SmartHawk

10.4

0-day

48 个模型检测该样本为恶意！

重新分析

下载样本

b47d9d67428950e82f16481d8cf6602dc622753dbab38e0e4275e9462cf46204

5f925b85d8b4bbaf2992ff3322e1dc37.exe

分析耗时

106s

最近分析

文件大小

432.1KB

静态报毒动态报毒 100% AI SCORE=88 AIDETECTVM CONFIDENCE CQPMYSCL1PG ELDORADO EMOTET EMOTETPMF GCHZ GENERICKDZ GENETIC HCEJ HIGH CONFIDENCE HRYMJR JUB03COIFLI KRYPTIK MALWARE2 MALWARE@#DCNU689E7UEF R + TROJ S15542147 SUSGEN UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20190318	1.0.0.2
Alibaba	Trojan:Win32/Emotet.0dc181de	20190527	0.3.0.5
Kingsoft		20201024	2013.8.14.323
McAfee	Emotet-FRV!5F925B85D8B4	20201024	6.0.6.653
Avast	Win32:Kryptik-PTA [Trj]	20201024	18.4.3895.0
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620777824.792874 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1620777815.808874 CryptGenKey	crypto_handle: 0x005b41c0 algorithm_identifier: 0x0000660e () provider_handle: 0x005b34d0 flags: 1 key: fE$Õ"#î,§2ñcQ(ý	success	1
1620777824.792874 CryptExportKey	crypto_handle: 0x005b41c0 crypto_export_handle: 0x005b4180 buffer: f¤# lç±çÉ´/wOþõcíw±¦CáÔG3ì\ÕÙºÒ{M ½c »~YßËô$`4åæ0Ôþ§ùEï0¢üO'ëºêTÖ_Ú÷MSõ±m] blob_type: 1 flags: 64	success	1
1620777851.777874 CryptExportKey	crypto_handle: 0x005b41c0 crypto_export_handle: 0x005b4180 buffer: f¤ú_aUAæSPåïxwìqfe6ê)ìHý6æ¬ñóÅG,L²V2=QýêÂW½¬y¹¤ôdF©x=Î®ÕRÓMVs¾ TK´ÆÛÿ`D¯k%øÉÔ jé1 blob_type: 1 flags: 64	success	1
1620777856.292874 CryptExportKey	crypto_handle: 0x005b41c0 crypto_export_handle: 0x005b4180 buffer: f¤9^¥hsd5.U¶²ÞEéµî=<®çyPÓ@lµâ7pVc¸©§ÅI:»ªÛ¶¢S$ÆÄk M["VaØh%¶Ò®Ñ÷Þ»UÃáYlÁ´ó blob_type: 1 flags: 64	success	1
1620777879.995874 CryptExportKey	crypto_handle: 0x005b41c0 crypto_export_handle: 0x005b4180 buffer: f¤@©3GÚuH¿{óôíoÅB§l\|,àaKÿ6myÅÀÀ÷A\gÔKòU¤nEíH"Â:a¢HÏ]sÍÿt¾GáÉ`Nß*ørQ'DF7" blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1620777810.464874 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00890000	success
1620777874.308999 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004040000	success
1620777815.417874 NtAllocateVirtualMemory	process_identifier: 1760 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00540000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 个事件)

Time & API	Arguments	Status	Return
1620777815.480874 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x00000154 process_identifier: 2476	success	1
1620777879.995874 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000003b4 process_identifier: 796	success	1
1620777879.995874 Process32NextW	process_name: inject-x64.exe snapshot_handle: 0x000003b4 process_identifier: 1324	success	1

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620777811.323874 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5f925b85d8b4bbaf2992ff3322e1dc37.exe newfilepath: C:\Windows\SysWOW64\eapphost\pnrpnsp.exe newfilepath_r: C:\Windows\SysWOW64\eapphost\pnrpnsp.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5f925b85d8b4bbaf2992ff3322e1dc37.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620777825.636874 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.428103171185719

section

{'size_of_data': '0x00033000', 'virtual_address': '0x0003d000', 'entropy': 7.428103171185719, 'name': '.rsrc', 'virtual_size': '0x00032230'}

description

A section with a high entropy has been found

entropy

0.4766355140186916

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 个事件)

process

pnrpnsp.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620777825.245874 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	116.202.234.183
host	137.119.36.33
host	172.217.24.14
host	204.197.146.48
host	69.30.203.214

Installs itself for autorun at Windows startup (1 个事件)

service_name

pnrpnsp

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\eapphost\pnrpnsp.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620777814.698874 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x034937e0 display_name: pnrpnsp error_control: 0 service_name: pnrpnsp filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\eapphost\pnrpnsp.exe" filepath_r: "C:\Windows\SysWOW64\eapphost\pnrpnsp.exe" service_manager_handle: 0x034937b8 desired_access: 2 service_type: 16 password:	success	55130080	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1620777828.214874 RegSetValueExA	key_handle: 0x000003b4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620777828.214874 RegSetValueExA	key_handle: 0x000003b4 value: `¡Ð±F× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620777828.214874 RegSetValueExA	key_handle: 0x000003b4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620777828.214874 RegSetValueExW	key_handle: 0x000003b4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620777828.214874 RegSetValueExA	key_handle: 0x000003cc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620777828.214874 RegSetValueExA	key_handle: 0x000003cc value: `¡Ð±F× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620777828.214874 RegSetValueExA	key_handle: 0x000003cc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620777828.245874 RegSetValueExW	key_handle: 0x000003b0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\eapphost\pnrpnsp.exe:Zone.Identifier

Generates some ICMP traffic

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69660
FireEye	Trojan.GenericKDZ.69660
CAT-QuickHeal	Backdoor.EmotetPMF.S15542147
ALYac	Trojan.GenericKDZ.69660
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005600f21 )
BitDefender	Trojan.GenericKDZ.69660
K7GW	Trojan ( 005600f21 )
Cyren	W32/Emotet.AQS.gen!Eldorado
Symantec	Trojan.Emotet
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Emotet-9482852-0
Kaspersky	Trojan-Banker.Win32.Emotet.gchz
Alibaba	Trojan:Win32/Emotet.0dc181de
NANO-Antivirus	Trojan.Win32.Emotet.hrymjr
ViRobot	Trojan.Win32.Emotet.442368.D
Ad-Aware	Trojan.GenericKDZ.69660
Comodo	Malware@#dcnu689e7uef
MaxSecure	Trojan.Malware.105895053.susgen
DrWeb	Trojan.Emotet.1003
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-R + Troj/Emotet-CLQ
McAfee-GW-Edition	BehavesLike.Win32.Emotet.gc
Sophos	Troj/Emotet-CLQ
Jiangmin	Backdoor.Emotet.sh
Avira	TR/AD.Emotet.bbn
MAX	malware (ai score=88)
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
Arcabit	Trojan.Generic.D1101C
ZoneAlarm	Trojan-Banker.Win32.Emotet.gchz
GData	Trojan.GenericKDZ.69660
AhnLab-V3	Malware/Win32.Generic.C4185183
McAfee	Emotet-FRV!5F925B85D8B4
TACHYON	Banker/W32.Emotet.442463
VBA32	Backdoor.Emotet
Panda	Trj/Genetic.gen
ESET-NOD32	Win32/Emotet.CD
Rising	Trojan.Kryptik!8.8 (TFE:5:cqpMYSCL1pG)
Yandex	Trojan.Emotet!JUB03cOiFLI
Ikarus	Trojan-Banker.Emotet
Fortinet	W32/Kryptik.HCEJ!tr
AVG	Win32:Kryptik-PTA [Trj]
Avast	Win32:Kryptik-PTA [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (10 个事件)

dead_host	192.168.56.101:49181
dead_host	192.168.56.101:49188
dead_host	137.119.36.33:80
dead_host	172.217.24.14:443
dead_host	116.202.234.183:8080
dead_host	192.168.56.101:49189
dead_host	192.168.56.101:49178
dead_host	69.30.203.214:8080
dead_host	192.168.56.101:49183
dead_host	192.168.56.101:49182

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-21 19:30:30

Imports

Library KERNEL32.dll:

• 0x42c178 GetStartupInfoA

• 0x42c17c GetCommandLineA

• 0x42c180 TerminateProcess

• 0x42c184 HeapFree

• 0x42c188 CreateThread

• 0x42c18c ExitThread

• 0x42c190 RaiseException

• 0x42c194 HeapReAlloc

• 0x42c198 HeapSize

• 0x42c19c GetACP

• 0x42c1a0 GetTimeZoneInformation

• 0x42c1a4 GetSystemTime

• 0x42c1a8 GetLocalTime

• 0x42c1ac LCMapStringA

• 0x42c1b0 LCMapStringW

• 0x42c1b4 FatalAppExitA

• 0x42c1b8 Sleep

• 0x42c1bc HeapDestroy

• 0x42c1c0 HeapCreate

• 0x42c1c4 VirtualFree

• 0x42c1c8 VirtualAlloc

• 0x42c1cc IsBadWritePtr

• 0x42c1d0 UnhandledExceptionFilter

• 0x42c1d4 FreeEnvironmentStringsA

• 0x42c1d8 FreeEnvironmentStringsW

• 0x42c1dc HeapAlloc

• 0x42c1e0 GetEnvironmentStringsW

• 0x42c1e4 SetHandleCount

• 0x42c1e8 GetStdHandle

• 0x42c1ec GetFileType

• 0x42c1f0 SetUnhandledExceptionFilter

• 0x42c1f4 GetStringTypeA

• 0x42c1f8 GetStringTypeW

• 0x42c1fc IsBadReadPtr

• 0x42c200 IsBadCodePtr

• 0x42c204 IsValidLocale

• 0x42c208 IsValidCodePage

• 0x42c20c GetLocaleInfoA

• 0x42c210 EnumSystemLocalesA

• 0x42c214 GetUserDefaultLCID

• 0x42c218 GetVersionExA

• 0x42c21c SetConsoleCtrlHandler

• 0x42c220 SetStdHandle

• 0x42c224 GetLocaleInfoW

• 0x42c228 CompareStringA

• 0x42c22c CompareStringW

• 0x42c230 SetEnvironmentVariableA

• 0x42c234 RtlUnwind

• 0x42c238 GetProfileStringA

• 0x42c23c InterlockedExchange

• 0x42c240 FileTimeToLocalFileTime

• 0x42c244 FileTimeToSystemTime

• 0x42c248 SetFileAttributesA

• 0x42c24c SetFileTime

• 0x42c250 SystemTimeToFileTime

• 0x42c254 LocalFileTimeToFileTime

• 0x42c258 GetFileTime

• 0x42c25c GetFileSize

• 0x42c260 GetFileAttributesA

• 0x42c264 GetShortPathNameA

• 0x42c268 GetThreadLocale

• 0x42c26c GetStringTypeExA

• 0x42c270 GetFullPathNameA

• 0x42c274 GetVolumeInformationA

• 0x42c278 FindFirstFileA

• 0x42c27c FindClose

• 0x42c280 DeleteFileA

• 0x42c284 MoveFileA

• 0x42c288 SetEndOfFile

• 0x42c28c UnlockFile

• 0x42c290 LockFile

• 0x42c294 FlushFileBuffers

• 0x42c298 SetFilePointer

• 0x42c29c WriteFile

• 0x42c2a0 ReadFile

• 0x42c2a4 CreateFileA

• 0x42c2a8 GetCurrentProcess

• 0x42c2ac DuplicateHandle

• 0x42c2b0 SetErrorMode

• 0x42c2b4 FormatMessageA

• 0x42c2b8 GetOEMCP

• 0x42c2bc GetCPInfo

• 0x42c2c0 SizeofResource

• 0x42c2c4 GetProcessVersion

• 0x42c2c8 GetLastError

• 0x42c2cc GetCurrentDirectoryA

• 0x42c2d0 WritePrivateProfileStringA

• 0x42c2d4 GetPrivateProfileStringA

• 0x42c2d8 GetPrivateProfileIntA

• 0x42c2dc GlobalFlags

• 0x42c2e0 TlsGetValue

• 0x42c2e4 LocalReAlloc

• 0x42c2e8 TlsSetValue

• 0x42c2ec EnterCriticalSection

• 0x42c2f0 GlobalReAlloc

• 0x42c2f4 LeaveCriticalSection

• 0x42c2f8 TlsFree

• 0x42c2fc GlobalHandle

• 0x42c300 DeleteCriticalSection

• 0x42c304 TlsAlloc

• 0x42c308 InitializeCriticalSection

• 0x42c30c LocalFree

• 0x42c310 LocalAlloc

• 0x42c314 lstrcpynA

• 0x42c318 MulDiv

• 0x42c31c ExitProcess

• 0x42c320 SetLastError

• 0x42c324 MultiByteToWideChar

• 0x42c328 WideCharToMultiByte

• 0x42c32c lstrlenA

• 0x42c330 InterlockedIncrement

• 0x42c334 InterlockedDecrement

• 0x42c338 LoadLibraryA

• 0x42c33c FreeLibrary

• 0x42c340 GetVersion

• 0x42c344 lstrcatA

• 0x42c348 GlobalGetAtomNameA

• 0x42c34c GlobalAddAtomA

• 0x42c350 GlobalFindAtomA

• 0x42c354 lstrcpyA

• 0x42c358 GetModuleHandleA

• 0x42c35c GetProcAddress

• 0x42c360 GlobalUnlock

• 0x42c364 GlobalFree

• 0x42c368 LockResource

• 0x42c36c FindResourceA

• 0x42c370 LoadResource

• 0x42c374 CreateEventA

• 0x42c378 SuspendThread

• 0x42c37c SetThreadPriority

• 0x42c380 ResumeThread

• 0x42c384 SetEvent

• 0x42c388 WaitForSingleObject

• 0x42c38c CloseHandle

• 0x42c390 GetModuleFileNameA

• 0x42c394 GlobalLock

• 0x42c398 GlobalAlloc

• 0x42c39c GlobalDeleteAtom

• 0x42c3a0 lstrcmpA

• 0x42c3a4 lstrcmpiA

• 0x42c3a8 GetCurrentThread

• 0x42c3ac GetCurrentThreadId

• 0x42c3b0 GetEnvironmentStrings

Library USER32.dll:

• 0x42c3c4 ScrollWindow

• 0x42c3c8 EndDeferWindowPos

• 0x42c3cc CopyRect

• 0x42c3d0 BeginDeferWindowPos

• 0x42c3d4 DeferWindowPos

• 0x42c3d8 ScreenToClient

• 0x42c3dc AdjustWindowRectEx

• 0x42c3e0 SetFocus

• 0x42c3e4 MapWindowPoints

• 0x42c3e8 SendDlgItemMessageA

• 0x42c3ec CheckDlgButton

• 0x42c3f0 CheckRadioButton

• 0x42c3f4 GetDlgItemInt

• 0x42c3f8 GetDlgItemTextA

• 0x42c3fc SetDlgItemInt

• 0x42c400 SetDlgItemTextA

• 0x42c404 IsDlgButtonChecked

• 0x42c408 ScrollWindowEx

• 0x42c40c IsDialogMessageA

• 0x42c410 SetWindowTextA

• 0x42c414 MoveWindow

• 0x42c418 wvsprintfA

• 0x42c41c CharToOemA

• 0x42c420 OemToCharA

• 0x42c424 LoadStringA

• 0x42c428 DestroyMenu

• 0x42c42c ClientToScreen

• 0x42c430 GetWindowDC

• 0x42c434 BeginPaint

• 0x42c438 EndPaint

• 0x42c43c TabbedTextOutA

• 0x42c440 DrawTextA

• 0x42c444 GrayStringA

• 0x42c448 InflateRect

• 0x42c44c GetClassNameA

• 0x42c450 GetDesktopWindow

• 0x42c454 InsertMenuA

• 0x42c458 DeleteMenu

• 0x42c45c GetMenuStringA

• 0x42c460 LoadCursorA

• 0x42c464 GetSysColorBrush

• 0x42c468 GetDialogBaseUnits

• 0x42c46c CharUpperA

• 0x42c470 GetScrollRange

• 0x42c474 SetScrollRange

• 0x42c478 GetScrollPos

• 0x42c47c SetScrollPos

• 0x42c480 GetTopWindow

• 0x42c484 IsChild

• 0x42c488 GetCapture

• 0x42c48c WinHelpA

• 0x42c490 wsprintfA

• 0x42c494 GetClassInfoA

• 0x42c498 RegisterClassA

• 0x42c49c GetMenu

• 0x42c4a0 GetMenuItemCount

• 0x42c4a4 GetMenuItemID

• 0x42c4a8 TrackPopupMenu

• 0x42c4ac SetWindowPlacement

• 0x42c4b0 GetWindowTextLengthA

• 0x42c4b4 GetWindowTextA

• 0x42c4b8 GetDlgCtrlID

• 0x42c4bc DefWindowProcA

• 0x42c4c0 CreateWindowExA

• 0x42c4c4 GetClassLongA

• 0x42c4c8 SetPropA

• 0x42c4cc UnhookWindowsHookEx

• 0x42c4d0 GetPropA

• 0x42c4d4 CallWindowProcA

• 0x42c4d8 GetScrollInfo

• 0x42c4dc GetMessageTime

• 0x42c4e0 GetMessagePos

• 0x42c4e4 GetForegroundWindow

• 0x42c4e8 SetForegroundWindow

• 0x42c4ec GetWindow

• 0x42c4f0 SetWindowLongA

• 0x42c4f4 SetWindowPos

• 0x42c4f8 RegisterWindowMessageA

• 0x42c4fc OffsetRect

• 0x42c500 IntersectRect

• 0x42c504 GetWindowPlacement

• 0x42c508 GetWindowRect

• 0x42c50c EndDialog

• 0x42c510 SetActiveWindow

• 0x42c514 IsWindow

• 0x42c518 CreateDialogIndirectParamA

• 0x42c51c DestroyWindow

• 0x42c520 GetDlgItem

• 0x42c524 GetMenuCheckMarkDimensions

• 0x42c528 GetMenuState

• 0x42c52c ModifyMenuA

• 0x42c530 SetMenuItemBitmaps

• 0x42c534 CheckMenuItem

• 0x42c538 EnableMenuItem

• 0x42c53c GetFocus

• 0x42c540 GetNextDlgTabItem

• 0x42c544 GetMessageA

• 0x42c548 TranslateMessage

• 0x42c54c DispatchMessageA

• 0x42c550 GetActiveWindow

• 0x42c554 GetKeyState

• 0x42c558 CallNextHookEx

• 0x42c55c ValidateRect

• 0x42c560 IsWindowVisible

• 0x42c564 PeekMessageA

• 0x42c568 GetCursorPos

• 0x42c56c SetWindowsHookExA

• 0x42c570 GetParent

• 0x42c574 GetLastActivePopup

• 0x42c578 IsWindowEnabled

• 0x42c57c GetWindowLongA

• 0x42c580 MessageBoxA

• 0x42c584 SetCursor

• 0x42c588 ShowOwnedPopups

• 0x42c58c PostMessageA

• 0x42c590 PostQuitMessage

• 0x42c594 LoadBitmapA

• 0x42c598 InvalidateRect

• 0x42c59c UpdateWindow

• 0x42c5a0 GetSysColor

• 0x42c5a4 EqualRect

• 0x42c5a8 IsRectEmpty

• 0x42c5ac GetDC

• 0x42c5b0 ReleaseDC

• 0x42c5b4 LoadIconA

• 0x42c5b8 UnregisterClassA

• 0x42c5bc HideCaret

• 0x42c5c0 ShowCaret

• 0x42c5c4 ExcludeUpdateRgn

• 0x42c5c8 DrawFocusRect

• 0x42c5cc DefDlgProcA

• 0x42c5d0 CharNextA

• 0x42c5d4 LoadImageA

• 0x42c5d8 EnableWindow

• 0x42c5dc LoadMenuA

• 0x42c5e0 PtInRect

• 0x42c5e4 GetSubMenu

• 0x42c5e8 IsIconic

• 0x42c5ec GetSystemMetrics

• 0x42c5f0 GetClientRect

• 0x42c5f4 DrawIcon

• 0x42c5f8 SetScrollInfo

• 0x42c5fc RemovePropA

• 0x42c600 ShowScrollBar

• 0x42c604 GetSystemMenu

• 0x42c608 AppendMenuA

• 0x42c60c SendMessageA

• 0x42c610 ShowWindow

• 0x42c614 IsWindowUnicode

• 0x42c618 SystemParametersInfoA

Library GDI32.dll:

• 0x42c02c DeleteDC

• 0x42c030 StartDocA

• 0x42c034 SaveDC

• 0x42c038 RestoreDC

• 0x42c03c SelectObject

• 0x42c040 GetStockObject

• 0x42c044 SelectPalette

• 0x42c048 SetBkMode

• 0x42c04c SetPolyFillMode

• 0x42c050 SetROP2

• 0x42c054 SetStretchBltMode

• 0x42c058 SetMapMode

• 0x42c05c SetViewportOrgEx

• 0x42c060 OffsetViewportOrgEx

• 0x42c064 SetViewportExtEx

• 0x42c068 ScaleViewportExtEx

• 0x42c06c SetWindowOrgEx

• 0x42c070 OffsetWindowOrgEx

• 0x42c074 SetWindowExtEx

• 0x42c078 ScaleWindowExtEx

• 0x42c07c SelectClipRgn

• 0x42c080 ExcludeClipRect

• 0x42c084 IntersectClipRect

• 0x42c088 OffsetClipRgn

• 0x42c08c MoveToEx

• 0x42c090 LineTo

• 0x42c094 SetTextAlign

• 0x42c098 SetTextJustification

• 0x42c09c SetTextCharacterExtra

• 0x42c0a0 SetMapperFlags

• 0x42c0a4 GetCurrentPositionEx

• 0x42c0a8 ArcTo

• 0x42c0ac SetArcDirection

• 0x42c0b0 PolyDraw

• 0x42c0b4 SetBkColor

• 0x42c0b8 SetColorAdjustment

• 0x42c0bc PolyBezierTo

• 0x42c0c0 DeleteObject

• 0x42c0c4 GetClipRgn

• 0x42c0c8 CreateRectRgn

• 0x42c0cc SelectClipPath

• 0x42c0d0 ExtSelectClipRgn

• 0x42c0d4 PlayMetaFileRecord

• 0x42c0d8 GetObjectType

• 0x42c0dc EnumMetaFile

• 0x42c0e0 PlayMetaFile

• 0x42c0e4 GetDeviceCaps

• 0x42c0e8 GetViewportExtEx

• 0x42c0ec GetWindowExtEx

• 0x42c0f0 CreatePen

• 0x42c0f4 ExtCreatePen

• 0x42c0f8 CreateSolidBrush

• 0x42c0fc CreateHatchBrush

• 0x42c100 CreatePatternBrush

• 0x42c104 CreateDIBPatternBrushPt

• 0x42c108 PtVisible

• 0x42c10c RectVisible

• 0x42c110 TextOutA

• 0x42c114 ExtTextOutA

• 0x42c118 Escape

• 0x42c11c GetMapMode

• 0x42c120 PatBlt

• 0x42c124 SetRectRgn

• 0x42c128 CombineRgn

• 0x42c12c CreateRectRgnIndirect

• 0x42c130 CreateFontIndirectA

• 0x42c134 DPtoLP

• 0x42c138 GetTextExtentPoint32A

• 0x42c13c GetTextMetricsA

• 0x42c140 SetTextColor

• 0x42c144 GetClipBox

• 0x42c148 GetDCOrgEx

• 0x42c14c CreateBitmap

• 0x42c150 StretchBlt

• 0x42c154 CreateCompatibleDC

• 0x42c158 BitBlt

• 0x42c15c GetObjectA

• 0x42c160 CreateCompatibleBitmap

• 0x42c164 PolylineTo

• 0x42c168 CreateDIBitmap

• 0x42c16c GetTextExtentPointA

• 0x42c170 SetBitmapBits

Library comdlg32.dll:

• 0x42c630 GetOpenFileNameA

• 0x42c634 GetSaveFileNameA

• 0x42c638 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42c620 OpenPrinterA

• 0x42c624 DocumentPropertiesA

• 0x42c628 ClosePrinter

Library ADVAPI32.dll:

• 0x42c000 RegSetValueExA

• 0x42c004 RegOpenKeyA

• 0x42c008 RegDeleteKeyA

• 0x42c00c RegDeleteValueA

• 0x42c010 RegCloseKey

• 0x42c014 RegQueryValueExA

• 0x42c018 RegOpenKeyExA

• 0x42c01c RegCreateKeyExA

Library SHELL32.dll:

• 0x42c3b8 DragAcceptFiles

• 0x42c3bc SHGetFileInfoA

Library COMCTL32.dll:

• 0x42c024

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 51.105.208.173 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 216.58.200.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49178	216.58.200.78 clients2.google.com	443
192.168.56.101	49181	216.58.200.78 clients2.google.com	443
192.168.56.101	49182	216.58.200.78 clients2.google.com	443
192.168.56.101	49184	216.58.200.78 clients2.google.com	443
192.168.56.101	49188	216.58.200.78 clients2.google.com	443
192.168.56.101	49189	216.58.200.78 clients2.google.com	443
192.168.56.101	49190	216.58.200.78 clients2.google.com	443
192.168.56.101	49191	216.58.200.78 clients2.google.com	443
192.168.56.101	49194	216.58.200.78 clients2.google.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.