SmartHawk

5.6

高危

55 个模型检测该样本为恶意！

重新分析

下载样本

91c195410f9100d9d92102829087bcfd011b5e07667f1d03dbf340d4671c1265

766963f23a59de5f3bda29b6ea5001e6.exe

分析耗时

75s

最近分析

文件大小

636.0KB

静态报毒动态报毒 100% AI SCORE=100 AIDETECTVM BANKERX CLASSIC CONFIDENCE DOWNLOADER33 ELDORADO EMOTET ENCPK FVS7R9N+EEG GENCIRC GENKRYPTIK HIGH CONFIDENCE HJRKDA KRYPTIK MALWARE2 MALWARE@#3LOVXN4LTAO73 R + MAL R336563 SCORE SRNWD SUSGEN TROJANBANKER UNSAFE ZENPAK ZUSY 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FQQ!766963F23A59	20201229	6.0.6.653
Alibaba	Backdoor:Win32/Emotet.066cc9b5	20190527	0.3.0.5
Avast	Win32:BankerX-gen [Trj]	20201229	21.1.5827.0
Baidu		20190318	1.0.0.2
Tencent	Malware.Win32.Gencirc.10b9ed33	20201229	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649244.390372 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619649230.968372 CryptGenKey	crypto_handle: 0x005c5028 algorithm_identifier: 0x0000660e () provider_handle: 0x005c4640 flags: 1 key: fKuq j çwý&@k	success	1
1619649244.530372 CryptExportKey	crypto_handle: 0x005c5028 crypto_export_handle: 0x005c4708 buffer: f¤a³ÃàÞoÇaÓÃâltR¸ë±½cØi^6ÉãmEÖQ»,JÂmÒÞø¾ãF¨ÇöjlËM$¿/J1~Â!@Ih"~ªêg«ªÿR3½ÈßôF-±H blob_type: 1 flags: 64	success	1
1619649280.171372 CryptExportKey	crypto_handle: 0x005c5028 crypto_export_handle: 0x005c4708 buffer: f¤ÔÐ(²Ð4ò1'Ö/çÒøÒ;ÆBUn¿ÁUÇ!³_ Y¤Ü´Ð_VQÙG¸Ô,bF´90Z5zÁ0¯ÚÆµXURªHöñ'L[ò?r0o blob_type: 1 flags: 64	success	1

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

AVI

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649223.812372 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00560000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649245.062372 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

766963f23a59de5f3bda29b6ea5001e6.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649244.749372 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	185.155.20.82
host	82.223.70.24

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619649247.624372 RegSetValueExA	key_handle: 0x000003c4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619649247.624372 RegSetValueExA	key_handle: 0x000003c4 value: @-n`<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619649247.624372 RegSetValueExA	key_handle: 0x000003c4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619649247.624372 RegSetValueExW	key_handle: 0x000003c4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619649247.624372 RegSetValueExA	key_handle: 0x000003dc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619649247.624372 RegSetValueExA	key_handle: 0x000003dc value: @-n`<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619649247.624372 RegSetValueExA	key_handle: 0x000003dc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619649247.671372 RegSetValueExW	key_handle: 0x000003c0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

185.155.20.82:80

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader33.37969
MicroWorld-eScan	Gen:Variant.Emotet.108
FireEye	Gen:Variant.Emotet.108
CAT-QuickHeal	Trojan.Emotet
Qihoo-360	Win32/Trojan.091
McAfee	Emotet-FQQ!766963F23A59
Cylance	Unsafe
K7AntiVirus	Trojan ( 005600f21 )
Alibaba	Backdoor:Win32/Emotet.066cc9b5
K7GW	Trojan ( 005600f21 )
Cybereason	malicious.23a59d
Arcabit	Trojan.Emotet.108
Cyren	W32/Zusy.EE.gen!Eldorado
Symantec	Packed.Generic.534
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
ClamAV	Win.Dropper.Emotet-7732306-0
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.gen
BitDefender	Gen:Variant.Emotet.108
NANO-Antivirus	Trojan.Win32.GenKryptik.hjrkda
Paloalto	generic.ml
AegisLab	Trojan.Win32.Emotet.L!c
Rising	Trojan.Kryptik!1.C80B (CLASSIC)
Ad-Aware	Gen:Variant.Emotet.108
Sophos	Mal/Generic-R + Mal/EncPk-APR
Comodo	Malware@#3lovxn4ltao73
F-Secure	Trojan.TR/AD.Emotet.srnwd
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.EMOTET.SMT.hp
McAfee-GW-Edition	BehavesLike.Win32.Emotet.jm
Emsisoft	Trojan.Emotet (A)
Jiangmin	Trojan.Zenpak.bpq
Webroot	W32.Trojan.Emotet
Avira	TR/AD.Emotet.srnwd
Antiy-AVL	Trojan/Win32.Zenpak
Microsoft	Trojan:Win32/Emotet.DEC!MTB
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.gen
GData	Gen:Variant.Emotet.108
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.RL_Emotet.R336563
VBA32	TrojanBanker.Emotet
MAX	malware (ai score=100)
Malwarebytes	Trojan.Emotet
ESET-NOD32	Win32/Emotet.CD
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.SMT.hp
Tencent	Malware.Win32.Gencirc.10b9ed33
Yandex	Trojan.Emotet!FvS7R9N+EEg
Ikarus	Trojan-Banker.Emotet

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-04-30 19:00:36

Imports

Library KERNEL32.dll:

• 0x4490d4 GetFileAttributesA

• 0x4490d8 GetFileTime

• 0x4490dc GetTickCount

• 0x4490e0 RtlUnwind

• 0x4490e4 RaiseException

• 0x4490e8 HeapAlloc

• 0x4490ec HeapFree

• 0x4490f0 HeapReAlloc

• 0x4490f4 VirtualProtect

• 0x4490f8 VirtualAlloc

• 0x4490fc GetSystemInfo

• 0x449100 VirtualQuery

• 0x449104 GetSystemTimeAsFileTime

• 0x449108 GetCommandLineA

• 0x44910c GetProcessHeap

• 0x449110 GetStartupInfoA

• 0x449114 ExitProcess

• 0x449118 HeapSize

• 0x44911c TerminateProcess

• 0x449120 UnhandledExceptionFilter

• 0x449124 SetUnhandledExceptionFilter

• 0x449128 IsDebuggerPresent

• 0x44912c Sleep

• 0x449130 GetACP

• 0x449134 VirtualFree

• 0x449138 HeapCreate

• 0x44913c GetStdHandle

• 0x449140 GetTimeZoneInformation

• 0x449144 FreeEnvironmentStringsA

• 0x449148 GetEnvironmentStrings

• 0x44914c FreeEnvironmentStringsW

• 0x449150 GetEnvironmentStringsW

• 0x449154 SetHandleCount

• 0x449158 GetFileType

• 0x44915c QueryPerformanceCounter

• 0x449160 GetStringTypeA

• 0x449164 GetStringTypeW

• 0x449168 GetConsoleCP

• 0x44916c GetConsoleMode

• 0x449170 LCMapStringA

• 0x449174 LCMapStringW

• 0x449178 GetUserDefaultLCID

• 0x44917c EnumSystemLocalesA

• 0x449180 IsValidLocale

• 0x449184 IsValidCodePage

• 0x449188 GetLocaleInfoW

• 0x44918c SetStdHandle

• 0x449190 WriteConsoleA

• 0x449194 GetConsoleOutputCP

• 0x449198 WriteConsoleW

• 0x44919c SetEnvironmentVariableA

• 0x4491a0 FileTimeToLocalFileTime

• 0x4491a4 SetErrorMode

• 0x4491a8 FileTimeToSystemTime

• 0x4491ac CreateFileA

• 0x4491b0 GetFullPathNameA

• 0x4491b4 GetVolumeInformationA

• 0x4491b8 FindFirstFileA

• 0x4491bc FindClose

• 0x4491c0 GetCurrentProcess

• 0x4491c4 DuplicateHandle

• 0x4491c8 GetThreadLocale

• 0x4491cc GetFileSize

• 0x4491d0 SetEndOfFile

• 0x4491d4 UnlockFile

• 0x4491d8 LockFile

• 0x4491dc FlushFileBuffers

• 0x4491e0 SetFilePointer

• 0x4491e4 WriteFile

• 0x4491e8 ReadFile

• 0x4491ec WritePrivateProfileStringA

• 0x4491f0 GetOEMCP

• 0x4491f4 GetCPInfo

• 0x4491f8 InterlockedIncrement

• 0x4491fc TlsFree

• 0x449200 DeleteCriticalSection

• 0x449204 LocalReAlloc

• 0x449208 TlsSetValue

• 0x44920c TlsAlloc

• 0x449210 InitializeCriticalSection

• 0x449214 GlobalHandle

• 0x449218 GlobalReAlloc

• 0x44921c EnterCriticalSection

• 0x449220 TlsGetValue

• 0x449224 LeaveCriticalSection

• 0x449228 LocalAlloc

• 0x44922c GlobalFlags

• 0x449230 InterlockedDecrement

• 0x449234 GetModuleFileNameW

• 0x449238 FormatMessageA

• 0x44923c LocalFree

• 0x449240 GetCurrentProcessId

• 0x449244 CloseHandle

• 0x449248 GetCurrentThread

• 0x44924c ConvertDefaultLocale

• 0x449250 EnumResourceLanguagesA

• 0x449254 GetLocaleInfoA

• 0x449258 lstrcmpA

• 0x44925c GlobalAlloc

• 0x449260 GetCurrentThreadId

• 0x449264 GlobalGetAtomNameA

• 0x449268 GlobalAddAtomA

• 0x44926c GlobalFindAtomA

• 0x449270 GlobalDeleteAtom

• 0x449274 FreeLibrary

• 0x449278 LoadLibraryA

• 0x44927c lstrcmpW

• 0x449280 GetVersionExA

• 0x449284 GlobalFree

• 0x449288 FreeResource

• 0x44928c GlobalLock

• 0x449290 GlobalUnlock

• 0x449294 MulDiv

• 0x449298 GetModuleHandleA

• 0x44929c GetProcAddress

• 0x4492a0 SetLastError

• 0x4492a4 lstrlenA

• 0x4492a8 CompareStringW

• 0x4492ac CompareStringA

• 0x4492b0 GetVersion

• 0x4492b4 GetLastError

• 0x4492b8 MultiByteToWideChar

• 0x4492bc InterlockedExchange

• 0x4492c0 GetModuleFileNameA

• 0x4492c4 LoadLibraryExW

• 0x4492c8 WideCharToMultiByte

• 0x4492cc FindResourceA

• 0x4492d0 LoadResource

• 0x4492d4 LockResource

• 0x4492d8 HeapDestroy

• 0x4492dc SizeofResource

Library USER32.dll:

• 0x449340 InflateRect

• 0x449344 GetMenuItemInfoA

• 0x449348 WindowFromPoint

• 0x44934c GetSysColorBrush

• 0x449350 LoadCursorA

• 0x449354 SetCapture

• 0x449358 IsRectEmpty

• 0x44935c CharNextA

• 0x449360 CopyAcceleratorTableA

• 0x449364 SetRect

• 0x449368 InvalidateRgn

• 0x44936c GetNextDlgGroupItem

• 0x449370 MessageBeep

• 0x449374 UnregisterClassA

• 0x449378 RegisterClipboardFormatA

• 0x44937c PostThreadMessageA

• 0x449380 BringWindowToTop

• 0x449384 SetMenu

• 0x449388 TranslateAcceleratorA

• 0x44938c GetWindowThreadProcessId

• 0x449390 ShowOwnedPopups

• 0x449394 SetCursor

• 0x449398 GetMessageA

• 0x44939c TranslateMessage

• 0x4493a0 ValidateRect

• 0x4493a4 PostQuitMessage

• 0x4493a8 ShowWindow

• 0x4493ac MoveWindow

• 0x4493b0 SetWindowTextA

• 0x4493b4 IsDialogMessageA

• 0x4493b8 SetMenuItemBitmaps

• 0x4493bc GetMenuCheckMarkDimensions

• 0x4493c0 LoadBitmapA

• 0x4493c4 ModifyMenuA

• 0x4493c8 GetMenuState

• 0x4493cc EnableMenuItem

• 0x4493d0 CheckMenuItem

• 0x4493d4 RegisterWindowMessageA

• 0x4493d8 SendDlgItemMessageA

• 0x4493dc WinHelpA

• 0x4493e0 IsChild

• 0x4493e4 GetCapture

• 0x4493e8 CallNextHookEx

• 0x4493ec GetClassLongA

• 0x4493f0 GetClassNameA

• 0x4493f4 SetPropA

• 0x4493f8 GetPropA

• 0x4493fc RemovePropA

• 0x449400 SetFocus

• 0x449404 GetWindowTextLengthA

• 0x449408 GetForegroundWindow

• 0x44940c GetLastActivePopup

• 0x449410 DispatchMessageA

• 0x449414 BeginDeferWindowPos

• 0x449418 EndDeferWindowPos

• 0x44941c GetTopWindow

• 0x449420 UnhookWindowsHookEx

• 0x449424 GetMessageTime

• 0x449428 GetMessagePos

• 0x44942c PeekMessageA

• 0x449430 MapWindowPoints

• 0x449434 GetKeyState

• 0x449438 IsWindowVisible

• 0x44943c UpdateWindow

• 0x449440 GetMenu

• 0x449444 GetMenuItemCount

• 0x449448 MessageBoxA

• 0x44944c CreateWindowExA

• 0x449450 GetClassInfoExA

• 0x449454 GetClassInfoA

• 0x449458 RegisterClassA

• 0x44945c AdjustWindowRectEx

• 0x449460 EqualRect

• 0x449464 DeferWindowPos

• 0x449468 CopyRect

• 0x44946c PtInRect

• 0x449470 GetDlgCtrlID

• 0x449474 DefWindowProcA

• 0x449478 CallWindowProcA

• 0x44947c OffsetRect

• 0x449480 IntersectRect

• 0x449484 GetWindowPlacement

• 0x449488 GetWindowRect

• 0x44948c GetWindow

• 0x449490 GetDesktopWindow

• 0x449494 GetActiveWindow

• 0x449498 SetActiveWindow

• 0x44949c CreateDialogIndirectParamA

• 0x4494a0 EnableWindow

• 0x4494a4 DrawIcon

• 0x4494a8 AppendMenuA

• 0x4494ac SendMessageA

• 0x4494b0 PostMessageA

• 0x4494b4 GetSystemMenu

• 0x4494b8 DestroyWindow

• 0x4494bc IsWindow

• 0x4494c0 GetDlgItem

• 0x4494c4 IsWindowEnabled

• 0x4494c8 GetParent

• 0x4494cc GetNextDlgTabItem

• 0x4494d0 EndDialog

• 0x4494d4 GetSysColor

• 0x4494d8 EndPaint

• 0x4494dc BeginPaint

• 0x4494e0 GetWindowDC

• 0x4494e4 ClientToScreen

• 0x4494e8 ScreenToClient

• 0x4494ec SetWindowContextHelpId

• 0x4494f0 MapDialogRect

• 0x4494f4 UnpackDDElParam

• 0x4494f8 ReuseDDElParam

• 0x4494fc DestroyMenu

• 0x449500 ReleaseCapture

• 0x449504 LoadAcceleratorsA

• 0x449508 InvalidateRect

• 0x44950c InsertMenuItemA

• 0x449510 CreatePopupMenu

• 0x449514 GetFocus

• 0x449518 SetRectEmpty

• 0x44951c IsIconic

• 0x449520 GetClientRect

• 0x449524 FindWindowExA

• 0x449528 LoadIconA

• 0x44952c GetSystemMetrics

• 0x449530 ShowCursor

• 0x449534 SystemParametersInfoA

• 0x449538 UnregisterHotKey

• 0x44953c RegisterHotKey

• 0x449540 GetWindowTextA

• 0x449544 SetWindowPos

• 0x449548 SetWindowLongA

• 0x44954c GetWindowLongA

• 0x449550 ReleaseDC

• 0x449554 GetDC

• 0x449558 HideCaret

• 0x44955c CharUpperA

• 0x449560 GetMenuItemID

• 0x449564 GetSubMenu

• 0x449568 LoadMenuA

• 0x44956c KillTimer

• 0x449570 SetForegroundWindow

• 0x449574 SetMenuDefaultItem

• 0x449578 TrackPopupMenu

• 0x44957c GetCursorPos

• 0x449580 FillRect

• 0x449584 TabbedTextOutA

• 0x449588 DrawTextA

• 0x44958c DrawTextExA

• 0x449590 GrayStringA

• 0x449594 SetWindowsHookExA

Library GDI32.dll:

• 0x449028 ExtSelectClipRgn

• 0x44902c DeleteDC

• 0x449030 CreatePatternBrush

• 0x449034 CreateBitmap

• 0x449038 CreateCompatibleDC

• 0x44903c GetStockObject

• 0x449040 CreateCompatibleBitmap

• 0x449044 CreateFontIndirectA

• 0x449048 GetTextExtentPoint32A

• 0x44904c CreateRectRgnIndirect

• 0x449050 GetMapMode

• 0x449054 GetBkColor

• 0x449058 GetTextColor

• 0x44905c GetRgnBox

• 0x449060 ScaleWindowExtEx

• 0x449064 SetWindowExtEx

• 0x449068 ScaleViewportExtEx

• 0x44906c SetViewportExtEx

• 0x449070 OffsetViewportOrgEx

• 0x449074 SetViewportOrgEx

• 0x449078 SelectObject

• 0x44907c Escape

• 0x449080 CreateSolidBrush

• 0x449084 TextOutA

• 0x449088 RectVisible

• 0x44908c PtVisible

• 0x449090 GetPixel

• 0x449094 BitBlt

• 0x449098 GetWindowExtEx

• 0x44909c GetViewportExtEx

• 0x4490a0 GetObjectA

• 0x4490a4 DeleteObject

• 0x4490a8 GetClipBox

• 0x4490ac SetMapMode

• 0x4490b0 SetTextColor

• 0x4490b4 SetBkMode

• 0x4490b8 SetBkColor

• 0x4490bc RestoreDC

• 0x4490c0 SaveDC

• 0x4490c4 GetDeviceCaps

• 0x4490c8 CreateFontA

• 0x4490cc ExtTextOutA

Library comdlg32.dll:

• 0x4495ac GetFileTitleA

Library WINSPOOL.DRV:

• 0x44959c DocumentPropertiesA

• 0x4495a0 OpenPrinterA

• 0x4495a4 ClosePrinter

Library ADVAPI32.dll:

• 0x449000 RegQueryValueA

• 0x449004 RegOpenKeyA

• 0x449008 RegEnumKeyA

• 0x44900c RegDeleteKeyA

• 0x449010 RegOpenKeyExA

• 0x449014 RegQueryValueExA

• 0x449018 RegCreateKeyExA

• 0x44901c RegSetValueExA

• 0x449020 RegCloseKey

Library SHELL32.dll:

• 0x44931c DragFinish

• 0x449320 DragQueryFileA

• 0x449324 Shell_NotifyIconA

Library SHLWAPI.dll:

• 0x44932c PathFindFileNameA

• 0x449330 PathStripToRootA

• 0x449334 PathFindExtensionA

• 0x449338 PathIsUNCA

Library oledlg.dll:

• 0x4495f4

Library ole32.dll:

• 0x4495b4 OleInitialize

• 0x4495b8 CoFreeUnusedLibraries

• 0x4495bc OleUninitialize

• 0x4495c0 CreateILockBytesOnHGlobal

• 0x4495c4 StgCreateDocfileOnILockBytes

• 0x4495c8 StgOpenStorageOnILockBytes

• 0x4495cc CoGetClassObject

• 0x4495d0 CoRevokeClassObject

• 0x4495d4 CoTaskMemFree

• 0x4495d8 CLSIDFromString

• 0x4495dc CLSIDFromProgID

• 0x4495e0 OleIsCurrentClipboard

• 0x4495e4 OleFlushClipboard

• 0x4495e8 CoRegisterMessageFilter

• 0x4495ec CoTaskMemAlloc

Library OLEAUT32.dll:

• 0x4492e4 SystemTimeToVariantTime

• 0x4492e8 VariantClear

• 0x4492ec VariantChangeType

• 0x4492f0 VariantInit

• 0x4492f4 SysAllocStringLen

• 0x4492f8 SysFreeString

• 0x4492fc SysStringLen

• 0x449300 SysAllocStringByteLen

• 0x449304 OleCreateFontIndirect

• 0x449308 SafeArrayDestroy

• 0x44930c SysAllocString

• 0x449310 VariantCopy

• 0x449314 VariantTimeToSystemTime

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.