SmartHawk

10.4

0-day

61 个模型检测该样本为恶意！

重新分析

下载样本

a83d00913bb5e3f6e95d31626388d67c0db45fbd098d68e63e88c0167f248620

4f0f049d514c094a0a56f1ff91c57e4b.exe

分析耗时

74s

最近分析

文件大小

629.5KB

静态报毒动态报毒 AI SCORE=88 AIDETECTVM ALI2000015 AUTOIT CLOUD CONFIDENCE DELF DELFINJECT DELPHI DELPHILESS EMTN EMUK FAREIT FORMBOOK GENERICIH GENERICKD HIGH CONFIDENCE HPCXYF KRYPTIK LOKIBOT MALWARE2 NANOCORE NGW@AMIGTAPI PDMT PHYA PMYIE PUTTY R002C0WGT20 S15398965 SCORE SUSGEN SUSPICIOUS PE TSCOPE UNSAFE X2091 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FPQ!4F0F049D514C	20200818	6.0.6.653
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20200818	18.4.3895.0
Kingsoft		20200818	2013.8.14.323
Tencent	Win32.Trojan.Kryptik.Pdmt	20200818	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619454412.9155 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619454417.9775 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619454422.5715 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619454411.1185 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619426984.747017 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619426985.091017 NtAllocateVirtualMemory	process_identifier: 428 region_size: 77824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x007f0000	success
1619426985.106017 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f40000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426985.122017 Process32NextW	process_name: conhost.exe snapshot_handle: 0x000000f4 process_identifier: 2268	success	1	0

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619454422.5405 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f0f049d514c094a0a56f1ff91c57e4b.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f0f049d514c094a0a56f1ff91c57e4b.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.434749579114764

section

{'size_of_data': '0x00023000', 'virtual_address': '0x00080000', 'entropy': 7.434749579114764, 'name': '.rsrc', 'virtual_size': '0x00022efc'}

description

A section with a high entropy has been found

entropy

0.22275258552108193

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619454417.8835 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 428 called NtSetContextThread to modify thread in remote process 1068
1619426985.669017 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1068	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 428 resumed a thread in remote process 1068
1619426985.934017 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 1068	success	0	0

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619426985.559017 CreateProcessInternalW	thread_identifier: 2272 thread_handle: 0x000000f8 process_identifier: 1068 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f0f049d514c094a0a56f1ff91c57e4b.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000fc inherit_handles: 0	success	1
1619426985.559017 NtUnmapViewOfSection	process_identifier: 1068 region_size: 4096 process_handle: 0x000000fc base_address: 0x00400000	success	0
1619426985.559017 NtMapViewOfSection	section_handle: 0x00000104 process_identifier: 1068 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000fc allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619426985.669017 NtGetContextThread	thread_handle: 0x000000f8	success	0
1619426985.669017 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1068	success	0
1619426985.934017 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 1068	success	0
1619454411.6655 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1068	success	0

File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34254058
FireEye	Generic.mg.4f0f049d514c094a
CAT-QuickHeal	Trojan.GenericIH.S15398965
McAfee	Fareit-FPQ!4F0F049D514C
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.754865
Sangfor	Malware
K7AntiVirus	Trojan ( 0056b6131 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Trojan ( 0056b6131 )
Cybereason	malicious.d9148f
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZelphiF.34152.NGW@amIgTapi
F-Prot	W32/Injector.JGW
Symantec	Trojan.Gen.MBT
TrendMicro-HouseCall	TROJ_GEN.R002C0WGT20
Avast	Win32:Trojan-gen
ClamAV	Win.Dropper.Nanocore-9235748-0
GData	Trojan.GenericKD.34254058
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.GenericKD.34254058
NANO-Antivirus	Trojan.Win32.Stealer.hpcxyf
Paloalto	generic.ml
AegisLab	Trojan.Multi.Generic.4!c
Rising	Trojan.Injector!1.C99D (CLOUD)
Ad-Aware	Trojan.GenericKD.34254058
Emsisoft	Trojan.GenericKD.34254058 (B)
F-Secure	Dropper.DR/Delphi.pmyie
DrWeb	Trojan.PWS.Stealer.19347
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0WGT20
SentinelOne	DFI - Suspicious PE
Sophos	Mal/Generic-S
APEX	Malicious
Cyren	W32/Injector.PHYA-6947
Jiangmin	Trojan.Kryptik.byu
Avira	DR/Delphi.pmyie
Antiy-AVL	Trojan/Win32.Kryptik
Arcabit	Trojan.Generic.D20AACEA
ViRobot	Trojan.Win32.Z.Kryptik.644608.J
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
Microsoft	Trojan:Win32/FormBook.DE!MTB
Cynet	Malicious (score: 90)
AhnLab-V3	Suspicious/Win.Delphiless.X2091
Acronis	suspicious
ALYac	Trojan.GenericKD.34254058
MAX	malware (ai score=88)
VBA32	TScope.Trojan.Delf

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47412c DeleteCriticalSection

• 0x474130 LeaveCriticalSection

• 0x474134 EnterCriticalSection

• 0x474138 InitializeCriticalSection

• 0x47413c VirtualFree

• 0x474140 VirtualAlloc

• 0x474144 LocalFree

• 0x474148 LocalAlloc

• 0x47414c GetVersion

• 0x474150 GetCurrentThreadId

• 0x474154 InterlockedDecrement

• 0x474158 InterlockedIncrement

• 0x47415c VirtualQuery

• 0x474160 WideCharToMultiByte

• 0x474164 MultiByteToWideChar

• 0x474168 lstrlenA

• 0x47416c lstrcpynA

• 0x474170 LoadLibraryExA

• 0x474174 GetThreadLocale

• 0x474178 GetStartupInfoA

• 0x47417c GetProcAddress

• 0x474180 GetModuleHandleA

• 0x474184 GetModuleFileNameA

• 0x474188 GetLocaleInfoA

• 0x47418c GetCommandLineA

• 0x474190 FreeLibrary

• 0x474194 FindFirstFileA

• 0x474198 FindClose

• 0x47419c ExitProcess

• 0x4741a0 WriteFile

• 0x4741a4 UnhandledExceptionFilter

• 0x4741a8 RtlUnwind

• 0x4741ac RaiseException

• 0x4741b0 GetStdHandle

Library user32.dll:

• 0x4741b8 GetKeyboardType

• 0x4741bc LoadStringA

• 0x4741c0 MessageBoxA

• 0x4741c4 CharNextA

Library advapi32.dll:

• 0x4741cc RegQueryValueExA

• 0x4741d0 RegOpenKeyExA

• 0x4741d4 RegCloseKey

Library oleaut32.dll:

• 0x4741dc SysFreeString

• 0x4741e0 SysReAllocStringLen

• 0x4741e4 SysAllocStringLen

Library kernel32.dll:

• 0x4741ec TlsSetValue

• 0x4741f0 TlsGetValue

• 0x4741f4 LocalAlloc

• 0x4741f8 GetModuleHandleA

Library advapi32.dll:

• 0x474200 RegQueryValueExA

• 0x474204 RegOpenKeyExA

• 0x474208 RegCloseKey

Library kernel32.dll:

• 0x474210 lstrcpyA

• 0x474214 WriteFile

• 0x474218 WaitForSingleObject

• 0x47421c VirtualQuery

• 0x474220 VirtualAlloc

• 0x474224 Sleep

• 0x474228 SizeofResource

• 0x47422c SetThreadLocale

• 0x474230 SetFilePointer

• 0x474234 SetEvent

• 0x474238 SetErrorMode

• 0x47423c SetEndOfFile

• 0x474240 ResetEvent

• 0x474244 ReadFile

• 0x474248 MulDiv

• 0x47424c LockResource

• 0x474250 LoadResource

• 0x474254 LoadLibraryA

• 0x474258 LeaveCriticalSection

• 0x47425c InitializeCriticalSection

• 0x474260 GlobalUnlock

• 0x474264 GlobalReAlloc

• 0x474268 GlobalHandle

• 0x47426c GlobalLock

• 0x474270 GlobalFree

• 0x474274 GlobalFindAtomA

• 0x474278 GlobalDeleteAtom

• 0x47427c GlobalAlloc

• 0x474280 GlobalAddAtomA

• 0x474284 GetVersionExA

• 0x474288 GetVersion

• 0x47428c GetTickCount

• 0x474290 GetThreadLocale

• 0x474294 GetSystemInfo

• 0x474298 GetStringTypeExA

• 0x47429c GetStdHandle

• 0x4742a0 GetProcAddress

• 0x4742a4 GetModuleHandleA

• 0x4742a8 GetModuleFileNameA

• 0x4742ac GetLocaleInfoA

• 0x4742b0 GetLocalTime

• 0x4742b4 GetLastError

• 0x4742b8 GetFullPathNameA

• 0x4742bc GetDiskFreeSpaceA

• 0x4742c0 GetDateFormatA

• 0x4742c4 GetCurrentThreadId

• 0x4742c8 GetCurrentProcessId

• 0x4742cc GetCPInfo

• 0x4742d0 GetACP

• 0x4742d4 FreeResource

• 0x4742d8 InterlockedExchange

• 0x4742dc FreeLibrary

• 0x4742e0 FormatMessageA

• 0x4742e4 FindResourceA

• 0x4742e8 EnumCalendarInfoA

• 0x4742ec EnterCriticalSection

• 0x4742f0 DeleteCriticalSection

• 0x4742f4 CreateThread

• 0x4742f8 CreateFileA

• 0x4742fc CreateEventA

• 0x474300 CompareStringA

• 0x474304 CloseHandle

Library version.dll:

• 0x47430c VerQueryValueA

• 0x474310 GetFileVersionInfoSizeA

• 0x474314 GetFileVersionInfoA

Library gdi32.dll:

• 0x47431c UnrealizeObject

• 0x474320 StretchBlt

• 0x474324 SetWindowOrgEx

• 0x474328 SetViewportOrgEx

• 0x47432c SetTextColor

• 0x474330 SetStretchBltMode

• 0x474334 SetROP2

• 0x474338 SetPixel

• 0x47433c SetDIBColorTable

• 0x474340 SetBrushOrgEx

• 0x474344 SetBkMode

• 0x474348 SetBkColor

• 0x47434c SelectPalette

• 0x474350 SelectObject

• 0x474354 SaveDC

• 0x474358 RestoreDC

• 0x47435c Rectangle

• 0x474360 RectVisible

• 0x474364 RealizePalette

• 0x474368 PtVisible

• 0x47436c PatBlt

• 0x474370 MoveToEx

• 0x474374 MaskBlt

• 0x474378 LineTo

• 0x47437c IntersectClipRect

• 0x474380 GetWindowOrgEx

• 0x474384 GetTextMetricsA

• 0x474388 GetTextExtentPoint32A

• 0x47438c GetSystemPaletteEntries

• 0x474390 GetStockObject

• 0x474394 GetPixel

• 0x474398 GetPaletteEntries

• 0x47439c GetObjectA

• 0x4743a0 GetDeviceCaps

• 0x4743a4 GetDIBits

• 0x4743a8 GetDIBColorTable

• 0x4743ac GetDCOrgEx

• 0x4743b0 GetCurrentPositionEx

• 0x4743b4 GetClipBox

• 0x4743b8 GetBrushOrgEx

• 0x4743bc GetBitmapBits

• 0x4743c0 ExcludeClipRect

• 0x4743c4 DeleteObject

• 0x4743c8 DeleteDC

• 0x4743cc CreateSolidBrush

• 0x4743d0 CreatePenIndirect

• 0x4743d4 CreatePen

• 0x4743d8 CreatePalette

• 0x4743dc CreateHalftonePalette

• 0x4743e0 CreateFontIndirectA

• 0x4743e4 CreateDIBitmap

• 0x4743e8 CreateDIBSection

• 0x4743ec CreateCompatibleDC

• 0x4743f0 CreateCompatibleBitmap

• 0x4743f4 CreateBrushIndirect

• 0x4743f8 CreateBitmap

• 0x4743fc BitBlt

Library user32.dll:

• 0x474404 CreateWindowExA

• 0x474408 WindowFromPoint

• 0x47440c WinHelpA

• 0x474410 WaitMessage

• 0x474414 ValidateRect

• 0x474418 UpdateWindow

• 0x47441c UnregisterClassA

• 0x474420 UnhookWindowsHookEx

• 0x474424 TranslateMessage

• 0x474428 TranslateMDISysAccel

• 0x47442c TrackPopupMenu

• 0x474430 SystemParametersInfoA

• 0x474434 ShowWindow

• 0x474438 ShowScrollBar

• 0x47443c ShowOwnedPopups

• 0x474440 ShowCursor

• 0x474444 SetWindowsHookExA

• 0x474448 SetWindowTextA

• 0x47444c SetWindowPos

• 0x474450 SetWindowPlacement

• 0x474454 SetWindowLongA

• 0x474458 SetTimer

• 0x47445c SetScrollRange

• 0x474460 SetScrollPos

• 0x474464 SetScrollInfo

• 0x474468 SetRect

• 0x47446c SetPropA

• 0x474470 SetParent

• 0x474474 SetMenuItemInfoA

• 0x474478 SetMenu

• 0x47447c SetForegroundWindow

• 0x474480 SetFocus

• 0x474484 SetCursor

• 0x474488 SetClassLongA

• 0x47448c SetCapture

• 0x474490 SetActiveWindow

• 0x474494 SendMessageA

• 0x474498 ScrollWindow

• 0x47449c ScreenToClient

• 0x4744a0 RemovePropA

• 0x4744a4 RemoveMenu

• 0x4744a8 ReleaseDC

• 0x4744ac ReleaseCapture

• 0x4744b0 RegisterWindowMessageA

• 0x4744b4 RegisterClipboardFormatA

• 0x4744b8 RegisterClassA

• 0x4744bc RedrawWindow

• 0x4744c0 PtInRect

• 0x4744c4 PostQuitMessage

• 0x4744c8 PostMessageA

• 0x4744cc PeekMessageA

• 0x4744d0 OffsetRect

• 0x4744d4 OemToCharA

• 0x4744d8 MessageBoxA

• 0x4744dc MessageBeep

• 0x4744e0 MapWindowPoints

• 0x4744e4 MapVirtualKeyA

• 0x4744e8 LoadStringA

• 0x4744ec LoadKeyboardLayoutA

• 0x4744f0 LoadIconA

• 0x4744f4 LoadCursorA

• 0x4744f8 LoadBitmapA

• 0x4744fc KillTimer

• 0x474500 IsZoomed

• 0x474504 IsWindowVisible

• 0x474508 IsWindowEnabled

• 0x47450c IsWindow

• 0x474510 IsRectEmpty

• 0x474514 IsIconic

• 0x474518 IsDialogMessageA

• 0x47451c IsChild

• 0x474520 InvalidateRect

• 0x474524 IntersectRect

• 0x474528 InsertMenuItemA

• 0x47452c InsertMenuA

• 0x474530 InflateRect

• 0x474534 GetWindowThreadProcessId

• 0x474538 GetWindowTextA

• 0x47453c GetWindowRect

• 0x474540 GetWindowPlacement

• 0x474544 GetWindowLongA

• 0x474548 GetWindowDC

• 0x47454c GetTopWindow

• 0x474550 GetSystemMetrics

• 0x474554 GetSystemMenu

• 0x474558 GetSysColorBrush

• 0x47455c GetSysColor

• 0x474560 GetSubMenu

• 0x474564 GetScrollRange

• 0x474568 GetScrollPos

• 0x47456c GetScrollInfo

• 0x474570 GetPropA

• 0x474574 GetParent

• 0x474578 GetWindow

• 0x47457c GetMenuStringA

• 0x474580 GetMenuState

• 0x474584 GetMenuItemInfoA

• 0x474588 GetMenuItemID

• 0x47458c GetMenuItemCount

• 0x474590 GetMenu

• 0x474594 GetLastActivePopup

• 0x474598 GetKeyboardState

• 0x47459c GetKeyboardLayoutList

• 0x4745a0 GetKeyboardLayout

• 0x4745a4 GetKeyState

• 0x4745a8 GetKeyNameTextA

• 0x4745ac GetIconInfo

• 0x4745b0 GetForegroundWindow

• 0x4745b4 GetFocus

• 0x4745b8 GetDlgItem

• 0x4745bc GetDesktopWindow

• 0x4745c0 GetDCEx

• 0x4745c4 GetDC

• 0x4745c8 GetCursorPos

• 0x4745cc GetCursor

• 0x4745d0 GetClientRect

• 0x4745d4 GetClassNameA

• 0x4745d8 GetClassInfoA

• 0x4745dc GetCapture

• 0x4745e0 GetActiveWindow

• 0x4745e4 FrameRect

• 0x4745e8 FindWindowA

• 0x4745ec FillRect

• 0x4745f0 EqualRect

• 0x4745f4 EnumWindows

• 0x4745f8 EnumThreadWindows

• 0x4745fc EndPaint

• 0x474600 EnableWindow

• 0x474604 EnableScrollBar

• 0x474608 EnableMenuItem

• 0x47460c DrawTextA

• 0x474610 DrawMenuBar

• 0x474614 DrawIconEx

• 0x474618 DrawIcon

• 0x47461c DrawFrameControl

• 0x474620 DrawFocusRect

• 0x474624 DrawEdge

• 0x474628 DispatchMessageA

• 0x47462c DestroyWindow

• 0x474630 DestroyMenu

• 0x474634 DestroyIcon

• 0x474638 DestroyCursor

• 0x47463c DeleteMenu

• 0x474640 DefWindowProcA

• 0x474644 DefMDIChildProcA

• 0x474648 DefFrameProcA

• 0x47464c CreatePopupMenu

• 0x474650 CreateMenu

• 0x474654 CreateIcon

• 0x474658 ClientToScreen

• 0x47465c CheckMenuItem

• 0x474660 CallWindowProcA

• 0x474664 CallNextHookEx

• 0x474668 BeginPaint

• 0x47466c CharNextA

• 0x474670 CharLowerA

• 0x474674 CharToOemA

• 0x474678 AdjustWindowRectEx

• 0x47467c ActivateKeyboardLayout

Library kernel32.dll:

• 0x474684 Sleep

Library oleaut32.dll:

• 0x47468c SafeArrayPtrOfIndex

• 0x474690 SafeArrayGetUBound

• 0x474694 SafeArrayGetLBound

• 0x474698 SafeArrayCreate

• 0x47469c VariantChangeType

• 0x4746a0 VariantCopy

• 0x4746a4 VariantClear

• 0x4746a8 VariantInit

Library comctl32.dll:

• 0x4746b0 ImageList_SetIconSize

• 0x4746b4 ImageList_GetIconSize

• 0x4746b8 ImageList_Write

• 0x4746bc ImageList_Read

• 0x4746c0 ImageList_GetDragImage

• 0x4746c4 ImageList_DragShowNolock

• 0x4746c8 ImageList_SetDragCursorImage

• 0x4746cc ImageList_DragMove

• 0x4746d0 ImageList_DragLeave

• 0x4746d4 ImageList_DragEnter

• 0x4746d8 ImageList_EndDrag

• 0x4746dc ImageList_BeginDrag

• 0x4746e0 ImageList_Remove

• 0x4746e4 ImageList_DrawEx

• 0x4746e8 ImageList_Replace

• 0x4746ec ImageList_Draw

• 0x4746f0 ImageList_GetBkColor

• 0x4746f4 ImageList_SetBkColor

• 0x4746f8 ImageList_ReplaceIcon

• 0x4746fc ImageList_Add

• 0x474700 ImageList_GetImageCount

• 0x474704 ImageList_Destroy

• 0x474708 ImageList_Create

• 0x47470c InitCommonControls

Library comdlg32.dll:

• 0x474714 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
beckhoff-th.com
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.