SmartHawk

2.0

低危

1 个模型检测该样本为恶意！

重新分析

下载样本

ca244b7185a431bfca1b7eea3532da3734365ce82490fe119cf56ece06336835

4d3d018fc69dd7be38cdd7e2a85b5972.exe

分析耗时

89s

最近分析

文件大小

9.1MB

静态报毒动态报毒 SWEETLABS

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀时间	查杀版本
McAfee	20201029	6.0.6.653
Alibaba	20190527	0.3.0.5
CrowdStrike	20190702	1.0
Avast	20201029	18.4.3895.0
Baidu	20190318	1.0.0.2
Kingsoft	20201029	2013.8.14.323
Tencent	20201029	1.0.0.1

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

ServiceHostApp.pdb

The file contains an unknown PE resource name possibly indicative of a packer (2 个事件)

resource name	IMAGE
resource name	TEXT

Foreign language identified in PE resource (50 out of 208 个事件)

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

name

RT_STRING

language

LANG_CHINESE

offset

0x008de654

filetype

data

sublanguage

*unknown*

size

0x00000058

File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)

DrWeb

Adware.SweetLabs.3

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-25 01:31:46

Imports

Library dbghelp.dll:

• 0xa9085c SymSetOptions

• 0xa90860 SymGetLineFromAddr64

• 0xa90864 SymFunctionTableAccess64

• 0xa90868 SymFromAddr

• 0xa9086c SymGetModuleBase64

• 0xa90870 StackWalk64

• 0xa90874 SymInitialize

• 0xa90878 MiniDumpWriteDump

Library MSIMG32.dll:

• 0xa90674 AlphaBlend

Library gdiplus.dll:

• 0xa90880 GdipCreateFromHWND

• 0xa90884 GdipAddPathLine

• 0xa90888 GdipClosePathFigures

• 0xa9088c GdipSetStringFormatTrimming

• 0xa90890 GdipSetStringFormatFlags

• 0xa90894 GdipCreateSolidFill

• 0xa90898 GdipDeleteFont

• 0xa9089c GdipCreateFont

• 0xa908a0 GdipDeleteFontFamily

• 0xa908a4 GdipGetGenericFontFamilySansSerif

• 0xa908a8 GdipCreateFontFamilyFromName

• 0xa908ac GdipFlush

• 0xa908b0 GdipDeletePath

• 0xa908b4 GdipCreatePath

• 0xa908b8 GdipDeleteStringFormat

• 0xa908bc GdipCreateStringFormat

• 0xa908c0 GdipDeletePen

• 0xa908c4 GdipCreatePen1

• 0xa908c8 GdipDeleteBrush

• 0xa908cc GdipGetImageEncoders

• 0xa908d0 GdipGetImageEncodersSize

• 0xa908d4 GdipBitmapSetPixel

• 0xa908d8 GdipBitmapGetPixel

• 0xa908dc GdipCreateBitmapFromHICON

• 0xa908e0 GdipDrawImageRectRectI

• 0xa908e4 GdipSetSmoothingMode

• 0xa908e8 GdipSetInterpolationMode

• 0xa908ec GdipSetCompositingMode

• 0xa908f0 GdipSetImageAttributesWrapMode

• 0xa908f4 GdipCreateBitmapFromHBITMAP

• 0xa908f8 GdipSaveImageToFile

• 0xa908fc GdipDrawImageRectI

• 0xa90900 GdipCloneBrush

• 0xa90904 GdipSetClipRectI

• 0xa90908 GdipDrawImage

• 0xa9090c GdipCreateBitmapFromFile

• 0xa90910 GdipCreateBitmapFromFileICM

• 0xa90914 GdipCreateBitmapFromScan0

• 0xa90918 GdipBitmapLockBits

• 0xa9091c GdipBitmapUnlockBits

• 0xa90920 GdipBitmapApplyEffect

• 0xa90924 GdipCloneImage

• 0xa90928 GdipCreateImageAttributes

• 0xa9092c GdipDisposeImageAttributes

• 0xa90930 GdipCreateFromHWNDICM

• 0xa90934 GdipDeleteGraphics

• 0xa90938 GdipMeasureString

• 0xa9093c GdipDrawString

• 0xa90940 GdipFillPath

• 0xa90944 GdipFillEllipse

• 0xa90948 GdipFillRectangle

• 0xa9094c GdiplusShutdown

• 0xa90950 GdipSetImageAttributesColorMatrix

• 0xa90954 GdiplusStartup

• 0xa90958 GdipFree

• 0xa9095c GdipSetCompositingQuality

• 0xa90960 GdipSetTextRenderingHint

• 0xa90964 GdipDrawLine

• 0xa90968 GdipDrawImageI

• 0xa9096c GdipGetImageGraphicsContext

• 0xa90970 GdipAlloc

• 0xa90974 GdipDeleteEffect

• 0xa90978 GdipSetEffectParameters

• 0xa9097c GdipCreateEffect

• 0xa90980 GdipGetImagePalette

• 0xa90984 GdipGetImagePaletteSize

• 0xa90988 GdipGetImagePixelFormat

• 0xa9098c GdipGetImageHeight

• 0xa90990 GdipGetImageWidth

• 0xa90994 GdipDrawImageRectRect

• 0xa90998 GdipGraphicsClear

• 0xa9099c GdipRotateWorldTransform

• 0xa909a0 GdipTranslateWorldTransform

• 0xa909a4 GdipCreateFromHDC

• 0xa909a8 GdipDrawLines

• 0xa909ac GdipDrawRectangle

• 0xa909b0 GdipDisposeImage

Library PSAPI.DLL:

• 0xa906d4 GetProcessMemoryInfo

• 0xa906d8 QueryWorkingSet

Library KERNEL32.dll:

• 0xa901dc GetSystemTimeAsFileTime

• 0xa901e0 QueryPerformanceFrequency

• 0xa901e4 SystemTimeToFileTime

• 0xa901e8 TzSpecificLocalTimeToSystemTime

• 0xa901ec SystemTimeToTzSpecificLocalTime

• 0xa901f0 FileTimeToSystemTime

• 0xa901f4 OpenProcess

• 0xa901f8 SetInformationJobObject

• 0xa901fc GetExitCodeProcess

• 0xa90200 CreateToolhelp32Snapshot

• 0xa90204 GetProcessIoCounters

• 0xa90208 VirtualQueryEx

• 0xa9020c HeapSetInformation

• 0xa90210 SetPriorityClass

• 0xa90214 AllocConsole

• 0xa90218 AttachConsole

• 0xa9021c Process32NextW

• 0xa90220 Process32FirstW

• 0xa90224 GetProcessHeaps

• 0xa90228 GetModuleHandleExA

• 0xa9022c DuplicateHandle

• 0xa90230 TerminateProcess

• 0xa90234 GetSystemInfo

• 0xa90238 ResumeThread

• 0xa9023c AssignProcessToJobObject

• 0xa90240 ReadFile

• 0xa90244 GetStdHandle

• 0xa90248 SetHandleInformation

• 0xa9024c CreatePipe

• 0xa90250 GetProcessTimes

• 0xa90254 InterlockedIncrement

• 0xa90258 RtlCaptureStackBackTrace

• 0xa9025c GetCurrentThread

• 0xa90260 GetDiskFreeSpaceExW

• 0xa90264 GlobalMemoryStatusEx

• 0xa90268 UnregisterWaitEx

• 0xa9026c RegisterWaitForSingleObject

• 0xa90270 InterlockedExchange

• 0xa90274 GetQueuedCompletionStatus

• 0xa90278 CreateIoCompletionPort

• 0xa9027c PostQueuedCompletionStatus

• 0xa90280 TerminateJobObject

• 0xa90284 InitializeCriticalSection

• 0xa90288 SignalObjectAndWait

• 0xa9028c GetProcessHandleCount

• 0xa90290 VirtualFree

• 0xa90294 VirtualAllocEx

• 0xa90298 FreeLibrary

• 0xa9029c LoadLibraryW

• 0xa902a0 WriteProcessMemory

• 0xa902a4 GetThreadContext

• 0xa902a8 MapViewOfFile

• 0xa902ac CreateFileMappingW

• 0xa902b0 InterlockedDecrement

• 0xa902b4 VirtualProtectEx

• 0xa902b8 GetFileAttributesW

• 0xa902bc QueryDosDeviceW

• 0xa902c0 GetLongPathNameW

• 0xa902c4 VirtualFreeEx

• 0xa902c8 CreateJobObjectW

• 0xa902cc CreateNamedPipeW

• 0xa902d0 SearchPathW

• 0xa902d4 GetCurrentDirectoryW

• 0xa902d8 LocalFree

• 0xa902dc ReadProcessMemory

• 0xa902e0 SuspendThread

• 0xa902e4 GetVersion

• 0xa902e8 WaitForMultipleObjects

• 0xa902ec WaitForSingleObject

• 0xa902f0 GetTimeZoneInformation

• 0xa902f4 SetHandleCount

• 0xa902f8 HeapAlloc

• 0xa902fc GetProcessHeap

• 0xa90300 HeapFree

• 0xa90304 VirtualQuery

• 0xa90308 MulDiv

• 0xa9030c GetModuleFileNameA

• 0xa90310 IsValidCodePage

• 0xa90314 GetOEMCP

• 0xa90318 GetACP

• 0xa9031c SetConsoleCtrlHandler

• 0xa90320 HeapCreate

• 0xa90324 GetDateFormatA

• 0xa90328 GetTimeFormatA

• 0xa9032c GetCPInfo

• 0xa90330 LCMapStringW

• 0xa90334 GetDateFormatW

• 0xa90338 GetTimeFormatW

• 0xa9033c ExitThread

• 0xa90340 FindFirstFileExA

• 0xa90344 GetDriveTypeA

• 0xa90348 FileTimeToLocalFileTime

• 0xa9034c ExitProcess

• 0xa90350 GetConsoleMode

• 0xa90354 GetConsoleCP

• 0xa90358 UnhandledExceptionFilter

• 0xa9035c GetStartupInfoW

• 0xa90360 GetCommandLineA

• 0xa90364 VirtualProtect

• 0xa90368 RtlUnwind

• 0xa9036c CreateWaitableTimerA

• 0xa90370 GetModuleHandleExW

• 0xa90374 TlsAlloc

• 0xa90378 TlsSetValue

• 0xa9037c TlsFree

• 0xa90380 TlsGetValue

• 0xa90384 SetThreadPriority

• 0xa90388 IsDebuggerPresent

• 0xa9038c InterlockedExchangeAdd

• 0xa90390 InterlockedCompareExchange

• 0xa90394 TryEnterCriticalSection

• 0xa90398 DeleteCriticalSection

• 0xa9039c InitializeCriticalSectionAndSpinCount

• 0xa903a0 GetModuleHandleA

• 0xa903a4 FormatMessageA

• 0xa903a8 OutputDebugStringA

• 0xa903ac WriteFile

• 0xa903b0 SetFilePointer

• 0xa903b4 CreateMutexW

• 0xa903b8 GetEnvironmentVariableW

• 0xa903bc CreateThread

• 0xa903c0 CreateTimerQueue

• 0xa903c4 GetProcessId

• 0xa903c8 CreateTimerQueueTimer

• 0xa903cc DeleteTimerQueue

• 0xa903d0 DeleteTimerQueueTimer

• 0xa903d4 CreateEventW

• 0xa903d8 GetTickCount

• 0xa903dc SetDllDirectoryW

• 0xa903e0 SetDefaultDllDirectories

• 0xa903e4 GetCommandLineW

• 0xa903e8 SetProcessShutdownParameters

• 0xa903ec SetUnhandledExceptionFilter

• 0xa903f0 Sleep

• 0xa903f4 GetLastError

• 0xa903f8 OpenEventW

• 0xa903fc ResetEvent

• 0xa90400 CreateDirectoryW

• 0xa90404 lstrlenA

• 0xa90408 CreateFileW

• 0xa9040c GetSystemPowerStatus

• 0xa90410 GetSystemTime

• 0xa90414 SetLastError

• 0xa90418 GetCurrentProcess

• 0xa9041c FlushInstructionCache

• 0xa90420 lstrlenW

• 0xa90424 GetModuleHandleW

• 0xa90428 GetProcAddress

• 0xa9042c LeaveCriticalSection

• 0xa90430 EnterCriticalSection

• 0xa90434 RaiseException

• 0xa90438 GetCurrentThreadId

• 0xa9043c SetEvent

• 0xa90440 WaitForSingleObjectEx

• 0xa90444 GetCurrentProcessId

• 0xa90448 ProcessIdToSessionId

• 0xa9044c CloseHandle

• 0xa90450 CreateEventA

• 0xa90454 WriteConsoleW

• 0xa90458 SetStdHandle

• 0xa9045c FatalAppExitA

• 0xa90460 GetFullPathNameA

• 0xa90464 CreateFileA

• 0xa90468 SetCurrentDirectoryW

• 0xa9046c SetEnvironmentVariableA

• 0xa90470 GetUserDefaultLCID

• 0xa90474 EnumSystemLocalesA

• 0xa90478 IsValidLocale

• 0xa9047c GetDriveTypeW

• 0xa90480 SetEndOfFile

• 0xa90484 GetStringTypeExA

• 0xa90488 SetConsoleMode

• 0xa9048c ReadConsoleA

• 0xa90490 WaitForMultipleObjectsEx

• 0xa90494 GetLogicalProcessorInformation

• 0xa90498 OpenEventA

• 0xa9049c SetWaitableTimer

• 0xa904a0 ReleaseSemaphore

• 0xa904a4 DecodePointer

• 0xa904a8 ReadConsoleW

• 0xa904ac FormatMessageW

• 0xa904b0 DeleteFiber

• 0xa904b4 SwitchToFiber

• 0xa904b8 CreateFiber

• 0xa904bc ConvertFiberToThread

• 0xa904c0 ConvertThreadToFiber

• 0xa904c4 FlushViewOfFile

• 0xa904c8 UnmapViewOfFile

• 0xa904cc UnlockFileEx

• 0xa904d0 UnlockFile

• 0xa904d4 EncodePointer

• 0xa904d8 GetStringTypeW

• 0xa904dc HeapSize

• 0xa904e0 HeapReAlloc

• 0xa904e4 HeapDestroy

• 0xa904e8 InterlockedPopEntrySList

• 0xa904ec VirtualAlloc

• 0xa904f0 IsProcessorFeaturePresent

• 0xa904f4 InterlockedPushEntrySList

• 0xa904f8 FindResourceA

• 0xa904fc GetLocaleInfoA

• 0xa90500 GlobalFree

• 0xa90504 GetUserGeoID

• 0xa90508 GetFileSize

• 0xa9050c GetConsoleDisplayMode

• 0xa90510 FreeConsole

• 0xa90514 GetExitCodeThread

• 0xa90518 TerminateThread

• 0xa9051c GetThreadPriority

• 0xa90520 LockFileEx

• 0xa90524 LockFile

• 0xa90528 HeapCompact

• 0xa9052c SetThreadLocale

• 0xa90530 GetThreadLocale

• 0xa90534 CreateMutexA

• 0xa90538 GetFileSizeEx

• 0xa9053c ConnectNamedPipe

• 0xa90540 WaitNamedPipeW

• 0xa90544 SetNamedPipeHandleState

• 0xa90548 GetNamedPipeInfo

• 0xa9054c FlushFileBuffers

• 0xa90550 DisconnectNamedPipe

• 0xa90554 GetCurrentPackageFamilyName

• 0xa90558 HeapValidate

• 0xa9055c GetVersionExA

• 0xa90560 GetTempPathA

• 0xa90564 GetStringTypeExW

• 0xa90568 LCMapStringA

• 0xa9056c GetFullPathNameW

• 0xa90570 GetModuleFileNameW

• 0xa90574 CreateProcessW

• 0xa90578 DeleteFileW

• 0xa9057c ReleaseMutex

• 0xa90580 ExpandEnvironmentStringsW

• 0xa90584 GetVersionExW

• 0xa90588 GetNativeSystemInfo

• 0xa9058c QueryPerformanceCounter

• 0xa90590 GetFileAttributesA

• 0xa90594 GetDiskFreeSpaceW

• 0xa90598 GetDiskFreeSpaceA

• 0xa9059c DeleteFileA

• 0xa905a0 CreateFileMappingA

• 0xa905a4 AreFileApisANSI

• 0xa905a8 SetFileAttributesA

• 0xa905ac DebugBreak

• 0xa905b0 VerifyVersionInfoW

• 0xa905b4 GetComputerNameW

• 0xa905b8 GetSystemDirectoryW

• 0xa905bc GetVolumeInformationW

• 0xa905c0 DosDateTimeToFileTime

• 0xa905c4 CompareStringW

• 0xa905c8 FindFirstFileExW

• 0xa905cc IsWow64Process

• 0xa905d0 GetFileInformationByHandle

• 0xa905d4 GetTempPathW

• 0xa905d8 ExpandEnvironmentStringsA

• 0xa905dc GetTempFileNameW

• 0xa905e0 GetFileAttributesExW

• 0xa905e4 FindResourceW

• 0xa905e8 FindResourceExW

• 0xa905ec SizeofResource

• 0xa905f0 LoadResource

• 0xa905f4 LockResource

• 0xa905f8 FreeResource

• 0xa905fc OutputDebugStringW

• 0xa90600 LoadLibraryExW

• 0xa90604 EnumResourceNamesW

• 0xa90608 SetEnvironmentVariableW

• 0xa9060c GetEnvironmentStringsW

• 0xa90610 VerifyVersionInfoA

• 0xa90614 VerSetConditionMask

• 0xa90618 GetSystemDirectoryA

• 0xa9061c LoadLibraryA

• 0xa90620 SleepEx

• 0xa90624 GetEnvironmentVariableA

• 0xa90628 PeekNamedPipe

• 0xa9062c GetFileType

• 0xa90630 MoveFileExA

• 0xa90634 MultiByteToWideChar

• 0xa90638 WideCharToMultiByte

• 0xa9063c LocalAlloc

• 0xa90640 GetUserDefaultUILanguage

• 0xa90644 GetSystemDefaultUILanguage

• 0xa90648 GetLocaleInfoEx

• 0xa9064c GetLocaleInfoW

• 0xa90650 FindFirstFileW

• 0xa90654 CreateDirectoryA

• 0xa90658 FindClose

• 0xa9065c FindNextFileW

• 0xa90660 MoveFileExW

• 0xa90664 CopyFileW

• 0xa90668 QueryFullProcessImageNameW

• 0xa9066c FreeEnvironmentStringsW

Library WTSAPI32.dll:

• 0xa9083c WTSEnumerateSessionsW

• 0xa90840 WTSFreeMemory

• 0xa90844 WTSQueryUserToken

• 0xa90848 WTSDisconnectSession

• 0xa9084c WTSRegisterSessionNotification

Library Secur32.dll:

• 0xa9071c GetUserNameExW

Library COMCTL32.dll:

• 0xa90138

• 0xa9013c

• 0xa90140

• 0xa90144 _TrackMouseEvent

Library POWRPROF.dll:

• 0xa906c8 GetPwrCapabilities

• 0xa906cc SetSuspendState

Library Normaliz.dll:

• 0xa9067c IdnToAscii

• 0xa90680 IdnToUnicode

Library WLDAP32.dll:

• 0xa9076c

• 0xa90770

• 0xa90774

• 0xa90778

• 0xa9077c

• 0xa90780

• 0xa90784

• 0xa90788

• 0xa9078c

• 0xa90790

• 0xa90794

• 0xa90798

• 0xa9079c

• 0xa907a0

• 0xa907a4

• 0xa907a8

• 0xa907ac

• 0xa907b0

Library GDI32.dll:

• 0xa90174 SetDIBits

• 0xa90178 CreateBitmap

• 0xa9017c GetTextExtentPoint32W

• 0xa90180 SetMapMode

• 0xa90184 GetTextMetricsW

• 0xa90188 CreateFontW

• 0xa9018c TextOutW

• 0xa90190 LPtoDP

• 0xa90194 SetDIBColorTable

• 0xa90198 GetStockObject

• 0xa9019c SetBrushOrgEx

• 0xa901a0 SetBkMode

• 0xa901a4 CreateDIBSection

• 0xa901a8 CreateCompatibleBitmap

• 0xa901ac CreateCompatibleDC

• 0xa901b0 SelectObject

• 0xa901b4 BitBlt

• 0xa901b8 DeleteDC

• 0xa901bc CreateSolidBrush

• 0xa901c0 GetObjectW

• 0xa901c4 CreateFontIndirectW

• 0xa901c8 DeleteObject

• 0xa901cc SetTextColor

• 0xa901d0 GetDeviceCaps

• 0xa901d4 GetDIBits

Library ADVAPI32.dll:

• 0xa90000 GetSidSubAuthority

• 0xa90004 CryptGetUserKey

• 0xa90008 CryptGetProvParam

• 0xa9000c RegOpenKeyExW

• 0xa90010 RegCreateKeyExW

• 0xa90014 RegDeleteKeyW

• 0xa90018 RegDeleteValueW

• 0xa9001c RegCloseKey

• 0xa90020 RegQueryValueExW

• 0xa90024 RegSetValueExW

• 0xa90028 CryptReleaseContext

• 0xa9002c CryptDestroyHash

• 0xa90030 CryptGetHashParam

• 0xa90034 CryptHashData

• 0xa90038 CryptCreateHash

• 0xa9003c CryptAcquireContextW

• 0xa90040 GetAce

• 0xa90044 AddAccessAllowedAceEx

• 0xa90048 AddAce

• 0xa9004c InitializeAcl

• 0xa90050 GetAclInformation

• 0xa90054 OpenThreadToken

• 0xa90058 RegOpenKeyW

• 0xa9005c LookupAccountNameW

• 0xa90060 GetSecurityDescriptorLength

• 0xa90064 FreeSid

• 0xa90068 AllocateAndInitializeSid

• 0xa9006c SetNamedSecurityInfoW

• 0xa90070 GetNamedSecurityInfoW

• 0xa90074 RegDeleteTreeW

• 0xa90078 RegCopyTreeW

• 0xa9007c RegFlushKey

• 0xa90080 DeregisterEventSource

• 0xa90084 ReportEventW

• 0xa90088 RegisterEventSourceW

• 0xa9008c CryptEnumProvidersW

• 0xa90090 CryptDestroyKey

• 0xa90094 SetEntriesInAclW

• 0xa90098 GetSecurityInfo

• 0xa9009c CryptDecrypt

• 0xa900a0 CryptSetHashParam

• 0xa900a4 CryptSignHashW

• 0xa900a8 CreateWellKnownSid

• 0xa900ac CopySid

• 0xa900b0 EqualSid

• 0xa900b4 DuplicateToken

• 0xa900b8 DuplicateTokenEx

• 0xa900bc CreateRestrictedToken

• 0xa900c0 SetThreadToken

• 0xa900c4 ConvertStringSecurityDescriptorToSecurityDescriptorW

• 0xa900c8 GetSecurityDescriptorSacl

• 0xa900cc SetSecurityInfo

• 0xa900d0 ConvertStringSidToSidW

• 0xa900d4 GetLengthSid

• 0xa900d8 SetTokenInformation

• 0xa900dc RevertToSelf

• 0xa900e0 RegDisablePredefinedCache

• 0xa900e4 RegisterTraceGuidsW

• 0xa900e8 TraceEvent

• 0xa900ec UnregisterTraceGuids

• 0xa900f0 GetTraceLoggerHandle

• 0xa900f4 GetTraceEnableFlags

• 0xa900f8 GetTraceEnableLevel

• 0xa900fc GetSidSubAuthorityCount

• 0xa90100 CreateProcessAsUserW

• 0xa90104 RegNotifyChangeKeyValue

• 0xa90108 RegEnumValueW

• 0xa9010c RegQueryInfoKeyW

• 0xa90110 GetTokenInformation

• 0xa90114 ConvertSidToStringSidW

• 0xa90118 GetCurrentHwProfileW

• 0xa9011c GetUserNameW

• 0xa90120 OpenProcessToken

• 0xa90124 LookupPrivilegeValueW

• 0xa90128 AdjustTokenPrivileges

• 0xa9012c RegEnumKeyExW

• 0xa90130 CryptExportKey

Library ole32.dll:

• 0xa909f0 CoSetProxyBlanket

• 0xa909f4 CoInitializeEx

• 0xa909f8 CoUninitialize

• 0xa909fc CoAllowSetForegroundWindow

• 0xa90a00 StringFromGUID2

• 0xa90a04 CoTaskMemFree

• 0xa90a08 OleUninitialize

• 0xa90a0c OleInitialize

• 0xa90a10 CoCreateGuid

• 0xa90a14 PropVariantClear

• 0xa90a18 CoInitializeSecurity

• 0xa90a1c CoCreateInstance

Library OLEAUT32.dll:

• 0xa90688 VariantChangeType

• 0xa9068c GetErrorInfo

• 0xa90690 SysStringLen

• 0xa90694 SafeArrayGetLBound

• 0xa90698 SafeArrayGetUBound

• 0xa9069c SafeArrayGetElement

• 0xa906a0 VariantCopy

• 0xa906a4 SysAllocStringLen

• 0xa906a8 SafeArrayDestroy

• 0xa906ac VariantClear

• 0xa906b0 SetErrorInfo

• 0xa906b4 SysFreeString

• 0xa906b8 VariantInit

• 0xa906bc SysAllocString

• 0xa906c0 CreateErrorInfo

Library libServiceHostApp.dll:

• 0xa909b8 ?Pump@IPokki@@SAXXZ

• 0xa909bc ?Destroy@IPokki@@SAXPAV1@_N@Z

• 0xa909c0 ?SetOSModal@IPokki@@SAX_N@Z

• 0xa909c4 ?PluginsUnload@IPokki@@SAXPB_W@Z

• 0xa909c8 ?PluginsRefresh@IPokki@@SAXP6AXXZ@Z

• 0xa909cc ?EnableBrowserPurge@IPokki@@SAX_N@Z

• 0xa909d0 ?DoIdleTasks@IPokki@@SAXXZ

• 0xa909d4 ?RunMessageLoop@IPokki@@SAXXZ

• 0xa909d8 ?libPokkiStart@@YAHPAXP6AHXZPB_W_N@Z

• 0xa909dc ?CreateInstance@IPokki@@SAPAV1@PB_W0PAVIPokkiListener@@@Z

Library SHLWAPI.dll:

• 0xa906f0 SHRegDuplicateHKey

• 0xa906f4 PathGetArgsW

• 0xa906f8 AssocQueryStringW

• 0xa906fc StrChrIW

• 0xa90700 SHDeleteKeyW

• 0xa90704 SHStrDupW

• 0xa90708 PathFileExistsW

• 0xa9070c StrRetToBufW

• 0xa90710

• 0xa90714

Library WINMM.dll:

• 0xa9075c timeGetTime

• 0xa90760 timeBeginPeriod

• 0xa90764 timeEndPeriod

Library RPCRT4.dll:

• 0xa906e0 RpcStringFreeW

• 0xa906e4 UuidCreateSequential

• 0xa906e8 UuidToStringW

Library msi.dll:

• 0xa909e4

• 0xa909e8

Exports

Ordinal	Address	Name
1	0x774ca0	_cJSON_AddArrayToObject@8
2	0x774990	_cJSON_AddBoolToObject@12
3	0x7748e0	_cJSON_AddFalseToObject@8
4	0x772e90	_cJSON_AddItemReferenceToArray@8
5	0x772ee0	_cJSON_AddItemReferenceToObject@12
6	0x772cf0	_cJSON_AddItemToArray@8
7	0x772dc0	_cJSON_AddItemToObject@12
8	0x772e30	_cJSON_AddItemToObjectCS@12
9	0x774780	_cJSON_AddNullToObject@8
10	0x774a40	_cJSON_AddNumberToObject@16

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	57757	239.255.255.250	3702
192.168.56.101	57875	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.