SmartHawk

11.8

0-day

60 个模型检测该样本为恶意！

重新分析

下载样本

ccef9d82eacf2aff22f807f7c533e7e19024fa0b9ed083426cea8dc083024c00

76f7b11f75484344911eb4846f52ad40.exe

分析耗时

75s

最近分析

文件大小

754.0KB

静态报毒动态报毒 100% AGEN AGENSLA AI SCORE=82 AIDETECTVM ALI2000015 AUTO CLASSIC CONFIDENCE DELFINJECT DELPHILESS EESQ ELJN EOBX FAREIT GENETIC HIGH CONFIDENCE HIKGJJ KPOT LOKI LOKIBOT MALICIOUS PE MALWARE2 PUTTY QVM05 R + MAL RNNS SCORE SIGGEN2 SMDF SUSGEN TROJANPWS UNSAFE VGW@ACZVHUOI WACATAC X2059 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FRQ!76F7B11F7548	20201029	6.0.6.653
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201029	18.4.3895.0
Tencent	Win32.Backdoor.Fareit.Auto	20201029	1.0.0.1
Kingsoft		20201029	2013.8.14.323
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619663715.801626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619663721.613626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619663726.894626 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619663713.082626 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (6 个事件)

Time & API	Arguments	Status
1619649225.495343 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a0000	success
1619649226.558343 NtAllocateVirtualMemory	process_identifier: 364 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e20000	success
1619649226.558343 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e50000	success
1619663710.270249 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d0000	success
1619663711.083249 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x004f0000	success
1619663711.083249 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00520000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nesy.vbs

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.147338382433993

section

{'size_of_data': '0x00025e00', 'virtual_address': '0x0009c000', 'entropy': 7.147338382433993, 'name': '.rsrc', 'virtual_size': '0x00025c24'}

description

A section with a high entropy has been found

entropy

0.20119521912350596

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619663721.488626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (3 个事件)

host	116.11.67.6
host	172.217.24.14
host	85.204.116.216

Creates an Alternate Data Stream (ADS) (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\smgy\psou.exe:ZoneIdentifier

Installs itself for autorun at Windows startup (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nesy.vbs

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\smgy\psou.exe

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2340 called NtSetContextThread to modify thread in remote process 2256
1619663711.286249 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2256	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2340 resumed a thread in remote process 2256
1619663711.833249 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 2256	success	0	0

Executed a process and injected code into it, probably while unpacking (8 个事件)

Time & API	Arguments	Status	Return
1619649227.277343 CreateProcessInternalW	thread_identifier: 428 thread_handle: 0x00000108 process_identifier: 2340 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\smgy\psou.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\smgy\psou.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000100 inherit_handles: 0	success	1
1619663711.192249 CreateProcessInternalW	thread_identifier: 3064 thread_handle: 0x00000100 process_identifier: 2256 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\smgy\psou.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000108 inherit_handles: 0	success	1
1619663711.192249 NtUnmapViewOfSection	process_identifier: 2256 region_size: 4096 process_handle: 0x00000108 base_address: 0x00400000	success	0
1619663711.192249 NtMapViewOfSection	section_handle: 0x00000110 process_identifier: 2256 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000108 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619663711.270249 NtGetContextThread	thread_handle: 0x00000100	success	0
1619663711.286249 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2256	success	0
1619663711.833249 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 2256	success	0
1619663713.754626 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2256	success	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Agent.EOBX
FireEye	Generic.mg.76f7b11f75484344
CAT-QuickHeal	Trojanpws.Agensla
McAfee	Fareit-FRQ!76F7B11F7548
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.697670
Sangfor	Malware
K7AntiVirus	Trojan ( 005640bd1 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Trojan ( 005640bd1 )
Cybereason	malicious.73995f
Arcabit	Trojan.Agent.EOBX
Invincea	Mal/Generic-R + Mal/Fareit-V
Cyren	W32/Trojan.RNNS-5963
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan-PSW.Win32.Agensla.gen
BitDefender	Trojan.Agent.EOBX
NANO-Antivirus	Trojan.Win32.Agensla.hikgjj
Paloalto	generic.ml
Tencent	Win32.Backdoor.Fareit.Auto
Ad-Aware	Trojan.Agent.EOBX
Sophos	Mal/Fareit-V
F-Secure	Heuristic.HEUR/AGEN.1133569
DrWeb	Trojan.PWS.Siggen2.46371
VIPRE	Win32.Malware!Drop
TrendMicro	TrojanSpy.Win32.LOKI.SMDF.hp
McAfee-GW-Edition	BehavesLike.Win32.Fareit.bh
Emsisoft	Trojan.Agent.EOBX (B)
SentinelOne	DFI - Malicious PE
Jiangmin	Trojan.PSW.Agensla.fm
eGambit	Unsafe.AI_Score_98%
Avira	HEUR/AGEN.1133569
Antiy-AVL	Trojan[PSW]/Win32.Agensla
Gridinsoft	Trojan.Win32.Agent.vb
Microsoft	Trojan:Win32/Kpot.PA!MTB
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan-PSW.Win32.Agensla.gen
GData	Trojan.Agent.EOBX
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2059
BitDefenderTheta	Gen:NN.ZelphiF.34590.VGW@aCZVHuoi
ALYac	Spyware.LokiBot
MAX	malware (ai score=82)
VBA32	Trojan.Wacatac
Malwarebytes	Trojan.MalPack.DLF
ESET-NOD32	a variant of Win32/Injector.ELJN

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x48e168 DeleteCriticalSection

• 0x48e16c LeaveCriticalSection

• 0x48e170 EnterCriticalSection

• 0x48e174 InitializeCriticalSection

• 0x48e178 VirtualFree

• 0x48e17c VirtualAlloc

• 0x48e180 LocalFree

• 0x48e184 LocalAlloc

• 0x48e188 GetVersion

• 0x48e18c GetCurrentThreadId

• 0x48e190 InterlockedDecrement

• 0x48e194 InterlockedIncrement

• 0x48e198 VirtualQuery

• 0x48e19c WideCharToMultiByte

• 0x48e1a0 MultiByteToWideChar

• 0x48e1a4 lstrlenA

• 0x48e1a8 lstrcpynA

• 0x48e1ac LoadLibraryExA

• 0x48e1b0 GetThreadLocale

• 0x48e1b4 GetStartupInfoA

• 0x48e1b8 GetProcAddress

• 0x48e1bc GetModuleHandleA

• 0x48e1c0 GetModuleFileNameA

• 0x48e1c4 GetLocaleInfoA

• 0x48e1c8 GetCommandLineA

• 0x48e1cc FreeLibrary

• 0x48e1d0 FindFirstFileA

• 0x48e1d4 FindClose

• 0x48e1d8 ExitProcess

• 0x48e1dc ExitThread

• 0x48e1e0 CreateThread

• 0x48e1e4 WriteFile

• 0x48e1e8 UnhandledExceptionFilter

• 0x48e1ec RtlUnwind

• 0x48e1f0 RaiseException

• 0x48e1f4 GetStdHandle

Library user32.dll:

• 0x48e1fc GetKeyboardType

• 0x48e200 LoadStringA

• 0x48e204 MessageBoxA

• 0x48e208 CharNextA

Library advapi32.dll:

• 0x48e210 RegQueryValueExA

• 0x48e214 RegOpenKeyExA

• 0x48e218 RegCloseKey

Library oleaut32.dll:

• 0x48e220 SysFreeString

• 0x48e224 SysReAllocStringLen

• 0x48e228 SysAllocStringLen

Library kernel32.dll:

• 0x48e230 TlsSetValue

• 0x48e234 TlsGetValue

• 0x48e238 LocalAlloc

• 0x48e23c GetModuleHandleA

Library advapi32.dll:

• 0x48e244 RegQueryValueExA

• 0x48e248 RegOpenKeyExA

• 0x48e24c RegCloseKey

Library kernel32.dll:

• 0x48e254 lstrlenA

• 0x48e258 lstrcpyA

• 0x48e25c lstrcmpA

• 0x48e260 WriteFile

• 0x48e264 WaitForSingleObject

• 0x48e268 WaitForMultipleObjects

• 0x48e26c VirtualQuery

• 0x48e270 VirtualFree

• 0x48e274 VirtualAllocEx

• 0x48e278 VirtualAlloc

• 0x48e27c Sleep

• 0x48e280 SizeofResource

• 0x48e284 SetThreadLocale

• 0x48e288 SetFilePointer

• 0x48e28c SetEvent

• 0x48e290 SetErrorMode

• 0x48e294 SetEndOfFile

• 0x48e298 SetCurrentDirectoryA

• 0x48e29c ResumeThread

• 0x48e2a0 ResetEvent

• 0x48e2a4 ReleaseMutex

• 0x48e2a8 ReadFile

• 0x48e2ac MultiByteToWideChar

• 0x48e2b0 MulDiv

• 0x48e2b4 LockResource

• 0x48e2b8 LoadResource

• 0x48e2bc LoadLibraryA

• 0x48e2c0 LeaveCriticalSection

• 0x48e2c4 InitializeCriticalSection

• 0x48e2c8 GlobalUnlock

• 0x48e2cc GlobalReAlloc

• 0x48e2d0 GlobalHandle

• 0x48e2d4 GlobalLock

• 0x48e2d8 GlobalFree

• 0x48e2dc GlobalFindAtomA

• 0x48e2e0 GlobalDeleteAtom

• 0x48e2e4 GlobalAlloc

• 0x48e2e8 GlobalAddAtomA

• 0x48e2ec GetVersionExA

• 0x48e2f0 GetVersion

• 0x48e2f4 GetTickCount

• 0x48e2f8 GetThreadLocale

• 0x48e2fc GetSystemInfo

• 0x48e300 GetStringTypeExA

• 0x48e304 GetStdHandle

• 0x48e308 GetProcAddress

• 0x48e30c GetModuleHandleA

• 0x48e310 GetModuleFileNameA

• 0x48e314 GetLocaleInfoA

• 0x48e318 GetLocalTime

• 0x48e31c GetLastError

• 0x48e320 GetFullPathNameA

• 0x48e324 GetExitCodeThread

• 0x48e328 GetDiskFreeSpaceA

• 0x48e32c GetDateFormatA

• 0x48e330 GetCurrentThreadId

• 0x48e334 GetCurrentProcessId

• 0x48e338 GetCurrentProcess

• 0x48e33c GetCurrentDirectoryA

• 0x48e340 GetCPInfo

• 0x48e344 GetACP

• 0x48e348 FreeResource

• 0x48e34c InterlockedIncrement

• 0x48e350 InterlockedExchange

• 0x48e354 InterlockedDecrement

• 0x48e358 FreeLibrary

• 0x48e35c FormatMessageA

• 0x48e360 FindResourceA

• 0x48e364 FindNextChangeNotification

• 0x48e368 FindFirstFileA

• 0x48e36c FindFirstChangeNotificationA

• 0x48e370 FindCloseChangeNotification

• 0x48e374 FindClose

• 0x48e378 FileTimeToLocalFileTime

• 0x48e37c FileTimeToDosDateTime

• 0x48e380 EnumCalendarInfoA

• 0x48e384 EnterCriticalSection

• 0x48e388 DeleteCriticalSection

• 0x48e38c CreateThread

• 0x48e390 CreateMutexA

• 0x48e394 CreateFileA

• 0x48e398 CreateEventA

• 0x48e39c CompareStringA

• 0x48e3a0 CloseHandle

Library version.dll:

• 0x48e3a8 VerQueryValueA

• 0x48e3ac GetFileVersionInfoSizeA

• 0x48e3b0 GetFileVersionInfoA

Library gdi32.dll:

• 0x48e3b8 UnrealizeObject

• 0x48e3bc StretchBlt

• 0x48e3c0 SetWindowOrgEx

• 0x48e3c4 SetViewportOrgEx

• 0x48e3c8 SetTextColor

• 0x48e3cc SetStretchBltMode

• 0x48e3d0 SetROP2

• 0x48e3d4 SetPixel

• 0x48e3d8 SetDIBColorTable

• 0x48e3dc SetBrushOrgEx

• 0x48e3e0 SetBkMode

• 0x48e3e4 SetBkColor

• 0x48e3e8 SelectPalette

• 0x48e3ec SelectObject

• 0x48e3f0 SaveDC

• 0x48e3f4 RestoreDC

• 0x48e3f8 Rectangle

• 0x48e3fc RectVisible

• 0x48e400 RealizePalette

• 0x48e404 PatBlt

• 0x48e408 MoveToEx

• 0x48e40c MaskBlt

• 0x48e410 LineTo

• 0x48e414 IntersectClipRect

• 0x48e418 GetWindowOrgEx

• 0x48e41c GetTextMetricsA

• 0x48e420 GetTextExtentPoint32A

• 0x48e424 GetSystemPaletteEntries

• 0x48e428 GetStockObject

• 0x48e42c GetPixel

• 0x48e430 GetPaletteEntries

• 0x48e434 GetObjectA

• 0x48e438 GetDeviceCaps

• 0x48e43c GetDIBits

• 0x48e440 GetDIBColorTable

• 0x48e444 GetDCOrgEx

• 0x48e448 GetCurrentPositionEx

• 0x48e44c GetClipBox

• 0x48e450 GetBrushOrgEx

• 0x48e454 GetBitmapBits

• 0x48e458 ExtTextOutA

• 0x48e45c ExcludeClipRect

• 0x48e460 DeleteObject

• 0x48e464 DeleteDC

• 0x48e468 CreateSolidBrush

• 0x48e46c CreatePenIndirect

• 0x48e470 CreatePalette

• 0x48e474 CreateHalftonePalette

• 0x48e478 CreateFontIndirectA

• 0x48e47c CreateDIBitmap

• 0x48e480 CreateDIBSection

• 0x48e484 CreateCompatibleDC

• 0x48e488 CreateCompatibleBitmap

• 0x48e48c CreateBrushIndirect

• 0x48e490 CreateBitmap

• 0x48e494 BitBlt

Library user32.dll:

• 0x48e49c CreateWindowExA

• 0x48e4a0 WindowFromPoint

• 0x48e4a4 WinHelpA

• 0x48e4a8 WaitMessage

• 0x48e4ac UpdateWindow

• 0x48e4b0 UnregisterClassA

• 0x48e4b4 UnhookWindowsHookEx

• 0x48e4b8 TranslateMessage

• 0x48e4bc TranslateMDISysAccel

• 0x48e4c0 TrackPopupMenu

• 0x48e4c4 SystemParametersInfoA

• 0x48e4c8 ShowWindow

• 0x48e4cc ShowScrollBar

• 0x48e4d0 ShowOwnedPopups

• 0x48e4d4 ShowCursor

• 0x48e4d8 SetWindowsHookExA

• 0x48e4dc SetWindowTextA

• 0x48e4e0 SetWindowPos

• 0x48e4e4 SetWindowPlacement

• 0x48e4e8 SetWindowLongA

• 0x48e4ec SetTimer

• 0x48e4f0 SetScrollRange

• 0x48e4f4 SetScrollPos

• 0x48e4f8 SetScrollInfo

• 0x48e4fc SetRect

• 0x48e500 SetPropA

• 0x48e504 SetParent

• 0x48e508 SetMenuItemInfoA

• 0x48e50c SetMenu

• 0x48e510 SetForegroundWindow

• 0x48e514 SetFocus

• 0x48e518 SetCursor

• 0x48e51c SetClassLongA

• 0x48e520 SetCapture

• 0x48e524 SetActiveWindow

• 0x48e528 SendMessageA

• 0x48e52c ScrollWindow

• 0x48e530 ScreenToClient

• 0x48e534 RemovePropA

• 0x48e538 RemoveMenu

• 0x48e53c ReleaseDC

• 0x48e540 ReleaseCapture

• 0x48e544 RegisterWindowMessageA

• 0x48e548 RegisterClipboardFormatA

• 0x48e54c RegisterClassA

• 0x48e550 RedrawWindow

• 0x48e554 PtInRect

• 0x48e558 PostQuitMessage

• 0x48e55c PostMessageA

• 0x48e560 PeekMessageA

• 0x48e564 OffsetRect

• 0x48e568 OemToCharA

• 0x48e56c MsgWaitForMultipleObjects

• 0x48e570 MessageBoxA

• 0x48e574 MapWindowPoints

• 0x48e578 MapVirtualKeyA

• 0x48e57c LoadStringA

• 0x48e580 LoadKeyboardLayoutA

• 0x48e584 LoadIconA

• 0x48e588 LoadCursorA

• 0x48e58c LoadBitmapA

• 0x48e590 KillTimer

• 0x48e594 IsZoomed

• 0x48e598 IsWindowVisible

• 0x48e59c IsWindowEnabled

• 0x48e5a0 IsWindow

• 0x48e5a4 IsRectEmpty

• 0x48e5a8 IsIconic

• 0x48e5ac IsDialogMessageA

• 0x48e5b0 IsChild

• 0x48e5b4 InvalidateRect

• 0x48e5b8 IntersectRect

• 0x48e5bc InsertMenuItemA

• 0x48e5c0 InsertMenuA

• 0x48e5c4 InflateRect

• 0x48e5c8 GetWindowThreadProcessId

• 0x48e5cc GetWindowTextA

• 0x48e5d0 GetWindowRect

• 0x48e5d4 GetWindowPlacement

• 0x48e5d8 GetWindowLongA

• 0x48e5dc GetWindowDC

• 0x48e5e0 GetTopWindow

• 0x48e5e4 GetSystemMetrics

• 0x48e5e8 GetSystemMenu

• 0x48e5ec GetSysColorBrush

• 0x48e5f0 GetSysColor

• 0x48e5f4 GetSubMenu

• 0x48e5f8 GetScrollRange

• 0x48e5fc GetScrollPos

• 0x48e600 GetScrollInfo

• 0x48e604 GetPropA

• 0x48e608 GetParent

• 0x48e60c GetWindow

• 0x48e610 GetMessagePos

• 0x48e614 GetMenuStringA

• 0x48e618 GetMenuState

• 0x48e61c GetMenuItemInfoA

• 0x48e620 GetMenuItemID

• 0x48e624 GetMenuItemCount

• 0x48e628 GetMenu

• 0x48e62c GetLastActivePopup

• 0x48e630 GetKeyboardState

• 0x48e634 GetKeyboardLayoutList

• 0x48e638 GetKeyboardLayout

• 0x48e63c GetKeyState

• 0x48e640 GetKeyNameTextA

• 0x48e644 GetIconInfo

• 0x48e648 GetForegroundWindow

• 0x48e64c GetFocus

• 0x48e650 GetDesktopWindow

• 0x48e654 GetDCEx

• 0x48e658 GetDC

• 0x48e65c GetCursorPos

• 0x48e660 GetCursor

• 0x48e664 GetClientRect

• 0x48e668 GetClassNameA

• 0x48e66c GetClassInfoA

• 0x48e670 GetCapture

• 0x48e674 GetActiveWindow

• 0x48e678 FrameRect

• 0x48e67c FindWindowA

• 0x48e680 FillRect

• 0x48e684 EqualRect

• 0x48e688 EnumWindows

• 0x48e68c EnumThreadWindows

• 0x48e690 EndPaint

• 0x48e694 EnableWindow

• 0x48e698 EnableScrollBar

• 0x48e69c EnableMenuItem

• 0x48e6a0 DrawTextA

• 0x48e6a4 DrawMenuBar

• 0x48e6a8 DrawIconEx

• 0x48e6ac DrawIcon

• 0x48e6b0 DrawFrameControl

• 0x48e6b4 DrawEdge

• 0x48e6b8 DispatchMessageA

• 0x48e6bc DestroyWindow

• 0x48e6c0 DestroyMenu

• 0x48e6c4 DestroyIcon

• 0x48e6c8 DestroyCursor

• 0x48e6cc DeleteMenu

• 0x48e6d0 DefWindowProcA

• 0x48e6d4 DefMDIChildProcA

• 0x48e6d8 DefFrameProcA

• 0x48e6dc CreatePopupMenu

• 0x48e6e0 CreateMenu

• 0x48e6e4 CreateIcon

• 0x48e6e8 ClientToScreen

• 0x48e6ec ChildWindowFromPoint

• 0x48e6f0 CheckMenuItem

• 0x48e6f4 CallWindowProcA

• 0x48e6f8 CallNextHookEx

• 0x48e6fc BeginPaint

• 0x48e700 CharNextA

• 0x48e704 CharLowerA

• 0x48e708 CharUpperBuffA

• 0x48e70c CharToOemA

• 0x48e710 AdjustWindowRectEx

• 0x48e714 ActivateKeyboardLayout

Library kernel32.dll:

• 0x48e71c Sleep

Library oleaut32.dll:

• 0x48e724 SafeArrayPtrOfIndex

• 0x48e728 SafeArrayPutElement

• 0x48e72c SafeArrayGetElement

• 0x48e730 SafeArrayUnaccessData

• 0x48e734 SafeArrayAccessData

• 0x48e738 SafeArrayGetUBound

• 0x48e73c SafeArrayGetLBound

• 0x48e740 SafeArrayCreate

• 0x48e744 VariantChangeType

• 0x48e748 VariantCopyInd

• 0x48e74c VariantCopy

• 0x48e750 VariantClear

• 0x48e754 VariantInit

Library ole32.dll:

• 0x48e75c OleUninitialize

• 0x48e760 OleInitialize

• 0x48e764 CoTaskMemAlloc

• 0x48e768 CoCreateInstance

• 0x48e76c CoUninitialize

• 0x48e770 CoInitialize

Library oleaut32.dll:

• 0x48e778 CreateErrorInfo

• 0x48e77c GetErrorInfo

• 0x48e780 SetErrorInfo

• 0x48e784 SysFreeString

Library comctl32.dll:

• 0x48e78c ImageList_SetIconSize

• 0x48e790 ImageList_GetIconSize

• 0x48e794 ImageList_Write

• 0x48e798 ImageList_Read

• 0x48e79c ImageList_GetDragImage

• 0x48e7a0 ImageList_DragShowNolock

• 0x48e7a4 ImageList_SetDragCursorImage

• 0x48e7a8 ImageList_DragMove

• 0x48e7ac ImageList_DragLeave

• 0x48e7b0 ImageList_DragEnter

• 0x48e7b4 ImageList_EndDrag

• 0x48e7b8 ImageList_BeginDrag

• 0x48e7bc ImageList_Remove

• 0x48e7c0 ImageList_DrawEx

• 0x48e7c4 ImageList_Draw

• 0x48e7c8 ImageList_GetBkColor

• 0x48e7cc ImageList_SetBkColor

• 0x48e7d0 ImageList_ReplaceIcon

• 0x48e7d4 ImageList_Add

• 0x48e7d8 ImageList_GetImageCount

• 0x48e7dc ImageList_Destroy

• 0x48e7e0 ImageList_Create

• 0x48e7e4 InitCommonControls

Library shell32.dll:

• 0x48e7ec ShellExecuteExA

• 0x48e7f0 ShellExecuteA

• 0x48e7f4 SHGetFileInfoA

Library shell32.dll:

• 0x48e7fc SHGetSpecialFolderLocation

• 0x48e800 SHGetMalloc

• 0x48e804 SHGetDesktopFolder

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
bibpap.com
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
85.204.116.216	443	192.168.56.101	49180

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.