SmartHawk

9.4

极危

该样本未表现出任何异常！

重新分析

下载样本

7d776b2b9b68c836861746dc63d53ebc67533e5b004c7cf24203f0b34bc394d0

68cf1162c8c9fa227cec84cab524fe44.exe

分析耗时

101s

最近分析

文件大小

483.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619646307.168875 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619646296.527875 CryptGenKey	crypto_handle: 0x005c6920 algorithm_identifier: 0x0000660e () provider_handle: 0x005c5f60 flags: 1 key: fåà£?h®¢¼<ì¿¡ú¨v	success	1
1619646307.183875 CryptExportKey	crypto_handle: 0x005c6920 crypto_export_handle: 0x005c6028 buffer: f¤ð'L<ÂÔ°]ÛÚçs®áå¤7Éwá®Ìð¢«Z»ó\|ü½ \|©Öó-R§Åì{Ô*²i³2è~FºxxáR+Ú´2È_=ÃRõìÀ!ë×Ó]h$ blob_type: 1 flags: 64	success	1
1619646334.605875 CryptExportKey	crypto_handle: 0x005c6920 crypto_export_handle: 0x005c6028 buffer: f¤.\|çûú1.}+Ú »þ*îÝõ$Ócóø¤ËÑÇSÆÒ;qþ ¿ß´¡ºæèÒ~Ü¹9MÌ²¡üzá×lÉMúÉÜÕ®ýÂ öJÞ¾x blob_type: 1 flags: 64	success	1
1619646338.730875 CryptExportKey	crypto_handle: 0x005c6920 crypto_export_handle: 0x005c6028 buffer: f¤NXõýÔQg¨ÝG ±`ü\æç¦iÿßUWÓw}ªÃ:ö kùÛJò¢bÙKÜÕ/µIü¸åº~"¹E¹âªÜ!¡.ÄI_°xòÀéYóëê h blob_type: 1 flags: 64	success	1
1619646342.527875 CryptExportKey	crypto_handle: 0x005c6920 crypto_export_handle: 0x005c6028 buffer: f¤beJ)æÁô¥NG-ãì}ò MbÐIÝÎ_þv¿nl¼cKbüç«Ý·Ã[ó¡CÛ¬èJÒ0Uwfk¼l×.º_ãù×®§´ºÊz$».iß* blob_type: 1 flags: 64	success	1

This executable has a PDB path (1 个事件)

pdb_path

C:\Users\Mr.Anderson\Desktop\2008\HtmlParser\HtmlParser\Release\HtmlParser.pdb

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (5 个事件)

Time & API	Arguments	Status
1619646289.777875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00500000	success
1619646289.777875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00510000	success
1619645922.780769 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004160000	success
1619646292.902875 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01ff0000	success
1619646292.902875 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02810000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619646342.527875 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000003c4 process_identifier: 3272	success	1	0
1619646342.527875 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000003c4 process_identifier: 3304	success	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619646289.777875 NtProtectVirtualMemory	process_identifier: 428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 28672 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x00531000	success	0	0

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619646290.340875 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\68cf1162c8c9fa227cec84cab524fe44.exe newfilepath: C:\Windows\SysWOW64\WerFault\PresentationHostProxy.exe newfilepath_r: C:\Windows\SysWOW64\WerFault\PresentationHostProxy.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\68cf1162c8c9fa227cec84cab524fe44.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619646307.730875 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

presentationhostproxy.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619646307.433875 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	142.44.137.67
host	162.241.242.173
host	172.217.24.14
host	192.158.216.73
host	85.214.28.226

Installs itself for autorun at Windows startup (1 个事件)

service_name

PresentationHostProxy

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\WerFault\PresentationHostProxy.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619646291.933875 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x02cc2758 display_name: PresentationHostProxy error_control: 0 service_name: PresentationHostProxy filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\WerFault\PresentationHostProxy.exe" filepath_r: "C:\Windows\SysWOW64\WerFault\PresentationHostProxy.exe" service_manager_handle: 0x02cb9370 desired_access: 2 service_type: 16 password:	success	46933848	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619646310.355875 RegSetValueExA	key_handle: 0x000003c4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619646310.355875 RegSetValueExA	key_handle: 0x000003c4 value: @Ágz<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619646310.355875 RegSetValueExA	key_handle: 0x000003c4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619646310.355875 RegSetValueExW	key_handle: 0x000003c4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619646310.355875 RegSetValueExA	key_handle: 0x000003dc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619646310.355875 RegSetValueExA	key_handle: 0x000003dc value: @Ágz<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619646310.355875 RegSetValueExA	key_handle: 0x000003dc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619646310.355875 RegSetValueExW	key_handle: 0x000003c0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\WerFault\PresentationHostProxy.exe:Zone.Identifier

Generates some ICMP traffic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (7 个事件)

dead_host	192.158.216.73:80
dead_host	192.168.56.101:49188
dead_host	216.58.200.238:443
dead_host	162.241.242.173:8080
dead_host	172.217.24.14:443
dead_host	85.214.28.226:8080
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-04 04:54:21

Imports

Library KERNEL32.dll:

• 0x4470b8 GetTickCount

• 0x4470bc RtlUnwind

• 0x4470c0 TerminateProcess

• 0x4470c4 UnhandledExceptionFilter

• 0x4470c8 SetUnhandledExceptionFilter

• 0x4470cc IsDebuggerPresent

• 0x4470d0 GetSystemTimeAsFileTime

• 0x4470d4 RaiseException

• 0x4470d8 GetCommandLineA

• 0x4470dc GetStartupInfoA

• 0x4470e0 HeapAlloc

• 0x4470e4 HeapFree

• 0x4470e8 Sleep

• 0x4470ec ExitProcess

• 0x4470f0 VirtualProtect

• 0x4470f4 GetSystemInfo

• 0x4470f8 VirtualQuery

• 0x4470fc HeapReAlloc

• 0x447100 HeapSize

• 0x447104 SetStdHandle

• 0x447108 GetFileType

• 0x44710c GetACP

• 0x447110 IsValidCodePage

• 0x447114 GetStringTypeA

• 0x447118 GetStringTypeW

• 0x44711c LCMapStringA

• 0x447120 LCMapStringW

• 0x447124 SetErrorMode

• 0x447128 GetStdHandle

• 0x44712c FreeEnvironmentStringsA

• 0x447130 GetEnvironmentStrings

• 0x447134 FreeEnvironmentStringsW

• 0x447138 GetEnvironmentStringsW

• 0x44713c SetHandleCount

• 0x447140 HeapCreate

• 0x447144 VirtualFree

• 0x447148 QueryPerformanceCounter

• 0x44714c InitializeCriticalSectionAndSpinCount

• 0x447150 GetConsoleCP

• 0x447154 GetConsoleMode

• 0x447158 WriteConsoleA

• 0x44715c GetConsoleOutputCP

• 0x447160 WriteConsoleW

• 0x447164 CompareStringW

• 0x447168 SetEnvironmentVariableA

• 0x44716c GetFileTime

• 0x447170 GetFileSizeEx

• 0x447174 GetFileAttributesA

• 0x447178 GetModuleHandleW

• 0x44717c GetOEMCP

• 0x447180 GetCPInfo

• 0x447184 CreateFileA

• 0x447188 GetFullPathNameA

• 0x44718c GetVolumeInformationA

• 0x447190 FindFirstFileA

• 0x447194 FindClose

• 0x447198 GetCurrentProcess

• 0x44719c DuplicateHandle

• 0x4471a0 SetEndOfFile

• 0x4471a4 UnlockFile

• 0x4471a8 LockFile

• 0x4471ac FlushFileBuffers

• 0x4471b0 SetFilePointer

• 0x4471b4 WriteFile

• 0x4471b8 ReadFile

• 0x4471bc GetThreadLocale

• 0x4471c0 InterlockedIncrement

• 0x4471c4 TlsFree

• 0x4471c8 LocalReAlloc

• 0x4471cc TlsSetValue

• 0x4471d0 TlsAlloc

• 0x4471d4 GlobalHandle

• 0x4471d8 GlobalReAlloc

• 0x4471dc TlsGetValue

• 0x4471e0 GlobalFlags

• 0x4471e4 LocalAlloc

• 0x4471e8 LeaveCriticalSection

• 0x4471ec EnterCriticalSection

• 0x4471f0 DeleteCriticalSection

• 0x4471f4 InitializeCriticalSection

• 0x4471f8 FileTimeToLocalFileTime

• 0x4471fc FileTimeToSystemTime

• 0x447200 InterlockedDecrement

• 0x447204 GetModuleFileNameW

• 0x447208 FormatMessageA

• 0x44720c LocalFree

• 0x447210 MulDiv

• 0x447214 GlobalGetAtomNameA

• 0x447218 GlobalFindAtomA

• 0x44721c lstrcmpW

• 0x447220 GetVersionExA

• 0x447224 lstrlenA

• 0x447228 WritePrivateProfileStringA

• 0x44722c GlobalUnlock

• 0x447230 GlobalFree

• 0x447234 FreeResource

• 0x447238 GetCurrentProcessId

• 0x44723c SetLastError

• 0x447240 GlobalAddAtomA

• 0x447244 WaitForSingleObject

• 0x447248 GlobalDeleteAtom

• 0x44724c GetCurrentThread

• 0x447250 GetCurrentThreadId

• 0x447254 ConvertDefaultLocale

• 0x447258 EnumResourceLanguagesA

• 0x44725c GetModuleFileNameA

• 0x447260 GetLocaleInfoA

• 0x447264 LoadLibraryA

• 0x447268 CompareStringA

• 0x44726c InterlockedExchange

• 0x447270 GlobalLock

• 0x447274 lstrcmpA

• 0x447278 GlobalAlloc

• 0x44727c FreeLibrary

• 0x447280 GetModuleHandleA

• 0x447284 GetProcAddress

• 0x447288 GetFileSize

• 0x44728c CreateFileMappingA

• 0x447290 MapViewOfFile

• 0x447294 UnmapViewOfFile

• 0x447298 CloseHandle

• 0x44729c MultiByteToWideChar

• 0x4472a0 GetLastError

• 0x4472a4 WideCharToMultiByte

• 0x4472a8 LoadResource

• 0x4472ac LockResource

• 0x4472b0 SizeofResource

• 0x4472b4 FindResourceA

• 0x4472b8 GetTimeZoneInformation

• 0x4472bc VirtualAlloc

Library USER32.dll:

• 0x447314 RegisterClipboardFormatA

• 0x447318 PostThreadMessageA

• 0x44731c CharUpperA

• 0x447320 GetSysColorBrush

• 0x447324 ReleaseCapture

• 0x447328 LoadCursorA

• 0x44732c SetCapture

• 0x447330 DestroyMenu

• 0x447334 EndPaint

• 0x447338 BeginPaint

• 0x44733c GetWindowDC

• 0x447340 ClientToScreen

• 0x447344 GrayStringA

• 0x447348 DrawTextExA

• 0x44734c DrawTextA

• 0x447350 TabbedTextOutA

• 0x447354 ShowWindow

• 0x447358 MoveWindow

• 0x44735c SetWindowTextA

• 0x447360 IsDialogMessageA

• 0x447364 SetDlgItemTextA

• 0x447368 RegisterWindowMessageA

• 0x44736c SendDlgItemMessageA

• 0x447370 WinHelpA

• 0x447374 IsChild

• 0x447378 GetCapture

• 0x44737c GetClassLongA

• 0x447380 GetClassNameA

• 0x447384 SetPropA

• 0x447388 GetPropA

• 0x44738c RemovePropA

• 0x447390 SetFocus

• 0x447394 GetWindowTextA

• 0x447398 GetForegroundWindow

• 0x44739c GetTopWindow

• 0x4473a0 UnhookWindowsHookEx

• 0x4473a4 GetMessageTime

• 0x4473a8 GetMessagePos

• 0x4473ac MapWindowPoints

• 0x4473b0 SetMenu

• 0x4473b4 SetForegroundWindow

• 0x4473b8 UpdateWindow

• 0x4473bc GetSubMenu

• 0x4473c0 GetMenuItemID

• 0x4473c4 GetMenuItemCount

• 0x4473c8 CreateWindowExA

• 0x4473cc GetClassInfoExA

• 0x4473d0 GetClassInfoA

• 0x4473d4 RegisterClassA

• 0x4473d8 GetSysColor

• 0x4473dc AdjustWindowRectEx

• 0x4473e0 EqualRect

• 0x4473e4 PtInRect

• 0x4473e8 GetDlgCtrlID

• 0x4473ec DefWindowProcA

• 0x4473f0 CallWindowProcA

• 0x4473f4 GetMenu

• 0x4473f8 SetWindowLongA

• 0x4473fc OffsetRect

• 0x447400 IntersectRect

• 0x447404 SystemParametersInfoA

• 0x447408 GetWindowPlacement

• 0x44740c GetWindowRect

• 0x447410 ReleaseDC

• 0x447414 GetDC

• 0x447418 CopyRect

• 0x44741c GetWindow

• 0x447420 SetWindowContextHelpId

• 0x447424 MapDialogRect

• 0x447428 SetWindowPos

• 0x44742c GetDesktopWindow

• 0x447430 SetActiveWindow

• 0x447434 CreateDialogIndirectParamA

• 0x447438 DestroyWindow

• 0x44743c GetDlgItem

• 0x447440 GetNextDlgTabItem

• 0x447444 EndDialog

• 0x447448 GetWindowThreadProcessId

• 0x44744c GetWindowLongA

• 0x447450 UnregisterClassA

• 0x447454 MessageBeep

• 0x447458 GetNextDlgGroupItem

• 0x44745c InvalidateRgn

• 0x447460 InvalidateRect

• 0x447464 SetRect

• 0x447468 IsRectEmpty

• 0x44746c CopyAcceleratorTableA

• 0x447470 CharNextA

• 0x447474 GetWindowTextLengthA

• 0x447478 GetLastActivePopup

• 0x44747c IsWindowEnabled

• 0x447480 MessageBoxA

• 0x447484 SetCursor

• 0x447488 SetWindowsHookExA

• 0x44748c CallNextHookEx

• 0x447490 GetMessageA

• 0x447494 TranslateMessage

• 0x447498 DispatchMessageA

• 0x44749c GetActiveWindow

• 0x4474a0 IsWindowVisible

• 0x4474a4 GetKeyState

• 0x4474a8 PeekMessageA

• 0x4474ac GetCursorPos

• 0x4474b0 ValidateRect

• 0x4474b4 SetMenuItemBitmaps

• 0x4474b8 GetMenuCheckMarkDimensions

• 0x4474bc LoadBitmapA

• 0x4474c0 GetFocus

• 0x4474c4 GetParent

• 0x4474c8 ModifyMenuA

• 0x4474cc GetMenuState

• 0x4474d0 EnableMenuItem

• 0x4474d4 CheckMenuItem

• 0x4474d8 PostMessageA

• 0x4474dc PostQuitMessage

• 0x4474e0 RedrawWindow

• 0x4474e4 IsWindow

• 0x4474e8 LoadIconA

• 0x4474ec EnableWindow

• 0x4474f0 GetClientRect

• 0x4474f4 IsIconic

• 0x4474f8 GetSystemMenu

• 0x4474fc SendMessageA

• 0x447500 AppendMenuA

• 0x447504 DrawIcon

• 0x447508 GetSystemMetrics

Library GDI32.dll:

• 0x447034 Escape

• 0x447038 GetStockObject

• 0x44703c GetDeviceCaps

• 0x447040 DeleteDC

• 0x447044 GetBkColor

• 0x447048 GetTextColor

• 0x44704c GetRgnBox

• 0x447050 GetMapMode

• 0x447054 ExtSelectClipRgn

• 0x447058 ExtTextOutA

• 0x44705c TextOutA

• 0x447060 RectVisible

• 0x447064 PtVisible

• 0x447068 ScaleWindowExtEx

• 0x44706c SetWindowExtEx

• 0x447070 ScaleViewportExtEx

• 0x447074 SetViewportExtEx

• 0x447078 OffsetViewportOrgEx

• 0x44707c SetViewportOrgEx

• 0x447080 CreateBitmap

• 0x447084 GetWindowExtEx

• 0x447088 GetViewportExtEx

• 0x44708c DeleteObject

• 0x447090 SetMapMode

• 0x447094 RestoreDC

• 0x447098 SaveDC

• 0x44709c GetObjectA

• 0x4470a0 SetBkColor

• 0x4470a4 SetTextColor

• 0x4470a8 GetClipBox

• 0x4470ac CreateRectRgnIndirect

• 0x4470b0 SelectObject

Library COMDLG32.dll:

• 0x44702c GetFileTitleA

Library WINSPOOL.DRV:

• 0x44754c ClosePrinter

• 0x447550 DocumentPropertiesA

• 0x447554 OpenPrinterA

Library ADVAPI32.dll:

• 0x447000 RegSetValueExA

• 0x447004 RegCreateKeyExA

• 0x447008 RegQueryValueA

• 0x44700c RegOpenKeyA

• 0x447010 RegEnumKeyA

• 0x447014 RegDeleteKeyA

• 0x447018 RegOpenKeyExA

• 0x44701c RegQueryValueExA

• 0x447020 RegCloseKey

• 0x447024 CryptAcquireContextA

Library SHLWAPI.dll:

• 0x4472fc PathFindExtensionA

• 0x447300 UrlUnescapeA

• 0x447304 PathStripToRootA

• 0x447308 PathIsUNCA

• 0x44730c PathFindFileNameA

Library oledlg.dll:

• 0x44759c

Library ole32.dll:

• 0x44755c StgCreateDocfileOnILockBytes

• 0x447560 CLSIDFromProgID

• 0x447564 CLSIDFromString

• 0x447568 CoTaskMemFree

• 0x44756c CoTaskMemAlloc

• 0x447570 CoGetClassObject

• 0x447574 StgOpenStorageOnILockBytes

• 0x447578 CreateILockBytesOnHGlobal

• 0x44757c OleUninitialize

• 0x447580 CoFreeUnusedLibraries

• 0x447584 OleInitialize

• 0x447588 CoRevokeClassObject

• 0x44758c OleIsCurrentClipboard

• 0x447590 OleFlushClipboard

• 0x447594 CoRegisterMessageFilter

Library OLEAUT32.dll:

• 0x4472c4 VariantCopy

• 0x4472c8 SysAllocString

• 0x4472cc SafeArrayDestroy

• 0x4472d0 OleCreateFontIndirect

• 0x4472d4 SysAllocStringByteLen

• 0x4472d8 SysStringLen

• 0x4472dc VariantInit

• 0x4472e0 VariantChangeType

• 0x4472e4 VariantClear

• 0x4472e8 SysAllocStringLen

• 0x4472ec SysFreeString

• 0x4472f0 SystemTimeToVariantTime

• 0x4472f4 VariantTimeToSystemTime

Library WININET.dll:

• 0x447510 InternetOpenUrlA

• 0x447514 InternetReadFile

• 0x447518 InternetWriteFile

• 0x44751c InternetSetFilePointer

• 0x447520 InternetSetStatusCallback

• 0x447524 InternetOpenA

• 0x447528 InternetGetLastResponseInfoA

• 0x44752c InternetCloseHandle

• 0x447530 HttpQueryInfoA

• 0x447534 InternetQueryDataAvailable

• 0x447538 InternetSetOptionExA

• 0x44753c InternetQueryOptionA

• 0x447540 InternetCrackUrlA

• 0x447544 InternetCanonicalizeUrlA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com A 216.58.200.238	172.217.27.142
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49189	142.44.137.67	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57236	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://142.44.137.67:443/sPZM4/o9pA9zrYecTFfoBE/P1MAQ/cTGf/	POST /sPZM4/o9pA9zrYecTFfoBE/P1MAQ/cTGf/ HTTP/1.1 Content-Type: multipart/form-data; boundary=---------0RoPTTxTd User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 142.44.137.67:443 Content-Length: 4532 Connection: Keep-Alive Cache-Control: no-cache

URI

Data

http://142.44.137.67:443/sPZM4/o9pA9zrYecTFfoBE/P1MAQ/cTGf/

POST /sPZM4/o9pA9zrYecTFfoBE/P1MAQ/cTGf/ HTTP/1.1
Content-Type: multipart/form-data; boundary=---------0RoPTTxTd
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 142.44.137.67:443
Content-Length: 4532
Connection: Keep-Alive
Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.