SmartHawk

6.2

高危

60 个模型检测该样本为恶意！

重新分析

下载样本

c7949573443efdf9faf7bdd96422dd515bc3576d8fce3091776333047524d1a2

4602a29f2d498dedbdfffac77e4286a1.exe

分析耗时

42s

最近分析

文件大小

723.0KB

静态报毒动态报毒 AI SCORE=86 AIDETECTVM ALI2000015 APHQ BSCOPE CLOUD CONFIDENCE DELF DELFINJECT DELPHILESS EMOP EMOY FAREIT HIGH CONFIDENCE HNUUEN HPLOKI KRYPTIK MALICIOUS PE MALWARE1 MALWARE@#D9AB0HYDXCE3 MODERATE NANOCORE NQWIO PABQ PASSWORDSTEALER PWSX SCORE SMBD SPYBOTNET SWOTTER TGX@AOHEKMKI TROJAN3 TROJANPSW TROJANPWS TSPY UNSAFE X2091 YZUU ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FTB!4602A29F2D49	20200729	6.0.6.653
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Avast	Win32:PWSX-gen [Trj]	20200729	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20200729	2013.8.14.323
Tencent	Win32.Trojan.Kryptik.Pabq	20200729	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619464047.28125 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34996036 registers.edi: 0 registers.eax: 0 registers.ebp: 34996104 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10 exception.symbol: 4602a29f2d498dedbdfffac77e4286a1+0x65396 exception.instruction: div eax exception.module: 4602a29f2d498dedbdfffac77e4286a1.exe exception.exception_code: 0xc0000094 exception.offset: 414614 exception.address: 0x465396	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (4 个事件)

Time & API	Arguments	Status
1619464047.14125 NtAllocateVirtualMemory	process_identifier: 784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00360000	success
1619464047.28125 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00465000	success
1619464047.28125 NtAllocateVirtualMemory	process_identifier: 784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x008c0000	success
1619486202.120501 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00a30000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.239090134691127

section

{'size_of_data': '0x0003be00', 'virtual_address': '0x0007f000', 'entropy': 7.239090134691127, 'name': '.rsrc', 'virtual_size': '0x0003bde0'}

description

A section with a high entropy has been found

entropy

0.33194733194733195

description

Overall entropy of this PE file is high

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 784 called NtSetContextThread to modify thread in remote process 2344
1619464047.56325 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4317872 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2344	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 784 resumed a thread in remote process 2344
1619464047.62525 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2344	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619464047.56325 CreateProcessInternalW	thread_identifier: 2984 thread_handle: 0x000000fc process_identifier: 2344 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4602a29f2d498dedbdfffac77e4286a1.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619464047.56325 NtUnmapViewOfSection	process_identifier: 2344 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619464047.56325 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 2344 commit_size: 184320 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 184320 base_address: 0x00400000	success	0
1619464047.56325 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619464047.56325 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4317872 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2344	success	0
1619464047.62525 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2344	success	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)

Bkav	W32.AIDetectVM.malware1
DrWeb	BackDoor.SpyBotNET.25
MicroWorld-eScan	Trojan.Delf.FareIt.Gen.7
FireEye	Generic.mg.4602a29f2d498ded
CAT-QuickHeal	TrojanPWS.Fareit
McAfee	Fareit-FTB!4602A29F2D49
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.749784
Sangfor	Malware
K7AntiVirus	Trojan ( 0056a5691 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Trojan ( 0056a5691 )
Cybereason	malicious.3018e9
Arcabit	Trojan.Delf.FareIt.Gen.7
TrendMicro	TSPY_HPLOKI.SMBD
BitDefenderTheta	Gen:NN.ZelphiF.34138.TGX@aOhEkMki
F-Prot	W32/Trojan3.APHQ
Symantec	Infostealer
ESET-NOD32	a variant of Win32/Injector.EMOP
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.Nanocore-8973483-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.Delf.FareIt.Gen.7
NANO-Antivirus	Trojan.Win32.Kryptik.hnuuen
Avast	Win32:PWSX-gen [Trj]
Rising	Trojan.Injector!1.C879 (CLOUD)
Ad-Aware	Trojan.Delf.FareIt.Gen.7
Emsisoft	Trojan.Delf.FareIt.Gen.7 (B)
Comodo	Malware@#d9ab0hydxce3
F-Secure	Trojan.TR/AD.Swotter.nqwio
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Cyren	W32/Trojan.YZUU-7588
Avira	TR/AD.Swotter.nqwio
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	PWS:Win32/Fareit.AQ!MTB
Endgame	malicious (high confidence)
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.Delf.FareIt.Gen.7
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2091
Acronis	suspicious
VBA32	BScope.TrojanPSW.Fareit
ALYac	Trojan.Delf.FareIt.Gen.7
MAX	malware (ai score=86)
Malwarebytes	Spyware.PasswordStealer

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x472154 DeleteCriticalSection

• 0x472158 LeaveCriticalSection

• 0x47215c EnterCriticalSection

• 0x472160 InitializeCriticalSection

• 0x472164 VirtualFree

• 0x472168 VirtualAlloc

• 0x47216c LocalFree

• 0x472170 LocalAlloc

• 0x472174 GetVersion

• 0x472178 GetCurrentThreadId

• 0x47217c InterlockedDecrement

• 0x472180 InterlockedIncrement

• 0x472184 VirtualQuery

• 0x472188 WideCharToMultiByte

• 0x47218c MultiByteToWideChar

• 0x472190 lstrlenA

• 0x472194 lstrcpynA

• 0x472198 LoadLibraryExA

• 0x47219c GetThreadLocale

• 0x4721a0 GetStartupInfoA

• 0x4721a4 GetProcAddress

• 0x4721a8 GetModuleHandleA

• 0x4721ac GetModuleFileNameA

• 0x4721b0 GetLocaleInfoA

• 0x4721b4 GetCommandLineA

• 0x4721b8 FreeLibrary

• 0x4721bc FindFirstFileA

• 0x4721c0 FindClose

• 0x4721c4 ExitProcess

• 0x4721c8 WriteFile

• 0x4721cc UnhandledExceptionFilter

• 0x4721d0 RtlUnwind

• 0x4721d4 RaiseException

• 0x4721d8 GetStdHandle

Library user32.dll:

• 0x4721e0 GetKeyboardType

• 0x4721e4 LoadStringA

• 0x4721e8 MessageBoxA

• 0x4721ec CharNextA

Library advapi32.dll:

• 0x4721f4 RegQueryValueExA

• 0x4721f8 RegOpenKeyExA

• 0x4721fc RegCloseKey

Library oleaut32.dll:

• 0x472204 SysFreeString

• 0x472208 SysReAllocStringLen

• 0x47220c SysAllocStringLen

Library kernel32.dll:

• 0x472214 TlsSetValue

• 0x472218 TlsGetValue

• 0x47221c LocalAlloc

• 0x472220 GetModuleHandleA

Library advapi32.dll:

• 0x472228 RegQueryValueExA

• 0x47222c RegOpenKeyExA

• 0x472230 RegCloseKey

Library kernel32.dll:

• 0x472238 lstrcpyA

• 0x47223c WriteFile

• 0x472240 WaitForSingleObject

• 0x472244 VirtualQuery

• 0x472248 VirtualProtectEx

• 0x47224c VirtualAlloc

• 0x472250 Sleep

• 0x472254 SizeofResource

• 0x472258 SetThreadLocale

• 0x47225c SetFilePointer

• 0x472260 SetEvent

• 0x472264 SetErrorMode

• 0x472268 SetEndOfFile

• 0x47226c ResetEvent

• 0x472270 ReadFile

• 0x472274 MultiByteToWideChar

• 0x472278 MulDiv

• 0x47227c LockResource

• 0x472280 LoadResource

• 0x472284 LoadLibraryA

• 0x472288 LeaveCriticalSection

• 0x47228c InitializeCriticalSection

• 0x472290 GlobalUnlock

• 0x472294 GlobalReAlloc

• 0x472298 GlobalHandle

• 0x47229c GlobalLock

• 0x4722a0 GlobalFree

• 0x4722a4 GlobalFindAtomA

• 0x4722a8 GlobalDeleteAtom

• 0x4722ac GlobalAlloc

• 0x4722b0 GlobalAddAtomA

• 0x4722b4 GetVersionExA

• 0x4722b8 GetVersion

• 0x4722bc GetTickCount

• 0x4722c0 GetThreadLocale

• 0x4722c4 GetSystemInfo

• 0x4722c8 GetStringTypeExA

• 0x4722cc GetStdHandle

• 0x4722d0 GetProcAddress

• 0x4722d4 GetModuleHandleA

• 0x4722d8 GetModuleFileNameA

• 0x4722dc GetLocaleInfoA

• 0x4722e0 GetLocalTime

• 0x4722e4 GetLastError

• 0x4722e8 GetFullPathNameA

• 0x4722ec GetFileAttributesA

• 0x4722f0 GetDiskFreeSpaceA

• 0x4722f4 GetDateFormatA

• 0x4722f8 GetCurrentThreadId

• 0x4722fc GetCurrentProcessId

• 0x472300 GetCurrentProcess

• 0x472304 GetCPInfo

• 0x472308 GetACP

• 0x47230c FreeResource

• 0x472310 InterlockedExchange

• 0x472314 FreeLibrary

• 0x472318 FormatMessageA

• 0x47231c FindResourceA

• 0x472320 FindFirstFileA

• 0x472324 FindClose

• 0x472328 FileTimeToLocalFileTime

• 0x47232c FileTimeToDosDateTime

• 0x472330 EnumCalendarInfoA

• 0x472334 EnterCriticalSection

• 0x472338 DeleteCriticalSection

• 0x47233c CreateThread

• 0x472340 CreateFileA

• 0x472344 CreateEventA

• 0x472348 CompareStringA

• 0x47234c CloseHandle

Library version.dll:

• 0x472354 VerQueryValueA

• 0x472358 GetFileVersionInfoSizeA

• 0x47235c GetFileVersionInfoA

Library gdi32.dll:

• 0x472364 UnrealizeObject

• 0x472368 StretchBlt

• 0x47236c SetWindowOrgEx

• 0x472370 SetWinMetaFileBits

• 0x472374 SetViewportOrgEx

• 0x472378 SetTextColor

• 0x47237c SetStretchBltMode

• 0x472380 SetROP2

• 0x472384 SetPixel

• 0x472388 SetEnhMetaFileBits

• 0x47238c SetDIBColorTable

• 0x472390 SetBrushOrgEx

• 0x472394 SetBkMode

• 0x472398 SetBkColor

• 0x47239c SelectPalette

• 0x4723a0 SelectObject

• 0x4723a4 SaveDC

• 0x4723a8 RestoreDC

• 0x4723ac Rectangle

• 0x4723b0 RectVisible

• 0x4723b4 RealizePalette

• 0x4723b8 Polyline

• 0x4723bc PlayEnhMetaFile

• 0x4723c0 PatBlt

• 0x4723c4 MoveToEx

• 0x4723c8 MaskBlt

• 0x4723cc LineTo

• 0x4723d0 IntersectClipRect

• 0x4723d4 GetWindowOrgEx

• 0x4723d8 GetWinMetaFileBits

• 0x4723dc GetTextMetricsA

• 0x4723e0 GetTextExtentPoint32A

• 0x4723e4 GetSystemPaletteEntries

• 0x4723e8 GetStockObject

• 0x4723ec GetPixel

• 0x4723f0 GetPaletteEntries

• 0x4723f4 GetObjectA

• 0x4723f8 GetEnhMetaFilePaletteEntries

• 0x4723fc GetEnhMetaFileHeader

• 0x472400 GetEnhMetaFileBits

• 0x472404 GetDeviceCaps

• 0x472408 GetDIBits

• 0x47240c GetDIBColorTable

• 0x472410 GetDCOrgEx

• 0x472414 GetCurrentPositionEx

• 0x472418 GetClipBox

• 0x47241c GetBrushOrgEx

• 0x472420 GetBitmapBits

• 0x472424 ExcludeClipRect

• 0x472428 EndPath

• 0x47242c DeleteObject

• 0x472430 DeleteEnhMetaFile

• 0x472434 DeleteDC

• 0x472438 CreateSolidBrush

• 0x47243c CreatePenIndirect

• 0x472440 CreatePalette

• 0x472444 CreateHalftonePalette

• 0x472448 CreateFontIndirectA

• 0x47244c CreateDIBitmap

• 0x472450 CreateDIBSection

• 0x472454 CreateCompatibleDC

• 0x472458 CreateCompatibleBitmap

• 0x47245c CreateBrushIndirect

• 0x472460 CreateBitmap

• 0x472464 CopyEnhMetaFileA

• 0x472468 BitBlt

Library user32.dll:

• 0x472470 CreateWindowExA

• 0x472474 WindowFromPoint

• 0x472478 WinHelpA

• 0x47247c WaitMessage

• 0x472480 UpdateWindow

• 0x472484 UnregisterClassA

• 0x472488 UnhookWindowsHookEx

• 0x47248c TranslateMessage

• 0x472490 TranslateMDISysAccel

• 0x472494 TrackPopupMenu

• 0x472498 SystemParametersInfoA

• 0x47249c ShowWindow

• 0x4724a0 ShowScrollBar

• 0x4724a4 ShowOwnedPopups

• 0x4724a8 ShowCursor

• 0x4724ac SetWindowsHookExA

• 0x4724b0 SetWindowPos

• 0x4724b4 SetWindowPlacement

• 0x4724b8 SetWindowLongA

• 0x4724bc SetTimer

• 0x4724c0 SetScrollRange

• 0x4724c4 SetScrollPos

• 0x4724c8 SetScrollInfo

• 0x4724cc SetRect

• 0x4724d0 SetPropA

• 0x4724d4 SetParent

• 0x4724d8 SetMenuItemInfoA

• 0x4724dc SetMenu

• 0x4724e0 SetForegroundWindow

• 0x4724e4 SetFocus

• 0x4724e8 SetCursor

• 0x4724ec SetClassLongA

• 0x4724f0 SetCapture

• 0x4724f4 SetActiveWindow

• 0x4724f8 SendMessageA

• 0x4724fc ScrollWindow

• 0x472500 ScreenToClient

• 0x472504 RemovePropA

• 0x472508 RemoveMenu

• 0x47250c ReleaseDC

• 0x472510 ReleaseCapture

• 0x472514 RegisterWindowMessageA

• 0x472518 RegisterClipboardFormatA

• 0x47251c RegisterClassA

• 0x472520 RedrawWindow

• 0x472524 PtInRect

• 0x472528 PostQuitMessage

• 0x47252c PostMessageA

• 0x472530 PeekMessageA

• 0x472534 OffsetRect

• 0x472538 OemToCharA

• 0x47253c MessageBoxA

• 0x472540 MapWindowPoints

• 0x472544 MapVirtualKeyA

• 0x472548 LoadStringA

• 0x47254c LoadKeyboardLayoutA

• 0x472550 LoadIconA

• 0x472554 LoadCursorA

• 0x472558 LoadBitmapA

• 0x47255c KillTimer

• 0x472560 IsZoomed

• 0x472564 IsWindowVisible

• 0x472568 IsWindowEnabled

• 0x47256c IsWindow

• 0x472570 IsRectEmpty

• 0x472574 IsIconic

• 0x472578 IsDialogMessageA

• 0x47257c IsChild

• 0x472580 InvalidateRect

• 0x472584 IntersectRect

• 0x472588 InsertMenuItemA

• 0x47258c InsertMenuA

• 0x472590 InflateRect

• 0x472594 GetWindowThreadProcessId

• 0x472598 GetWindowTextA

• 0x47259c GetWindowRect

• 0x4725a0 GetWindowPlacement

• 0x4725a4 GetWindowLongA

• 0x4725a8 GetWindowDC

• 0x4725ac GetTopWindow

• 0x4725b0 GetSystemMetrics

• 0x4725b4 GetSystemMenu

• 0x4725b8 GetSysColorBrush

• 0x4725bc GetSysColor

• 0x4725c0 GetSubMenu

• 0x4725c4 GetScrollRange

• 0x4725c8 GetScrollPos

• 0x4725cc GetScrollInfo

• 0x4725d0 GetPropA

• 0x4725d4 GetParent

• 0x4725d8 GetWindow

• 0x4725dc GetMenuStringA

• 0x4725e0 GetMenuState

• 0x4725e4 GetMenuItemInfoA

• 0x4725e8 GetMenuItemID

• 0x4725ec GetMenuItemCount

• 0x4725f0 GetMenu

• 0x4725f4 GetLastActivePopup

• 0x4725f8 GetKeyboardState

• 0x4725fc GetKeyboardLayoutList

• 0x472600 GetKeyboardLayout

• 0x472604 GetKeyState

• 0x472608 GetKeyNameTextA

• 0x47260c GetIconInfo

• 0x472610 GetForegroundWindow

• 0x472614 GetFocus

• 0x472618 GetDlgItem

• 0x47261c GetDesktopWindow

• 0x472620 GetDCEx

• 0x472624 GetDC

• 0x472628 GetCursorPos

• 0x47262c GetCursor

• 0x472630 GetClipboardData

• 0x472634 GetClientRect

• 0x472638 GetClassNameA

• 0x47263c GetClassInfoA

• 0x472640 GetCapture

• 0x472644 GetActiveWindow

• 0x472648 FrameRect

• 0x47264c FindWindowA

• 0x472650 FillRect

• 0x472654 EqualRect

• 0x472658 EnumWindows

• 0x47265c EnumThreadWindows

• 0x472660 EndPaint

• 0x472664 EnableWindow

• 0x472668 EnableScrollBar

• 0x47266c EnableMenuItem

• 0x472670 DrawTextA

• 0x472674 DrawMenuBar

• 0x472678 DrawIconEx

• 0x47267c DrawIcon

• 0x472680 DrawFrameControl

• 0x472684 DrawEdge

• 0x472688 DispatchMessageA

• 0x47268c DestroyWindow

• 0x472690 DestroyMenu

• 0x472694 DestroyIcon

• 0x472698 DestroyCursor

• 0x47269c DeleteMenu

• 0x4726a0 DefWindowProcA

• 0x4726a4 DefMDIChildProcA

• 0x4726a8 DefFrameProcA

• 0x4726ac CreatePopupMenu

• 0x4726b0 CreateMenu

• 0x4726b4 CreateIcon

• 0x4726b8 ClientToScreen

• 0x4726bc CheckMenuItem

• 0x4726c0 CallWindowProcA

• 0x4726c4 CallNextHookEx

• 0x4726c8 BeginPaint

• 0x4726cc CharNextA

• 0x4726d0 CharLowerBuffA

• 0x4726d4 CharLowerA

• 0x4726d8 CharUpperBuffA

• 0x4726dc CharToOemA

• 0x4726e0 AdjustWindowRectEx

• 0x4726e4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4726ec Sleep

Library oleaut32.dll:

• 0x4726f4 SafeArrayPtrOfIndex

• 0x4726f8 SafeArrayPutElement

• 0x4726fc SafeArrayGetElement

• 0x472700 SafeArrayUnaccessData

• 0x472704 SafeArrayAccessData

• 0x472708 SafeArrayGetUBound

• 0x47270c SafeArrayGetLBound

• 0x472710 SafeArrayCreate

• 0x472714 VariantChangeType

• 0x472718 VariantCopyInd

• 0x47271c VariantCopy

• 0x472720 VariantClear

• 0x472724 VariantInit

Library ole32.dll:

• 0x47272c CoCreateInstance

• 0x472730 CoGetMalloc

• 0x472734 CoUninitialize

• 0x472738 CoInitialize

Library oleaut32.dll:

• 0x472740 GetErrorInfo

• 0x472744 SysFreeString

Library comctl32.dll:

• 0x47274c ImageList_SetIconSize

• 0x472750 ImageList_GetIconSize

• 0x472754 ImageList_Write

• 0x472758 ImageList_Read

• 0x47275c ImageList_GetDragImage

• 0x472760 ImageList_DragShowNolock

• 0x472764 ImageList_SetDragCursorImage

• 0x472768 ImageList_DragMove

• 0x47276c ImageList_DragLeave

• 0x472770 ImageList_DragEnter

• 0x472774 ImageList_EndDrag

• 0x472778 ImageList_BeginDrag

• 0x47277c ImageList_Remove

• 0x472780 ImageList_DrawEx

• 0x472784 ImageList_Replace

• 0x472788 ImageList_Draw

• 0x47278c ImageList_GetBkColor

• 0x472790 ImageList_SetBkColor

• 0x472794 ImageList_ReplaceIcon

• 0x472798 ImageList_Add

• 0x47279c ImageList_GetImageCount

• 0x4727a0 ImageList_Destroy

• 0x4727a4 ImageList_Create

Library comdlg32.dll:

• 0x4727ac GetSaveFileNameA

• 0x4727b0 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.