SmartHawk

10.6

0-day

该样本未表现出任何异常！

重新分析

下载样本

e89edaf5576fc379d32ab5e1958cf413f2e12d279bf2fc6cd32a5dbe5ddf24ed

431ca77c187a51cc5105eef1ea28c882.exe

分析耗时

133s

最近分析

文件大小

432.1KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619418760.32625 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (6 个事件)

Time & API	Arguments	Status	Return
1619418750.67025 CryptGenKey	crypto_handle: 0x034f15f8 algorithm_identifier: 0x0000660e () provider_handle: 0x034f0848 flags: 1 key: f³ Ö#úYe÷sq»¤¹	success	1
1619418760.32625 CryptExportKey	crypto_handle: 0x034f15f8 crypto_export_handle: 0x034f14a0 buffer: f¤åB,(ãè.º ÏZå\|KS)I@Mb)´G¯7%¨m«VS6õN.í}TÄsÄ)Ê³#¢Ú'Ø÷¥JW¹AñÙHu¶Êÿ7Zz1ÝSÕµÐ blob_type: 1 flags: 64	success	1
1619418788.90425 CryptExportKey	crypto_handle: 0x034f15f8 crypto_export_handle: 0x034f14a0 buffer: f¤ÈÑÁÔ!öLÎkÞeÏþªzädÙI?ú_z-/`Òï("{H#2@¼g©æÂîMèEp\|¡#¯(ÑØËZñGÚ}heùà¸m#(K+bõ{qúèt blob_type: 1 flags: 64	success	1
1619418794.60725 CryptExportKey	crypto_handle: 0x034f15f8 crypto_export_handle: 0x034f14a0 buffer: f¤a,ËÒÛcýP§++dèz¦=°íþý ÖR0æ8°]}\¿ ·!,ãðBæ=\Pe¶é¾òÍoÀO lÎò´ìÚm³è° `[-«eZúO$åÃ_¾ blob_type: 1 flags: 64	success	1
1619418818.18625 CryptExportKey	crypto_handle: 0x034f15f8 crypto_export_handle: 0x034f14a0 buffer: f¤ÿ¾n¤Ä[\|VGàfQ9LÅ¤"Ø!wQTsªLVuJ«~>ÝaÒ¢ÎÌLÒ=:äÒóIbþÍ¦³¾¼95\ÝðbëH0;«v¨Õ\=¢ w blob_type: 1 flags: 64	success	1
1619418843.20125 CryptExportKey	crypto_handle: 0x034f15f8 crypto_export_handle: 0x034f14a0 buffer: f¤+O®ß1t³*å©=UÞúioÈ68±]¢mVA\ý¯/ì¬µÆÜÒüJbl·Z6câ2ñÝÎ"³mL÷BSn¿ìÈ¬7©«¿Jä=X blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 个事件)

suspicious_features	Connection to IP address				suspicious_request	POST http://104.131.41.185:8080/HZ4B9F/SeQiBud/xzuwx1dps6lB7teAezY/B8roNMg/eUBkxvaxahCPEAh2/
suspicious_features	POST method with no referer header				suspicious_request	POST https://update.googleapis.com/service/update2?cup2key=10:2457960391&cup2hreq=e01954a33fc733da29ee2a2d0d496c0db0f814cc45d4a28687a9512f1a27680f

Performs some HTTP requests (5 个事件)

request	POST http://104.131.41.185:8080/HZ4B9F/SeQiBud/xzuwx1dps6lB7teAezY/B8roNMg/eUBkxvaxahCPEAh2/
request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619389695&mv=m&mvi=1&pl=23&shardbypass=yes
request	HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=112c43c411143212&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619389695&mv=m
request	POST https://update.googleapis.com/service/update2?cup2key=10:2457960391&cup2hreq=e01954a33fc733da29ee2a2d0d496c0db0f814cc45d4a28687a9512f1a27680f

Sends data using the HTTP POST Method (2 个事件)

request	POST http://104.131.41.185:8080/HZ4B9F/SeQiBud/xzuwx1dps6lB7teAezY/B8roNMg/eUBkxvaxahCPEAh2/
request	POST https://update.googleapis.com/service/update2?cup2key=10:2457960391&cup2hreq=e01954a33fc733da29ee2a2d0d496c0db0f814cc45d4a28687a9512f1a27680f

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619418744.263875 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d30000	success
1619418379.798146 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004140000	success
1619418750.31125 NtAllocateVirtualMemory	process_identifier: 2080 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003c0000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a shortcut to an executable file (1 个事件)

file	C:\Users\Public\Desktop\Google Chrome.lnk

Drops a binary and executes it (1 个事件)

file	C:\Windows\SysWOW64\kbd103\ddodiag.exe

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619418745.169875 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\431ca77c187a51cc5105eef1ea28c882.exe newfilepath: C:\Windows\SysWOW64\kbd103\ddodiag.exe newfilepath_r: C:\Windows\SysWOW64\kbd103\ddodiag.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\431ca77c187a51cc5105eef1ea28c882.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619418761.38925 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.427959110276362

section

{'size_of_data': '0x00033000', 'virtual_address': '0x0003d000', 'entropy': 7.427959110276362, 'name': '.rsrc', 'virtual_size': '0x00032230'}

description

A section with a high entropy has been found

entropy

0.4766355140186916

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 个事件)

process

ddodiag.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619418761.17025 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (7 个事件)

host	104.131.41.185
host	172.217.24.14
host	181.30.61.163
host	188.135.15.49
host	209.126.6.222
host	5.153.250.14
host	203.208.41.33

Installs itself for autorun at Windows startup (1 个事件)

service_name

ddodiag

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\kbd103\ddodiag.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619418749.403875 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x033f9e08 display_name: ddodiag error_control: 0 service_name: ddodiag filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\kbd103\ddodiag.exe" filepath_r: "C:\Windows\SysWOW64\kbd103\ddodiag.exe" service_manager_handle: 0x033d6780 desired_access: 2 service_type: 16 password:	success	54500872	0

Deletes executed files from disk (1 个事件)

file	C:\Windows\SysWOW64\kbd103\ddodiag.exe

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619418763.95125 RegSetValueExA	key_handle: 0x000003bc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619418763.95125 RegSetValueExA	key_handle: 0x000003bc value: ð{J+:× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619418763.95125 RegSetValueExA	key_handle: 0x000003bc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619418763.95125 RegSetValueExW	key_handle: 0x000003bc value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619418763.95125 RegSetValueExA	key_handle: 0x000003d4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619418763.95125 RegSetValueExA	key_handle: 0x000003d4 value: ð{J+:× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619418763.95125 RegSetValueExA	key_handle: 0x000003d4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619418763.96725 RegSetValueExW	key_handle: 0x000003b8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\kbd103\ddodiag.exe:Zone.Identifier

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (8 个事件)

dead_host	172.217.160.110:443
dead_host	188.135.15.49:80
dead_host	172.217.24.14:443
dead_host	216.58.200.238:443
dead_host	209.126.6.222:8080
dead_host	5.153.250.14:8080
dead_host	192.168.56.101:49186
dead_host	181.30.61.163:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-21 19:29:20

Imports

Library KERNEL32.dll:

• 0x42c178 GetStartupInfoA

• 0x42c17c GetCommandLineA

• 0x42c180 TerminateProcess

• 0x42c184 HeapFree

• 0x42c188 CreateThread

• 0x42c18c ExitThread

• 0x42c190 RaiseException

• 0x42c194 HeapReAlloc

• 0x42c198 HeapSize

• 0x42c19c GetACP

• 0x42c1a0 GetTimeZoneInformation

• 0x42c1a4 GetSystemTime

• 0x42c1a8 GetLocalTime

• 0x42c1ac LCMapStringA

• 0x42c1b0 LCMapStringW

• 0x42c1b4 FatalAppExitA

• 0x42c1b8 Sleep

• 0x42c1bc HeapDestroy

• 0x42c1c0 HeapCreate

• 0x42c1c4 VirtualFree

• 0x42c1c8 VirtualAlloc

• 0x42c1cc IsBadWritePtr

• 0x42c1d0 UnhandledExceptionFilter

• 0x42c1d4 FreeEnvironmentStringsA

• 0x42c1d8 FreeEnvironmentStringsW

• 0x42c1dc HeapAlloc

• 0x42c1e0 GetEnvironmentStringsW

• 0x42c1e4 SetHandleCount

• 0x42c1e8 GetStdHandle

• 0x42c1ec GetFileType

• 0x42c1f0 SetUnhandledExceptionFilter

• 0x42c1f4 GetStringTypeA

• 0x42c1f8 GetStringTypeW

• 0x42c1fc IsBadReadPtr

• 0x42c200 IsBadCodePtr

• 0x42c204 IsValidLocale

• 0x42c208 IsValidCodePage

• 0x42c20c GetLocaleInfoA

• 0x42c210 EnumSystemLocalesA

• 0x42c214 GetUserDefaultLCID

• 0x42c218 GetVersionExA

• 0x42c21c SetConsoleCtrlHandler

• 0x42c220 SetStdHandle

• 0x42c224 GetLocaleInfoW

• 0x42c228 CompareStringA

• 0x42c22c CompareStringW

• 0x42c230 SetEnvironmentVariableA

• 0x42c234 RtlUnwind

• 0x42c238 GetProfileStringA

• 0x42c23c InterlockedExchange

• 0x42c240 FileTimeToLocalFileTime

• 0x42c244 FileTimeToSystemTime

• 0x42c248 SetFileAttributesA

• 0x42c24c SetFileTime

• 0x42c250 SystemTimeToFileTime

• 0x42c254 LocalFileTimeToFileTime

• 0x42c258 GetFileTime

• 0x42c25c GetFileSize

• 0x42c260 GetFileAttributesA

• 0x42c264 GetShortPathNameA

• 0x42c268 GetThreadLocale

• 0x42c26c GetStringTypeExA

• 0x42c270 GetFullPathNameA

• 0x42c274 GetVolumeInformationA

• 0x42c278 FindFirstFileA

• 0x42c27c FindClose

• 0x42c280 DeleteFileA

• 0x42c284 MoveFileA

• 0x42c288 SetEndOfFile

• 0x42c28c UnlockFile

• 0x42c290 LockFile

• 0x42c294 FlushFileBuffers

• 0x42c298 SetFilePointer

• 0x42c29c WriteFile

• 0x42c2a0 ReadFile

• 0x42c2a4 CreateFileA

• 0x42c2a8 GetCurrentProcess

• 0x42c2ac DuplicateHandle

• 0x42c2b0 SetErrorMode

• 0x42c2b4 FormatMessageA

• 0x42c2b8 GetOEMCP

• 0x42c2bc GetCPInfo

• 0x42c2c0 SizeofResource

• 0x42c2c4 GetProcessVersion

• 0x42c2c8 GetLastError

• 0x42c2cc GetCurrentDirectoryA

• 0x42c2d0 WritePrivateProfileStringA

• 0x42c2d4 GetPrivateProfileStringA

• 0x42c2d8 GetPrivateProfileIntA

• 0x42c2dc GlobalFlags

• 0x42c2e0 TlsGetValue

• 0x42c2e4 LocalReAlloc

• 0x42c2e8 TlsSetValue

• 0x42c2ec EnterCriticalSection

• 0x42c2f0 GlobalReAlloc

• 0x42c2f4 LeaveCriticalSection

• 0x42c2f8 TlsFree

• 0x42c2fc GlobalHandle

• 0x42c300 DeleteCriticalSection

• 0x42c304 TlsAlloc

• 0x42c308 InitializeCriticalSection

• 0x42c30c LocalFree

• 0x42c310 LocalAlloc

• 0x42c314 lstrcpynA

• 0x42c318 MulDiv

• 0x42c31c ExitProcess

• 0x42c320 SetLastError

• 0x42c324 MultiByteToWideChar

• 0x42c328 WideCharToMultiByte

• 0x42c32c lstrlenA

• 0x42c330 InterlockedIncrement

• 0x42c334 InterlockedDecrement

• 0x42c338 LoadLibraryA

• 0x42c33c FreeLibrary

• 0x42c340 GetVersion

• 0x42c344 lstrcatA

• 0x42c348 GlobalGetAtomNameA

• 0x42c34c GlobalAddAtomA

• 0x42c350 GlobalFindAtomA

• 0x42c354 lstrcpyA

• 0x42c358 GetModuleHandleA

• 0x42c35c GetProcAddress

• 0x42c360 GlobalUnlock

• 0x42c364 GlobalFree

• 0x42c368 LockResource

• 0x42c36c FindResourceA

• 0x42c370 LoadResource

• 0x42c374 CreateEventA

• 0x42c378 SuspendThread

• 0x42c37c SetThreadPriority

• 0x42c380 ResumeThread

• 0x42c384 SetEvent

• 0x42c388 WaitForSingleObject

• 0x42c38c CloseHandle

• 0x42c390 GetModuleFileNameA

• 0x42c394 GlobalLock

• 0x42c398 GlobalAlloc

• 0x42c39c GlobalDeleteAtom

• 0x42c3a0 lstrcmpA

• 0x42c3a4 lstrcmpiA

• 0x42c3a8 GetCurrentThread

• 0x42c3ac GetCurrentThreadId

• 0x42c3b0 GetEnvironmentStrings

Library USER32.dll:

• 0x42c3c4 ScrollWindow

• 0x42c3c8 EndDeferWindowPos

• 0x42c3cc CopyRect

• 0x42c3d0 BeginDeferWindowPos

• 0x42c3d4 DeferWindowPos

• 0x42c3d8 ScreenToClient

• 0x42c3dc AdjustWindowRectEx

• 0x42c3e0 SetFocus

• 0x42c3e4 MapWindowPoints

• 0x42c3e8 SendDlgItemMessageA

• 0x42c3ec CheckDlgButton

• 0x42c3f0 CheckRadioButton

• 0x42c3f4 GetDlgItemInt

• 0x42c3f8 GetDlgItemTextA

• 0x42c3fc SetDlgItemInt

• 0x42c400 SetDlgItemTextA

• 0x42c404 IsDlgButtonChecked

• 0x42c408 ScrollWindowEx

• 0x42c40c IsDialogMessageA

• 0x42c410 SetWindowTextA

• 0x42c414 MoveWindow

• 0x42c418 wvsprintfA

• 0x42c41c CharToOemA

• 0x42c420 OemToCharA

• 0x42c424 LoadStringA

• 0x42c428 DestroyMenu

• 0x42c42c ClientToScreen

• 0x42c430 GetWindowDC

• 0x42c434 BeginPaint

• 0x42c438 EndPaint

• 0x42c43c TabbedTextOutA

• 0x42c440 DrawTextA

• 0x42c444 GrayStringA

• 0x42c448 InflateRect

• 0x42c44c GetClassNameA

• 0x42c450 GetDesktopWindow

• 0x42c454 InsertMenuA

• 0x42c458 DeleteMenu

• 0x42c45c GetMenuStringA

• 0x42c460 LoadCursorA

• 0x42c464 GetSysColorBrush

• 0x42c468 GetDialogBaseUnits

• 0x42c46c CharUpperA

• 0x42c470 GetScrollRange

• 0x42c474 SetScrollRange

• 0x42c478 GetScrollPos

• 0x42c47c SetScrollPos

• 0x42c480 GetTopWindow

• 0x42c484 IsChild

• 0x42c488 GetCapture

• 0x42c48c WinHelpA

• 0x42c490 wsprintfA

• 0x42c494 GetClassInfoA

• 0x42c498 RegisterClassA

• 0x42c49c GetMenu

• 0x42c4a0 GetMenuItemCount

• 0x42c4a4 GetMenuItemID

• 0x42c4a8 TrackPopupMenu

• 0x42c4ac SetWindowPlacement

• 0x42c4b0 GetWindowTextLengthA

• 0x42c4b4 GetWindowTextA

• 0x42c4b8 GetDlgCtrlID

• 0x42c4bc DefWindowProcA

• 0x42c4c0 CreateWindowExA

• 0x42c4c4 GetClassLongA

• 0x42c4c8 SetPropA

• 0x42c4cc UnhookWindowsHookEx

• 0x42c4d0 GetPropA

• 0x42c4d4 CallWindowProcA

• 0x42c4d8 GetScrollInfo

• 0x42c4dc GetMessageTime

• 0x42c4e0 GetMessagePos

• 0x42c4e4 GetForegroundWindow

• 0x42c4e8 SetForegroundWindow

• 0x42c4ec GetWindow

• 0x42c4f0 SetWindowLongA

• 0x42c4f4 SetWindowPos

• 0x42c4f8 RegisterWindowMessageA

• 0x42c4fc OffsetRect

• 0x42c500 IntersectRect

• 0x42c504 GetWindowPlacement

• 0x42c508 GetWindowRect

• 0x42c50c EndDialog

• 0x42c510 SetActiveWindow

• 0x42c514 IsWindow

• 0x42c518 CreateDialogIndirectParamA

• 0x42c51c DestroyWindow

• 0x42c520 GetDlgItem

• 0x42c524 GetMenuCheckMarkDimensions

• 0x42c528 GetMenuState

• 0x42c52c ModifyMenuA

• 0x42c530 SetMenuItemBitmaps

• 0x42c534 CheckMenuItem

• 0x42c538 EnableMenuItem

• 0x42c53c GetFocus

• 0x42c540 GetNextDlgTabItem

• 0x42c544 GetMessageA

• 0x42c548 TranslateMessage

• 0x42c54c DispatchMessageA

• 0x42c550 GetActiveWindow

• 0x42c554 GetKeyState

• 0x42c558 CallNextHookEx

• 0x42c55c ValidateRect

• 0x42c560 IsWindowVisible

• 0x42c564 PeekMessageA

• 0x42c568 GetCursorPos

• 0x42c56c SetWindowsHookExA

• 0x42c570 GetParent

• 0x42c574 GetLastActivePopup

• 0x42c578 IsWindowEnabled

• 0x42c57c GetWindowLongA

• 0x42c580 MessageBoxA

• 0x42c584 SetCursor

• 0x42c588 ShowOwnedPopups

• 0x42c58c PostMessageA

• 0x42c590 PostQuitMessage

• 0x42c594 LoadBitmapA

• 0x42c598 InvalidateRect

• 0x42c59c UpdateWindow

• 0x42c5a0 GetSysColor

• 0x42c5a4 EqualRect

• 0x42c5a8 IsRectEmpty

• 0x42c5ac GetDC

• 0x42c5b0 ReleaseDC

• 0x42c5b4 LoadIconA

• 0x42c5b8 UnregisterClassA

• 0x42c5bc HideCaret

• 0x42c5c0 ShowCaret

• 0x42c5c4 ExcludeUpdateRgn

• 0x42c5c8 DrawFocusRect

• 0x42c5cc DefDlgProcA

• 0x42c5d0 CharNextA

• 0x42c5d4 LoadImageA

• 0x42c5d8 EnableWindow

• 0x42c5dc LoadMenuA

• 0x42c5e0 PtInRect

• 0x42c5e4 GetSubMenu

• 0x42c5e8 IsIconic

• 0x42c5ec GetSystemMetrics

• 0x42c5f0 GetClientRect

• 0x42c5f4 DrawIcon

• 0x42c5f8 SetScrollInfo

• 0x42c5fc RemovePropA

• 0x42c600 ShowScrollBar

• 0x42c604 GetSystemMenu

• 0x42c608 AppendMenuA

• 0x42c60c SendMessageA

• 0x42c610 ShowWindow

• 0x42c614 IsWindowUnicode

• 0x42c618 SystemParametersInfoA

Library GDI32.dll:

• 0x42c02c DeleteDC

• 0x42c030 StartDocA

• 0x42c034 SaveDC

• 0x42c038 RestoreDC

• 0x42c03c SelectObject

• 0x42c040 GetStockObject

• 0x42c044 SelectPalette

• 0x42c048 SetBkMode

• 0x42c04c SetPolyFillMode

• 0x42c050 SetROP2

• 0x42c054 SetStretchBltMode

• 0x42c058 SetMapMode

• 0x42c05c SetViewportOrgEx

• 0x42c060 OffsetViewportOrgEx

• 0x42c064 SetViewportExtEx

• 0x42c068 ScaleViewportExtEx

• 0x42c06c SetWindowOrgEx

• 0x42c070 OffsetWindowOrgEx

• 0x42c074 SetWindowExtEx

• 0x42c078 ScaleWindowExtEx

• 0x42c07c SelectClipRgn

• 0x42c080 ExcludeClipRect

• 0x42c084 IntersectClipRect

• 0x42c088 OffsetClipRgn

• 0x42c08c MoveToEx

• 0x42c090 LineTo

• 0x42c094 SetTextAlign

• 0x42c098 SetTextJustification

• 0x42c09c SetTextCharacterExtra

• 0x42c0a0 SetMapperFlags

• 0x42c0a4 GetCurrentPositionEx

• 0x42c0a8 ArcTo

• 0x42c0ac SetArcDirection

• 0x42c0b0 PolyDraw

• 0x42c0b4 SetBkColor

• 0x42c0b8 SetColorAdjustment

• 0x42c0bc PolyBezierTo

• 0x42c0c0 DeleteObject

• 0x42c0c4 GetClipRgn

• 0x42c0c8 CreateRectRgn

• 0x42c0cc SelectClipPath

• 0x42c0d0 ExtSelectClipRgn

• 0x42c0d4 PlayMetaFileRecord

• 0x42c0d8 GetObjectType

• 0x42c0dc EnumMetaFile

• 0x42c0e0 PlayMetaFile

• 0x42c0e4 GetDeviceCaps

• 0x42c0e8 GetViewportExtEx

• 0x42c0ec GetWindowExtEx

• 0x42c0f0 CreatePen

• 0x42c0f4 ExtCreatePen

• 0x42c0f8 CreateSolidBrush

• 0x42c0fc CreateHatchBrush

• 0x42c100 CreatePatternBrush

• 0x42c104 CreateDIBPatternBrushPt

• 0x42c108 PtVisible

• 0x42c10c RectVisible

• 0x42c110 TextOutA

• 0x42c114 ExtTextOutA

• 0x42c118 Escape

• 0x42c11c GetMapMode

• 0x42c120 PatBlt

• 0x42c124 SetRectRgn

• 0x42c128 CombineRgn

• 0x42c12c CreateRectRgnIndirect

• 0x42c130 CreateFontIndirectA

• 0x42c134 DPtoLP

• 0x42c138 GetTextExtentPoint32A

• 0x42c13c GetTextMetricsA

• 0x42c140 SetTextColor

• 0x42c144 GetClipBox

• 0x42c148 GetDCOrgEx

• 0x42c14c CreateBitmap

• 0x42c150 StretchBlt

• 0x42c154 CreateCompatibleDC

• 0x42c158 BitBlt

• 0x42c15c GetObjectA

• 0x42c160 CreateCompatibleBitmap

• 0x42c164 PolylineTo

• 0x42c168 CreateDIBitmap

• 0x42c16c GetTextExtentPointA

• 0x42c170 SetBitmapBits

Library comdlg32.dll:

• 0x42c630 GetOpenFileNameA

• 0x42c634 GetSaveFileNameA

• 0x42c638 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42c620 OpenPrinterA

• 0x42c624 DocumentPropertiesA

• 0x42c628 ClosePrinter

Library ADVAPI32.dll:

• 0x42c000 RegSetValueExA

• 0x42c004 RegOpenKeyA

• 0x42c008 RegDeleteKeyA

• 0x42c00c RegDeleteValueA

• 0x42c010 RegCloseKey

• 0x42c014 RegQueryValueExA

• 0x42c018 RegOpenKeyExA

• 0x42c01c RegCreateKeyExA

Library SHELL32.dll:

• 0x42c3b8 DragAcceptFiles

• 0x42c3bc SHGetFileInfoA

Library COMCTL32.dll:

• 0x42c024

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
r3---sn-j5o7dn7e.gvt1.com	CNAME r3.sn-j5o7dn7e.gvt1.com A 113.108.239.196	113.108.239.196
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
r1---sn-j5o7dn7e.gvt1.com	A 113.108.239.194 CNAME r1.sn-j5o7dn7e.gvt1.com	113.108.239.194
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com A 216.58.200.238	172.217.160.78
redirector.gvt1.com	A 203.208.41.97	203.208.41.33
update.googleapis.com	A 203.208.41.98	203.208.40.98
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49202	104.131.41.185	8080
192.168.56.101	49206	113.108.239.194 r1---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49207	113.108.239.196 r3---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49204	203.208.41.97 redirector.gvt1.com	80
192.168.56.101	49201	203.208.41.98 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53500	114.114.114.114	53
192.168.56.101	56743	114.114.114.114	53
192.168.56.101	58070	114.114.114.114	53
192.168.56.101	60088	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	54991	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619389695&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619389695&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=112c43c411143212&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619389695&mv=m	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=112c43c411143212&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619389695&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com
http://104.131.41.185:8080/HZ4B9F/SeQiBud/xzuwx1dps6lB7teAezY/B8roNMg/eUBkxvaxahCPEAh2/	POST /HZ4B9F/SeQiBud/xzuwx1dps6lB7teAezY/B8roNMg/eUBkxvaxahCPEAh2/ HTTP/1.1 Referer: http://104.131.41.185/HZ4B9F/SeQiBud/xzuwx1dps6lB7teAezY/B8roNMg/eUBkxvaxahCPEAh2/ Content-Type: multipart/form-data; boundary=---------------------------539684255096592 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 104.131.41.185:8080 Content-Length: 4532 Connection: Keep-Alive Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.