SmartHawk

11.6

0-day

该样本未表现出任何异常！

重新分析

下载样本

bcb51d2d0b589852e03844c9721c12f32292fa270b5db87027e99006d597f35f

74bc0f47988f742623e0a58ba85ce073.exe

分析耗时

106s

最近分析

文件大小

344.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620799501.983249 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1620799488.686249 CryptGenKey	crypto_handle: 0x00534a90 algorithm_identifier: 0x0000660e () provider_handle: 0x00534400 flags: 1 key: f$[Èzö,fÛÆæüÜ0¹	success	1
1620799501.998249 CryptExportKey	crypto_handle: 0x00534a90 crypto_export_handle: 0x00534a50 buffer: f¤·ÿqG©äpz!Æî·/Ã½]7ÿÉDáljD³ôê£vCn$Ñ`çÓô%4ê6óYdÍa¬õ+zi ØÍú:Â¥©½Ôü8ÿÁM/qÞÏ blob_type: 1 flags: 64	success	1
1620799530.920249 CryptExportKey	crypto_handle: 0x00534a90 crypto_export_handle: 0x00534a50 buffer: f¤rÐM[pàà8uÏþ ¬Á© /PLË[j~VÕ¤^`á ±ÔÑ{IÆU¥ýLB*ð®Q#!^H ò\g¹®úÊ×¥%©cW{x<iIiL¶ blob_type: 1 flags: 64	success	1
1620799535.905249 CryptExportKey	crypto_handle: 0x00534a90 crypto_export_handle: 0x00534a50 buffer: f¤5UhÍöâL:UdÏQ0xÅ>Óº©$ñî9kÙR{ÕQ!Ê¼·G;ØzÓÊzQÔWÁ.Ñ¡wÓû+N@672oè¢Ü¶XzIßîÑM blob_type: 1 flags: 64	success	1
1620799539.717249 CryptExportKey	crypto_handle: 0x00534a90 crypto_export_handle: 0x00534a50 buffer: f¤$5 ½Øµ.\8¥ÓWÐ`~Y UkUÅxjv_àkÅ¨DõÓÒ¸ëe²ç[\|§#Ð±ãp Öâ¿-×È\|ù6 âäÿ²U7þB.ï(±iÖv blob_type: 1 flags: 64	success	1

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:3106631889&cup2hreq=695053e5f60d32b598281dbd78cd08ae6d295dd382e7249eb80e76696cf89e70

Performs some HTTP requests (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:3106631889&cup2hreq=695053e5f60d32b598281dbd78cd08ae6d295dd382e7249eb80e76696cf89e70

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:3106631889&cup2hreq=695053e5f60d32b598281dbd78cd08ae6d295dd382e7249eb80e76696cf89e70

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1620799481.982374 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x004b0000	success
1620799110.267395 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004200000	success
1620799488.452249 NtAllocateVirtualMemory	process_identifier: 1948 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e30000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a shortcut to an executable file (1 个事件)

file	C:\Users\Public\Desktop\Google Chrome.lnk

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620799530.920249 Process32NextW	process_name: sppsvc.exe snapshot_handle: 0x000003bc process_identifier: 2812	success	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620799481.982374 NtProtectVirtualMemory	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 28672 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x004e1000	success	0	0

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620799484.669374 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\74bc0f47988f742623e0a58ba85ce073.exe newfilepath: C:\Windows\SysWOW64\userinit\PING.exe newfilepath_r: C:\Windows\SysWOW64\userinit\PING.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\74bc0f47988f742623e0a58ba85ce073.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620799503.280249 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

7.016649021766093

section

{'size_of_data': '0x00011000', 'virtual_address': '0x00049000', 'entropy': 7.016649021766093, 'name': '.rsrc', 'virtual_size': '0x000101e8'}

description

A section with a high entropy has been found

Expresses interest in specific running processes (1 个事件)

process

ping.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620799502.389249 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

C:\Windows\SysWOW64\userinit\PING.exe

Communicates with host for which no DNS query was performed (5 个事件)

host	142.44.137.67
host	162.241.242.173
host	172.217.24.14
host	192.158.216.73
host	85.214.28.226

Installs itself for autorun at Windows startup (1 个事件)

service_name

PING

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\userinit\PING.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620799486.966374 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x02a99cc8 display_name: PING error_control: 0 service_name: PING filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\userinit\PING.exe" filepath_r: "C:\Windows\SysWOW64\userinit\PING.exe" service_manager_handle: 0x02a99728 desired_access: 2 service_type: 16 password:	success	44670152	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1620799507.123249 RegSetValueExA	key_handle: 0x000003bc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620799507.123249 RegSetValueExA	key_handle: 0x000003bc value: 0ÈCºG× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620799507.123249 RegSetValueExA	key_handle: 0x000003bc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620799507.123249 RegSetValueExW	key_handle: 0x000003bc value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620799507.123249 RegSetValueExA	key_handle: 0x000003d4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620799507.123249 RegSetValueExA	key_handle: 0x000003d4 value: 0ÈCºG× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620799507.123249 RegSetValueExA	key_handle: 0x000003d4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620799507.123249 RegSetValueExW	key_handle: 0x000003b8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\userinit\PING.exe:Zone.Identifier

Generates some ICMP traffic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (6 个事件)

dead_host	192.158.216.73:80
dead_host	216.58.200.46:443
dead_host	162.241.242.173:8080
dead_host	172.217.24.14:443
dead_host	192.168.56.101:49187
dead_host	85.214.28.226:8080

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-05 01:07:32

Imports

Library KERNEL32.dll:

• 0x4340b4 GetFileTime

• 0x4340b8 GetTickCount

• 0x4340bc HeapFree

• 0x4340c0 RtlUnwind

• 0x4340c4 VirtualProtect

• 0x4340c8 VirtualAlloc

• 0x4340cc GetSystemInfo

• 0x4340d0 VirtualQuery

• 0x4340d4 HeapAlloc

• 0x4340d8 HeapReAlloc

• 0x4340dc GetCommandLineA

• 0x4340e0 GetProcessHeap

• 0x4340e4 GetStartupInfoA

• 0x4340e8 RaiseException

• 0x4340ec ExitProcess

• 0x4340f0 HeapSize

• 0x4340f4 HeapDestroy

• 0x4340f8 HeapCreate

• 0x4340fc VirtualFree

• 0x434100 TerminateProcess

• 0x434104 UnhandledExceptionFilter

• 0x434108 SetUnhandledExceptionFilter

• 0x43410c IsDebuggerPresent

• 0x434110 GetACP

• 0x434114 LCMapStringA

• 0x434118 GetFileAttributesA

• 0x43411c GetStdHandle

• 0x434120 Sleep

• 0x434124 FreeEnvironmentStringsA

• 0x434128 GetEnvironmentStrings

• 0x43412c FreeEnvironmentStringsW

• 0x434130 GetEnvironmentStringsW

• 0x434134 SetHandleCount

• 0x434138 GetFileType

• 0x43413c QueryPerformanceCounter

• 0x434140 GetSystemTimeAsFileTime

• 0x434144 GetStringTypeA

• 0x434148 GetStringTypeW

• 0x43414c GetTimeZoneInformation

• 0x434150 GetConsoleCP

• 0x434154 GetConsoleMode

• 0x434158 SetStdHandle

• 0x43415c WriteConsoleA

• 0x434160 GetConsoleOutputCP

• 0x434164 WriteConsoleW

• 0x434168 SetEnvironmentVariableA

• 0x43416c FileTimeToLocalFileTime

• 0x434170 SetErrorMode

• 0x434174 FileTimeToSystemTime

• 0x434178 GetOEMCP

• 0x43417c GetCPInfo

• 0x434180 CreateFileA

• 0x434184 GetFullPathNameA

• 0x434188 GetVolumeInformationA

• 0x43418c FindFirstFileA

• 0x434190 FindClose

• 0x434194 GetCurrentProcess

• 0x434198 DuplicateHandle

• 0x43419c GetThreadLocale

• 0x4341a0 GetFileSize

• 0x4341a4 SetEndOfFile

• 0x4341a8 UnlockFile

• 0x4341ac LockFile

• 0x4341b0 FlushFileBuffers

• 0x4341b4 SetFilePointer

• 0x4341b8 WriteFile

• 0x4341bc ReadFile

• 0x4341c0 GlobalFlags

• 0x4341c4 TlsFree

• 0x4341c8 DeleteCriticalSection

• 0x4341cc LocalReAlloc

• 0x4341d0 TlsSetValue

• 0x4341d4 TlsAlloc

• 0x4341d8 InitializeCriticalSection

• 0x4341dc GlobalHandle

• 0x4341e0 GlobalReAlloc

• 0x4341e4 EnterCriticalSection

• 0x4341e8 TlsGetValue

• 0x4341ec LeaveCriticalSection

• 0x4341f0 LocalAlloc

• 0x4341f4 InterlockedIncrement

• 0x4341f8 InterlockedDecrement

• 0x4341fc GetModuleFileNameW

• 0x434200 GlobalGetAtomNameA

• 0x434204 GlobalFindAtomA

• 0x434208 lstrcmpW

• 0x43420c GetVersionExA

• 0x434210 WritePrivateProfileStringA

• 0x434214 FreeResource

• 0x434218 GetCurrentProcessId

• 0x43421c GlobalAddAtomA

• 0x434220 CloseHandle

• 0x434224 GetCurrentThread

• 0x434228 GetCurrentThreadId

• 0x43422c ConvertDefaultLocale

• 0x434230 GetModuleFileNameA

• 0x434234 EnumResourceLanguagesA

• 0x434238 GetLocaleInfoA

• 0x43423c LoadLibraryA

• 0x434240 lstrcmpA

• 0x434244 FreeLibrary

• 0x434248 GlobalDeleteAtom

• 0x43424c GetModuleHandleA

• 0x434250 SetLastError

• 0x434254 GlobalFree

• 0x434258 GlobalAlloc

• 0x43425c GlobalLock

• 0x434260 GlobalUnlock

• 0x434264 FormatMessageA

• 0x434268 LocalFree

• 0x43426c MulDiv

• 0x434270 LoadResource

• 0x434274 LockResource

• 0x434278 SizeofResource

• 0x43427c FindResourceA

• 0x434280 LoadLibraryW

• 0x434284 GetProcAddress

• 0x434288 GetLastError

• 0x43428c lstrlenA

• 0x434290 WideCharToMultiByte

• 0x434294 CompareStringA

• 0x434298 CompareStringW

• 0x43429c MultiByteToWideChar

• 0x4342a0 GetVersion

• 0x4342a4 LCMapStringW

• 0x4342a8 InterlockedExchange

Library USER32.dll:

• 0x4342fc UnregisterClassA

• 0x434300 RegisterClipboardFormatA

• 0x434304 PostThreadMessageA

• 0x434308 ReleaseCapture

• 0x43430c SetCapture

• 0x434310 LoadCursorA

• 0x434314 GetSysColorBrush

• 0x434318 EndPaint

• 0x43431c BeginPaint

• 0x434320 GetWindowDC

• 0x434324 ReleaseDC

• 0x434328 GetDC

• 0x43432c ClientToScreen

• 0x434330 GrayStringA

• 0x434334 DrawTextExA

• 0x434338 DrawTextA

• 0x43433c TabbedTextOutA

• 0x434340 DestroyMenu

• 0x434344 ShowWindow

• 0x434348 MoveWindow

• 0x43434c SetWindowTextA

• 0x434350 IsDialogMessageA

• 0x434354 RegisterWindowMessageA

• 0x434358 SendDlgItemMessageA

• 0x43435c WinHelpA

• 0x434360 IsChild

• 0x434364 GetCapture

• 0x434368 GetClassLongA

• 0x43436c SetPropA

• 0x434370 GetPropA

• 0x434374 RemovePropA

• 0x434378 SetFocus

• 0x43437c GetWindowTextLengthA

• 0x434380 GetWindowTextA

• 0x434384 MessageBeep

• 0x434388 GetTopWindow

• 0x43438c UnhookWindowsHookEx

• 0x434390 GetMessageTime

• 0x434394 GetMessagePos

• 0x434398 MapWindowPoints

• 0x43439c SetForegroundWindow

• 0x4343a0 UpdateWindow

• 0x4343a4 GetMenu

• 0x4343a8 CreateWindowExA

• 0x4343ac GetClassInfoExA

• 0x4343b0 GetClassInfoA

• 0x4343b4 RegisterClassA

• 0x4343b8 GetSysColor

• 0x4343bc AdjustWindowRectEx

• 0x4343c0 EqualRect

• 0x4343c4 CopyRect

• 0x4343c8 PtInRect

• 0x4343cc GetDlgCtrlID

• 0x4343d0 DefWindowProcA

• 0x4343d4 CallWindowProcA

• 0x4343d8 SetWindowLongA

• 0x4343dc OffsetRect

• 0x4343e0 IntersectRect

• 0x4343e4 SystemParametersInfoA

• 0x4343e8 GetWindowPlacement

• 0x4343ec GetWindowRect

• 0x4343f0 GetWindow

• 0x4343f4 SetWindowContextHelpId

• 0x4343f8 MapDialogRect

• 0x4343fc SetWindowPos

• 0x434400 GetDesktopWindow

• 0x434404 CharUpperA

• 0x434408 EnableWindow

• 0x43440c LoadIconA

• 0x434410 SetActiveWindow

• 0x434414 CreateDialogIndirectParamA

• 0x434418 DestroyWindow

• 0x43441c IsWindow

• 0x434420 GetDlgItem

• 0x434424 GetNextDlgTabItem

• 0x434428 EndDialog

• 0x43442c GetWindowThreadProcessId

• 0x434430 GetWindowLongA

• 0x434434 GetLastActivePopup

• 0x434438 IsWindowEnabled

• 0x43443c MessageBoxA

• 0x434440 GetNextDlgGroupItem

• 0x434444 InvalidateRgn

• 0x434448 InvalidateRect

• 0x43444c SetRect

• 0x434450 IsRectEmpty

• 0x434454 SetCursor

• 0x434458 SetWindowsHookExA

• 0x43445c CopyAcceleratorTableA

• 0x434460 CharNextA

• 0x434464 GetForegroundWindow

• 0x434468 SendMessageA

• 0x43446c AppendMenuA

• 0x434470 GetSystemMenu

• 0x434474 DrawIcon

• 0x434478 GetClientRect

• 0x43447c GetSystemMetrics

• 0x434480 IsIconic

• 0x434484 GetSubMenu

• 0x434488 GetMenuItemCount

• 0x43448c GetMenuItemID

• 0x434490 GetMenuState

• 0x434494 PostQuitMessage

• 0x434498 PostMessageA

• 0x43449c CheckMenuItem

• 0x4344a0 EnableMenuItem

• 0x4344a4 ModifyMenuA

• 0x4344a8 GetParent

• 0x4344ac GetFocus

• 0x4344b0 LoadBitmapA

• 0x4344b4 GetMenuCheckMarkDimensions

• 0x4344b8 SetMenuItemBitmaps

• 0x4344bc ValidateRect

• 0x4344c0 GetCursorPos

• 0x4344c4 PeekMessageA

• 0x4344c8 GetKeyState

• 0x4344cc IsWindowVisible

• 0x4344d0 GetActiveWindow

• 0x4344d4 DispatchMessageA

• 0x4344d8 TranslateMessage

• 0x4344dc GetMessageA

• 0x4344e0 CallNextHookEx

• 0x4344e4 GetClassNameA

Library GDI32.dll:

• 0x434030 ScaleWindowExtEx

• 0x434034 ExtSelectClipRgn

• 0x434038 DeleteDC

• 0x43403c GetStockObject

• 0x434040 SetWindowExtEx

• 0x434044 GetBkColor

• 0x434048 GetTextColor

• 0x43404c CreateRectRgnIndirect

• 0x434050 GetRgnBox

• 0x434054 GetMapMode

• 0x434058 ScaleViewportExtEx

• 0x43405c SetViewportExtEx

• 0x434060 OffsetViewportOrgEx

• 0x434064 SetViewportOrgEx

• 0x434068 SelectObject

• 0x43406c Escape

• 0x434070 TextOutA

• 0x434074 RectVisible

• 0x434078 PtVisible

• 0x43407c GetDeviceCaps

• 0x434080 GetViewportExtEx

• 0x434084 DeleteObject

• 0x434088 SetMapMode

• 0x43408c RestoreDC

• 0x434090 SaveDC

• 0x434094 ExtTextOutA

• 0x434098 GetObjectA

• 0x43409c SetBkColor

• 0x4340a0 SetTextColor

• 0x4340a4 GetClipBox

• 0x4340a8 CreateBitmap

• 0x4340ac GetWindowExtEx

Library comdlg32.dll:

• 0x4344fc GetFileTitleA

Library WINSPOOL.DRV:

• 0x4344ec DocumentPropertiesA

• 0x4344f0 OpenPrinterA

• 0x4344f4 ClosePrinter

Library ADVAPI32.dll:

• 0x434000 RegOpenKeyExA

• 0x434004 RegQueryValueA

• 0x434008 RegEnumKeyA

• 0x43400c RegDeleteKeyA

• 0x434010 RegCloseKey

• 0x434014 RegOpenKeyA

• 0x434018 RegSetValueExA

• 0x43401c RegCreateKeyExA

• 0x434020 RegQueryValueExA

Library COMCTL32.dll:

• 0x434028

Library SHLWAPI.dll:

• 0x4342e8 PathFindFileNameA

• 0x4342ec PathStripToRootA

• 0x4342f0 PathFindExtensionA

• 0x4342f4 PathIsUNCA

Library oledlg.dll:

• 0x434544

Library ole32.dll:

• 0x434504 OleInitialize

• 0x434508 CoFreeUnusedLibraries

• 0x43450c OleUninitialize

• 0x434510 CreateILockBytesOnHGlobal

• 0x434514 StgCreateDocfileOnILockBytes

• 0x434518 StgOpenStorageOnILockBytes

• 0x43451c CoGetClassObject

• 0x434520 CLSIDFromString

• 0x434524 CoRevokeClassObject

• 0x434528 CoTaskMemAlloc

• 0x43452c CoTaskMemFree

• 0x434530 OleIsCurrentClipboard

• 0x434534 OleFlushClipboard

• 0x434538 CoRegisterMessageFilter

• 0x43453c CLSIDFromProgID

Library OLEAUT32.dll:

• 0x4342b0 SysAllocStringLen

• 0x4342b4 VariantClear

• 0x4342b8 VariantChangeType

• 0x4342bc VariantInit

• 0x4342c0 SysStringLen

• 0x4342c4 SysAllocStringByteLen

• 0x4342c8 OleCreateFontIndirect

• 0x4342cc VariantTimeToSystemTime

• 0x4342d0 SystemTimeToVariantTime

• 0x4342d4 SafeArrayDestroy

• 0x4342d8 SysAllocString

• 0x4342dc VariantCopy

• 0x4342e0 SysFreeString

Exports

Ordinal	Address	Name
1	0x401b20	UUACZDADWAJJJJJ

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 216.58.200.46 CNAME clients.l.google.com	172.217.161.174
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.41.98	203.208.50.98
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49189	142.44.137.67	443
192.168.56.101	49195	203.208.41.98 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	54260	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57236	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	58970	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://142.44.137.67:443/sCBOp4pXH/GO6JB1ZACfk/JikaBZVWIs1Ayb3A/pivi3M4q/	POST /sCBOp4pXH/GO6JB1ZACfk/JikaBZVWIs1Ayb3A/pivi3M4q/ HTTP/1.1 Content-Type: multipart/form-data; boundary=-------------izKr8SzWjq3Gd User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 142.44.137.67:443 Content-Length: 4532 Connection: Keep-Alive Cache-Control: no-cache

URI

Data

http://142.44.137.67:443/sCBOp4pXH/GO6JB1ZACfk/JikaBZVWIs1Ayb3A/pivi3M4q/

POST /sCBOp4pXH/GO6JB1ZACfk/JikaBZVWIs1Ayb3A/pivi3M4q/ HTTP/1.1
Content-Type: multipart/form-data; boundary=-------------izKr8SzWjq3Gd
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 142.44.137.67:443
Content-Length: 4532
Connection: Keep-Alive
Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.