SmartHawk

6.2

高危

55 个模型检测该样本为恶意！

重新分析

下载样本

1610c286f6933db45cca3b92f09ab0eea7981fd11e1e502756ba57cb5bd75210

50e585105dbd4950d3bf81db22c5a2d5.exe

分析耗时

23s

最近分析

文件大小

730.0KB

静态报毒动态报毒 AI SCORE=86 AIDETECTVM ALI2000015 BUGEJC CLASSIC CLIPPER CONFIDENCE DELF DELFINJECT DELPHILESS EMZL ENAA FAREIT GENERICKD HIGH CONFIDENCE HRHBBU IGENT KRYPT KRYPTIK LOKI LOKIBOT MALWARE2 NANOCORE R002C0DHF20 SCORE SUSGEN SWBD TGW@AU3NP4EI TSCOPE UJUHV UNSAFE WNGWA@0 X2091 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FPQ!50E585105DBD	20200913	6.0.6.653
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft		20200913	2013.8.14.323
Tencent	Win32.Trojan.Kryptik.Swbd	20200913	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619438639.679375 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752cd4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a 50e585105dbd4950d3bf81db22c5a2d5+0x523f8 @ 0x4523f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff4314ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619438639.679375
__exception__

stacktrace:

RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752cd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
50e585105dbd4950d3bf81db22c5a2d5+0x523f8 @ 0x4523f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4314ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (28 个事件)

Time & API	Arguments	Status
1619426980.938046 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619426981.110046 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00461000	success
1619426981.126046 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00520000	success
1619438639.304375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619438639.351375 NtAllocateVirtualMemory	process_identifier: 3064 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01dd0000	success
1619438639.351375 NtAllocateVirtualMemory	process_identifier: 3064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e20000	success
1619438639.351375 NtAllocateVirtualMemory	process_identifier: 3064 region_size: 303104 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01dd0000	success
1619438639.351375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 278528 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01dd2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619438639.663375 NtProtectVirtualMemory	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426981.126046 Process32NextW	process_name: taskhost.exe snapshot_handle: 0x000000f4 process_identifier: 2436	success	1	0
1619426981.126046 Process32NextW	process_name: 50e585105dbd4950d3bf81db22c5a2d5.exe snapshot_handle: 0x000000f4 process_identifier: 2248	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.596616627223373

section

{'size_of_data': '0x0003ae00', 'virtual_address': '0x00082000', 'entropy': 7.596616627223373, 'name': '.rsrc', 'virtual_size': '0x0003ad50'}

description

A section with a high entropy has been found

entropy

0.3230452674897119

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2248 called NtSetContextThread to modify thread in remote process 3064
1619426981.501046 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4849392 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3064	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2248 resumed a thread in remote process 3064
1619426982.329046 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 3064	success	0	0

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619426981.391046 CreateProcessInternalW	thread_identifier: 428 thread_handle: 0x000000f8 process_identifier: 3064 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\50e585105dbd4950d3bf81db22c5a2d5.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000fc inherit_handles: 0	success	1
1619426981.391046 NtUnmapViewOfSection	process_identifier: 3064 region_size: 4096 process_handle: 0x000000fc base_address: 0x00400000	success	0
1619426981.391046 NtMapViewOfSection	section_handle: 0x00000104 process_identifier: 3064 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000fc allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619426981.501046 NtGetContextThread	thread_handle: 0x000000f8	success	0
1619426981.501046 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4849392 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3064	success	0
1619426982.329046 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 3064	success	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.50e585105dbd4950
McAfee	Fareit-FPQ!50E585105DBD
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
SUPERAntiSpyware	Trojan.Agent/Gen-Loki
Sangfor	Malware
K7AntiVirus	Trojan ( 0056c7bd1 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Trojan ( 0056c7bd1 )
Cybereason	malicious.ff81b8
Arcabit	Trojan.Generic.D29A3F50
TrendMicro	TROJ_GEN.R002C0DHF20
Symantec	Infostealer.Lokibot!43
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.GenericKD.43663184
NANO-Antivirus	Trojan.Win32.Kryptik.hrhbbu
MicroWorld-eScan	Trojan.GenericKD.43663184
Rising	Trojan.Kryptik!1.CAC0 (CLASSIC)
Ad-Aware	Trojan.GenericKD.43663184
Comodo	TrojWare.Win32.Agent.wngwa@0
F-Secure	Trojan.TR/Kryptik.ujuhv
DrWeb	Trojan.Clipper.8
Zillya	Trojan.Injector.Win32.762536
Invincea	Mal/Generic-S
Sophos	Mal/Generic-S
Jiangmin	Trojan.Kryptik.cdj
eGambit	Unsafe.AI_Score_99%
Avira	TR/Kryptik.ujuhv
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	Trojan:Win32/NanoCore.VD!MTB
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.GenericKD.43663184
AhnLab-V3	Suspicious/Win.Delphiless.X2091
BitDefenderTheta	Gen:NN.ZelphiF.34216.TGW@au3nP4ei
ALYac	Trojan.GenericKD.43663184
MAX	malware (ai score=86)
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
ESET-NOD32	a variant of Win32/Injector.ENAA
TrendMicro-HouseCall	TROJ_GEN.R002C0DHF20
Tencent	Win32.Trojan.Kryptik.Swbd
Yandex	Trojan.Igent.bUgEjc.1
Ikarus	Trojan.Win32.Krypt
MaxSecure	Trojan.Malware.300983.susgen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47512c DeleteCriticalSection

• 0x475130 LeaveCriticalSection

• 0x475134 EnterCriticalSection

• 0x475138 InitializeCriticalSection

• 0x47513c VirtualFree

• 0x475140 VirtualAlloc

• 0x475144 LocalFree

• 0x475148 LocalAlloc

• 0x47514c GetVersion

• 0x475150 GetCurrentThreadId

• 0x475154 InterlockedDecrement

• 0x475158 InterlockedIncrement

• 0x47515c VirtualQuery

• 0x475160 WideCharToMultiByte

• 0x475164 SetCurrentDirectoryA

• 0x475168 MultiByteToWideChar

• 0x47516c lstrlenA

• 0x475170 lstrcpynA

• 0x475174 LoadLibraryExA

• 0x475178 GetThreadLocale

• 0x47517c GetStartupInfoA

• 0x475180 GetProcAddress

• 0x475184 GetModuleHandleA

• 0x475188 GetModuleFileNameA

• 0x47518c GetLocaleInfoA

• 0x475190 GetLastError

• 0x475194 GetCurrentDirectoryA

• 0x475198 GetCommandLineA

• 0x47519c FreeLibrary

• 0x4751a0 FindFirstFileA

• 0x4751a4 FindClose

• 0x4751a8 ExitProcess

• 0x4751ac WriteFile

• 0x4751b0 UnhandledExceptionFilter

• 0x4751b4 RtlUnwind

• 0x4751b8 RaiseException

• 0x4751bc GetStdHandle

Library user32.dll:

• 0x4751c4 GetKeyboardType

• 0x4751c8 LoadStringA

• 0x4751cc MessageBoxA

• 0x4751d0 CharNextA

Library advapi32.dll:

• 0x4751d8 RegQueryValueExA

• 0x4751dc RegOpenKeyExA

• 0x4751e0 RegCloseKey

Library oleaut32.dll:

• 0x4751e8 SysFreeString

• 0x4751ec SysReAllocStringLen

• 0x4751f0 SysAllocStringLen

Library kernel32.dll:

• 0x4751f8 TlsSetValue

• 0x4751fc TlsGetValue

• 0x475200 LocalAlloc

• 0x475204 GetModuleHandleA

Library advapi32.dll:

• 0x47520c RegQueryValueExA

• 0x475210 RegOpenKeyExA

• 0x475214 RegCloseKey

Library kernel32.dll:

• 0x47521c lstrcpyA

• 0x475220 WriteFile

• 0x475224 WaitForSingleObject

• 0x475228 VirtualQuery

• 0x47522c VirtualProtect

• 0x475230 VirtualAlloc

• 0x475234 Sleep

• 0x475238 SizeofResource

• 0x47523c SetThreadLocale

• 0x475240 SetFilePointer

• 0x475244 SetEvent

• 0x475248 SetErrorMode

• 0x47524c SetEndOfFile

• 0x475250 ResetEvent

• 0x475254 ReadFile

• 0x475258 MulDiv

• 0x47525c LockResource

• 0x475260 LoadResource

• 0x475264 LoadLibraryA

• 0x475268 LeaveCriticalSection

• 0x47526c InitializeCriticalSection

• 0x475270 GlobalUnlock

• 0x475274 GlobalReAlloc

• 0x475278 GlobalHandle

• 0x47527c GlobalLock

• 0x475280 GlobalFree

• 0x475284 GlobalFindAtomA

• 0x475288 GlobalDeleteAtom

• 0x47528c GlobalAlloc

• 0x475290 GlobalAddAtomA

• 0x475294 GetVolumeInformationA

• 0x475298 GetVersionExA

• 0x47529c GetVersion

• 0x4752a0 GetTickCount

• 0x4752a4 GetThreadLocale

• 0x4752a8 GetSystemTimeAsFileTime

• 0x4752ac GetSystemInfo

• 0x4752b0 GetStringTypeExA

• 0x4752b4 GetStdHandle

• 0x4752b8 GetProcAddress

• 0x4752bc GetModuleHandleA

• 0x4752c0 GetModuleFileNameA

• 0x4752c4 GetLocaleInfoA

• 0x4752c8 GetLocalTime

• 0x4752cc GetLastError

• 0x4752d0 GetFullPathNameA

• 0x4752d4 GetFileAttributesA

• 0x4752d8 GetDiskFreeSpaceA

• 0x4752dc GetDateFormatA

• 0x4752e0 GetCurrentThreadId

• 0x4752e4 GetCurrentProcessId

• 0x4752e8 GetCPInfo

• 0x4752ec GetACP

• 0x4752f0 FreeResource

• 0x4752f4 InterlockedExchange

• 0x4752f8 FreeLibrary

• 0x4752fc FormatMessageA

• 0x475300 FindResourceA

• 0x475304 FindNextFileA

• 0x475308 FindFirstFileA

• 0x47530c FindClose

• 0x475310 FileTimeToSystemTime

• 0x475314 FileTimeToLocalFileTime

• 0x475318 FileTimeToDosDateTime

• 0x47531c EnumCalendarInfoA

• 0x475320 EnterCriticalSection

• 0x475324 DeleteCriticalSection

• 0x475328 CreateThread

• 0x47532c CreateFileA

• 0x475330 CreateEventA

• 0x475334 CompareStringA

• 0x475338 CloseHandle

Library version.dll:

• 0x475340 VerQueryValueA

• 0x475344 GetFileVersionInfoSizeA

• 0x475348 GetFileVersionInfoA

Library gdi32.dll:

• 0x475350 UnrealizeObject

• 0x475354 StretchBlt

• 0x475358 SetWindowOrgEx

• 0x47535c SetWinMetaFileBits

• 0x475360 SetViewportOrgEx

• 0x475364 SetTextColor

• 0x475368 SetStretchBltMode

• 0x47536c SetROP2

• 0x475370 SetPixel

• 0x475374 SetEnhMetaFileBits

• 0x475378 SetDIBColorTable

• 0x47537c SetBrushOrgEx

• 0x475380 SetBkMode

• 0x475384 SetBkColor

• 0x475388 SelectPalette

• 0x47538c SelectObject

• 0x475390 SelectClipRgn

• 0x475394 SaveDC

• 0x475398 RestoreDC

• 0x47539c Rectangle

• 0x4753a0 RectVisible

• 0x4753a4 RealizePalette

• 0x4753a8 Polyline

• 0x4753ac PlayEnhMetaFile

• 0x4753b0 PatBlt

• 0x4753b4 MoveToEx

• 0x4753b8 MaskBlt

• 0x4753bc LineTo

• 0x4753c0 IntersectClipRect

• 0x4753c4 GetWindowOrgEx

• 0x4753c8 GetWinMetaFileBits

• 0x4753cc GetTextMetricsA

• 0x4753d0 GetTextExtentPoint32A

• 0x4753d4 GetSystemPaletteEntries

• 0x4753d8 GetStockObject

• 0x4753dc GetPixel

• 0x4753e0 GetPaletteEntries

• 0x4753e4 GetObjectA

• 0x4753e8 GetEnhMetaFilePaletteEntries

• 0x4753ec GetEnhMetaFileHeader

• 0x4753f0 GetEnhMetaFileBits

• 0x4753f4 GetDeviceCaps

• 0x4753f8 GetDIBits

• 0x4753fc GetDIBColorTable

• 0x475400 GetDCOrgEx

• 0x475404 GetCurrentPositionEx

• 0x475408 GetClipRgn

• 0x47540c GetClipBox

• 0x475410 GetBrushOrgEx

• 0x475414 GetBitmapBits

• 0x475418 GdiFlush

• 0x47541c ExtTextOutA

• 0x475420 ExcludeClipRect

• 0x475424 DeleteObject

• 0x475428 DeleteEnhMetaFile

• 0x47542c DeleteDC

• 0x475430 CreateSolidBrush

• 0x475434 CreateRectRgn

• 0x475438 CreatePenIndirect

• 0x47543c CreatePalette

• 0x475440 CreateHalftonePalette

• 0x475444 CreateFontIndirectA

• 0x475448 CreateDIBitmap

• 0x47544c CreateDIBSection

• 0x475450 CreateCompatibleDC

• 0x475454 CreateCompatibleBitmap

• 0x475458 CreateBrushIndirect

• 0x47545c CreateBitmap

• 0x475460 CopyEnhMetaFileA

• 0x475464 BitBlt

Library user32.dll:

• 0x47546c CreateWindowExA

• 0x475470 WindowFromPoint

• 0x475474 WinHelpA

• 0x475478 WaitMessage

• 0x47547c UpdateWindow

• 0x475480 UnregisterClassA

• 0x475484 UnhookWindowsHookEx

• 0x475488 TranslateMessage

• 0x47548c TranslateMDISysAccel

• 0x475490 TrackPopupMenu

• 0x475494 SystemParametersInfoA

• 0x475498 ShowWindow

• 0x47549c ShowScrollBar

• 0x4754a0 ShowOwnedPopups

• 0x4754a4 ShowCursor

• 0x4754a8 SetWindowsHookExA

• 0x4754ac SetWindowTextA

• 0x4754b0 SetWindowPos

• 0x4754b4 SetWindowPlacement

• 0x4754b8 SetWindowLongA

• 0x4754bc SetTimer

• 0x4754c0 SetScrollRange

• 0x4754c4 SetScrollPos

• 0x4754c8 SetScrollInfo

• 0x4754cc SetRect

• 0x4754d0 SetPropA

• 0x4754d4 SetParent

• 0x4754d8 SetMenuItemInfoA

• 0x4754dc SetMenu

• 0x4754e0 SetForegroundWindow

• 0x4754e4 SetFocus

• 0x4754e8 SetCursor

• 0x4754ec SetClassLongA

• 0x4754f0 SetCapture

• 0x4754f4 SetActiveWindow

• 0x4754f8 SendMessageA

• 0x4754fc ScrollWindow

• 0x475500 ScreenToClient

• 0x475504 RemovePropA

• 0x475508 RemoveMenu

• 0x47550c ReleaseDC

• 0x475510 ReleaseCapture

• 0x475514 RegisterWindowMessageA

• 0x475518 RegisterClipboardFormatA

• 0x47551c RegisterClassA

• 0x475520 RedrawWindow

• 0x475524 PtInRect

• 0x475528 PostQuitMessage

• 0x47552c PostMessageA

• 0x475530 PeekMessageA

• 0x475534 OffsetRect

• 0x475538 OemToCharA

• 0x47553c MessageBoxA

• 0x475540 MapWindowPoints

• 0x475544 MapVirtualKeyA

• 0x475548 LoadStringA

• 0x47554c LoadKeyboardLayoutA

• 0x475550 LoadIconA

• 0x475554 LoadCursorA

• 0x475558 LoadBitmapA

• 0x47555c KillTimer

• 0x475560 IsZoomed

• 0x475564 IsWindowVisible

• 0x475568 IsWindowEnabled

• 0x47556c IsWindow

• 0x475570 IsRectEmpty

• 0x475574 IsIconic

• 0x475578 IsDialogMessageA

• 0x47557c IsChild

• 0x475580 InvalidateRect

• 0x475584 IntersectRect

• 0x475588 InsertMenuItemA

• 0x47558c InsertMenuA

• 0x475590 InflateRect

• 0x475594 GetWindowThreadProcessId

• 0x475598 GetWindowTextA

• 0x47559c GetWindowRect

• 0x4755a0 GetWindowPlacement

• 0x4755a4 GetWindowLongA

• 0x4755a8 GetWindowDC

• 0x4755ac GetTopWindow

• 0x4755b0 GetSystemMetrics

• 0x4755b4 GetSystemMenu

• 0x4755b8 GetSysColorBrush

• 0x4755bc GetSysColor

• 0x4755c0 GetSubMenu

• 0x4755c4 GetScrollRange

• 0x4755c8 GetScrollPos

• 0x4755cc GetScrollInfo

• 0x4755d0 GetPropA

• 0x4755d4 GetParent

• 0x4755d8 GetWindow

• 0x4755dc GetMenuStringA

• 0x4755e0 GetMenuState

• 0x4755e4 GetMenuItemInfoA

• 0x4755e8 GetMenuItemID

• 0x4755ec GetMenuItemCount

• 0x4755f0 GetMenu

• 0x4755f4 GetLastActivePopup

• 0x4755f8 GetKeyboardState

• 0x4755fc GetKeyboardLayoutList

• 0x475600 GetKeyboardLayout

• 0x475604 GetKeyState

• 0x475608 GetKeyNameTextA

• 0x47560c GetIconInfo

• 0x475610 GetForegroundWindow

• 0x475614 GetFocus

• 0x475618 GetDlgItem

• 0x47561c GetDesktopWindow

• 0x475620 GetDCEx

• 0x475624 GetDC

• 0x475628 GetCursorPos

• 0x47562c GetCursor

• 0x475630 GetClipboardData

• 0x475634 GetClientRect

• 0x475638 GetClassNameA

• 0x47563c GetClassInfoA

• 0x475640 GetCapture

• 0x475644 GetActiveWindow

• 0x475648 FrameRect

• 0x47564c FindWindowA

• 0x475650 FillRect

• 0x475654 EqualRect

• 0x475658 EnumWindows

• 0x47565c EnumThreadWindows

• 0x475660 EndPaint

• 0x475664 EnableWindow

• 0x475668 EnableScrollBar

• 0x47566c EnableMenuItem

• 0x475670 DrawTextA

• 0x475674 DrawMenuBar

• 0x475678 DrawIconEx

• 0x47567c DrawIcon

• 0x475680 DrawFrameControl

• 0x475684 DrawFocusRect

• 0x475688 DrawEdge

• 0x47568c DispatchMessageA

• 0x475690 DestroyWindow

• 0x475694 DestroyMenu

• 0x475698 DestroyIcon

• 0x47569c DestroyCursor

• 0x4756a0 DeleteMenu

• 0x4756a4 DefWindowProcA

• 0x4756a8 DefMDIChildProcA

• 0x4756ac DefFrameProcA

• 0x4756b0 CreatePopupMenu

• 0x4756b4 CreateMenu

• 0x4756b8 CreateIcon

• 0x4756bc ClientToScreen

• 0x4756c0 CheckMenuItem

• 0x4756c4 CallWindowProcA

• 0x4756c8 CallNextHookEx

• 0x4756cc BeginPaint

• 0x4756d0 CharNextA

• 0x4756d4 CharLowerBuffA

• 0x4756d8 CharLowerA

• 0x4756dc CharToOemA

• 0x4756e0 AdjustWindowRectEx

• 0x4756e4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4756ec Sleep

Library oleaut32.dll:

• 0x4756f4 SafeArrayPtrOfIndex

• 0x4756f8 SafeArrayGetUBound

• 0x4756fc SafeArrayGetLBound

• 0x475700 SafeArrayCreate

• 0x475704 VariantChangeType

• 0x475708 VariantCopy

• 0x47570c VariantClear

• 0x475710 VariantInit

Library comctl32.dll:

• 0x475718 ImageList_SetIconSize

• 0x47571c ImageList_GetIconSize

• 0x475720 ImageList_Write

• 0x475724 ImageList_Read

• 0x475728 ImageList_GetDragImage

• 0x47572c ImageList_DragShowNolock

• 0x475730 ImageList_SetDragCursorImage

• 0x475734 ImageList_DragMove

• 0x475738 ImageList_DragLeave

• 0x47573c ImageList_DragEnter

• 0x475740 ImageList_EndDrag

• 0x475744 ImageList_BeginDrag

• 0x475748 ImageList_Remove

• 0x47574c ImageList_DrawEx

• 0x475750 ImageList_Replace

• 0x475754 ImageList_Draw

• 0x475758 ImageList_GetBkColor

• 0x47575c ImageList_SetBkColor

• 0x475760 ImageList_ReplaceIcon

• 0x475764 ImageList_Add

• 0x475768 ImageList_GetImageCount

• 0x47576c ImageList_Destroy

• 0x475770 ImageList_Create

Library comdlg32.dll:

• 0x475778 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1
dns.msftncsi.com	A 131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.