8.0
高危
53 个模型检测该样本为恶意！
重新分析
更多

0dfb0329a6e6fab4342ae6543cc8e289a23bbb544b548a5f53784ae2abfbaef7

6e5bdaeab3a3c9fd059e945e288ecc0b.exe

分析耗时

77s

最近分析

文件大小

252.0KB
静态报毒 动态报毒 100% AI SCORE=86 ATTRIBUTE CAZIMIMBL CJLR CONFIDENCE DOWNLOADER34 ELDORADO EMOTEPMF EMOTET ENCDOC GENCIRC GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE HSFKGA JJAHD MALWARE@#6D6ZX3GCFMQO OZHTORQHMDB R + TROJ R348329 REGZADS8 S15568185 UNSAFE WOREFLINT 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FRV!6E5BDAEAB3A3 20201023 6.0.6.653
Alibaba Trojan:Win32/Emotet.a3f30b70 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201023 18.4.3895.0
Tencent Malware.Win32.Gencirc.10cde8ed 20201023 1.0.0.1
Kingsoft 20201023 2013.8.14.323
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619596035.602103
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (5 个事件)
Time & API Arguments Status Return Repeated
1619596027.211103
CryptGenKey
crypto_handle: 0x00584f20
algorithm_identifier: 0x0000660e ()
provider_handle: 0x00584a00
flags: 1
key: fâ t2)f9Y{ÇS«¿¯
success 1 0
1619596035.617103
CryptExportKey
crypto_handle: 0x00584f20
crypto_export_handle: 0x00584ac8
buffer: f¤<÷.ù7*!–úHPùýò),ÜEžÉÂL}¤w:ÏÉí…V¸yÃÎ~z0@ q£¹OÙН7‡—µÅ)蛛¡, e8PWå Çæ\ÉW)€—çJg8Ú|š
blob_type: 1
flags: 64
success 1 0
1619596041.617103
CryptExportKey
crypto_handle: 0x00584f20
crypto_export_handle: 0x00584ac8
buffer: f¤•‡r²s/Á]:@Oc8A`ì·Ì´ÕµðR^g/H®M'ˆ}òÄ—G³“¡]"-¼|ê´ìùOEYn–˜Á•ëiüš#ôôÆ^9“£/7qíHω“£õh/óWÅ´‚åÐu
blob_type: 1
flags: 64
success 1 0
1619596046.352103
CryptExportKey
crypto_handle: 0x00584f20
crypto_export_handle: 0x00584ac8
buffer: f¤=[*÷Qf«AŽ°€ên$µÿ°¤“™c°Ÿ«!V8K[„#òÀÿÊό"¶Väf¶ÖòìÓb8<‡ïg<cÓ¿ÁhÓB:wŸa¿ãHpĆ@XÖ'ó8Ëqv{ˆÔê
blob_type: 1
flags: 64
success 1 0
1619596078.164103
CryptExportKey
crypto_handle: 0x00584f20
crypto_export_handle: 0x00584ac8
buffer: f¤x^¦F·Ñ…ðÀ.5°>_B]!Ð%.QÎåáQVË¡nG8"¨32"ú¡?>ñ÷Åtb¡&e€]P ¶9Œ¦r™ü \}ð éb8ƒÃŽýëgÓ+Ã<n ìËÈl
blob_type: 1
flags: 64
success 1 0
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features Connection to IP address suspicious_request POST http://45.173.88.33/SrdZBawk/
Performs some HTTP requests (1 个事件)
request POST http://45.173.88.33/SrdZBawk/
Sends data using the HTTP POST Method (1 个事件)
request POST http://45.173.88.33/SrdZBawk/
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619596026.508103
NtAllocateVirtualMemory
process_identifier: 2236
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004e0000
success 0 0
Foreign language identified in PE resource (7 个事件)
name RT_ICON language LANG_CHINESE offset 0x00035e00 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00035e00 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00035e00 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00035e00 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00035e00 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_RCDATA language LANG_CHINESE offset 0x000362b8 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00008546
name RT_GROUP_ICON language LANG_CHINESE offset 0x00036268 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000004c
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 个事件)
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619596035.992103
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Expresses interest in specific running processes (1 个事件)
process 6e5bdaeab3a3c9fd059e945e288ecc0b.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1619596035.727103
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (5 个事件)
host 172.217.24.14
host 190.163.31.26
host 209.126.6.222
host 45.173.88.33
host 5.153.250.14
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1619596038.555103
RegSetValueExA
key_handle: 0x000003ac
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619596038.555103
RegSetValueExA
key_handle: 0x000003ac
value: К÷¡ <×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619596038.555103
RegSetValueExA
key_handle: 0x000003ac
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619596038.555103
RegSetValueExW
key_handle: 0x000003ac
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619596038.555103
RegSetValueExA
key_handle: 0x000003c4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619596038.555103
RegSetValueExA
key_handle: 0x000003c4
value: К÷¡ <×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619596038.570103
RegSetValueExA
key_handle: 0x000003c4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619596038.586103
RegSetValueExW
key_handle: 0x000003a8
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1619596039.352103
RegSetValueExA
key_handle: 0x000003cc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619596039.352103
RegSetValueExA
key_handle: 0x000003cc
value:  7q¢ <×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619596039.352103
RegSetValueExA
key_handle: 0x000003cc
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619596039.352103
RegSetValueExW
key_handle: 0x000003cc
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619596039.352103
RegSetValueExA
key_handle: 0x000003ac
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619596039.352103
RegSetValueExA
key_handle: 0x000003ac
value:  7q¢ <×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619596039.352103
RegSetValueExA
key_handle: 0x000003ac
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)
Bkav W32.CazimiMBL.Trojan
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34381650
FireEye Trojan.GenericKD.34381650
CAT-QuickHeal Trojan.EmotePMF.S15568185
McAfee Emotet-FRV!6E5BDAEAB3A3
Cylance Unsafe
Zillya Trojan.Emotet.Win32.24503
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Emotet.a3f30b70
K7GW Riskware ( 0040eff71 )
Arcabit Trojan.Generic.D20C9F52
Cyren W32/Emotet.APY.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Malware.Emotet-9641869-0
Kaspersky Backdoor.Win32.Emotet.cjlr
BitDefender Trojan.GenericKD.34381650
NANO-Antivirus Trojan.Win32.Emotet.hsfkga
Paloalto generic.ml
ViRobot Trojan.Win32.Emotet.253952.C
Tencent Malware.Win32.Gencirc.10cde8ed
Ad-Aware Trojan.GenericKD.34381650
Sophos Troj/Emotet-CLF
Comodo Malware@#6d6zx3gcfmqo
DrWeb Trojan.DownLoader34.25114
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-R + Troj/Emotet-CLF
McAfee-GW-Edition BehavesLike.Win32.Emotet.dh
Emsisoft Trojan.Emotet (A)
Jiangmin Backdoor.Emotet.rn
Avira TR/Emotet.jjahd
MAX malware (ai score=86)
Antiy-AVL Trojan/Win32.Emotet
Microsoft Trojan:Win32/Emotet.ARJ!MTB
AegisLab Trojan.Win32.Emotet.L!c
ZoneAlarm Backdoor.Win32.Emotet.cjlr
GData Trojan.GenericKD.34381650
AhnLab-V3 Trojan/Win32.Emotet.R348329
ALYac Trojan.Agent.Emotet
TACHYON Backdoor/W32.Emotet.258048.B
VBA32 Trojan.Woreflint
Malwarebytes Trojan.MalPack.TRE
ESET-NOD32 Win32/Emotet.CD
Rising Downloader.EncDoc!8.11225 (TFE:5:ozhtOrQHMDB)
Yandex Trojan.Emotet!iw/reGZAdS8
Ikarus Trojan-Banker.Emotet
Fortinet W32/Emotet.E88D!tr
AVG Win32:Malware-gen
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 209.126.6.222:8080
dead_host 192.168.56.101:49179
dead_host 5.153.250.14:8080
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-18 04:38:41

Imports

Library KERNEL32.dll:
• 0x41f0bc GetStartupInfoA
• 0x41f0c0 GetCommandLineA
• 0x41f0c4 HeapReAlloc
• 0x41f0c8 TerminateProcess
• 0x41f0cc HeapSize
• 0x41f0d0 LCMapStringA
• 0x41f0d4 LCMapStringW
• 0x41f0d8 HeapDestroy
• 0x41f0dc HeapCreate
• 0x41f0e0 VirtualFree
• 0x41f0e4 IsBadWritePtr
• 0x41f0e8 GetStdHandle
• 0x41f100 VirtualQuery
• 0x41f104 GetFileType
• 0x41f10c GetTickCount
• 0x41f110 GetCurrentProcessId
• 0x41f11c GetStringTypeA
• 0x41f120 GetStringTypeW
• 0x41f124 IsBadReadPtr
• 0x41f128 IsBadCodePtr
• 0x41f12c SetStdHandle
• 0x41f130 GetSystemInfo
• 0x41f134 VirtualAlloc
• 0x41f138 VirtualProtect
• 0x41f13c HeapFree
• 0x41f140 HeapAlloc
• 0x41f144 RtlUnwind
• 0x41f148 SetErrorMode
• 0x41f14c GetCurrentProcess
• 0x41f150 FlushFileBuffers
• 0x41f154 SetFilePointer
• 0x41f158 WriteFile
• 0x41f15c ReadFile
• 0x41f164 RaiseException
• 0x41f168 GetOEMCP
• 0x41f16c GetCPInfo
• 0x41f174 GlobalFlags
• 0x41f178 TlsFree
• 0x41f180 LocalReAlloc
• 0x41f184 TlsSetValue
• 0x41f188 TlsAlloc
• 0x41f190 TlsGetValue
• 0x41f198 GlobalHandle
• 0x41f19c GlobalReAlloc
• 0x41f1a4 LocalAlloc
• 0x41f1ac GetCurrentThread
• 0x41f1b0 lstrcmpA
• 0x41f1b4 GetModuleFileNameA
• 0x41f1c0 lstrcpyA
• 0x41f1c4 CloseHandle
• 0x41f1c8 SetLastError
• 0x41f1cc GlobalFree
• 0x41f1d0 MulDiv
• 0x41f1d4 GlobalAlloc
• 0x41f1d8 GlobalLock
• 0x41f1dc GlobalUnlock
• 0x41f1e0 FormatMessageA
• 0x41f1e4 LocalFree
• 0x41f1e8 FreeResource
• 0x41f1ec GetCurrentThreadId
• 0x41f1f0 GlobalGetAtomNameA
• 0x41f1f4 GlobalAddAtomA
• 0x41f1f8 GlobalFindAtomA
• 0x41f1fc GlobalDeleteAtom
• 0x41f200 LoadLibraryA
• 0x41f204 FreeLibrary
• 0x41f208 lstrcatA
• 0x41f20c lstrcmpW
• 0x41f210 lstrcpynA
• 0x41f214 GetModuleHandleA
• 0x41f218 GetProcAddress
• 0x41f21c lstrlenA
• 0x41f220 lstrcmpiA
• 0x41f224 GetVersion
• 0x41f228 GetLastError
• 0x41f22c MultiByteToWideChar
• 0x41f230 ExitProcess
• 0x41f234 WideCharToMultiByte
• 0x41f238 FindResourceA
• 0x41f23c LoadResource
• 0x41f240 LockResource
• 0x41f244 SizeofResource
• 0x41f248 GetVersionExA
• 0x41f24c GetThreadLocale
• 0x41f250 GetLocaleInfoA
• 0x41f254 GetACP
• 0x41f258 SetHandleCount
• 0x41f25c InterlockedExchange
Library USER32.dll:
• 0x41f290 LoadCursorA
• 0x41f294 GetSysColorBrush
• 0x41f298 wsprintfA
• 0x41f29c DestroyMenu
• 0x41f2a0 GetDesktopWindow
• 0x41f2a8 GetNextDlgTabItem
• 0x41f2ac EndDialog
• 0x41f2b0 SetCursor
• 0x41f2b4 PostQuitMessage
• 0x41f2b8 WindowFromPoint
• 0x41f2bc SetMenuItemBitmaps
• 0x41f2c0 ModifyMenuA
• 0x41f2c4 EnableMenuItem
• 0x41f2c8 CheckMenuItem
• 0x41f2d0 LoadBitmapA
• 0x41f2d4 EndPaint
• 0x41f2d8 BeginPaint
• 0x41f2dc ReleaseDC
• 0x41f2e0 GetDC
• 0x41f2e4 ClientToScreen
• 0x41f2e8 GrayStringA
• 0x41f2ec DrawTextExA
• 0x41f2f0 DrawTextA
• 0x41f2f4 TabbedTextOutA
• 0x41f2f8 GetMessageA
• 0x41f2fc TranslateMessage
• 0x41f300 GetActiveWindow
• 0x41f304 ValidateRect
• 0x41f308 GetMenuState
• 0x41f30c IsWindowEnabled
• 0x41f310 MoveWindow
• 0x41f314 IsDialogMessageA
• 0x41f31c WinHelpA
• 0x41f320 CreateWindowExA
• 0x41f324 SetWindowsHookExA
• 0x41f328 CallNextHookEx
• 0x41f32c GetClassLongA
• 0x41f330 GetClassNameA
• 0x41f334 SetPropA
• 0x41f338 GetPropA
• 0x41f33c RemovePropA
• 0x41f340 SendDlgItemMessageA
• 0x41f344 SetFocus
• 0x41f34c GetWindowTextA
• 0x41f350 GetForegroundWindow
• 0x41f354 GetLastActivePopup
• 0x41f358 SetActiveWindow
• 0x41f35c DispatchMessageA
• 0x41f360 GetDlgItem
• 0x41f364 GetTopWindow
• 0x41f368 DestroyWindow
• 0x41f36c UnhookWindowsHookEx
• 0x41f370 GetMessageTime
• 0x41f374 GetMessagePos
• 0x41f378 PeekMessageA
• 0x41f37c MapWindowPoints
• 0x41f380 MessageBoxA
• 0x41f384 IsWindow
• 0x41f388 ShowWindow
• 0x41f38c IsRectEmpty
• 0x41f390 PtInRect
• 0x41f394 InflateRect
• 0x41f398 OffsetRect
• 0x41f39c SendMessageA
• 0x41f3a0 PostMessageA
• 0x41f3a4 GetClientRect
• 0x41f3a8 RedrawWindow
• 0x41f3ac SetTimer
• 0x41f3b0 KillTimer
• 0x41f3b4 GetCapture
• 0x41f3b8 SetCapture
• 0x41f3bc GetKeyState
• 0x41f3c0 SetForegroundWindow
• 0x41f3c4 IsWindowVisible
• 0x41f3c8 UpdateWindow
• 0x41f3cc GetMenu
• 0x41f3d0 GetSubMenu
• 0x41f3d4 GetMenuItemID
• 0x41f3d8 GetMenuItemCount
• 0x41f3dc AdjustWindowRectEx
• 0x41f3e0 ScreenToClient
• 0x41f3e4 GetClassInfoA
• 0x41f3e8 RegisterClassA
• 0x41f3ec UnregisterClassA
• 0x41f3f0 GetDlgCtrlID
• 0x41f3f4 DefWindowProcA
• 0x41f3f8 CallWindowProcA
• 0x41f3fc GetWindowLongA
• 0x41f400 GetClassInfoExA
• 0x41f404 GetFocus
• 0x41f408 GetParent
• 0x41f40c EnableWindow
• 0x41f410 GetSysColor
• 0x41f414 GetCursorPos
• 0x41f418 SetWindowTextA
• 0x41f41c ReleaseCapture
• 0x41f420 DrawIcon
• 0x41f424 AppendMenuA
• 0x41f428 GetSystemMenu
• 0x41f42c IsIconic
• 0x41f430 LoadIconA
• 0x41f434 GetSystemMetrics
• 0x41f438 GetWindow
• 0x41f43c SetWindowLongA
• 0x41f440 SetWindowPos
• 0x41f448 GetWindowPlacement
• 0x41f44c GetWindowRect
• 0x41f450 CopyRect
Library GDI32.dll:
• 0x41f030 GetStockObject
• 0x41f034 CreateBitmap
• 0x41f038 DeleteDC
• 0x41f03c ScaleWindowExtEx
• 0x41f040 SetWindowExtEx
• 0x41f044 ScaleViewportExtEx
• 0x41f048 SetViewportExtEx
• 0x41f04c OffsetViewportOrgEx
• 0x41f050 SetViewportOrgEx
• 0x41f054 SelectObject
• 0x41f058 Escape
• 0x41f05c ExtTextOutA
• 0x41f060 TextOutA
• 0x41f064 RectVisible
• 0x41f068 PtVisible
• 0x41f06c CreatePen
• 0x41f070 DeleteObject
• 0x41f074 MoveToEx
• 0x41f078 LineTo
• 0x41f07c SetMapMode
• 0x41f080 SetBkMode
• 0x41f084 RestoreDC
• 0x41f088 SaveDC
• 0x41f08c GetDeviceCaps
• 0x41f090 SetBkColor
• 0x41f094 SetTextColor
• 0x41f098 GetClipBox
• 0x41f0a0 GetCurrentObject
• 0x41f0a4 SetPixel
• 0x41f0a8 BitBlt
• 0x41f0ac CreateCompatibleDC
• 0x41f0b4 GetObjectA
Library comdlg32.dll:
• 0x41f468 GetOpenFileNameA
• 0x41f46c GetSaveFileNameA
Library WINSPOOL.DRV:
• 0x41f458 OpenPrinterA
• 0x41f45c DocumentPropertiesA
• 0x41f460 ClosePrinter
Library ADVAPI32.dll:
• 0x41f000 RegOpenKeyA
• 0x41f004 RegQueryValueExA
• 0x41f008 RegOpenKeyExA
• 0x41f00c RegDeleteKeyA
• 0x41f010 RegEnumKeyA
• 0x41f014 RegQueryValueA
• 0x41f018 RegCreateKeyExA
• 0x41f01c RegSetValueExA
• 0x41f020 RegCloseKey
Library SHELL32.dll:
• 0x41f278 SHBrowseForFolderA
• 0x41f27c SHGetMalloc
Library COMCTL32.dll:
• 0x41f028
Library SHLWAPI.dll:
• 0x41f284 PathFindFileNameA
• 0x41f288 PathFindExtensionA
Library OLEAUT32.dll:
• 0x41f264 VariantClear
• 0x41f268 VariantChangeType
• 0x41f26c VariantInit

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49178 45.173.88.33 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49240 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702

HTTP & HTTPS Requests

URI Data
http://45.173.88.33/SrdZBawk/ 
POST /SrdZBawk/ HTTP/1.1
Referer: http://45.173.88.33/SrdZBawk/
Content-Type: multipart/form-data; boundary=---------------------------446571975859876
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 45.173.88.33
Content-Length: 4500
Connection: Keep-Alive
Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.