SmartHawk

3.0

中危

该样本未表现出任何异常！

重新分析

下载样本

b2d14cab18288ad09f1dc55b83c6e06b7129bd8f841f11d7c5186ac1475b1f04

6f90df685d91a56cedafe412b5ca64a8.exe

分析耗时

44s

最近分析

文件大小

1.6MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620800413.013625 GlobalMemoryStatusEx		success	1	0

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

TEXTINCLUDE

Foreign language identified in PE resource (50 个事件)

name

TEXTINCLUDE

language

LANG_CHINESE

offset

0x00133da4

filetype

C source, ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000151

name

TEXTINCLUDE

language

LANG_CHINESE

offset

0x00133da4

filetype

C source, ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000151

name

TEXTINCLUDE

language

LANG_CHINESE

offset

0x00133da4

filetype

C source, ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000151

name

RT_CURSOR

language

LANG_CHINESE

offset

0x00134294

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

offset

0x00134294

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

offset

0x00134294

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

offset

0x00134294

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000b4

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

offset

0x0013599c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000144

name

RT_MENU

language

LANG_CHINESE

offset

0x001ab7ac

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000284

name

RT_MENU

language

LANG_CHINESE

offset

0x001ab7ac

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000284

name

RT_DIALOG

language

LANG_CHINESE

offset

0x001ac9f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

offset

0x001ac9f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

offset

0x001ac9f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

offset

0x001ac9f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

offset

0x001ac9f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

offset

0x001ac9f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

offset

0x001ac9f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

offset

0x001ac9f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

offset

0x001ac9f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

offset

0x001ac9f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000018c

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

offset

0x001ad43c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000024

name

RT_GROUP_CURSOR

language

LANG_CHINESE

offset

0x001ad488

filetype

Lotus unknown worksheet or configuration, revision 0x2

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000022

name

RT_GROUP_CURSOR

language

LANG_CHINESE

offset

0x001ad488

filetype

Lotus unknown worksheet or configuration, revision 0x2

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000022

name

RT_GROUP_CURSOR

language

LANG_CHINESE

offset

0x001ad488

filetype

Lotus unknown worksheet or configuration, revision 0x2

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000022

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x001ad58c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x001ad58c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x001ad58c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000014

Creates executable files on the filesystem (6 个事件)

file	C:\Users\Administrator\AppData\Local\TSBrowser\User Data\Default\Extensions\ncnibpkpaeefjkolgmhgghpgdhmmpabd\8.1.1_0\ts.js
file	C:\Users\Administrator\AppData\Local\ChromeCore\User Data\Default\Extensions\ncnibpkpaeefjkolgmhgghpgdhmmpabd\8.1.1_0\ts.js
file	C:\Users\Administrator\AppData\Roaming\360se6\User Data\Default\Extensions\ncnibpkpaeefjkolgmhgghpgdhmmpabd\8.1.1_0\ts.js
file	C:\Users\Administrator\AppData\Local\Tencent\QQBrowser\User Data\Default\Extensions\ncnibpkpaeefjkolgmhgghpgdhmmpabd\8.1.1_0\ts.js
file	C:\Users\Administrator\AppData\Local\360Chrome\Chrome\User Data\Default\Extensions\ncnibpkpaeefjkolgmhgghpgdhmmpabd\8.1.1_0\ts.js
file	C:\Users\Administrator\AppData\Local\2345Explorer\User Data\Default\Extensions\eonpggfeipaoifkpcbbdgplecohkghej\8.1.1_0\ts.js

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2019-05-28 19:59:34

Imports

Library WINMM.dll:

• 0x474674 midiStreamOut

• 0x474678 midiOutPrepareHeader

• 0x47467c midiStreamProperty

• 0x474680 waveOutGetNumDevs

• 0x474684 waveOutOpen

• 0x474688 midiOutUnprepareHeader

• 0x47468c waveOutReset

• 0x474690 waveOutPause

• 0x474694 waveOutWrite

• 0x474698 waveOutPrepareHeader

• 0x47469c waveOutUnprepareHeader

• 0x4746a0 waveOutClose

• 0x4746a4 midiStreamStop

• 0x4746a8 midiOutReset

• 0x4746ac midiStreamClose

• 0x4746b0 midiStreamRestart

• 0x4746b4 midiStreamOpen

Library WS2_32.dll:

• 0x4746cc WSAAsyncSelect

• 0x4746d0 closesocket

• 0x4746d4 WSACleanup

• 0x4746d8 recvfrom

• 0x4746dc ioctlsocket

• 0x4746e0 recv

• 0x4746e4 inet_ntoa

• 0x4746e8 getpeername

• 0x4746ec accept

Library KERNEL32.dll:

• 0x474174 MultiByteToWideChar

• 0x474178 SetLastError

• 0x47417c GetTimeZoneInformation

• 0x474180 GetVersion

• 0x474184 RaiseException

• 0x474188 GetLocalTime

• 0x47418c GetSystemTime

• 0x474190 RtlUnwind

• 0x474194 GetStartupInfoA

• 0x474198 GetCPInfo

• 0x47419c GetProcessVersion

• 0x4741a0 SetErrorMode

• 0x4741a4 GlobalFlags

• 0x4741a8 GetCurrentThread

• 0x4741ac GetFileTime

• 0x4741b0 TlsGetValue

• 0x4741b4 LocalReAlloc

• 0x4741b8 TlsSetValue

• 0x4741bc TlsFree

• 0x4741c0 GlobalHandle

• 0x4741c4 TlsAlloc

• 0x4741c8 LocalAlloc

• 0x4741cc lstrcmpA

• 0x4741d0 GlobalGetAtomNameA

• 0x4741d4 GlobalAddAtomA

• 0x4741d8 GlobalFindAtomA

• 0x4741dc GlobalDeleteAtom

• 0x4741e0 lstrcmpiA

• 0x4741e4 GetThreadLocale

• 0x4741e8 SetEndOfFile

• 0x4741ec UnlockFile

• 0x4741f0 LockFile

• 0x4741f4 FlushFileBuffers

• 0x4741f8 DuplicateHandle

• 0x4741fc lstrcpynA

• 0x474200 FileTimeToLocalFileTime

• 0x474204 FileTimeToSystemTime

• 0x474208 FormatMessageA

• 0x47420c LocalFree

• 0x474210 WideCharToMultiByte

• 0x474214 InterlockedDecrement

• 0x474218 InterlockedIncrement

• 0x47421c GlobalMemoryStatus

• 0x474220 TerminateProcess

• 0x474224 GetCurrentProcess

• 0x474228 GetFileSize

• 0x47422c SetFilePointer

• 0x474230 CreateSemaphoreA

• 0x474234 ResumeThread

• 0x474238 ReleaseSemaphore

• 0x47423c EnterCriticalSection

• 0x474240 LeaveCriticalSection

• 0x474244 GetProfileStringA

• 0x474248 WriteFile

• 0x47424c ReadFile

• 0x474250 GetLastError

• 0x474254 WaitForMultipleObjects

• 0x474258 CreateFileA

• 0x47425c SetEvent

• 0x474260 FindResourceA

• 0x474264 LoadResource

• 0x474268 LockResource

• 0x47426c GetModuleFileNameA

• 0x474270 GetCurrentThreadId

• 0x474274 ExitProcess

• 0x474278 GlobalSize

• 0x47427c GlobalFree

• 0x474280 DeleteCriticalSection

• 0x474284 InitializeCriticalSection

• 0x474288 lstrcatA

• 0x47428c WinExec

• 0x474290 lstrcpyA

• 0x474294 FindNextFileA

• 0x474298 GlobalReAlloc

• 0x47429c HeapFree

• 0x4742a0 InterlockedExchange

• 0x4742a4 HeapReAlloc

• 0x4742a8 GetProcessHeap

• 0x4742ac HeapAlloc

• 0x4742b0 GetFullPathNameA

• 0x4742b4 FreeLibrary

• 0x4742b8 LoadLibraryA

• 0x4742bc lstrlenA

• 0x4742c0 GetVersionExA

• 0x4742c4 WritePrivateProfileStringA

• 0x4742c8 CreateThread

• 0x4742cc CreateEventA

• 0x4742d0 Sleep

• 0x4742d4 GlobalAlloc

• 0x4742d8 GlobalLock

• 0x4742dc GlobalUnlock

• 0x4742e0 FindFirstFileA

• 0x4742e4 FindClose

• 0x4742e8 GetFileAttributesA

• 0x4742ec CreateDirectoryA

• 0x4742f0 SetCurrentDirectoryA

• 0x4742f4 GetVolumeInformationA

• 0x4742f8 GetModuleHandleA

• 0x4742fc GetProcAddress

• 0x474300 MulDiv

• 0x474304 GetCommandLineA

• 0x474308 GetTickCount

• 0x47430c CreateProcessA

• 0x474310 WaitForSingleObject

• 0x474314 CloseHandle

• 0x474318 HeapSize

• 0x47431c GetACP

• 0x474320 UnhandledExceptionFilter

• 0x474324 FreeEnvironmentStringsA

• 0x474328 FreeEnvironmentStringsW

• 0x47432c GetEnvironmentStrings

• 0x474330 GetEnvironmentStringsW

• 0x474334 SetHandleCount

• 0x474338 GetStdHandle

• 0x47433c GetFileType

• 0x474340 GetEnvironmentVariableA

• 0x474344 HeapDestroy

• 0x474348 HeapCreate

• 0x47434c VirtualFree

• 0x474350 SetEnvironmentVariableA

• 0x474354 LCMapStringA

• 0x474358 LCMapStringW

• 0x47435c VirtualAlloc

• 0x474360 IsBadWritePtr

• 0x474364 SetUnhandledExceptionFilter

• 0x474368 GetStringTypeA

• 0x47436c GetStringTypeW

• 0x474370 CompareStringA

• 0x474374 CompareStringW

• 0x474378 IsBadReadPtr

• 0x47437c IsBadCodePtr

• 0x474380 SetStdHandle

• 0x474384 GetOEMCP

Library USER32.dll:

• 0x4743ec GetActiveWindow

• 0x4743f0 GetWindow

• 0x4743f4 DestroyAcceleratorTable

• 0x4743f8 SetFocus

• 0x4743fc IsIconic

• 0x474400 PeekMessageA

• 0x474404 SetMenu

• 0x474408 GetMenu

• 0x47440c DefWindowProcA

• 0x474410 GetClassInfoA

• 0x474414 DeleteMenu

• 0x474418 GetSystemMenu

• 0x47441c IsZoomed

• 0x474420 PostQuitMessage

• 0x474424 CopyAcceleratorTableA

• 0x474428 GetKeyState

• 0x47442c TranslateAcceleratorA

• 0x474430 IsWindowEnabled

• 0x474434 ShowWindow

• 0x474438 LoadImageA

• 0x47443c EnumDisplaySettingsA

• 0x474440 ClientToScreen

• 0x474444 EnableMenuItem

• 0x474448 GetSubMenu

• 0x47444c GetDlgCtrlID

• 0x474450 CreateAcceleratorTableA

• 0x474454 SetWindowRgn

• 0x474458 GetMessagePos

• 0x47445c ScreenToClient

• 0x474460 ChildWindowFromPointEx

• 0x474464 CopyRect

• 0x474468 LoadBitmapA

• 0x47446c CreateMenu

• 0x474470 KillTimer

• 0x474474 SetTimer

• 0x474478 ReleaseCapture

• 0x47447c GetCapture

• 0x474480 SetCapture

• 0x474484 GetScrollRange

• 0x474488 SetScrollRange

• 0x47448c SetScrollPos

• 0x474490 InflateRect

• 0x474494 SetRect

• 0x474498 IntersectRect

• 0x47449c DestroyIcon

• 0x4744a0 PostThreadMessageA

• 0x4744a4 GetNextDlgGroupItem

• 0x4744a8 GetSysColorBrush

• 0x4744ac PtInRect

• 0x4744b0 OffsetRect

• 0x4744b4 IsWindowVisible

• 0x4744b8 EnableWindow

• 0x4744bc RedrawWindow

• 0x4744c0 GetWindowLongA

• 0x4744c4 SetWindowLongA

• 0x4744c8 GetSysColor

• 0x4744cc SetActiveWindow

• 0x4744d0 SetCursorPos

• 0x4744d4 LoadCursorA

• 0x4744d8 SetCursor

• 0x4744dc GetDC

• 0x4744e0 FillRect

• 0x4744e4 IsRectEmpty

• 0x4744e8 ReleaseDC

• 0x4744ec IsChild

• 0x4744f0 DestroyMenu

• 0x4744f4 SetForegroundWindow

• 0x4744f8 GetWindowRect

• 0x4744fc EqualRect

• 0x474500 UpdateWindow

• 0x474504 ValidateRect

• 0x474508 InvalidateRect

• 0x47450c GetClientRect

• 0x474510 GetFocus

• 0x474514 GetParent

• 0x474518 GetTopWindow

• 0x47451c PostMessageA

• 0x474520 IsWindow

• 0x474524 SetParent

• 0x474528 DestroyCursor

• 0x47452c SendMessageA

• 0x474530 SetWindowPos

• 0x474534 MessageBeep

• 0x474538 MessageBoxA

• 0x47453c GetCursorPos

• 0x474540 GetSystemMetrics

• 0x474544 EmptyClipboard

• 0x474548 SetClipboardData

• 0x47454c OpenClipboard

• 0x474550 GetClipboardData

• 0x474554 CloseClipboard

• 0x474558 wsprintfA

• 0x47455c WaitForInputIdle

• 0x474560 ModifyMenuA

• 0x474564 AppendMenuA

• 0x474568 CreatePopupMenu

• 0x47456c DrawIconEx

• 0x474570 CreateIconFromResource

• 0x474574 CreateIconFromResourceEx

• 0x474578 RegisterClipboardFormatA

• 0x47457c SetRectEmpty

• 0x474580 DispatchMessageA

• 0x474584 WindowFromPoint

• 0x474588 DrawFocusRect

• 0x47458c DrawEdge

• 0x474590 DrawFrameControl

• 0x474594 LoadIconA

• 0x474598 TranslateMessage

• 0x47459c SystemParametersInfoA

• 0x4745a0 GetDesktopWindow

• 0x4745a4 GetClassNameA

• 0x4745a8 UnregisterClassA

• 0x4745ac GetDlgItem

• 0x4745b0 GetWindowTextA

• 0x4745b4 WinHelpA

• 0x4745b8 GetMessageA

• 0x4745bc GetWindowTextLengthA

• 0x4745c0 CharUpperA

• 0x4745c4 GetWindowDC

• 0x4745c8 BeginPaint

• 0x4745cc EndPaint

• 0x4745d0 TabbedTextOutA

• 0x4745d4 DrawTextA

• 0x4745d8 GrayStringA

• 0x4745dc DestroyWindow

• 0x4745e0 CreateDialogIndirectParamA

• 0x4745e4 EndDialog

• 0x4745e8 GetNextDlgTabItem

• 0x4745ec GetWindowPlacement

• 0x4745f0 RegisterWindowMessageA

• 0x4745f4 GetForegroundWindow

• 0x4745f8 GetLastActivePopup

• 0x4745fc GetMessageTime

• 0x474600 RemovePropA

• 0x474604 CallWindowProcA

• 0x474608 GetPropA

• 0x47460c UnhookWindowsHookEx

• 0x474610 SetPropA

• 0x474614 GetClassLongA

• 0x474618 CallNextHookEx

• 0x47461c SetWindowsHookExA

• 0x474620 CreateWindowExA

• 0x474624 GetMenuItemID

• 0x474628 GetMenuItemCount

• 0x47462c RegisterClassA

• 0x474630 GetScrollPos

• 0x474634 AdjustWindowRectEx

• 0x474638 MapWindowPoints

• 0x47463c SendDlgItemMessageA

• 0x474640 ScrollWindowEx

• 0x474644 IsDialogMessageA

• 0x474648 SetWindowTextA

• 0x47464c MoveWindow

• 0x474650 CheckMenuItem

• 0x474654 SetMenuItemBitmaps

• 0x474658 GetMenuState

• 0x47465c GetMenuCheckMarkDimensions

• 0x474660 CharNextA

• 0x474664 SetWindowContextHelpId

• 0x474668 MapDialogRect

• 0x47466c LoadStringA

Library GDI32.dll:

• 0x474024 GetMapMode

• 0x474028 GetTextMetricsA

• 0x47402c Escape

• 0x474030 ExtTextOutA

• 0x474034 TextOutA

• 0x474038 RectVisible

• 0x47403c PtVisible

• 0x474040 GetViewportExtEx

• 0x474044 ExtSelectClipRgn

• 0x474048 GetStockObject

• 0x47404c CreateFontIndirectA

• 0x474050 EndPage

• 0x474054 EndDoc

• 0x474058 DeleteDC

• 0x47405c StartDocA

• 0x474060 StartPage

• 0x474064 BitBlt

• 0x474068 CreateCompatibleDC

• 0x47406c Ellipse

• 0x474070 Rectangle

• 0x474074 LPtoDP

• 0x474078 CreateSolidBrush

• 0x47407c GetCurrentObject

• 0x474080 RoundRect

• 0x474084 GetTextExtentPoint32A

• 0x474088 GetDeviceCaps

• 0x47408c CreateRectRgnIndirect

• 0x474090 SetBkColor

• 0x474094 LineTo

• 0x474098 MoveToEx

• 0x47409c ExcludeClipRect

• 0x4740a0 GetClipBox

• 0x4740a4 CombineRgn

• 0x4740a8 CreateRectRgn

• 0x4740ac FillRgn

• 0x4740b0 PatBlt

• 0x4740b4 CreatePen

• 0x4740b8 GetObjectA

• 0x4740bc SelectObject

• 0x4740c0 CreateBitmap

• 0x4740c4 CreateDCA

• 0x4740c8 CreateCompatibleBitmap

• 0x4740cc GetPolyFillMode

• 0x4740d0 GetStretchBltMode

• 0x4740d4 GetROP2

• 0x4740d8 GetBkColor

• 0x4740dc GetBkMode

• 0x4740e0 GetTextColor

• 0x4740e4 CreateRoundRectRgn

• 0x4740e8 CreateEllipticRgn

• 0x4740ec PathToRegion

• 0x4740f0 EndPath

• 0x4740f4 BeginPath

• 0x4740f8 GetWindowOrgEx

• 0x4740fc GetViewportOrgEx

• 0x474100 GetWindowExtEx

• 0x474104 GetDIBits

• 0x474108 RealizePalette

• 0x47410c ScaleWindowExtEx

• 0x474110 SetWindowExtEx

• 0x474114 SetWindowOrgEx

• 0x474118 ScaleViewportExtEx

• 0x47411c SetViewportExtEx

• 0x474120 OffsetViewportOrgEx

• 0x474124 SetViewportOrgEx

• 0x474128 SelectPalette

• 0x47412c StretchBlt

• 0x474130 CreatePalette

• 0x474134 GetSystemPaletteEntries

• 0x474138 CreateDIBitmap

• 0x47413c DeleteObject

• 0x474140 SelectClipRgn

• 0x474144 CreatePolygonRgn

• 0x474148 GetClipRgn

• 0x47414c SetStretchBltMode

• 0x474150 DPtoLP

• 0x474154 SetMapMode

• 0x474158 SetTextColor

• 0x47415c SetROP2

• 0x474160 SetPolyFillMode

• 0x474164 SetBkMode

• 0x474168 RestoreDC

• 0x47416c SaveDC

Library WINSPOOL.DRV:

• 0x4746bc ClosePrinter

• 0x4746c0 OpenPrinterA

• 0x4746c4 DocumentPropertiesA

Library ADVAPI32.dll:

• 0x474000 RegCloseKey

• 0x474004 RegOpenKeyExA

• 0x474008 RegSetValueExA

• 0x47400c RegQueryValueA

• 0x474010 RegCreateKeyExA

Library SHELL32.dll:

• 0x4743e0 ShellExecuteA

• 0x4743e4 Shell_NotifyIconA

Library ole32.dll:

• 0x474708 StgCreateDocfileOnILockBytes

• 0x47470c CreateILockBytesOnHGlobal

• 0x474710 CoFreeUnusedLibraries

• 0x474714 CoRegisterMessageFilter

• 0x474718 CoRevokeClassObject

• 0x47471c OleFlushClipboard

• 0x474720 OleIsCurrentClipboard

• 0x474724 StgOpenStorageOnILockBytes

• 0x474728 CoTaskMemFree

• 0x47472c CoTaskMemAlloc

• 0x474730 CLSIDFromProgID

• 0x474734 CLSIDFromString

• 0x474738 OleUninitialize

• 0x47473c OleInitialize

• 0x474740 CoGetClassObject

Library OLEAUT32.dll:

• 0x47438c VariantChangeType

• 0x474390 VariantClear

• 0x474394 VariantCopy

• 0x474398 SafeArrayGetUBound

• 0x47439c VariantTimeToSystemTime

• 0x4743a0 SysStringLen

• 0x4743a4 SysAllocStringLen

• 0x4743a8 SysAllocStringByteLen

• 0x4743ac SafeArrayGetElemsize

• 0x4743b0 SafeArrayUnaccessData

• 0x4743b4 SafeArrayAccessData

• 0x4743b8 SafeArrayGetLBound

• 0x4743bc SysFreeString

• 0x4743c0 OleCreateFontIndirect

• 0x4743c4 LoadTypeLib

• 0x4743c8 RegisterTypeLib

• 0x4743cc UnRegisterTypeLib

• 0x4743d0 SafeArrayCreate

• 0x4743d4 SysAllocString

• 0x4743d8 SafeArrayGetDim

Library COMCTL32.dll:

• 0x474018

• 0x47401c ImageList_Destroy

Library oledlg.dll:

• 0x474748

Library comdlg32.dll:

• 0x4746f4 ChooseColorA

• 0x4746f8 GetOpenFileNameA

• 0x4746fc GetSaveFileNameA

• 0x474700 GetFileTitleA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	216.58.200.78

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.