SmartHawk

3.2

中危

58 个模型检测该样本为恶意！

重新分析

下载样本

67dd76507ddec735cd005cab517f05914e29063c31a4e29e600b889298b8b722

6f7e82d8c5394cae46c4755ad261cf28.exe

分析耗时

38s

最近分析

文件大小

1.4MB

静态报毒动态报毒 100% AHW@AYOEOLNI AI SCORE=82 ANDROM BTJNDH CLASSIC CONFIDENCE DELF DELPHILESS EESQ EKVO FAREIT GEN7 GENERICKDZ HDOLMG HIGH CONFIDENCE IGENT LOKIBOT MALWARE@#3CQ3YKV15550F MIMIKATZNTR S + MAL SCORE SIGGEN8 STATIC AI SUSPICIOUS PE TRJGEN TSCOPE TZMU UHBAZCLJN UNSAFE WSAW XPACK ZELPHIF ZUSY 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FRB!6F7E82D8C539	20201229	6.0.6.653
Alibaba	Backdoor:Win32/Androm.9384cb2b	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft		20201229	2017.9.26.565
Tencent	Win32.Backdoor.Androm.Wsaw	20201229	1.0.0.1
Avast	Win32:Trojan-gen	20201229	21.1.5827.0
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596027.874212 __exception__	stacktrace: 6f7e82d8c5394cae46c4755ad261cf28+0xb35fa @ 0x4b35fa 6f7e82d8c5394cae46c4755ad261cf28+0x3e17 @ 0x403e17 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637896 registers.edi: 4929068 registers.eax: 0 registers.ebp: 1638208 registers.edx: 6699480 registers.ebx: 80 registers.esi: 0 registers.ecx: 2010527866 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 0f e9 91 03 f5 exception.symbol: 6f7e82d8c5394cae46c4755ad261cf28+0xb343e exception.instruction: div eax exception.module: 6f7e82d8c5394cae46c4755ad261cf28.exe exception.exception_code: 0xc0000094 exception.offset: 734270 exception.address: 0x4b343e	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619596027.561212 NtAllocateVirtualMemory	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619596046.061212 NtAllocateVirtualMemory	process_identifier: 152 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x005a0000	success
1619596046.061212 NtAllocateVirtualMemory	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x005d0000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.778429474906606

section

{'size_of_data': '0x00099200', 'virtual_address': '0x000d5000', 'entropy': 7.778429474906606, 'name': '.rsrc', 'virtual_size': '0x000990f8'}

description

A section with a high entropy has been found

entropy

0.42519958347795905

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.MimikatzNTR.Trojan
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen8.46567
ClamAV	Win.Trojan.Zusy-9608603-0
FireEye	Generic.mg.6f7e82d8c5394cae
CAT-QuickHeal	Backdoor.Androm
McAfee	Fareit-FRB!6F7E82D8C539
Cylance	Unsafe
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKDZ.65226
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.8c5394
Arcabit	Trojan.Generic.DFECA
BitDefenderTheta	Gen:NN.ZelphiF.34700.AHW@ayOeOlni
Cyren	W32/Injector.TZMU-0208
Symantec	Trojan.Gen.MBT
Zoner	Trojan.Win32.89458
TrendMicro-HouseCall	TrojanSpy.Win32.FAREIT.UHBAZCLJN
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
Alibaba	Backdoor:Win32/Androm.9384cb2b
NANO-Antivirus	Trojan.Win32.TrjGen.hdolmg
MicroWorld-eScan	Trojan.GenericKDZ.65226
Rising	Trojan.Injector!1.AFE3 (CLASSIC)
Ad-Aware	Trojan.GenericKDZ.65226
Sophos	Mal/Generic-S + Mal/Fareit-V
Comodo	Malware@#3cq3ykv15550f
F-Secure	Trojan.TR/Crypt.XPACK.Gen7
TrendMicro	TrojanSpy.Win32.FAREIT.UHBAZCLJN
McAfee-GW-Edition	BehavesLike.Win32.Fareit.tc
Emsisoft	Trojan.GenericKDZ.65226 (B)
Ikarus	Trojan-Spy.LokiBot
Avira	TR/Crypt.XPACK.Gen7
Antiy-AVL	Trojan[Backdoor]/Win32.Androm
Gridinsoft	Trojan.Win32.Gen.ba!s1
Microsoft	PWS:Win32/Fareit.AKK!MTB
ZoneAlarm	HEUR:Backdoor.Win32.Androm.gen
GData	Trojan.GenericKDZ.65226
AhnLab-V3	Win-Trojan/Delphiless.Exp
VBA32	TScope.Trojan.Delf
ALYac	Trojan.GenericKDZ.65226
MAX	malware (ai score=82)
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/CI.A
APEX	Malicious
ESET-NOD32	a variant of Win32/Injector.EKVO
Tencent	Win32.Backdoor.Androm.Wsaw

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-09 16:27:16

Imports

Library kernel32.dll:

• 0x4c2168 DeleteCriticalSection

• 0x4c216c LeaveCriticalSection

• 0x4c2170 EnterCriticalSection

• 0x4c2174 InitializeCriticalSection

• 0x4c2178 VirtualFree

• 0x4c217c VirtualAlloc

• 0x4c2180 LocalFree

• 0x4c2184 LocalAlloc

• 0x4c2188 GetVersion

• 0x4c218c GetCurrentThreadId

• 0x4c2190 InterlockedDecrement

• 0x4c2194 InterlockedIncrement

• 0x4c2198 VirtualQuery

• 0x4c219c WideCharToMultiByte

• 0x4c21a0 MultiByteToWideChar

• 0x4c21a4 lstrlenA

• 0x4c21a8 lstrcpynA

• 0x4c21ac LoadLibraryExA

• 0x4c21b0 GetThreadLocale

• 0x4c21b4 GetStartupInfoA

• 0x4c21b8 GetProcAddress

• 0x4c21bc GetModuleHandleA

• 0x4c21c0 GetModuleFileNameA

• 0x4c21c4 GetLocaleInfoA

• 0x4c21c8 GetCommandLineA

• 0x4c21cc FreeLibrary

• 0x4c21d0 FindFirstFileA

• 0x4c21d4 FindClose

• 0x4c21d8 ExitProcess

• 0x4c21dc ExitThread

• 0x4c21e0 CreateThread

• 0x4c21e4 WriteFile

• 0x4c21e8 UnhandledExceptionFilter

• 0x4c21ec RtlUnwind

• 0x4c21f0 RaiseException

• 0x4c21f4 GetStdHandle

Library user32.dll:

• 0x4c21fc GetKeyboardType

• 0x4c2200 LoadStringA

• 0x4c2204 MessageBoxA

• 0x4c2208 CharNextA

Library advapi32.dll:

• 0x4c2210 RegQueryValueExA

• 0x4c2214 RegOpenKeyExA

• 0x4c2218 RegCloseKey

Library oleaut32.dll:

• 0x4c2220 SysFreeString

• 0x4c2224 SysReAllocStringLen

• 0x4c2228 SysAllocStringLen

Library kernel32.dll:

• 0x4c2230 TlsSetValue

• 0x4c2234 TlsGetValue

• 0x4c2238 LocalAlloc

• 0x4c223c GetModuleHandleA

Library advapi32.dll:

• 0x4c2244 RegQueryValueExA

• 0x4c2248 RegOpenKeyExA

• 0x4c224c RegCloseKey

Library kernel32.dll:

• 0x4c2254 lstrlenA

• 0x4c2258 lstrcpyA

• 0x4c225c lstrcmpA

• 0x4c2260 WriteFile

• 0x4c2264 WaitForSingleObject

• 0x4c2268 WaitForMultipleObjects

• 0x4c226c VirtualQuery

• 0x4c2270 VirtualFree

• 0x4c2274 VirtualAlloc

• 0x4c2278 Sleep

• 0x4c227c SizeofResource

• 0x4c2280 SetThreadLocale

• 0x4c2284 SetFilePointer

• 0x4c2288 SetEvent

• 0x4c228c SetErrorMode

• 0x4c2290 SetEndOfFile

• 0x4c2294 SetCurrentDirectoryA

• 0x4c2298 SearchPathA

• 0x4c229c ResumeThread

• 0x4c22a0 ResetEvent

• 0x4c22a4 ReleaseMutex

• 0x4c22a8 ReadFile

• 0x4c22ac OpenFileMappingA

• 0x4c22b0 MultiByteToWideChar

• 0x4c22b4 MulDiv

• 0x4c22b8 LockResource

• 0x4c22bc LoadResource

• 0x4c22c0 LoadLibraryA

• 0x4c22c4 LeaveCriticalSection

• 0x4c22c8 IsDBCSLeadByte

• 0x4c22cc InitializeCriticalSection

• 0x4c22d0 GlobalUnlock

• 0x4c22d4 GlobalSize

• 0x4c22d8 GlobalReAlloc

• 0x4c22dc GlobalHandle

• 0x4c22e0 GlobalLock

• 0x4c22e4 GlobalFree

• 0x4c22e8 GlobalFindAtomA

• 0x4c22ec GlobalDeleteAtom

• 0x4c22f0 GlobalAlloc

• 0x4c22f4 GlobalAddAtomA

• 0x4c22f8 GetVersionExA

• 0x4c22fc GetVersion

• 0x4c2300 GetUserDefaultLCID

• 0x4c2304 GetTickCount

• 0x4c2308 GetThreadLocale

• 0x4c230c GetSystemInfo

• 0x4c2310 GetStringTypeExA

• 0x4c2314 GetStdHandle

• 0x4c2318 GetProcAddress

• 0x4c231c GetModuleHandleA

• 0x4c2320 GetModuleFileNameA

• 0x4c2324 GetLocaleInfoA

• 0x4c2328 GetLocalTime

• 0x4c232c GetLastError

• 0x4c2330 GetFullPathNameA

• 0x4c2334 GetExitCodeThread

• 0x4c2338 GetDiskFreeSpaceA

• 0x4c233c GetDateFormatA

• 0x4c2340 GetCurrentThreadId

• 0x4c2344 GetCurrentProcessId

• 0x4c2348 GetCurrentDirectoryA

• 0x4c234c GetComputerNameA

• 0x4c2350 GetCPInfo

• 0x4c2354 GetACP

• 0x4c2358 FreeResource

• 0x4c235c InterlockedIncrement

• 0x4c2360 InterlockedExchange

• 0x4c2364 InterlockedDecrement

• 0x4c2368 FreeLibrary

• 0x4c236c FormatMessageA

• 0x4c2370 FindResourceA

• 0x4c2374 FindNextChangeNotification

• 0x4c2378 FindFirstFileA

• 0x4c237c FindFirstChangeNotificationA

• 0x4c2380 FindCloseChangeNotification

• 0x4c2384 FindClose

• 0x4c2388 FileTimeToLocalFileTime

• 0x4c238c FileTimeToDosDateTime

• 0x4c2390 FatalAppExitA

• 0x4c2394 EnumCalendarInfoA

• 0x4c2398 EnterCriticalSection

• 0x4c239c DeleteCriticalSection

• 0x4c23a0 CreateThread

• 0x4c23a4 CreateMutexA

• 0x4c23a8 CreateFileA

• 0x4c23ac CreateEventA

• 0x4c23b0 CompareStringA

• 0x4c23b4 CloseHandle

Library version.dll:

• 0x4c23bc VerQueryValueA

• 0x4c23c0 GetFileVersionInfoSizeA

• 0x4c23c4 GetFileVersionInfoA

Library gdi32.dll:

• 0x4c23cc UnrealizeObject

• 0x4c23d0 StretchBlt

• 0x4c23d4 SetWindowOrgEx

• 0x4c23d8 SetWinMetaFileBits

• 0x4c23dc SetViewportOrgEx

• 0x4c23e0 SetTextColor

• 0x4c23e4 SetStretchBltMode

• 0x4c23e8 SetROP2

• 0x4c23ec SetPixel

• 0x4c23f0 SetMapMode

• 0x4c23f4 SetEnhMetaFileBits

• 0x4c23f8 SetDIBColorTable

• 0x4c23fc SetBrushOrgEx

• 0x4c2400 SetBkMode

• 0x4c2404 SetBkColor

• 0x4c2408 SelectPalette

• 0x4c240c SelectObject

• 0x4c2410 SaveDC

• 0x4c2414 RestoreDC

• 0x4c2418 Rectangle

• 0x4c241c RectVisible

• 0x4c2420 RealizePalette

• 0x4c2424 PlayEnhMetaFile

• 0x4c2428 PatBlt

• 0x4c242c MoveToEx

• 0x4c2430 MaskBlt

• 0x4c2434 LineTo

• 0x4c2438 LPtoDP

• 0x4c243c IntersectClipRect

• 0x4c2440 GetWindowOrgEx

• 0x4c2444 GetWinMetaFileBits

• 0x4c2448 GetTextMetricsA

• 0x4c244c GetTextExtentPoint32A

• 0x4c2450 GetSystemPaletteEntries

• 0x4c2454 GetStockObject

• 0x4c2458 GetPixel

• 0x4c245c GetPaletteEntries

• 0x4c2460 GetObjectA

• 0x4c2464 GetEnhMetaFilePaletteEntries

• 0x4c2468 GetEnhMetaFileHeader

• 0x4c246c GetEnhMetaFileDescriptionA

• 0x4c2470 GetEnhMetaFileBits

• 0x4c2474 GetDeviceCaps

• 0x4c2478 GetDIBits

• 0x4c247c GetDIBColorTable

• 0x4c2480 GetDCOrgEx

• 0x4c2484 GetCurrentPositionEx

• 0x4c2488 GetClipBox

• 0x4c248c GetBrushOrgEx

• 0x4c2490 GetBkMode

• 0x4c2494 GetBitmapBits

• 0x4c2498 ExtTextOutA

• 0x4c249c ExcludeClipRect

• 0x4c24a0 DeleteObject

• 0x4c24a4 DeleteEnhMetaFile

• 0x4c24a8 DeleteDC

• 0x4c24ac CreateSolidBrush

• 0x4c24b0 CreatePenIndirect

• 0x4c24b4 CreatePalette

• 0x4c24b8 CreateHalftonePalette

• 0x4c24bc CreateFontIndirectA

• 0x4c24c0 CreateEnhMetaFileA

• 0x4c24c4 CreateDIBitmap

• 0x4c24c8 CreateDIBSection

• 0x4c24cc CreateCompatibleDC

• 0x4c24d0 CreateCompatibleBitmap

• 0x4c24d4 CreateBrushIndirect

• 0x4c24d8 CreateBitmap

• 0x4c24dc CopyEnhMetaFileA

• 0x4c24e0 CloseEnhMetaFile

• 0x4c24e4 BitBlt

Library user32.dll:

• 0x4c24ec CreateWindowExA

• 0x4c24f0 WindowFromPoint

• 0x4c24f4 WinHelpA

• 0x4c24f8 WaitMessage

• 0x4c24fc UpdateWindow

• 0x4c2500 UnregisterClassA

• 0x4c2504 UnhookWindowsHookEx

• 0x4c2508 TranslateMessage

• 0x4c250c TranslateMDISysAccel

• 0x4c2510 TrackPopupMenu

• 0x4c2514 SystemParametersInfoA

• 0x4c2518 ShowWindow

• 0x4c251c ShowScrollBar

• 0x4c2520 ShowOwnedPopups

• 0x4c2524 ShowCursor

• 0x4c2528 SetWindowsHookExA

• 0x4c252c SetWindowTextA

• 0x4c2530 SetWindowPos

• 0x4c2534 SetWindowPlacement

• 0x4c2538 SetWindowLongA

• 0x4c253c SetTimer

• 0x4c2540 SetScrollRange

• 0x4c2544 SetScrollPos

• 0x4c2548 SetScrollInfo

• 0x4c254c SetRect

• 0x4c2550 SetPropA

• 0x4c2554 SetParent

• 0x4c2558 SetMenuItemInfoA

• 0x4c255c SetMenu

• 0x4c2560 SetForegroundWindow

• 0x4c2564 SetFocus

• 0x4c2568 SetCursor

• 0x4c256c SetClassLongA

• 0x4c2570 SetCapture

• 0x4c2574 SetActiveWindow

• 0x4c2578 SendMessageA

• 0x4c257c ScrollWindow

• 0x4c2580 ScreenToClient

• 0x4c2584 RemovePropA

• 0x4c2588 RemoveMenu

• 0x4c258c ReleaseDC

• 0x4c2590 ReleaseCapture

• 0x4c2594 RegisterWindowMessageA

• 0x4c2598 RegisterClipboardFormatA

• 0x4c259c RegisterClassA

• 0x4c25a0 RedrawWindow

• 0x4c25a4 PtInRect

• 0x4c25a8 PostQuitMessage

• 0x4c25ac PostMessageA

• 0x4c25b0 PeekMessageA

• 0x4c25b4 OffsetRect

• 0x4c25b8 OemToCharBuffA

• 0x4c25bc OemToCharA

• 0x4c25c0 MsgWaitForMultipleObjects

• 0x4c25c4 MessageBoxA

• 0x4c25c8 MapWindowPoints

• 0x4c25cc MapVirtualKeyA

• 0x4c25d0 LoadStringA

• 0x4c25d4 LoadKeyboardLayoutA

• 0x4c25d8 LoadIconA

• 0x4c25dc LoadCursorA

• 0x4c25e0 LoadBitmapA

• 0x4c25e4 KillTimer

• 0x4c25e8 IsZoomed

• 0x4c25ec IsWindowVisible

• 0x4c25f0 IsWindowEnabled

• 0x4c25f4 IsWindow

• 0x4c25f8 IsRectEmpty

• 0x4c25fc IsIconic

• 0x4c2600 IsDialogMessageA

• 0x4c2604 IsChild

• 0x4c2608 InvalidateRect

• 0x4c260c IntersectRect

• 0x4c2610 InsertMenuItemA

• 0x4c2614 InsertMenuA

• 0x4c2618 InflateRect

• 0x4c261c GetWindowThreadProcessId

• 0x4c2620 GetWindowTextA

• 0x4c2624 GetWindowRect

• 0x4c2628 GetWindowPlacement

• 0x4c262c GetWindowLongA

• 0x4c2630 GetWindowDC

• 0x4c2634 GetTopWindow

• 0x4c2638 GetSystemMetrics

• 0x4c263c GetSystemMenu

• 0x4c2640 GetSysColorBrush

• 0x4c2644 GetSysColor

• 0x4c2648 GetSubMenu

• 0x4c264c GetScrollRange

• 0x4c2650 GetScrollPos

• 0x4c2654 GetScrollInfo

• 0x4c2658 GetPropA

• 0x4c265c GetParent

• 0x4c2660 GetWindow

• 0x4c2664 GetMessageTime

• 0x4c2668 GetMessagePos

• 0x4c266c GetMenuStringA

• 0x4c2670 GetMenuState

• 0x4c2674 GetMenuItemInfoA

• 0x4c2678 GetMenuItemID

• 0x4c267c GetMenuItemCount

• 0x4c2680 GetMenu

• 0x4c2684 GetLastActivePopup

• 0x4c2688 GetKeyboardState

• 0x4c268c GetKeyboardLayoutList

• 0x4c2690 GetKeyboardLayout

• 0x4c2694 GetKeyState

• 0x4c2698 GetKeyNameTextA

• 0x4c269c GetIconInfo

• 0x4c26a0 GetForegroundWindow

• 0x4c26a4 GetFocus

• 0x4c26a8 GetDesktopWindow

• 0x4c26ac GetDCEx

• 0x4c26b0 GetDC

• 0x4c26b4 GetCursorPos

• 0x4c26b8 GetCursor

• 0x4c26bc GetClipboardData

• 0x4c26c0 GetClientRect

• 0x4c26c4 GetClassNameA

• 0x4c26c8 GetClassInfoA

• 0x4c26cc GetCapture

• 0x4c26d0 GetActiveWindow

• 0x4c26d4 FrameRect

• 0x4c26d8 FindWindowA

• 0x4c26dc FillRect

• 0x4c26e0 EqualRect

• 0x4c26e4 EnumWindows

• 0x4c26e8 EnumThreadWindows

• 0x4c26ec EndPaint

• 0x4c26f0 EnableWindow

• 0x4c26f4 EnableScrollBar

• 0x4c26f8 EnableMenuItem

• 0x4c26fc DrawTextA

• 0x4c2700 DrawMenuBar

• 0x4c2704 DrawIconEx

• 0x4c2708 DrawIcon

• 0x4c270c DrawFrameControl

• 0x4c2710 DrawFocusRect

• 0x4c2714 DrawEdge

• 0x4c2718 DispatchMessageA

• 0x4c271c DestroyWindow

• 0x4c2720 DestroyMenu

• 0x4c2724 DestroyIcon

• 0x4c2728 DestroyCursor

• 0x4c272c DeleteMenu

• 0x4c2730 DefWindowProcA

• 0x4c2734 DefMDIChildProcA

• 0x4c2738 DefFrameProcA

• 0x4c273c CreatePopupMenu

• 0x4c2740 CreateMenu

• 0x4c2744 CreateIcon

• 0x4c2748 ClientToScreen

• 0x4c274c ChildWindowFromPoint

• 0x4c2750 CheckMenuItem

• 0x4c2754 CallWindowProcA

• 0x4c2758 CallNextHookEx

• 0x4c275c BeginPaint

• 0x4c2760 CharNextA

• 0x4c2764 CharLowerBuffA

• 0x4c2768 CharLowerA

• 0x4c276c CharUpperBuffA

• 0x4c2770 CharToOemBuffA

• 0x4c2774 CharToOemA

• 0x4c2778 AdjustWindowRectEx

• 0x4c277c ActivateKeyboardLayout

Library kernel32.dll:

• 0x4c2784 Sleep

Library oleaut32.dll:

• 0x4c278c SafeArrayPtrOfIndex

• 0x4c2790 SafeArrayPutElement

• 0x4c2794 SafeArrayGetElement

• 0x4c2798 SafeArrayUnaccessData

• 0x4c279c SafeArrayAccessData

• 0x4c27a0 SafeArrayGetUBound

• 0x4c27a4 SafeArrayGetLBound

• 0x4c27a8 SafeArrayCreate

• 0x4c27ac VariantChangeType

• 0x4c27b0 VariantCopyInd

• 0x4c27b4 VariantCopy

• 0x4c27b8 VariantClear

• 0x4c27bc VariantInit

Library ole32.dll:

• 0x4c27c4 CreateStreamOnHGlobal

• 0x4c27c8 IsAccelerator

• 0x4c27cc OleDraw

• 0x4c27d0 OleSetMenuDescriptor

• 0x4c27d4 OleUninitialize

• 0x4c27d8 OleInitialize

• 0x4c27dc CoTaskMemFree

• 0x4c27e0 CoTaskMemAlloc

• 0x4c27e4 ProgIDFromCLSID

• 0x4c27e8 StringFromCLSID

• 0x4c27ec CoCreateInstance

• 0x4c27f0 CoGetClassObject

• 0x4c27f4 CoUninitialize

• 0x4c27f8 CoInitialize

• 0x4c27fc IsEqualGUID

Library oleaut32.dll:

• 0x4c2804 GetErrorInfo

• 0x4c2808 GetActiveObject

• 0x4c280c SysFreeString

Library comctl32.dll:

• 0x4c2814 ImageList_SetIconSize

• 0x4c2818 ImageList_GetIconSize

• 0x4c281c ImageList_Write

• 0x4c2820 ImageList_Read

• 0x4c2824 ImageList_GetDragImage

• 0x4c2828 ImageList_DragShowNolock

• 0x4c282c ImageList_SetDragCursorImage

• 0x4c2830 ImageList_DragMove

• 0x4c2834 ImageList_DragLeave

• 0x4c2838 ImageList_DragEnter

• 0x4c283c ImageList_EndDrag

• 0x4c2840 ImageList_BeginDrag

• 0x4c2844 ImageList_Remove

• 0x4c2848 ImageList_DrawEx

• 0x4c284c ImageList_Replace

• 0x4c2850 ImageList_Draw

• 0x4c2854 ImageList_GetBkColor

• 0x4c2858 ImageList_SetBkColor

• 0x4c285c ImageList_ReplaceIcon

• 0x4c2860 ImageList_Add

• 0x4c2864 ImageList_GetImageCount

• 0x4c2868 ImageList_Destroy

• 0x4c286c ImageList_Create

• 0x4c2870 InitCommonControls

Library shell32.dll:

• 0x4c2878 ShellExecuteExA

• 0x4c287c ShellExecuteA

• 0x4c2880 SHGetFileInfoA

Library shell32.dll:

• 0x4c2888 SHGetSpecialFolderLocation

• 0x4c288c SHGetMalloc

• 0x4c2890 SHGetDesktopFolder

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49714	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.