SmartHawk

5.8

高危

53 个模型检测该样本为恶意！

重新分析

下载样本

9af42638628323098b6873eee65103c97fa1ff971d6640323ab4a5290edc71c2

73fa9bfb100fa4d8304fef98446d2b62.exe

分析耗时

26s

最近分析

文件大小

947.0KB

静态报毒动态报毒 100% 7GW@A4YISBPI AEME AI SCORE=81 AIDETECTVM ALI2000015 AUTO CLASSIC CONFIDENCE CWHEY@0 DELF DELFINJECT DELPHILESS EMZL ENAC EUZU EXPLORERHIJACK FAREIT HIGH CONFIDENCE HRVYHI IGENERIC KRYPTIK LOKIBOT MALWARE1 NANOBOT NANOCORE OAIOW R002C0DHE20 SCORE SIGGEN10 SUSGEN SUSPICIOUS PE TSCOPE X2091 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20200830	18.4.3895.0
Kingsoft		20200830	2013.8.14.323
McAfee	Fareit-FPQ!73FA9BFB100F	20200830	6.0.6.653
Tencent	Win32.Trojan.Inject.Auto	20200830	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619611684.205626 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3 73fa9bfb100fa4d8304fef98446d2b62+0x90a4d @ 0x490a4d 73fa9bfb100fa4d8304fef98446d2b62+0x89254 @ 0x489254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfea514ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619611684.205626
__exception__

stacktrace:

CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
73fa9bfb100fa4d8304fef98446d2b62+0x90a4d @ 0x490a4d
73fa9bfb100fa4d8304fef98446d2b62+0x89254 @ 0x489254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfea514ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (30 个事件)

Time & API	Arguments	Status
1619611681.503126 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success
1619611681.612126 NtProtectVirtualMemory	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 73728 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00467000	success
1619611681.612126 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00530000	success
1619611682.955626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619611683.064626 NtAllocateVirtualMemory	process_identifier: 2424 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f50000	success
1619611683.064626 NtAllocateVirtualMemory	process_identifier: 2424 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020b0000	success
1619611683.064626 NtAllocateVirtualMemory	process_identifier: 2424 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01eb0000	success
1619611683.080626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 520192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01eb2000	success
1619611683.658626 NtAllocateVirtualMemory	process_identifier: 2424 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x022b0000	success
1619611683.658626 NtAllocateVirtualMemory	process_identifier: 2424 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02420000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f42000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f42000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f42000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f42000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f42000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f42000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f42000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f42000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f42000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f42000	success
1619611684.189626 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.421743448839119

section

{'size_of_data': '0x00068e00', 'virtual_address': '0x0008a000', 'entropy': 7.421743448839119, 'name': '.rsrc', 'virtual_size': '0x00068d50'}

description

A section with a high entropy has been found

entropy

0.44344608879492603

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2196 called NtSetContextThread to modify thread in remote process 2424
1619611682.190126 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5354784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2424	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2196 resumed a thread in remote process 2424
1619611682.768126 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 2424	success	0	0

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619611682.096126 CreateProcessInternalW	thread_identifier: 1060 thread_handle: 0x00000100 process_identifier: 2424 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\73fa9bfb100fa4d8304fef98446d2b62.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000104 inherit_handles: 0	success	1
1619611682.096126 NtUnmapViewOfSection	process_identifier: 2424 region_size: 4096 process_handle: 0x00000104 base_address: 0x00400000	success	0
1619611682.096126 NtMapViewOfSection	section_handle: 0x0000010c process_identifier: 2424 commit_size: 1167360 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000104 allocation_type: 0 () section_offset: 0 view_size: 1167360 base_address: 0x00400000	success	0
1619611682.190126 NtGetContextThread	thread_handle: 0x00000100	success	0
1619611682.190126 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5354784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2424	success	0
1619611682.768126 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 2424	success	0

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Agent.EUZU
FireEye	Generic.mg.73fa9bfb100fa4d8
CAT-QuickHeal	Trojan.IGENERIC
ALYac	Trojan.Agent.EUZU
Malwarebytes	Trojan.MalPack.DLF
K7AntiVirus	Trojan ( 0056c6e51 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Trojan ( 0056c6e51 )
Cybereason	malicious.b100fa
Arcabit	Trojan.Agent.EUZU
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZelphiF.34196.7GW@a4yIsbpi
Cyren	W32/Trojan.AEME-0145
Symantec	Infostealer.Lokibot!43
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Backdoor.Win32.NanoBot.gen
BitDefender	Trojan.Agent.EUZU
NANO-Antivirus	Trojan.Win32.NanoBot.hrvyhi
Paloalto	generic.ml
AegisLab	Trojan.Win32.NanoBot.m!c
Rising	Trojan.Injector!1.CA8A (CLASSIC)
Ad-Aware	Trojan.Agent.EUZU
Comodo	TrojWare.Win32.Agent.cwhey@0
F-Secure	Trojan.TR/Kryptik.oaiow
DrWeb	Trojan.Siggen10.5384
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DHE20
Sophos	Mal/Generic-S
SentinelOne	DFI - Suspicious PE
Avira	TR/Kryptik.oaiow
MAX	malware (ai score=81)
Antiy-AVL	Trojan[Backdoor]/Win32.NanoBot
Microsoft	Trojan:Win32/NanoCore.VD!MTB
ZoneAlarm	HEUR:Backdoor.Win32.NanoBot.gen
GData	Trojan.Agent.EUZU
Cynet	Malicious (score: 90)
AhnLab-V3	Suspicious/Win.Delphiless.X2091
Acronis	suspicious
McAfee	Fareit-FPQ!73FA9BFB100F
VBA32	TScope.Trojan.Delf
ESET-NOD32	a variant of Win32/Injector.ENAC
TrendMicro-HouseCall	TROJ_GEN.R002C0DHE20
Tencent	Win32.Trojan.Inject.Auto
Ikarus	Gen.Win32.ExplorerHijack
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Injector.EMZL!tr
AVG	Win32:Trojan-gen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47d140 DeleteCriticalSection

• 0x47d144 LeaveCriticalSection

• 0x47d148 EnterCriticalSection

• 0x47d14c InitializeCriticalSection

• 0x47d150 VirtualFree

• 0x47d154 VirtualAlloc

• 0x47d158 LocalFree

• 0x47d15c LocalAlloc

• 0x47d160 GetVersion

• 0x47d164 GetCurrentThreadId

• 0x47d168 InterlockedDecrement

• 0x47d16c InterlockedIncrement

• 0x47d170 VirtualQuery

• 0x47d174 WideCharToMultiByte

• 0x47d178 SetCurrentDirectoryA

• 0x47d17c MultiByteToWideChar

• 0x47d180 lstrlenA

• 0x47d184 lstrcpynA

• 0x47d188 LoadLibraryExA

• 0x47d18c GetThreadLocale

• 0x47d190 GetStartupInfoA

• 0x47d194 GetProcAddress

• 0x47d198 GetModuleHandleA

• 0x47d19c GetModuleFileNameA

• 0x47d1a0 GetLocaleInfoA

• 0x47d1a4 GetLastError

• 0x47d1a8 GetCurrentDirectoryA

• 0x47d1ac GetCommandLineA

• 0x47d1b0 FreeLibrary

• 0x47d1b4 FindFirstFileA

• 0x47d1b8 FindClose

• 0x47d1bc ExitProcess

• 0x47d1c0 WriteFile

• 0x47d1c4 UnhandledExceptionFilter

• 0x47d1c8 RtlUnwind

• 0x47d1cc RaiseException

• 0x47d1d0 GetStdHandle

Library user32.dll:

• 0x47d1d8 GetKeyboardType

• 0x47d1dc LoadStringA

• 0x47d1e0 MessageBoxA

• 0x47d1e4 CharNextA

Library advapi32.dll:

• 0x47d1ec RegQueryValueExA

• 0x47d1f0 RegOpenKeyExA

• 0x47d1f4 RegCloseKey

Library oleaut32.dll:

• 0x47d1fc SysFreeString

• 0x47d200 SysReAllocStringLen

• 0x47d204 SysAllocStringLen

Library kernel32.dll:

• 0x47d20c TlsSetValue

• 0x47d210 TlsGetValue

• 0x47d214 LocalAlloc

• 0x47d218 GetModuleHandleA

Library advapi32.dll:

• 0x47d220 RegQueryValueExA

• 0x47d224 RegOpenKeyExA

• 0x47d228 RegCloseKey

Library kernel32.dll:

• 0x47d230 lstrcpyA

• 0x47d234 WriteFile

• 0x47d238 WinExec

• 0x47d23c WaitForSingleObject

• 0x47d240 VirtualQuery

• 0x47d244 VirtualProtect

• 0x47d248 VirtualAlloc

• 0x47d24c Sleep

• 0x47d250 SizeofResource

• 0x47d254 SetThreadLocale

• 0x47d258 SetFilePointer

• 0x47d25c SetEvent

• 0x47d260 SetErrorMode

• 0x47d264 SetEndOfFile

• 0x47d268 ResetEvent

• 0x47d26c ReadFile

• 0x47d270 MulDiv

• 0x47d274 LockResource

• 0x47d278 LoadResource

• 0x47d27c LoadLibraryA

• 0x47d280 LeaveCriticalSection

• 0x47d284 InitializeCriticalSection

• 0x47d288 GlobalUnlock

• 0x47d28c GlobalReAlloc

• 0x47d290 GlobalHandle

• 0x47d294 GlobalLock

• 0x47d298 GlobalFree

• 0x47d29c GlobalFindAtomA

• 0x47d2a0 GlobalDeleteAtom

• 0x47d2a4 GlobalAlloc

• 0x47d2a8 GlobalAddAtomA

• 0x47d2ac GetVersionExA

• 0x47d2b0 GetVersion

• 0x47d2b4 GetTickCount

• 0x47d2b8 GetThreadLocale

• 0x47d2bc GetSystemTimeAsFileTime

• 0x47d2c0 GetSystemInfo

• 0x47d2c4 GetStringTypeExA

• 0x47d2c8 GetStdHandle

• 0x47d2cc GetProcAddress

• 0x47d2d0 GetModuleHandleA

• 0x47d2d4 GetModuleFileNameA

• 0x47d2d8 GetLocaleInfoA

• 0x47d2dc GetLocalTime

• 0x47d2e0 GetLastError

• 0x47d2e4 GetFullPathNameA

• 0x47d2e8 GetFileAttributesA

• 0x47d2ec GetDiskFreeSpaceA

• 0x47d2f0 GetDateFormatA

• 0x47d2f4 GetCurrentThreadId

• 0x47d2f8 GetCurrentProcessId

• 0x47d2fc GetCPInfo

• 0x47d300 GetACP

• 0x47d304 FreeResource

• 0x47d308 InterlockedExchange

• 0x47d30c FreeLibrary

• 0x47d310 FormatMessageA

• 0x47d314 FindResourceA

• 0x47d318 FindNextFileA

• 0x47d31c FindFirstFileA

• 0x47d320 FindClose

• 0x47d324 FileTimeToSystemTime

• 0x47d328 FileTimeToLocalFileTime

• 0x47d32c FileTimeToDosDateTime

• 0x47d330 EnumCalendarInfoA

• 0x47d334 EnterCriticalSection

• 0x47d338 DeleteCriticalSection

• 0x47d33c CreateThread

• 0x47d340 CreateFileA

• 0x47d344 CreateEventA

• 0x47d348 CompareStringA

• 0x47d34c CloseHandle

Library version.dll:

• 0x47d354 VerQueryValueA

• 0x47d358 GetFileVersionInfoSizeA

• 0x47d35c GetFileVersionInfoA

Library gdi32.dll:

• 0x47d364 UnrealizeObject

• 0x47d368 StretchBlt

• 0x47d36c SetWindowOrgEx

• 0x47d370 SetWinMetaFileBits

• 0x47d374 SetViewportOrgEx

• 0x47d378 SetTextColor

• 0x47d37c SetStretchBltMode

• 0x47d380 SetROP2

• 0x47d384 SetPixel

• 0x47d388 SetEnhMetaFileBits

• 0x47d38c SetDIBColorTable

• 0x47d390 SetBrushOrgEx

• 0x47d394 SetBkMode

• 0x47d398 SetBkColor

• 0x47d39c SelectPalette

• 0x47d3a0 SelectObject

• 0x47d3a4 SaveDC

• 0x47d3a8 RestoreDC

• 0x47d3ac Rectangle

• 0x47d3b0 RectVisible

• 0x47d3b4 RealizePalette

• 0x47d3b8 PlayEnhMetaFile

• 0x47d3bc PatBlt

• 0x47d3c0 MoveToEx

• 0x47d3c4 MaskBlt

• 0x47d3c8 LineTo

• 0x47d3cc IntersectClipRect

• 0x47d3d0 GetWindowOrgEx

• 0x47d3d4 GetWinMetaFileBits

• 0x47d3d8 GetTextMetricsA

• 0x47d3dc GetTextExtentPoint32A

• 0x47d3e0 GetSystemPaletteEntries

• 0x47d3e4 GetStockObject

• 0x47d3e8 GetPixel

• 0x47d3ec GetPaletteEntries

• 0x47d3f0 GetObjectA

• 0x47d3f4 GetEnhMetaFilePaletteEntries

• 0x47d3f8 GetEnhMetaFileHeader

• 0x47d3fc GetEnhMetaFileBits

• 0x47d400 GetDeviceCaps

• 0x47d404 GetDIBits

• 0x47d408 GetDIBColorTable

• 0x47d40c GetDCOrgEx

• 0x47d410 GetCurrentPositionEx

• 0x47d414 GetClipBox

• 0x47d418 GetBrushOrgEx

• 0x47d41c GetBitmapBits

• 0x47d420 ExtTextOutA

• 0x47d424 ExcludeClipRect

• 0x47d428 DeleteObject

• 0x47d42c DeleteEnhMetaFile

• 0x47d430 DeleteDC

• 0x47d434 CreateSolidBrush

• 0x47d438 CreatePenIndirect

• 0x47d43c CreatePalette

• 0x47d440 CreateHalftonePalette

• 0x47d444 CreateFontIndirectA

• 0x47d448 CreateDIBitmap

• 0x47d44c CreateDIBSection

• 0x47d450 CreateCompatibleDC

• 0x47d454 CreateCompatibleBitmap

• 0x47d458 CreateBrushIndirect

• 0x47d45c CreateBitmap

• 0x47d460 CopyEnhMetaFileA

• 0x47d464 BitBlt

Library opengl32.dll:

• 0x47d46c wglCreateContext

Library user32.dll:

• 0x47d474 CreateWindowExA

• 0x47d478 WindowFromPoint

• 0x47d47c WinHelpA

• 0x47d480 WaitMessage

• 0x47d484 UpdateWindow

• 0x47d488 UnregisterClassA

• 0x47d48c UnhookWindowsHookEx

• 0x47d490 TranslateMessage

• 0x47d494 TranslateMDISysAccel

• 0x47d498 TrackPopupMenu

• 0x47d49c SystemParametersInfoA

• 0x47d4a0 ShowWindow

• 0x47d4a4 ShowScrollBar

• 0x47d4a8 ShowOwnedPopups

• 0x47d4ac ShowCursor

• 0x47d4b0 SetWindowsHookExA

• 0x47d4b4 SetWindowTextA

• 0x47d4b8 SetWindowPos

• 0x47d4bc SetWindowPlacement

• 0x47d4c0 SetWindowLongA

• 0x47d4c4 SetTimer

• 0x47d4c8 SetScrollRange

• 0x47d4cc SetScrollPos

• 0x47d4d0 SetScrollInfo

• 0x47d4d4 SetRect

• 0x47d4d8 SetPropA

• 0x47d4dc SetParent

• 0x47d4e0 SetMenuItemInfoA

• 0x47d4e4 SetMenu

• 0x47d4e8 SetKeyboardState

• 0x47d4ec SetForegroundWindow

• 0x47d4f0 SetFocus

• 0x47d4f4 SetCursor

• 0x47d4f8 SetClipboardData

• 0x47d4fc SetClassLongA

• 0x47d500 SetCapture

• 0x47d504 SetActiveWindow

• 0x47d508 SendMessageA

• 0x47d50c ScrollWindow

• 0x47d510 ScreenToClient

• 0x47d514 RemovePropA

• 0x47d518 RemoveMenu

• 0x47d51c ReleaseDC

• 0x47d520 ReleaseCapture

• 0x47d524 RegisterWindowMessageA

• 0x47d528 RegisterClipboardFormatA

• 0x47d52c RegisterClassA

• 0x47d530 RedrawWindow

• 0x47d534 PtInRect

• 0x47d538 PostQuitMessage

• 0x47d53c PostMessageA

• 0x47d540 PeekMessageA

• 0x47d544 OpenClipboard

• 0x47d548 OffsetRect

• 0x47d54c OemToCharA

• 0x47d550 MessageBoxA

• 0x47d554 MessageBeep

• 0x47d558 MapWindowPoints

• 0x47d55c MapVirtualKeyA

• 0x47d560 LoadStringA

• 0x47d564 LoadKeyboardLayoutA

• 0x47d568 LoadIconA

• 0x47d56c LoadCursorA

• 0x47d570 LoadBitmapA

• 0x47d574 KillTimer

• 0x47d578 IsZoomed

• 0x47d57c IsWindowVisible

• 0x47d580 IsWindowEnabled

• 0x47d584 IsWindow

• 0x47d588 IsRectEmpty

• 0x47d58c IsIconic

• 0x47d590 IsDialogMessageA

• 0x47d594 IsChild

• 0x47d598 IsCharAlphaNumericA

• 0x47d59c IsCharAlphaA

• 0x47d5a0 InvalidateRect

• 0x47d5a4 IntersectRect

• 0x47d5a8 InsertMenuItemA

• 0x47d5ac InsertMenuA

• 0x47d5b0 InflateRect

• 0x47d5b4 GetWindowThreadProcessId

• 0x47d5b8 GetWindowTextA

• 0x47d5bc GetWindowRect

• 0x47d5c0 GetWindowPlacement

• 0x47d5c4 GetWindowLongA

• 0x47d5c8 GetWindowDC

• 0x47d5cc GetTopWindow

• 0x47d5d0 GetSystemMetrics

• 0x47d5d4 GetSystemMenu

• 0x47d5d8 GetSysColorBrush

• 0x47d5dc GetSysColor

• 0x47d5e0 GetSubMenu

• 0x47d5e4 GetScrollRange

• 0x47d5e8 GetScrollPos

• 0x47d5ec GetScrollInfo

• 0x47d5f0 GetPropA

• 0x47d5f4 GetParent

• 0x47d5f8 GetWindow

• 0x47d5fc GetMenuStringA

• 0x47d600 GetMenuState

• 0x47d604 GetMenuItemInfoA

• 0x47d608 GetMenuItemID

• 0x47d60c GetMenuItemCount

• 0x47d610 GetMenu

• 0x47d614 GetLastActivePopup

• 0x47d618 GetKeyboardState

• 0x47d61c GetKeyboardLayoutList

• 0x47d620 GetKeyboardLayout

• 0x47d624 GetKeyState

• 0x47d628 GetKeyNameTextA

• 0x47d62c GetIconInfo

• 0x47d630 GetForegroundWindow

• 0x47d634 GetFocus

• 0x47d638 GetDesktopWindow

• 0x47d63c GetDCEx

• 0x47d640 GetDC

• 0x47d644 GetCursorPos

• 0x47d648 GetCursor

• 0x47d64c GetClipboardData

• 0x47d650 GetClientRect

• 0x47d654 GetClassNameA

• 0x47d658 GetClassInfoA

• 0x47d65c GetCapture

• 0x47d660 GetActiveWindow

• 0x47d664 FrameRect

• 0x47d668 FindWindowA

• 0x47d66c FillRect

• 0x47d670 EqualRect

• 0x47d674 EnumWindows

• 0x47d678 EnumThreadWindows

• 0x47d67c EnumClipboardFormats

• 0x47d680 EndPaint

• 0x47d684 EnableWindow

• 0x47d688 EnableScrollBar

• 0x47d68c EnableMenuItem

• 0x47d690 EmptyClipboard

• 0x47d694 DrawTextA

• 0x47d698 DrawMenuBar

• 0x47d69c DrawIconEx

• 0x47d6a0 DrawIcon

• 0x47d6a4 DrawFrameControl

• 0x47d6a8 DrawFocusRect

• 0x47d6ac DrawEdge

• 0x47d6b0 DispatchMessageA

• 0x47d6b4 DestroyWindow

• 0x47d6b8 DestroyMenu

• 0x47d6bc DestroyIcon

• 0x47d6c0 DestroyCursor

• 0x47d6c4 DeleteMenu

• 0x47d6c8 DefWindowProcA

• 0x47d6cc DefMDIChildProcA

• 0x47d6d0 DefFrameProcA

• 0x47d6d4 CreatePopupMenu

• 0x47d6d8 CreateMenu

• 0x47d6dc CreateIcon

• 0x47d6e0 CloseClipboard

• 0x47d6e4 ClientToScreen

• 0x47d6e8 CheckMenuItem

• 0x47d6ec CallWindowProcA

• 0x47d6f0 CallNextHookEx

• 0x47d6f4 BeginPaint

• 0x47d6f8 CharNextA

• 0x47d6fc CharLowerBuffA

• 0x47d700 CharLowerA

• 0x47d704 CharUpperBuffA

• 0x47d708 CharToOemA

• 0x47d70c AdjustWindowRectEx

• 0x47d710 ActivateKeyboardLayout

Library kernel32.dll:

• 0x47d718 Sleep

Library oleaut32.dll:

• 0x47d720 SafeArrayPtrOfIndex

• 0x47d724 SafeArrayGetUBound

• 0x47d728 SafeArrayGetLBound

• 0x47d72c SafeArrayCreate

• 0x47d730 VariantChangeType

• 0x47d734 VariantCopy

• 0x47d738 VariantClear

• 0x47d73c VariantInit

Library comctl32.dll:

• 0x47d744 ImageList_SetIconSize

• 0x47d748 ImageList_GetIconSize

• 0x47d74c ImageList_Write

• 0x47d750 ImageList_Read

• 0x47d754 ImageList_GetDragImage

• 0x47d758 ImageList_DragShowNolock

• 0x47d75c ImageList_SetDragCursorImage

• 0x47d760 ImageList_DragMove

• 0x47d764 ImageList_DragLeave

• 0x47d768 ImageList_DragEnter

• 0x47d76c ImageList_EndDrag

• 0x47d770 ImageList_BeginDrag

• 0x47d774 ImageList_Remove

• 0x47d778 ImageList_DrawEx

• 0x47d77c ImageList_Replace

• 0x47d780 ImageList_Draw

• 0x47d784 ImageList_GetBkColor

• 0x47d788 ImageList_SetBkColor

• 0x47d78c ImageList_ReplaceIcon

• 0x47d790 ImageList_Add

• 0x47d794 ImageList_GetImageCount

• 0x47d798 ImageList_Destroy

• 0x47d79c ImageList_Create

• 0x47d7a0 InitCommonControls

Library user32.dll:

• 0x47d7a8 DdeCmpStringHandles

• 0x47d7ac DdeFreeStringHandle

• 0x47d7b0 DdeQueryStringA

• 0x47d7b4 DdeCreateStringHandleA

• 0x47d7b8 DdeGetLastError

• 0x47d7bc DdeFreeDataHandle

• 0x47d7c0 DdeUnaccessData

• 0x47d7c4 DdeAccessData

• 0x47d7c8 DdeCreateDataHandle

• 0x47d7cc DdeClientTransaction

• 0x47d7d0 DdeNameService

• 0x47d7d4 DdePostAdvise

• 0x47d7d8 DdeSetUserHandle

• 0x47d7dc DdeQueryConvInfo

• 0x47d7e0 DdeDisconnect

• 0x47d7e4 DdeConnect

• 0x47d7e8 DdeUninitialize

• 0x47d7ec DdeInitializeA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.