• 0x4615fc EnableWindow
• 0x461600 EnableScrollBar
• 0x461604 EnableMenuItem
• 0x461608 DrawTextA
• 0x46160c DrawMenuBar
• 0x461610 DrawIconEx
• 0x461614 DrawIcon
• 0x461618 DrawFrameControl
• 0x46161c DrawFocusRect
• 0x461620 DrawEdge
• 0x461624 DispatchMessageA
• 0x461628 DestroyWindow
• 0x46162c DestroyMenu
• 0x461630 DestroyIcon
• 0x461634 DestroyCursor
• 0x461638 DeleteMenu
• 0x46163c DefWindowProcA
• 0x461640 DefMDIChildProcA
• 0x461644 DefFrameProcA
• 0x461648 CreatePopupMenu
• 0x46164c CreateMenu
• 0x461650 CreateIcon
• 0x461654 ClientToScreen
• 0x461658 CheckMenuItem
• 0x46165c CallWindowProcA
• 0x461660 CallNextHookEx
• 0x461664 BeginPaint
• 0x461668 CharNextA
• 0x46166c CharLowerA
• 0x461670 CharToOemA
• 0x461674 AdjustWindowRectEx
Library kernel32.dll:
• 0x461680 Sleep
Library oleaut32.dll:
• 0x461688 SafeArrayPtrOfIndex
• 0x46168c SafeArrayGetUBound
• 0x461690 SafeArrayGetLBound
• 0x461694 SafeArrayCreate
• 0x461698 VariantChangeType
• 0x46169c VariantCopy
• 0x4616a0 VariantClear
• 0x4616a4 VariantInit
Library comctl32.dll:
• 0x4616b4 ImageList_Write
• 0x4616b8 ImageList_Read
• 0x4616c8 ImageList_DragMove
• 0x4616cc ImageList_DragLeave
• 0x4616d0 ImageList_DragEnter
• 0x4616d4 ImageList_EndDrag
• 0x4616d8 ImageList_BeginDrag
• 0x4616dc ImageList_Remove
• 0x4616e0 ImageList_DrawEx
• 0x4616e4 ImageList_Draw
• 0x4616f4 ImageList_Add
• 0x4616fc ImageList_Destroy
• 0x461700 ImageList_Create
• 0x461704 InitCommonControls
Library comdlg32.dll:
• 0x46170c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.