8.0
高危
59 个模型检测该样本为恶意！
重新分析
更多

c600d2c2146cbdd5eb227252c58d50143bafe04d1b8b98efa1e3be2ec2f706d1

624780660979543e29a4719a55238229.exe

分析耗时

79s

最近分析

文件大小

296.0KB
静态报毒 动态报毒 100% AI SCORE=87 CONFIDENCE CRYPTERX DOWNLOADER34 EGVRZ ELDORADO EMOTET EMOTETLTG ESEK ESTYDUBW3VE GDVZ GENCIRC GENERICKD GENKD GENKRYPTIK HGCU HIGH CONFIDENCE HWXEWW IPHALNXG5RI KRYPTIK MALICIOUS PE MALWARE@#3G5TMSYEIBBAM SCORE SUSGEN THIADBO UNSAFE WACATAC 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FSE!624780660979 20201012 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Alibaba Trojan:Win32/Emotet.f7a92143 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:CrypterX-gen [Trj] 20201014 18.4.3895.0
Tencent Malware.Win32.Gencirc.10ce0726 20201014 1.0.0.1
Kingsoft 20201014 2013.8.14.323
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1620948861.583627
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (4 个事件)
Time & API Arguments Status Return Repeated
1620948852.614627
CryptGenKey
crypto_handle: 0x002f5ac8
algorithm_identifier: 0x0000660e ()
provider_handle: 0x002f5310
flags: 1
key: f!^^|ˏŽRwüŸlÛ2ù
success 1 0
1620948861.599627
CryptExportKey
crypto_handle: 0x002f5ac8
crypto_export_handle: 0x002f5a88
buffer: f¤ˆ† †ŠH¼î íÑmËa…ú$þ¸Õ%ª’邤2kHÝì·úž9¯S&P8®Å©S!ߊŽ­íŒ-û¸,n³jÉy!ÑØ EÀ‡D N›#@áö™&B8dô|Ž®
blob_type: 1
flags: 64
success 1 0
1620948870.364627
CryptExportKey
crypto_handle: 0x002f5ac8
crypto_export_handle: 0x002f5a88
buffer: f¤Ãk+UIØV´ð`j¥{ÍÅ@=¤—³Î`œˆPUŽþ%pÐñεû|Lԁð§šOzu+Kr‡âI:›™ƒŸªéýCÜL:çŸmDà„"ƒBG^^ ™9Á6èÂs
blob_type: 1
flags: 64
success 1 0
1620948903.521627
CryptExportKey
crypto_handle: 0x002f5ac8
crypto_export_handle: 0x002f5a88
buffer: f¤5„—Ù­—g˜¿äEä)žÏĀÇáE |­égPœ0“%m|÷ ãgo‰ÁÞ٘…¯iÌn P»à`ˆdȷʪN Â8c“q‡‰O£“¨­W¶~Õ ã9íݗ4 ­`p
blob_type: 1
flags: 64
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name None
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1620948851.802627
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 61440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f20000
success 0 0
Foreign language identified in PE resource (4 个事件)
name RT_ICON language LANG_CHINESE offset 0x0003c898 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000128
name RT_ICON language LANG_CHINESE offset 0x0003c898 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000128
name RT_GROUP_ICON language LANG_CHINESE offset 0x0003c9c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000022
name None language LANG_CHINESE offset 0x0003c9e8 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000ed33
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 个事件)
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1620948851.849627
NtProtectVirtualMemory
process_identifier: 2772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 45056
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x01f51000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620948862.161627
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.651591156106561 section {'size_of_data': '0x00012000', 'virtual_address': '0x0003c000', 'entropy': 7.651591156106561, 'name': '.rsrc', 'virtual_size': '0x00011d50'} description A section with a high entropy has been found
entropy 0.2465753424657534 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process 624780660979543e29a4719a55238229.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1620948861.786627
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (4 个事件)
host 172.217.24.14
host 178.79.163.131
host 185.183.16.47
host 51.38.124.206
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1620948864.708627
RegSetValueExA
key_handle: 0x000003c4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620948864.708627
RegSetValueExA
key_handle: 0x000003c4
value: P?”EaH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620948864.708627
RegSetValueExA
key_handle: 0x000003c4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620948864.724627
RegSetValueExW
key_handle: 0x000003c4
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620948864.724627
RegSetValueExA
key_handle: 0x000003dc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620948864.724627
RegSetValueExA
key_handle: 0x000003dc
value: P?”EaH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620948864.724627
RegSetValueExA
key_handle: 0x000003dc
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620948864.739627
RegSetValueExW
key_handle: 0x000003c0
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.EmotetLTG.Trojan
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43816964
CAT-QuickHeal Trojan.Wacatac
McAfee Emotet-FSE!624780660979
Malwarebytes Trojan.MalPack.TRE
Zillya Trojan.Kryptik.Win32.2528759
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Trojan:Win32/Emotet.f7a92143
K7GW Trojan ( 005605291 )
K7AntiVirus Trojan ( 005605291 )
Arcabit Trojan.Generic.D29C9804
Invincea Mal/Generic-S
Cyren W32/Emotet.ASJ.gen!Eldorado
Symantec Trojan.Gen.2
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Emotet-7570708-0
Kaspersky Trojan-Banker.Win32.Emotet.gdvz
BitDefender Trojan.GenericKD.43816964
NANO-Antivirus Trojan.Win32.Emotet.hwxeww
Avast Win32:CrypterX-gen [Trj]
Tencent Malware.Win32.Gencirc.10ce0726
Ad-Aware Trojan.GenericKD.43816964
Sophos Mal/Generic-S
Comodo Malware@#3g5tmsyeibbam
F-Secure Trojan.TR/AD.Emotet.egvrz
DrWeb Trojan.DownLoader34.39802
VIPRE Trojan.Win32.Generic!BT
TrendMicro Trojan.Win32.WACATAC.THIADBO
McAfee-GW-Edition Emotet-FSE!624780660979
FireEye Generic.mg.624780660979543e
Emsisoft Trojan.GenericKD.43816964 (B)
SentinelOne DFI - Malicious PE
Jiangmin Trojan.Banker.Emotet.omw
Webroot W32.Trojan.GenKD
Avira TR/AD.Emotet.egvrz
MAX malware (ai score=87)
Antiy-AVL Trojan[Banker]/Win32.Emotet
Microsoft Trojan:Win32/Emotet.AR!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm Trojan-Banker.Win32.Emotet.gdvz
GData Trojan.GenericKD.43816964
Cynet Malicious (score: 90)
AhnLab-V3 Malware/Win32.Generic.C4196637
ALYac Trojan.GenericKD.43816964
VBA32 Trojan.Wacatac
Cylance Unsafe
ESET-NOD32 a variant of Win32/Kryptik.HGCU
TrendMicro-HouseCall Trojan.Win32.WACATAC.THIADBO
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 51.38.124.206:80
dead_host 185.183.16.47:80
dead_host 192.168.56.101:49175
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-09-12 01:29:09

Imports

Library KERNEL32.dll:
• 0x42a0f0 HeapSize
• 0x42a0f4 HeapReAlloc
• 0x42a0f8 GetACP
• 0x42a100 HeapDestroy
• 0x42a104 HeapCreate
• 0x42a108 VirtualFree
• 0x42a10c VirtualAlloc
• 0x42a110 IsBadWritePtr
• 0x42a128 SetHandleCount
• 0x42a12c GetStdHandle
• 0x42a130 GetFileType
• 0x42a134 LCMapStringA
• 0x42a138 LCMapStringW
• 0x42a13c GetStringTypeA
• 0x42a140 GetStringTypeW
• 0x42a144 IsBadReadPtr
• 0x42a148 IsBadCodePtr
• 0x42a14c SetStdHandle
• 0x42a150 CompareStringA
• 0x42a154 CompareStringW
• 0x42a15c TerminateProcess
• 0x42a160 GetProfileStringA
• 0x42a164 HeapFree
• 0x42a168 RaiseException
• 0x42a16c ExitProcess
• 0x42a170 GetCommandLineA
• 0x42a174 GetStartupInfoA
• 0x42a178 HeapAlloc
• 0x42a17c RtlUnwind
• 0x42a180 GetFileTime
• 0x42a184 GetFileSize
• 0x42a188 GetFileAttributesA
• 0x42a18c GetTickCount
• 0x42a198 GetFullPathNameA
• 0x42a1a0 FindFirstFileA
• 0x42a1a4 FindClose
• 0x42a1a8 SetEndOfFile
• 0x42a1ac UnlockFile
• 0x42a1b0 LockFile
• 0x42a1b4 FlushFileBuffers
• 0x42a1b8 SetFilePointer
• 0x42a1bc WriteFile
• 0x42a1c0 ReadFile
• 0x42a1c4 CreateFileA
• 0x42a1c8 GetCurrentProcess
• 0x42a1cc DuplicateHandle
• 0x42a1d0 SetErrorMode
• 0x42a1d4 GetThreadLocale
• 0x42a1d8 SizeofResource
• 0x42a1e0 GetOEMCP
• 0x42a1e4 GetCPInfo
• 0x42a1e8 GetProcessVersion
• 0x42a1ec GlobalFlags
• 0x42a1f0 TlsGetValue
• 0x42a1f4 LocalReAlloc
• 0x42a1f8 TlsSetValue
• 0x42a200 GlobalReAlloc
• 0x42a208 TlsFree
• 0x42a20c GlobalHandle
• 0x42a214 TlsAlloc
• 0x42a21c LocalAlloc
• 0x42a220 GetLastError
• 0x42a224 lstrcpynA
• 0x42a228 GlobalFree
• 0x42a22c CloseHandle
• 0x42a230 GlobalAlloc
• 0x42a234 lstrcmpA
• 0x42a238 GetCurrentThread
• 0x42a23c FormatMessageA
• 0x42a240 LocalFree
• 0x42a244 GetModuleFileNameA
• 0x42a248 MultiByteToWideChar
• 0x42a24c WideCharToMultiByte
• 0x42a250 lstrlenA
• 0x42a25c GlobalLock
• 0x42a260 GlobalUnlock
• 0x42a264 MulDiv
• 0x42a268 SetLastError
• 0x42a26c FindResourceA
• 0x42a270 LoadResource
• 0x42a274 LockResource
• 0x42a278 GetVersion
• 0x42a27c GetCurrentThreadId
• 0x42a280 GlobalGetAtomNameA
• 0x42a284 lstrcmpiA
• 0x42a288 GlobalAddAtomA
• 0x42a28c GlobalFindAtomA
• 0x42a290 GlobalDeleteAtom
• 0x42a294 lstrcpyA
• 0x42a298 GetModuleHandleA
• 0x42a29c GetProcAddress
• 0x42a2a0 FreeConsole
• 0x42a2a4 lstrcatA
• 0x42a2a8 CreateProcessA
• 0x42a2b0 LoadLibraryA
• 0x42a2b8 FreeLibrary
Library USER32.dll:
• 0x42a2f8 GetNextDlgGroupItem
• 0x42a2fc CharUpperA
• 0x42a304 PostThreadMessageA
• 0x42a308 IsDialogMessageA
• 0x42a30c CheckRadioButton
• 0x42a310 PostMessageA
• 0x42a314 SendDlgItemMessageA
• 0x42a318 MapWindowPoints
• 0x42a31c PeekMessageA
• 0x42a320 DispatchMessageA
• 0x42a324 SetActiveWindow
• 0x42a328 AdjustWindowRectEx
• 0x42a32c ScreenToClient
• 0x42a330 IsWindowVisible
• 0x42a334 GetTopWindow
• 0x42a338 MessageBoxA
• 0x42a33c IsChild
• 0x42a340 WinHelpA
• 0x42a344 wsprintfA
• 0x42a348 GetClassInfoA
• 0x42a34c RegisterClassA
• 0x42a350 GetMenu
• 0x42a354 GetMenuItemCount
• 0x42a358 GetSubMenu
• 0x42a35c GetMenuItemID
• 0x42a360 GetDlgItem
• 0x42a368 GetWindowTextA
• 0x42a36c GetDlgCtrlID
• 0x42a374 DestroyWindow
• 0x42a378 CreateWindowExA
• 0x42a37c SetWindowsHookExA
• 0x42a380 CallNextHookEx
• 0x42a384 GetClassLongA
• 0x42a388 SetPropA
• 0x42a38c UnhookWindowsHookEx
• 0x42a390 GetPropA
• 0x42a394 CallWindowProcA
• 0x42a398 RemovePropA
• 0x42a39c GetMessageTime
• 0x42a3a0 GetMessagePos
• 0x42a3a4 GetLastActivePopup
• 0x42a3a8 GetForegroundWindow
• 0x42a3ac SetForegroundWindow
• 0x42a3b0 GetWindow
• 0x42a3b4 GetWindowLongA
• 0x42a3b8 SetWindowPos
• 0x42a3c0 OffsetRect
• 0x42a3c4 IntersectRect
• 0x42a3cc GetWindowPlacement
• 0x42a3d0 GetCapture
• 0x42a3d4 GetFocus
• 0x42a3d8 DrawFocusRect
• 0x42a3dc SetRect
• 0x42a3e0 CopyRect
• 0x42a3e4 SetFocus
• 0x42a3e8 UpdateWindow
• 0x42a3ec IsIconic
• 0x42a3f0 GetSystemMetrics
• 0x42a3f4 DrawIcon
• 0x42a3f8 GetSystemMenu
• 0x42a3fc AppendMenuA
• 0x42a400 ShowWindow
• 0x42a404 LoadIconA
• 0x42a408 EnableWindow
• 0x42a40c LoadCursorA
• 0x42a410 CopyIcon
• 0x42a414 GetSysColor
• 0x42a418 UnregisterClassA
• 0x42a41c HideCaret
• 0x42a420 ShowCaret
• 0x42a424 ExcludeUpdateRgn
• 0x42a428 DefDlgProcA
• 0x42a42c IsWindowUnicode
• 0x42a430 DestroyCursor
• 0x42a434 GetWindowRect
• 0x42a438 GetParent
• 0x42a43c GetDC
• 0x42a440 ReleaseDC
• 0x42a444 InflateRect
• 0x42a448 InvalidateRect
• 0x42a44c IsWindow
• 0x42a450 SetWindowLongA
• 0x42a454 SetCursor
• 0x42a458 GetClientRect
• 0x42a45c PtInRect
• 0x42a460 ReleaseCapture
• 0x42a464 RedrawWindow
• 0x42a468 SetCapture
• 0x42a46c CharNextA
• 0x42a470 GetKeyState
• 0x42a474 MessageBeep
• 0x42a478 SendMessageA
• 0x42a47c GetSysColorBrush
• 0x42a480 GetDesktopWindow
• 0x42a484 GetClassNameA
• 0x42a488 DestroyMenu
• 0x42a48c LoadStringA
• 0x42a490 MapDialogRect
• 0x42a498 EndDialog
• 0x42a4a0 GetMessageA
• 0x42a4a4 TranslateMessage
• 0x42a4a8 GetActiveWindow
• 0x42a4ac ValidateRect
• 0x42a4b0 PostQuitMessage
• 0x42a4b4 GetCursorPos
• 0x42a4b8 WindowFromPoint
• 0x42a4bc GrayStringA
• 0x42a4c0 DrawTextA
• 0x42a4c4 TabbedTextOutA
• 0x42a4c8 EndPaint
• 0x42a4cc BeginPaint
• 0x42a4d0 GetWindowDC
• 0x42a4d4 ClientToScreen
• 0x42a4dc LoadBitmapA
• 0x42a4e0 GetMenuState
• 0x42a4e4 ModifyMenuA
• 0x42a4e8 SetMenuItemBitmaps
• 0x42a4ec CheckMenuItem
• 0x42a4f0 EnableMenuItem
• 0x42a4f4 SetWindowTextA
• 0x42a4f8 IsWindowEnabled
• 0x42a4fc DefWindowProcA
• 0x42a500 MoveWindow
• 0x42a504 GetNextDlgTabItem
Library GDI32.dll:
• 0x42a028 LineTo
• 0x42a02c MoveToEx
• 0x42a030 Polygon
• 0x42a034 GetClipBox
• 0x42a038 SetTextColor
• 0x42a03c SetBkColor
• 0x42a040 CreateBitmap
• 0x42a044 SaveDC
• 0x42a048 RestoreDC
• 0x42a04c SetBkMode
• 0x42a050 SetMapMode
• 0x42a054 SetViewportOrgEx
• 0x42a058 OffsetViewportOrgEx
• 0x42a05c SetViewportExtEx
• 0x42a060 ScaleViewportExtEx
• 0x42a064 SetWindowExtEx
• 0x42a068 ScaleWindowExtEx
• 0x42a06c CreateDIBSection
• 0x42a070 GetDeviceCaps
• 0x42a074 GetViewportExtEx
• 0x42a078 GetWindowExtEx
• 0x42a07c PtVisible
• 0x42a080 RectVisible
• 0x42a084 TextOutA
• 0x42a088 ExtTextOutA
• 0x42a08c Escape
• 0x42a090 GetMapMode
• 0x42a094 PatBlt
• 0x42a098 DPtoLP
• 0x42a09c GetTextColor
• 0x42a0a0 GetBkColor
• 0x42a0a4 LPtoDP
• 0x42a0a8 CreateCompatibleDC
• 0x42a0ac SelectObject
• 0x42a0b0 CreateSolidBrush
• 0x42a0b4 Rectangle
• 0x42a0b8 GdiFlush
• 0x42a0bc IntersectClipRect
• 0x42a0c0 CreatePen
• 0x42a0c4 Arc
• 0x42a0c8 BitBlt
• 0x42a0cc DeleteDC
• 0x42a0d0 DeleteObject
• 0x42a0d8 GetObjectA
• 0x42a0dc CreateFontIndirectA
• 0x42a0e0 CreateDIBitmap
• 0x42a0e4 GetTextExtentPointA
• 0x42a0e8 GetStockObject
Library comdlg32.dll:
• 0x42a51c GetFileTitleA
Library WINSPOOL.DRV:
• 0x42a50c ClosePrinter
• 0x42a510 DocumentPropertiesA
• 0x42a514 OpenPrinterA
Library ADVAPI32.dll:
• 0x42a000 RegCloseKey
• 0x42a004 RegSetValueExA
• 0x42a008 RegCreateKeyExA
• 0x42a010 RegOpenKeyExA
• 0x42a014 RegQueryValueA
Library SHELL32.dll:
• 0x42a2f0 ShellExecuteA
Library COMCTL32.dll:
• 0x42a01c
Library oledlg.dll:
• 0x42a564
Library ole32.dll:
• 0x42a528 OleInitialize
• 0x42a52c CoTaskMemAlloc
• 0x42a530 CoTaskMemFree
• 0x42a540 CoGetClassObject
• 0x42a544 CLSIDFromString
• 0x42a548 CLSIDFromProgID
• 0x42a550 CoRevokeClassObject
• 0x42a554 OleFlushClipboard
• 0x42a55c OleUninitialize
Library OLEPRO32.DLL:
• 0x42a2e8
Library OLEAUT32.dll:
• 0x42a2c0 SysFreeString
• 0x42a2c4 SysAllocStringLen
• 0x42a2c8 VariantClear
• 0x42a2d0 VariantCopy
• 0x42a2d4 VariantChangeType
• 0x42a2d8 SysAllocString
• 0x42a2e0 SysStringLen

Exports

Ordinal Address Name
1 0x402450 yuAAQERWEARDFGSFdgtgfgSZXAWQFAs

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.