SmartHawk

8.8

极危

该样本未表现出任何异常！

重新分析

下载样本

e6830067cf3212d4ae98f325c5fd6bceeae78740b5e350e65c74d8c4d2e89845

403c4d3454a098be690f410922f4ca57.exe

分析耗时

99s

最近分析

文件大小

448.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619387286.94475 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619387275.49175 CryptGenKey	crypto_handle: 0x0037dcc8 algorithm_identifier: 0x0000660e () provider_handle: 0x0037d220 flags: 1 key: f*÷Zu2Í >Ï>¯"FRÂ	success	1
1619387286.96075 CryptExportKey	crypto_handle: 0x0037dcc8 crypto_export_handle: 0x0037d1e0 buffer: f¤ÎG!s0c6AæùÉõZÂ~Ç[]¯ûENÒ*K\|)¯»1O{\|Aò¥ %¤'y×¦éÍØx¡T¤Þ£5§ mü¦»3"w$É/úïÙ ^.BÀüó blob_type: 1 flags: 64	success	1
1619387316.28875 CryptExportKey	crypto_handle: 0x0037dcc8 crypto_export_handle: 0x0037d1e0 buffer: f¤9ð$A:nJ®wËJxVä_Û`2uÃ@,¹Ï=[¥ì$Ø;¤±ãnkI]uýÁß¯Y³BmíÒHÜ7íïCT.£vÒ¸¬ò_7FV¶ýén4 blob_type: 1 flags: 64	success	1
1619387333.52375 CryptExportKey	crypto_handle: 0x0037dcc8 crypto_export_handle: 0x0037d1e0 buffer: f¤n?5Ï!À_ 2¨²c(;H)R>/UYp]´*·ý¶¬=¾<âI_ÚÂËÚü3¼~WD{«"=ýÊ8ÈôÛ{ûa%,oàöOðZ¢ýlyZoxöÕÐÅ¥I blob_type: 1 flags: 64	success	1
1619387338.49175 CryptExportKey	crypto_handle: 0x0037dcc8 crypto_export_handle: 0x0037d1e0 buffer: f¤{T_"ýâæ¾¦ÄÈ= zªùbo88r¢;¶6¬}[òD ÷=c±TuºDT-½>9Lã·¯¥É°wÝ9½Ãè 6Må'Í+.Ï%ô)èÃæ blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619387267.429501 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01ee0000	success
1619386899.464396 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00000000050a0000	success
1619387275.08575 NtAllocateVirtualMemory	process_identifier: 1712 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01fd0000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Foreign language identified in PE resource (33 个事件)

name

RT_CURSOR

language

LANG_CHINESE

offset

0x00072e80

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

offset

0x00072e80

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000b4

name

RT_BITMAP

language

LANG_CHINESE

offset

0x00073858

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x00073858

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x00073858

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x00073858

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00073548

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e2

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00073548

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e2

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00073548

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e2

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000742c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00069f58

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00008544

name

RT_GROUP_CURSOR

language

LANG_CHINESE

offset

0x00072f38

filetype

Lotus unknown worksheet or configuration, revision 0x2

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000022

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00069ee0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000076

name

RT_VERSION

language

LANG_CHINESE

offset

0x00072a48

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000300

Creates a shortcut to an executable file (1 个事件)

file	C:\Users\Public\Desktop\Google Chrome.lnk

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619387316.28875 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x000003cc process_identifier: 3136	success	1	0
1619387333.52375 Process32NextW	process_name: inject-x64.exe snapshot_handle: 0x000003cc process_identifier: 3496	success	1	0

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619387269.273501 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\403c4d3454a098be690f410922f4ca57.exe newfilepath: C:\Windows\SysWOW64\wsock32\dbghelp.exe newfilepath_r: C:\Windows\SysWOW64\wsock32\dbghelp.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\403c4d3454a098be690f410922f4ca57.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619387289.67975 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

dbghelp.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619387288.22675 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	168.235.82.183
host	172.217.24.14
host	181.113.229.139
host	185.86.148.68
host	71.57.180.213

Installs itself for autorun at Windows startup (1 个事件)

service_name

dbghelp

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\wsock32\dbghelp.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619387273.429501 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x02a99028 display_name: dbghelp error_control: 0 service_name: dbghelp filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\wsock32\dbghelp.exe" filepath_r: "C:\Windows\SysWOW64\wsock32\dbghelp.exe" service_manager_handle: 0x02ab5e10 desired_access: 2 service_type: 16 password:	success	44666920	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619387292.24175 RegSetValueExA	key_handle: 0x000003cc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619387292.24175 RegSetValueExA	key_handle: 0x000003cc value: ¾õ9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619387292.24175 RegSetValueExA	key_handle: 0x000003cc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619387292.24175 RegSetValueExW	key_handle: 0x000003cc value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619387292.24175 RegSetValueExA	key_handle: 0x000003e4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619387292.24175 RegSetValueExA	key_handle: 0x000003e4 value: ¾õ9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619387292.24175 RegSetValueExA	key_handle: 0x000003e4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619387292.25775 RegSetValueExW	key_handle: 0x000003c8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\wsock32\dbghelp.exe:Zone.Identifier

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (7 个事件)

dead_host	192.168.56.101:49191
dead_host	172.217.24.14:443
dead_host	216.58.200.238:443
dead_host	172.217.160.110:443
dead_host	71.57.180.213:80
dead_host	185.86.148.68:443
dead_host	168.235.82.183:8080

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-15 02:46:41

Imports

Library WS2_32.dll:

• 0x42f4e0 shutdown

• 0x42f4e4 WSAStartup

• 0x42f4e8 WSACleanup

• 0x42f4ec send

• 0x42f4f0 recv

• 0x42f4f4 closesocket

• 0x42f4f8 WSAWaitForMultipleEvents

• 0x42f4fc WSACloseEvent

• 0x42f500 WSAEventSelect

• 0x42f504 WSACreateEvent

• 0x42f508 socket

• 0x42f50c inet_addr

• 0x42f510 WSAEnumNetworkEvents

• 0x42f514 connect

• 0x42f518 gethostbyaddr

• 0x42f51c htons

• 0x42f520 gethostbyname

Library KERNEL32.dll:

• 0x42f0bc FindClose

• 0x42f0c0 FindFirstFileA

• 0x42f0c4 GetVolumeInformationA

• 0x42f0c8 GetFullPathNameA

• 0x42f0cc FileTimeToSystemTime

• 0x42f0d0 FileTimeToLocalFileTime

• 0x42f0d4 GetTickCount

• 0x42f0d8 GetFileAttributesA

• 0x42f0dc GetFileSize

• 0x42f0e0 GetFileTime

• 0x42f0e4 RtlUnwind

• 0x42f0e8 CreateThread

• 0x42f0ec ExitThread

• 0x42f0f0 RaiseException

• 0x42f0f4 GetStartupInfoA

• 0x42f0f8 GetCommandLineA

• 0x42f0fc HeapAlloc

• 0x42f100 HeapFree

• 0x42f104 TerminateProcess

• 0x42f108 HeapReAlloc

• 0x42f10c HeapSize

• 0x42f110 GetACP

• 0x42f114 GetTimeZoneInformation

• 0x42f118 UnhandledExceptionFilter

• 0x42f11c SetUnhandledExceptionFilter

• 0x42f120 LCMapStringA

• 0x42f124 LCMapStringW

• 0x42f128 FreeEnvironmentStringsA

• 0x42f12c FreeEnvironmentStringsW

• 0x42f130 GetEnvironmentStrings

• 0x42f134 GetEnvironmentStringsW

• 0x42f138 GetStdHandle

• 0x42f13c GetFileType

• 0x42f140 HeapDestroy

• 0x42f144 HeapCreate

• 0x42f148 VirtualFree

• 0x42f14c VirtualAlloc

• 0x42f150 GetStringTypeA

• 0x42f154 GetStringTypeW

• 0x42f158 IsBadCodePtr

• 0x42f15c SetStdHandle

• 0x42f160 CompareStringA

• 0x42f164 CompareStringW

• 0x42f168 SetEnvironmentVariableA

• 0x42f16c GetProfileStringA

• 0x42f170 InterlockedExchange

• 0x42f174 ResetEvent

• 0x42f178 CreateEventA

• 0x42f17c CloseHandle

• 0x42f180 WaitForSingleObject

• 0x42f184 SetEvent

• 0x42f188 lstrlenA

• 0x42f18c Sleep

• 0x42f190 ExitProcess

• 0x42f194 InterlockedIncrement

• 0x42f198 InterlockedDecrement

• 0x42f19c WideCharToMultiByte

• 0x42f1a0 MultiByteToWideChar

• 0x42f1a4 LocalFree

• 0x42f1a8 FormatMessageA

• 0x42f1ac SetEndOfFile

• 0x42f1b0 UnlockFile

• 0x42f1b4 LockFile

• 0x42f1b8 FlushFileBuffers

• 0x42f1bc SetFilePointer

• 0x42f1c0 WriteFile

• 0x42f1c4 ReadFile

• 0x42f1c8 CreateFileA

• 0x42f1cc GetCurrentProcess

• 0x42f1d0 DuplicateHandle

• 0x42f1d4 SetErrorMode

• 0x42f1d8 GetOEMCP

• 0x42f1dc GetCPInfo

• 0x42f1e0 GetThreadLocale

• 0x42f1e4 SizeofResource

• 0x42f1e8 IsBadWritePtr

• 0x42f1ec IsBadReadPtr

• 0x42f1f0 GetCurrentThreadId

• 0x42f1f4 GetCurrentThread

• 0x42f1f8 lstrcmpiA

• 0x42f1fc lstrcmpA

• 0x42f200 GlobalDeleteAtom

• 0x42f204 WritePrivateProfileStringA

• 0x42f208 GlobalFlags

• 0x42f20c TlsGetValue

• 0x42f210 LocalReAlloc

• 0x42f214 TlsSetValue

• 0x42f218 GlobalReAlloc

• 0x42f21c TlsFree

• 0x42f220 GlobalHandle

• 0x42f224 TlsAlloc

• 0x42f228 LocalAlloc

• 0x42f22c GetProcessVersion

• 0x42f230 lstrcpynA

• 0x42f234 GetLastError

• 0x42f238 EnterCriticalSection

• 0x42f23c LeaveCriticalSection

• 0x42f240 DeleteCriticalSection

• 0x42f244 InitializeCriticalSection

• 0x42f248 MulDiv

• 0x42f24c SetLastError

• 0x42f250 LoadLibraryA

• 0x42f254 FreeLibrary

• 0x42f258 GetVersion

• 0x42f25c lstrcatA

• 0x42f260 GlobalAlloc

• 0x42f264 GlobalGetAtomNameA

• 0x42f268 GlobalAddAtomA

• 0x42f26c GlobalFindAtomA

• 0x42f270 lstrcpyA

• 0x42f274 GetModuleHandleA

• 0x42f278 GetProcAddress

• 0x42f27c GlobalUnlock

• 0x42f280 GlobalFree

• 0x42f284 LockResource

• 0x42f288 FindResourceA

• 0x42f28c LoadResource

• 0x42f290 GetModuleFileNameA

• 0x42f294 GlobalLock

• 0x42f298 SetHandleCount

Library USER32.dll:

• 0x42f2d0 GrayStringA

• 0x42f2d4 DestroyMenu

• 0x42f2d8 LoadCursorA

• 0x42f2dc GetSysColorBrush

• 0x42f2e0 GetDesktopWindow

• 0x42f2e4 GetClassNameA

• 0x42f2e8 PtInRect

• 0x42f2ec CharNextA

• 0x42f2f0 CopyAcceleratorTableA

• 0x42f2f4 SetRect

• 0x42f2f8 GetNextDlgGroupItem

• 0x42f2fc MessageBeep

• 0x42f300 InvalidateRect

• 0x42f304 CharUpperA

• 0x42f308 InflateRect

• 0x42f30c RegisterClipboardFormatA

• 0x42f310 PostThreadMessageA

• 0x42f314 GetDC

• 0x42f318 ClientToScreen

• 0x42f31c LoadStringA

• 0x42f320 wvsprintfA

• 0x42f324 ShowWindow

• 0x42f328 MoveWindow

• 0x42f32c SetWindowTextA

• 0x42f330 IsDialogMessageA

• 0x42f334 UpdateWindow

• 0x42f338 SendDlgItemMessageA

• 0x42f33c MapWindowPoints

• 0x42f340 GetSysColor

• 0x42f344 SetFocus

• 0x42f348 AdjustWindowRectEx

• 0x42f34c ScreenToClient

• 0x42f350 CopyRect

• 0x42f354 DrawTextA

• 0x42f358 GetTopWindow

• 0x42f35c IsChild

• 0x42f360 GetCapture

• 0x42f364 WinHelpA

• 0x42f368 wsprintfA

• 0x42f36c GetClassInfoA

• 0x42f370 RegisterClassA

• 0x42f374 GetMenu

• 0x42f378 GetMenuItemCount

• 0x42f37c GetSubMenu

• 0x42f380 GetMenuItemID

• 0x42f384 GetWindowTextLengthA

• 0x42f388 GetWindowTextA

• 0x42f38c GetDlgCtrlID

• 0x42f390 DefWindowProcA

• 0x42f394 CreateWindowExA

• 0x42f398 GetClassLongA

• 0x42f39c UnhookWindowsHookEx

• 0x42f3a0 GetPropA

• 0x42f3a4 CallWindowProcA

• 0x42f3a8 RemovePropA

• 0x42f3ac GetMessageTime

• 0x42f3b0 GetMessagePos

• 0x42f3b4 GetForegroundWindow

• 0x42f3b8 SetForegroundWindow

• 0x42f3bc SetWindowLongA

• 0x42f3c0 RegisterWindowMessageA

• 0x42f3c4 OffsetRect

• 0x42f3c8 IntersectRect

• 0x42f3cc SystemParametersInfoA

• 0x42f3d0 GetWindowPlacement

• 0x42f3d4 GetWindowRect

• 0x42f3d8 MapDialogRect

• 0x42f3dc SetWindowPos

• 0x42f3e0 GetWindow

• 0x42f3e4 SetWindowContextHelpId

• 0x42f3e8 EndDialog

• 0x42f3ec SetActiveWindow

• 0x42f3f0 IsWindow

• 0x42f3f4 CreateDialogIndirectParamA

• 0x42f3f8 DestroyWindow

• 0x42f3fc GetDlgItem

• 0x42f400 GetMenuCheckMarkDimensions

• 0x42f404 LoadBitmapA

• 0x42f408 GetMenuState

• 0x42f40c ModifyMenuA

• 0x42f410 SetMenuItemBitmaps

• 0x42f414 CheckMenuItem

• 0x42f418 EnableMenuItem

• 0x42f41c GetFocus

• 0x42f420 GetNextDlgTabItem

• 0x42f424 GetActiveWindow

• 0x42f428 GetKeyState

• 0x42f42c CallNextHookEx

• 0x42f430 ValidateRect

• 0x42f434 IsWindowVisible

• 0x42f438 GetCursorPos

• 0x42f43c SetWindowsHookExA

• 0x42f440 GetParent

• 0x42f444 GetLastActivePopup

• 0x42f448 IsWindowEnabled

• 0x42f44c GetWindowLongA

• 0x42f450 MessageBoxA

• 0x42f454 SetCursor

• 0x42f458 TabbedTextOutA

• 0x42f45c EndPaint

• 0x42f460 BeginPaint

• 0x42f464 GetWindowDC

• 0x42f468 ReleaseDC

• 0x42f46c PostMessageA

• 0x42f470 LoadIconA

• 0x42f474 EnableWindow

• 0x42f478 GetClientRect

• 0x42f47c IsIconic

• 0x42f480 GetSystemMenu

• 0x42f484 SendMessageA

• 0x42f488 AppendMenuA

• 0x42f48c DrawIcon

• 0x42f490 PostQuitMessage

• 0x42f494 GetSystemMetrics

• 0x42f498 GetMessageA

• 0x42f49c TranslateMessage

• 0x42f4a0 PeekMessageA

• 0x42f4a4 DispatchMessageA

• 0x42f4a8 MsgWaitForMultipleObjects

• 0x42f4ac IsWindowUnicode

• 0x42f4b0 DefDlgProcA

• 0x42f4b4 DrawFocusRect

• 0x42f4b8 ExcludeUpdateRgn

• 0x42f4bc ShowCaret

• 0x42f4c0 HideCaret

• 0x42f4c4 UnregisterClassA

• 0x42f4c8 SetPropA

Library GDI32.dll:

• 0x42f01c SetBkMode

• 0x42f020 SetMapMode

• 0x42f024 SetViewportOrgEx

• 0x42f028 OffsetViewportOrgEx

• 0x42f02c SetViewportExtEx

• 0x42f030 ScaleViewportExtEx

• 0x42f034 SetWindowExtEx

• 0x42f038 ScaleWindowExtEx

• 0x42f03c IntersectClipRect

• 0x42f040 DeleteObject

• 0x42f044 GetStockObject

• 0x42f048 GetDeviceCaps

• 0x42f04c GetViewportExtEx

• 0x42f050 GetWindowExtEx

• 0x42f054 CreateSolidBrush

• 0x42f058 PtVisible

• 0x42f05c RectVisible

• 0x42f060 TextOutA

• 0x42f064 ExtTextOutA

• 0x42f068 Escape

• 0x42f06c GetTextColor

• 0x42f070 GetBkColor

• 0x42f074 DPtoLP

• 0x42f078 LPtoDP

• 0x42f07c GetMapMode

• 0x42f080 PatBlt

• 0x42f084 SelectObject

• 0x42f088 RestoreDC

• 0x42f08c SaveDC

• 0x42f090 DeleteDC

• 0x42f094 GetObjectA

• 0x42f098 SetBkColor

• 0x42f09c SetTextColor

• 0x42f0a0 GetClipBox

• 0x42f0a4 GetTextExtentPointA

• 0x42f0a8 BitBlt

• 0x42f0ac CreateCompatibleDC

• 0x42f0b0 CreateDIBitmap

• 0x42f0b4 CreateBitmap

Library comdlg32.dll:

• 0x42f528 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42f4d0 DocumentPropertiesA

• 0x42f4d4 ClosePrinter

• 0x42f4d8 OpenPrinterA

Library ADVAPI32.dll:

• 0x42f000 RegCloseKey

• 0x42f004 RegSetValueExA

• 0x42f008 RegOpenKeyExA

• 0x42f00c RegCreateKeyExA

Library COMCTL32.dll:

• 0x42f014

Library oledlg.dll:

• 0x42f570

Library ole32.dll:

• 0x42f530 CoTaskMemFree

• 0x42f534 CreateILockBytesOnHGlobal

• 0x42f538 StgCreateDocfileOnILockBytes

• 0x42f53c OleInitialize

• 0x42f540 CoGetClassObject

• 0x42f544 CLSIDFromString

• 0x42f548 CoTaskMemAlloc

• 0x42f54c OleUninitialize

• 0x42f550 CoFreeUnusedLibraries

• 0x42f554 CLSIDFromProgID

• 0x42f558 OleIsCurrentClipboard

• 0x42f55c OleFlushClipboard

• 0x42f560 CoRevokeClassObject

• 0x42f564 CoRegisterMessageFilter

• 0x42f568 StgOpenStorageOnILockBytes

Library OLEPRO32.DLL:

• 0x42f2c8

Library OLEAUT32.dll:

• 0x42f2a0 SysAllocStringByteLen

• 0x42f2a4 SysStringLen

• 0x42f2a8 SysAllocString

• 0x42f2ac VariantChangeType

• 0x42f2b0 VariantCopy

• 0x42f2b4 VariantTimeToSystemTime

• 0x42f2b8 VariantClear

• 0x42f2bc SysAllocStringLen

• 0x42f2c0 SysFreeString

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238 A 172.217.160.110	172.217.24.14
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57236	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	58970	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.