4.8
中危
62 个模型检测该样本为恶意！
重新分析
更多

d59e1af7ccf6cd41ad04dd1a8dc8c59ceb93e2684bb6de89975819d0e9ddf888

6bb72d800a2362e7865f8fd8083752c5.exe

分析耗时

80s

最近分析

文件大小

600.0KB
静态报毒 动态报毒 100% AI SCORE=80 AIDETECTGBM ATTRIBUTE BSYMEM CLASSIC CONFIDENCE CRYPTINJECT DOWNLOADER34 ELDORADO EMOTET ENDK EVJT EVJU FSTA GDSDA GENKRYPTIK GVWYZ2YZSFU HIGH CONFIDENCE HIGHCONFIDENCE HSYQIV HWMA7XSA KCLOUD KDJJZ KRYPTIK LM0@AMMCRMMO MALICIOUS PE MALWARE@#AVXZZGQG00RP R349200 SAVE SCORE SMTHF STATIC AI SUSGEN TRICKBOT TSCOPE UNSAFE WSAP ZEVBAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Bsymem.e73cb90b 20190527 0.3.0.5
Avast Win32:Malware-gen 20210223 21.1.5827.0
Tencent Win32.Trojan.Bsymem.Wsap 20210223 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft Win32.Troj.Bsymem.s.(kcloud) 20210223 2017.9.26.565
McAfee Trickbot-FSTA!6BB72D800A23 20210223 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619606786.52827
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619606788.29427
__exception__
stacktrace: 
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
hook_in_monitor+0x45 lde-0x133 @ 0x756142ea
New_ntdll_LdrGetProcedureAddress+0x43 New_ntdll_LdrLoadDll-0x156 @ 0x7562f7f3
GetProcAddress+0x60 GetModuleHandleA-0x80 kernelbase+0x4190 @ 0x7fefdc54190
SvchostPushServiceGlobals+0x471 WinHttpQueryOption-0x1a7b winhttp+0x1eb99 @ 0x7fef9efeb99
SvchostPushServiceGlobals+0x4fb WinHttpQueryOption-0x19f1 winhttp+0x1ec23 @ 0x7fef9efec23
WinHttpConnect+0x1ab WinHttpGetDefaultProxyConfiguration-0x1615 winhttp+0x13fe7 @ 0x7fef9ef3fe7

registers.r14: 25518718
registers.r9: 1970001920
registers.rcx: 0
registers.rsi: 3950512
registers.r10: 0
registers.rbx: 0
registers.rdi: 0
registers.r11: 0
registers.r8: 5
registers.rdx: 2
registers.rbp: 0
registers.r15: 589824
registers.r12: 3776560
registers.rsp: 2354000
registers.rax: 1
registers.r13: 449
exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c
exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a
exception.instruction: mov rax, qword ptr [rcx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 105050
exception.address: 0x77b69a5a
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Performs some HTTP requests (1 个事件)
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Allocates read-write-execute memory (usually to unpack itself) (22 个事件)
Time & API Arguments Status Return Repeated
1619607166.650251
NtAllocateVirtualMemory
process_identifier: 152
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x025e0000
success 0 0
1619607171.369251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607172.635251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607173.947251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607175.150251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607176.432251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607177.822251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607179.025251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607180.213251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607181.416251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607182.650251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607183.978251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607185.182251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x025e0000
success 0 0
1619607185.182251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00448000
success 0 0
1619607185.197251
NtAllocateVirtualMemory
process_identifier: 152
region_size: 188416
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02730000
success 0 0
1619607185.197251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 184320
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02731000
success 0 0
1619607185.244251
NtAllocateVirtualMemory
process_identifier: 152
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x0bd30000
success 0 0
1619607185.244251
NtAllocateVirtualMemory
process_identifier: 152
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x10000000
success 0 0
1619607185.244251
NtAllocateVirtualMemory
process_identifier: 152
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x10001000
success 0 0
1619607185.338251
NtAllocateVirtualMemory
process_identifier: 152
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x0bd40000
success 0 0
1619607185.338251
NtAllocateVirtualMemory
process_identifier: 152
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x0bd50000
success 0 0
1619607185.338251
NtAllocateVirtualMemory
process_identifier: 152
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x0bd60000
success 0 0
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1619607166.010251
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x00570000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619606793.68527
GetAdaptersAddresses
flags: 15
family: 0
failed 111 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 个事件)
Time & API Arguments Status Return Repeated
1619606756.27827
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619606766.46627
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619606779.66927
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 181.112.157.42
File has been identified by 62 AntiVirus engines on VirusTotal as malicious (50 out of 62 个事件)
Bkav W32.AIDetectGBM.malware.02
Elastic malicious (high confidence)
DrWeb Trojan.DownLoader34.28557
MicroWorld-eScan Trojan.Agent.EVJT
FireEye Generic.mg.6bb72d800a2362e7
ALYac Trojan.Agent.EVJT
Cylance Unsafe
Zillya Trojan.Bsymem.Win32.1436
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0056d4581 )
Alibaba Trojan:Win32/Bsymem.e73cb90b
K7GW Trojan ( 0056d4581 )
Cybereason malicious.00a236
Arcabit Trojan.Agent.EVJT
BitDefenderTheta Gen:NN.ZevbaF.34574.Lm0@ammcRmmO
Cyren W32/Kryptik.BUX.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.ENDK
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan.Win32.Bsymem.vho
BitDefender Trojan.Agent.EVJT
NANO-Antivirus Trojan.Win32.Bsymem.hsyqiv
Paloalto generic.ml
AegisLab Trojan.Win32.Bsymem.4!c
Tencent Win32.Trojan.Bsymem.Wsap
Ad-Aware Trojan.Agent.EVJT
TACHYON Trojan/W32.VB-Bsymem.614400
Sophos Mal/Generic-S
Comodo Malware@#avxzzgqg00rp
F-Secure Trojan.TR/Injector.kdjjz
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.EMOTET.SMTHF.hp
McAfee-GW-Edition BehavesLike.Win32.Emotet.jh
Emsisoft Trojan.Agent (A)
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Bsymem.aex
eGambit Generic.Malware
Avira TR/Injector.kdjjz
Antiy-AVL Trojan/Win32.Injector
Kingsoft Win32.Troj.Bsymem.s.(kcloud)
Gridinsoft Trojan.Win32.TrickBot.oa
Microsoft Trojan:Win32/Trickbot.VI!MSR
ViRobot Trojan.Win32.Agent.614400.AI
ZoneAlarm HEUR:Trojan.Win32.Bsymem.vho
GData Trojan.Agent.EVJT
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.CryptInject.R349200
McAfee Trickbot-FSTA!6BB72D800A23
MAX malware (ai score=80)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-24 16:54:48

Imports

Library oleaut32.dll:
• 0x401000 SysAllocStringLen
• 0x401008 SysStringLen
Library user32.dll:
• 0x401010 LoadStringW
Library kernel32.dll:
• 0x401018 GetProcAddress
• 0x40101c VirtualAlloc
• 0x401020 VirtualProtect
• 0x401024 RtlMoveMemory
• 0x401028 WideCharToMultiByte
• 0x40102c GetModuleHandleW
Library MSVBVM60.DLL:
• 0x401038 __vbaVarSub
• 0x40103c __vbaStrI2
• 0x401040 _CIcos
• 0x401044 _adj_fptan
• 0x401048 __vbaStrI4
• 0x40104c __vbaVarMove
• 0x401050 __vbaVarVargNofree
• 0x401054 __vbaFreeVar
• 0x401058 __vbaAryMove
• 0x40105c __vbaLenBstr
• 0x401060 __vbaStrVarMove
• 0x401064 __vbaFreeVarList
• 0x401068 _adj_fdiv_m64
• 0x40106c
• 0x401070 EVENT_SINK_Invoke
• 0x401074 __vbaRaiseEvent
• 0x401078 __vbaFreeObjList
• 0x40107c
• 0x401080 __vbaStrErrVarCopy
• 0x401084 _adj_fprem1
• 0x40108c
• 0x401090
• 0x401094 __vbaStrCat
• 0x401098 __vbaSetSystemError
• 0x4010a0 __vbaLenVar
• 0x4010a4 _adj_fdiv_m32
• 0x4010a8 __vbaAryVar
• 0x4010ac Zombie_GetTypeInfo
• 0x4010b0 __vbaAryDestruct
• 0x4010b8 __vbaExitProc
• 0x4010bc __vbaOnError
• 0x4010c0
• 0x4010c4 __vbaObjSet
• 0x4010c8 _adj_fdiv_m16i
• 0x4010cc __vbaObjSetAddref
• 0x4010d0 _adj_fdivr_m16i
• 0x4010d4
• 0x4010d8 __vbaVarIndexLoad
• 0x4010dc __vbaBoolVarNull
• 0x4010e0 __vbaRefVarAry
• 0x4010e4 _CIsin
• 0x4010e8
• 0x4010ec
• 0x4010f0 __vbaErase
• 0x4010f4 __vbaChkstk
• 0x4010f8 __vbaFileClose
• 0x4010fc EVENT_SINK_AddRef
• 0x401100
• 0x401108 __vbaStrCmp
• 0x40110c __vbaVarTstEq
• 0x401110 __vbaAryConstruct2
• 0x401114 __vbaGet4
• 0x401118 __vbaObjVar
• 0x40111c __vbaI2I4
• 0x401120
• 0x401124 DllFunctionCall
• 0x401128 __vbaVarLateMemSt
• 0x40112c __vbaCastObjVar
• 0x401130 __vbaRedimPreserve
• 0x401134 _adj_fpatan
• 0x401138 __vbaLateIdCallLd
• 0x401140 __vbaStrR8
• 0x401144 __vbaRedim
• 0x401148 EVENT_SINK_Release
• 0x40114c __vbaNew
• 0x401150 __vbaUI1I2
• 0x401154 _CIsqrt
• 0x401158 __vbaObjIs
• 0x401160 __vbaUI1I4
• 0x401164 __vbaExceptHandler
• 0x401168
• 0x40116c
• 0x401170 __vbaStrToUnicode
• 0x401174
• 0x401178 _adj_fprem
• 0x40117c _adj_fdivr_m64
• 0x401180 __vbaI2Str
• 0x401184
• 0x401188 __vbaFPException
• 0x40118c
• 0x401190 __vbaUbound
• 0x401194 __vbaStrVarVal
• 0x401198 __vbaVarCat
• 0x40119c
• 0x4011a0
• 0x4011a4 _CIlog
• 0x4011a8 __vbaErrorOverflow
• 0x4011ac __vbaFileOpen
• 0x4011b0 __vbaR8Str
• 0x4011b8 __vbaNew2
• 0x4011bc __vbaInStr
• 0x4011c0 __vbaVar2Vec
• 0x4011c4
• 0x4011c8
• 0x4011cc _adj_fdiv_m32i
• 0x4011d0 _adj_fdivr_m32i
• 0x4011d4 __vbaVarSetObj
• 0x4011d8 __vbaStrCopy
• 0x4011dc __vbaI4Str
• 0x4011e0 __vbaFreeStrList
• 0x4011e4 _adj_fdivr_m32
• 0x4011e8 _adj_fdiv_r
• 0x4011ec
• 0x4011f0
• 0x4011f4 __vbaVarTstNe
• 0x4011f8
• 0x4011fc __vbaVarSetVar
• 0x401200 __vbaI4Var
• 0x401204
• 0x401208 __vbaVarAdd
• 0x40120c
• 0x401210 __vbaLateMemCall
• 0x401214 __vbaAryLock
• 0x401218 __vbaFreeVarg
• 0x40121c
• 0x401220 __vbaVarDup
• 0x401224 __vbaStrToAnsi
• 0x401228
• 0x40122c __vbaUnkVar
• 0x401234
• 0x401238 __vbaFpI4
• 0x401240 _CIatan
• 0x401244 __vbaCastObj
• 0x401248 __vbaStrMove
• 0x40124c __vbaAryCopy
• 0x401250
• 0x401254
• 0x401258 _allmul
• 0x40125c __vbaLateIdSt
• 0x401260 __vbaLenVarB
• 0x401264 _CItan
• 0x401268
• 0x40126c __vbaAryUnlock
• 0x401270
• 0x401274 _CIexp
• 0x401278 __vbaFreeStr
• 0x40127c __vbaFreeObj
• 0x401280 __vbaI4ErrVar
• 0x401284

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49179 181.112.157.42 449
192.168.56.101 49181 192.35.177.64 apps.identrust.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://apps.identrust.com/roots/dstrootcax3.p7c 
GET /roots/dstrootcax3.p7c HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: apps.identrust.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.