SmartHawk

7.0

高危

57 个模型检测该样本为恶意！

重新分析

下载样本

21c37002b69efc98e95e8f34ddd1020e0ff72e48cb5c8f9c4884a9a5d3f3f29e

5419a61ba9944f59a2e96d4c81c7cb24.exe

分析耗时

75s

最近分析

文件大小

448.0KB

静态报毒动态报毒 100% AI SCORE=82 AIDETECTVM BSCOPE CLASSIC CONFIDENCE CQ0@AGVSNVCB DOWNLOADER34 ELDORADO EMOTET EMOTETPMF GENCIRC GENERICKD GENETIC HCEJ HIGH CONFIDENCE HSEZGM KRYPTIK MALWARE2 NOPXF R + TROJ R347905 S15557985 SCORE SUSGEN THHAFBO UNSAFE ZEXAE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRV!5419A61BA994	20201023	6.0.6.653
Alibaba	Trojan:Win32/Emotet.e7b66c33	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20201023	18.4.3895.0
Tencent	Malware.Win32.Gencirc.10cde817	20201023	1.0.0.1
Kingsoft		20201023	2013.8.14.323
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426997.238755 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619426981.941755 CryptGenKey	crypto_handle: 0x008f79e0 algorithm_identifier: 0x0000660e () provider_handle: 0x008f6f08 flags: 1 key: fg P¤Vºz5c:[äÑ	success	1
1619426997.254755 CryptExportKey	crypto_handle: 0x008f79e0 crypto_export_handle: 0x008f6ec8 buffer: f¤êv® AèJDÄA½âx2 Ëg_®¦He=¸aa¶_zo"¾dìºåwÿñB9¼yé0ßÕdßC¹p[Õm;ÐüºûÅya+n.:Èh blob_type: 1 flags: 64	success	1
1619427032.363755 CryptExportKey	crypto_handle: 0x008f79e0 crypto_export_handle: 0x008f6ec8 buffer: f¤±ºì½ì&]7çðt¤#ÖC7í¼ÊÂÃK 4ã~ÂZ0rãäúG<(â® >#*="ôn,¬!\|¨UòÈÚ.¸áà«ìÙNÔïVlxKJÛä©,1Þjþ ûæj blob_type: 1 flags: 64	success	1
1619427038.082755 CryptExportKey	crypto_handle: 0x008f79e0 crypto_export_handle: 0x008f6ec8 buffer: f¤áöÇCï\|AÐû¡ó]Z{C''ç\|Æ{zD_fÖ~0¦¤ÎÇ¥è«JÜv°>4:ÂÈ°©Å¬£lyzûßÌnú¦`Àõ·¸OÀIÂ^v] blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426981.285755 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00640000	success	0	0

Foreign language identified in PE resource (33 个事件)

name

RT_CURSOR

language

LANG_CHINESE

offset

0x00072c80

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

offset

0x00072c80

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000b4

name

RT_BITMAP

language

LANG_CHINESE

offset

0x00073658

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x00073658

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x00073658

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x00073658

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00069a78

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00073348

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e2

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00073348

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e2

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00073348

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000e2

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x000740c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00069f58

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00008344

name

RT_GROUP_CURSOR

language

LANG_CHINESE

offset

0x00072d38

filetype

Lotus unknown worksheet or configuration, revision 0x2

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000022

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00069ee0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000076

name

RT_VERSION

language

LANG_CHINESE

offset

0x00072848

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000300

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426981.691755 Process32NextW	process_name: wsqmcons.exe snapshot_handle: 0x00000178 process_identifier: 2544	success	1	0
1619426981.691755 Process32NextW	process_name: 5419a61ba9944f59a2e96d4c81c7cb24.exe snapshot_handle: 0x00000178 process_identifier: 2504	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426997.707755 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

5419a61ba9944f59a2e96d4c81c7cb24.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426997.395755 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (4 个事件)

host	172.217.24.14
host	67.205.85.243
host	69.30.203.214
host	75.139.38.211

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619427000.285755 RegSetValueExA	key_handle: 0x000003cc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619427000.285755 RegSetValueExA	key_handle: 0x000003cc value: T^:× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619427000.285755 RegSetValueExA	key_handle: 0x000003cc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619427000.285755 RegSetValueExW	key_handle: 0x000003cc value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619427000.285755 RegSetValueExA	key_handle: 0x000003e4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619427000.285755 RegSetValueExA	key_handle: 0x000003e4 value: T^:× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619427000.285755 RegSetValueExA	key_handle: 0x000003e4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619427000.301755 RegSetValueExW	key_handle: 0x000003c8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43923942
FireEye	Trojan.GenericKD.43923942
CAT-QuickHeal	Backdoor.EmotetPMF.S15557985
Qihoo-360	Generic/Trojan.f3d
McAfee	Emotet-FRV!5419A61BA994
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 0056df731 )
Alibaba	Trojan:Win32/Emotet.e7b66c33
K7GW	Trojan ( 0056df731 )
Arcabit	Trojan.Generic.D29E39E6
Cyren	W32/Emotet.AQB.gen!Eldorado
Symantec	Trojan.Emotet
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Trojan.Emotet-9371545-0
Kaspersky	HEUR:Backdoor.Win32.Emotet.vho
BitDefender	Trojan.GenericKD.43923942
NANO-Antivirus	Trojan.Win32.Emotet.hsezgm
Paloalto	generic.ml
AegisLab	Trojan.Win32.Emotet.L!c
Tencent	Malware.Win32.Gencirc.10cde817
Ad-Aware	Trojan.GenericKD.43923942
TACHYON	Trojan/W32.Emotet.458752.C
Sophos	Troj/Emotet-CLD
DrWeb	Trojan.DownLoader34.24265
Zillya	Backdoor.Emotet.Win32.1010
Invincea	Mal/Generic-R + Troj/Emotet-CLD
McAfee-GW-Edition	Emotet-FRV!5419A61BA994
Emsisoft	Trojan.Emotet (A)
Ikarus	Trojan-Banker.Emotet
Jiangmin	Backdoor.Emotet.ra
Webroot	W32.Trojan.Emotet
Avira	TR/AD.Emotet.nopxf
Antiy-AVL	Trojan[Backdoor]/Win32.Emotet
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
ViRobot	Trojan.Win32.Emotet.458752.B
ZoneAlarm	HEUR:Backdoor.Win32.Emotet.vho
GData	Trojan.GenericKD.43923942
Cynet	Malicious (score: 90)
AhnLab-V3	Trojan/Win32.Emotet.R347905
BitDefenderTheta	Gen:NN.ZexaE.34570.Cq0@aGVsNVcb
ALYac	Trojan.GenericKD.43923942
MAX	malware (ai score=82)
VBA32	BScope.Backdoor.Emotet
Malwarebytes	Trojan.Emotet
ESET-NOD32	Win32/Emotet.CD
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.THHAFBO

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	69.30.203.214:8080
dead_host	192.168.56.101:49180
dead_host	75.139.38.211:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-15 02:43:56

Imports

Library WS2_32.dll:

• 0x42f4e0 shutdown

• 0x42f4e4 WSAStartup

• 0x42f4e8 WSACleanup

• 0x42f4ec send

• 0x42f4f0 recv

• 0x42f4f4 closesocket

• 0x42f4f8 WSAWaitForMultipleEvents

• 0x42f4fc WSACloseEvent

• 0x42f500 WSAEventSelect

• 0x42f504 WSACreateEvent

• 0x42f508 socket

• 0x42f50c inet_addr

• 0x42f510 WSAEnumNetworkEvents

• 0x42f514 connect

• 0x42f518 gethostbyaddr

• 0x42f51c htons

• 0x42f520 gethostbyname

Library KERNEL32.dll:

• 0x42f0bc FindClose

• 0x42f0c0 FindFirstFileA

• 0x42f0c4 GetVolumeInformationA

• 0x42f0c8 GetFullPathNameA

• 0x42f0cc FileTimeToSystemTime

• 0x42f0d0 FileTimeToLocalFileTime

• 0x42f0d4 GetTickCount

• 0x42f0d8 GetFileAttributesA

• 0x42f0dc GetFileSize

• 0x42f0e0 GetFileTime

• 0x42f0e4 RtlUnwind

• 0x42f0e8 CreateThread

• 0x42f0ec ExitThread

• 0x42f0f0 RaiseException

• 0x42f0f4 GetStartupInfoA

• 0x42f0f8 GetCommandLineA

• 0x42f0fc HeapAlloc

• 0x42f100 HeapFree

• 0x42f104 TerminateProcess

• 0x42f108 HeapReAlloc

• 0x42f10c HeapSize

• 0x42f110 GetACP

• 0x42f114 GetTimeZoneInformation

• 0x42f118 UnhandledExceptionFilter

• 0x42f11c SetUnhandledExceptionFilter

• 0x42f120 LCMapStringA

• 0x42f124 LCMapStringW

• 0x42f128 FreeEnvironmentStringsA

• 0x42f12c FreeEnvironmentStringsW

• 0x42f130 GetEnvironmentStrings

• 0x42f134 GetEnvironmentStringsW

• 0x42f138 GetStdHandle

• 0x42f13c GetFileType

• 0x42f140 HeapDestroy

• 0x42f144 HeapCreate

• 0x42f148 VirtualFree

• 0x42f14c VirtualAlloc

• 0x42f150 GetStringTypeA

• 0x42f154 GetStringTypeW

• 0x42f158 IsBadCodePtr

• 0x42f15c SetStdHandle

• 0x42f160 CompareStringA

• 0x42f164 CompareStringW

• 0x42f168 SetEnvironmentVariableA

• 0x42f16c GetProfileStringA

• 0x42f170 InterlockedExchange

• 0x42f174 ResetEvent

• 0x42f178 CreateEventA

• 0x42f17c CloseHandle

• 0x42f180 WaitForSingleObject

• 0x42f184 SetEvent

• 0x42f188 lstrlenA

• 0x42f18c Sleep

• 0x42f190 ExitProcess

• 0x42f194 InterlockedIncrement

• 0x42f198 InterlockedDecrement

• 0x42f19c WideCharToMultiByte

• 0x42f1a0 MultiByteToWideChar

• 0x42f1a4 LocalFree

• 0x42f1a8 FormatMessageA

• 0x42f1ac SetEndOfFile

• 0x42f1b0 UnlockFile

• 0x42f1b4 LockFile

• 0x42f1b8 FlushFileBuffers

• 0x42f1bc SetFilePointer

• 0x42f1c0 WriteFile

• 0x42f1c4 ReadFile

• 0x42f1c8 CreateFileA

• 0x42f1cc GetCurrentProcess

• 0x42f1d0 DuplicateHandle

• 0x42f1d4 SetErrorMode

• 0x42f1d8 GetOEMCP

• 0x42f1dc GetCPInfo

• 0x42f1e0 GetThreadLocale

• 0x42f1e4 SizeofResource

• 0x42f1e8 IsBadWritePtr

• 0x42f1ec IsBadReadPtr

• 0x42f1f0 GetCurrentThreadId

• 0x42f1f4 GetCurrentThread

• 0x42f1f8 lstrcmpiA

• 0x42f1fc lstrcmpA

• 0x42f200 GlobalDeleteAtom

• 0x42f204 WritePrivateProfileStringA

• 0x42f208 GlobalFlags

• 0x42f20c TlsGetValue

• 0x42f210 LocalReAlloc

• 0x42f214 TlsSetValue

• 0x42f218 GlobalReAlloc

• 0x42f21c TlsFree

• 0x42f220 GlobalHandle

• 0x42f224 TlsAlloc

• 0x42f228 LocalAlloc

• 0x42f22c GetProcessVersion

• 0x42f230 lstrcpynA

• 0x42f234 GetLastError

• 0x42f238 EnterCriticalSection

• 0x42f23c LeaveCriticalSection

• 0x42f240 DeleteCriticalSection

• 0x42f244 InitializeCriticalSection

• 0x42f248 MulDiv

• 0x42f24c SetLastError

• 0x42f250 LoadLibraryA

• 0x42f254 FreeLibrary

• 0x42f258 GetVersion

• 0x42f25c lstrcatA

• 0x42f260 GlobalAlloc

• 0x42f264 GlobalGetAtomNameA

• 0x42f268 GlobalAddAtomA

• 0x42f26c GlobalFindAtomA

• 0x42f270 lstrcpyA

• 0x42f274 GetModuleHandleA

• 0x42f278 GetProcAddress

• 0x42f27c GlobalUnlock

• 0x42f280 GlobalFree

• 0x42f284 LockResource

• 0x42f288 FindResourceA

• 0x42f28c LoadResource

• 0x42f290 GetModuleFileNameA

• 0x42f294 GlobalLock

• 0x42f298 SetHandleCount

Library USER32.dll:

• 0x42f2d0 GrayStringA

• 0x42f2d4 DestroyMenu

• 0x42f2d8 LoadCursorA

• 0x42f2dc GetSysColorBrush

• 0x42f2e0 GetDesktopWindow

• 0x42f2e4 GetClassNameA

• 0x42f2e8 PtInRect

• 0x42f2ec CharNextA

• 0x42f2f0 CopyAcceleratorTableA

• 0x42f2f4 SetRect

• 0x42f2f8 GetNextDlgGroupItem

• 0x42f2fc MessageBeep

• 0x42f300 InvalidateRect

• 0x42f304 CharUpperA

• 0x42f308 InflateRect

• 0x42f30c RegisterClipboardFormatA

• 0x42f310 PostThreadMessageA

• 0x42f314 GetDC

• 0x42f318 ClientToScreen

• 0x42f31c LoadStringA

• 0x42f320 wvsprintfA

• 0x42f324 ShowWindow

• 0x42f328 MoveWindow

• 0x42f32c SetWindowTextA

• 0x42f330 IsDialogMessageA

• 0x42f334 UpdateWindow

• 0x42f338 SendDlgItemMessageA

• 0x42f33c MapWindowPoints

• 0x42f340 GetSysColor

• 0x42f344 SetFocus

• 0x42f348 AdjustWindowRectEx

• 0x42f34c ScreenToClient

• 0x42f350 CopyRect

• 0x42f354 DrawTextA

• 0x42f358 GetTopWindow

• 0x42f35c IsChild

• 0x42f360 GetCapture

• 0x42f364 WinHelpA

• 0x42f368 wsprintfA

• 0x42f36c GetClassInfoA

• 0x42f370 RegisterClassA

• 0x42f374 GetMenu

• 0x42f378 GetMenuItemCount

• 0x42f37c GetSubMenu

• 0x42f380 GetMenuItemID

• 0x42f384 GetWindowTextLengthA

• 0x42f388 GetWindowTextA

• 0x42f38c GetDlgCtrlID

• 0x42f390 DefWindowProcA

• 0x42f394 CreateWindowExA

• 0x42f398 GetClassLongA

• 0x42f39c UnhookWindowsHookEx

• 0x42f3a0 GetPropA

• 0x42f3a4 CallWindowProcA

• 0x42f3a8 RemovePropA

• 0x42f3ac GetMessageTime

• 0x42f3b0 GetMessagePos

• 0x42f3b4 GetForegroundWindow

• 0x42f3b8 SetForegroundWindow

• 0x42f3bc SetWindowLongA

• 0x42f3c0 RegisterWindowMessageA

• 0x42f3c4 OffsetRect

• 0x42f3c8 IntersectRect

• 0x42f3cc SystemParametersInfoA

• 0x42f3d0 GetWindowPlacement

• 0x42f3d4 GetWindowRect

• 0x42f3d8 MapDialogRect

• 0x42f3dc SetWindowPos

• 0x42f3e0 GetWindow

• 0x42f3e4 SetWindowContextHelpId

• 0x42f3e8 EndDialog

• 0x42f3ec SetActiveWindow

• 0x42f3f0 IsWindow

• 0x42f3f4 CreateDialogIndirectParamA

• 0x42f3f8 DestroyWindow

• 0x42f3fc GetDlgItem

• 0x42f400 GetMenuCheckMarkDimensions

• 0x42f404 LoadBitmapA

• 0x42f408 GetMenuState

• 0x42f40c ModifyMenuA

• 0x42f410 SetMenuItemBitmaps

• 0x42f414 CheckMenuItem

• 0x42f418 EnableMenuItem

• 0x42f41c GetFocus

• 0x42f420 GetNextDlgTabItem

• 0x42f424 GetActiveWindow

• 0x42f428 GetKeyState

• 0x42f42c CallNextHookEx

• 0x42f430 ValidateRect

• 0x42f434 IsWindowVisible

• 0x42f438 GetCursorPos

• 0x42f43c SetWindowsHookExA

• 0x42f440 GetParent

• 0x42f444 GetLastActivePopup

• 0x42f448 IsWindowEnabled

• 0x42f44c GetWindowLongA

• 0x42f450 MessageBoxA

• 0x42f454 SetCursor

• 0x42f458 TabbedTextOutA

• 0x42f45c EndPaint

• 0x42f460 BeginPaint

• 0x42f464 GetWindowDC

• 0x42f468 ReleaseDC

• 0x42f46c PostMessageA

• 0x42f470 LoadIconA

• 0x42f474 EnableWindow

• 0x42f478 GetClientRect

• 0x42f47c IsIconic

• 0x42f480 GetSystemMenu

• 0x42f484 SendMessageA

• 0x42f488 AppendMenuA

• 0x42f48c DrawIcon

• 0x42f490 PostQuitMessage

• 0x42f494 GetSystemMetrics

• 0x42f498 GetMessageA

• 0x42f49c TranslateMessage

• 0x42f4a0 PeekMessageA

• 0x42f4a4 DispatchMessageA

• 0x42f4a8 MsgWaitForMultipleObjects

• 0x42f4ac IsWindowUnicode

• 0x42f4b0 DefDlgProcA

• 0x42f4b4 DrawFocusRect

• 0x42f4b8 ExcludeUpdateRgn

• 0x42f4bc ShowCaret

• 0x42f4c0 HideCaret

• 0x42f4c4 UnregisterClassA

• 0x42f4c8 SetPropA

Library GDI32.dll:

• 0x42f01c SetBkMode

• 0x42f020 SetMapMode

• 0x42f024 SetViewportOrgEx

• 0x42f028 OffsetViewportOrgEx

• 0x42f02c SetViewportExtEx

• 0x42f030 ScaleViewportExtEx

• 0x42f034 SetWindowExtEx

• 0x42f038 ScaleWindowExtEx

• 0x42f03c IntersectClipRect

• 0x42f040 DeleteObject

• 0x42f044 GetStockObject

• 0x42f048 GetDeviceCaps

• 0x42f04c GetViewportExtEx

• 0x42f050 GetWindowExtEx

• 0x42f054 CreateSolidBrush

• 0x42f058 PtVisible

• 0x42f05c RectVisible

• 0x42f060 TextOutA

• 0x42f064 ExtTextOutA

• 0x42f068 Escape

• 0x42f06c GetTextColor

• 0x42f070 GetBkColor

• 0x42f074 DPtoLP

• 0x42f078 LPtoDP

• 0x42f07c GetMapMode

• 0x42f080 PatBlt

• 0x42f084 SelectObject

• 0x42f088 RestoreDC

• 0x42f08c SaveDC

• 0x42f090 DeleteDC

• 0x42f094 GetObjectA

• 0x42f098 SetBkColor

• 0x42f09c SetTextColor

• 0x42f0a0 GetClipBox

• 0x42f0a4 GetTextExtentPointA

• 0x42f0a8 BitBlt

• 0x42f0ac CreateCompatibleDC

• 0x42f0b0 CreateDIBitmap

• 0x42f0b4 CreateBitmap

Library comdlg32.dll:

• 0x42f528 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42f4d0 DocumentPropertiesA

• 0x42f4d4 ClosePrinter

• 0x42f4d8 OpenPrinterA

Library ADVAPI32.dll:

• 0x42f000 RegCloseKey

• 0x42f004 RegSetValueExA

• 0x42f008 RegOpenKeyExA

• 0x42f00c RegCreateKeyExA

Library COMCTL32.dll:

• 0x42f014

Library oledlg.dll:

• 0x42f570

Library ole32.dll:

• 0x42f530 CoTaskMemFree

• 0x42f534 CreateILockBytesOnHGlobal

• 0x42f538 StgCreateDocfileOnILockBytes

• 0x42f53c OleInitialize

• 0x42f540 CoGetClassObject

• 0x42f544 CLSIDFromString

• 0x42f548 CoTaskMemAlloc

• 0x42f54c OleUninitialize

• 0x42f550 CoFreeUnusedLibraries

• 0x42f554 CLSIDFromProgID

• 0x42f558 OleIsCurrentClipboard

• 0x42f55c OleFlushClipboard

• 0x42f560 CoRevokeClassObject

• 0x42f564 CoRegisterMessageFilter

• 0x42f568 StgOpenStorageOnILockBytes

Library OLEPRO32.DLL:

• 0x42f2c8

Library OLEAUT32.dll:

• 0x42f2a0 SysAllocStringByteLen

• 0x42f2a4 SysStringLen

• 0x42f2a8 SysAllocString

• 0x42f2ac VariantChangeType

• 0x42f2b0 VariantCopy

• 0x42f2b4 VariantTimeToSystemTime

• 0x42f2b8 VariantClear

• 0x42f2bc SysAllocStringLen

• 0x42f2c0 SysFreeString

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.