SmartHawk

5.6

高危

5 个模型检测该样本为恶意！

重新分析

下载样本

1c780082a25731028b03a1c78c4a164c44c6d1322a007952097c41ce80c7a33d

787fc60b822e55b7d71b9f43b0f644f9.exe

分析耗时

84s

最近分析

文件大小

412.7KB

静态报毒动态报毒 BACS@6KP8UA CONFIDENCE CONVERTAD GENERIC ML PUA MAILRU SUSPICIOUS PE

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee		20200906	6.0.6.653
Alibaba		20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast		20200906	18.4.3895.0
Tencent		20200907	1.0.0.1
Kingsoft		20200907	2013.8.14.323
CrowdStrike	win/malicious_confidence_80% (D)	20190702	1.0

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

e:\amigo_helpers\amigo_loader_lite\Release\mini_loader.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (2 个事件)

resource name	AFX_DIALOG_LAYOUT
resource name	PNG

Performs some HTTP requests (4 个事件)

request	GET http://mrds.mail.ru/update/2/version.txt?GUID={DF097E69-7F80-49F1-8D31-A87D10EC7A8A}&os=6.1&type=run_loader_run&newrfr=901406
request	GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
request	GET http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEA8Byg3xePJ2xAXD21b7Wg8%3D
request	HEAD https://goappsdl.distribmail.ru/go_installer_pulse.exe

Resolves a suspicious Top Level Domain (TLD) (1 个事件)

domain

goappsdl.distribmail.ru

description

Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620962931.241 NtAllocateVirtualMemory	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01030000	success	0	0

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\mini_loader_scoped_dir_1620941331\787fc60b822e55b7d71b9f43b0f644f9.exe.dul!

File has been identified by 5 AntiVirus engines on VirusTotal as malicious (5 个事件)

Comodo	Application.Win32.MailRu.BACS@6kp8ua
Invincea	Generic ML PUA (PUA)
Jiangmin	AdWare.ConvertAd.tpx
SentinelOne	DFI - Suspicious PE
CrowdStrike	win/malicious_confidence_80% (D)

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620962927.085 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

An executable file was downloaded by the process 787fc60b822e55b7d71b9f43b0f644f9.exe (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620962945.319 InternetReadFile	buffer: MZÿÿ¸@Øº´ Í!¸LÍ!This program cannot be run in DOS mode. $KG6ç&X´&X´&X´ÝB\µ &X´-FYµ&X´&Y´0&X´&X´&X´äB§´&X´&Ï´&X´äBZµ&X´Rich&X´PELÐ[à"(Ún@@@oEo@Id`ÂnoÈ0oH@G8xG@@.text&( `.rdata@,@@.data4P<@À.rsrcÂn`Ân>@@.relocH0oo@BUåVìuôh@VèÄÄÿ6ÿ,@@VL$D$ÉtT$ÆIvuø^ÃÌÌÌ1ÀÇAA@A$AAAAAAÈÆA"fÇA ÃÌUåVÎÀt Pÿ0@@Ç1ÀÇFA@F$FFFFFFÆF"fÇF ^]ÃUåWVÎ}Àt Pÿ0@@Ç1ÀÇFA@ñF$FFFFFFÆF"fÇF Wèÿ4@@ñPèo^_]ÂÌUåSWVPuMðj jVÿ8@@Çÿt?WVÿ<@@ÃÛt1WVÿ@@@Çÿt#øàuSÿD@@Àtçþf\|8þuMðA$Ä^_[]ÂÌUåSWVìEÎ~FWPÿü@@À5~uìé1Û}ðCë=H@@hA@ÿ4ÿ×ÀtPh2A@ÿ4ÿ×ÀtFhFA@ÿ4ÿ×Àt?1É·´ dA@·H÷f ×tf9òu&AùrâuìÀFëoÆF ëiÇFë`ÆF"ëZ1É·¼ rA@·Hþf Ötf9úuAùrâuìÀFë/1É·¼ A@·Hþf Ötf9úuìUðuAùrÜuìÀFUðC;ÿÿÿ~ u1uä1ÀfFfjVhA@ÿL@@·øuìÀù1Á ÁN °ÆF!ë1ÀÄ^_[]ÂÌUåSWVäøì ¡P@Àu^t$hjVèýÿÿÄ1ÿ»fÇD$SVÿ4½ÀA@ÿP@@H9ØsjjVÿT@@£P@ë¡P@Àu GÿrÄ¡P@ë75X@@hB@PÿÖ£P@hB@ÿ5P@ÿÖ£P@h¡B@ÿ5P@ÿÖ£P@1Û=P@ P@ÉÀø]Sÿ\@@4CÀ~·ø\tÆþ9Þwñ9ÞÎÆ1ÒJñèÍ)ÞÇÙÑþ\|$òèºM1ÒÆJt$è©1ÛöD$tvÿtrÀtn1ÛD$<$XXPjÿh2@hH@h[@h@hÑ@h¦@hÀ@ÿP@Ä$Çÿt(ÿuShÚ@SVÿt$WÿP@ÄÀÃWÿP@ÄL$èêL$èáL$èØë1ÛØeô^_[]ÃUåSWVìÖ1ÛSSSSVMìQShéýÿ`@@ÇÿtH1ÀþÿuðÀÇÿd@@WjPÿh@@Æöt%1ÀPPWV]ðSÿuìPhéýÿ`@@ûÿtÆD>ÿóØÄ^_[]ÃUåÿujÿuÿuÿl@@]ÃUåÿuÿp@@øÀ]ÃUåWVPEMU1ö}ô7VWRQPÿt@@ÀtEôë 1ÀÇEôÿÿÿÿHÄ^_]ÃUåWVPEMU1ö}ô7VWRQPÿx@@ÀtEôë 1ÀÇEôÿÿÿÿHÄ^_]ÃUåSWVP]¾ÀöÃuÞÁæ÷Öæ@Æ@Áë1ÀãóPPjÿÿuPhéýÿ\|@@Çÿt^?Eðÿd@@ÿuðjPÿh@@ÀtNWPjÿÿu1ÿWhéýEðÿ\|@@WhSW1ÛjVuðVÿ@@Çÿd@@VSPÿ@@ë"1ÀPhSPë 1ÉQhSQjVPÿ@@ÇøÄ^_[]ÃUåVuÿd@@VjPÿ@@^]ÃUåVuÿd@@VjPÿh@@^]ÃUåSWVìEøw,}1Ûwÿ$¬B@1ÀPhjPjh@Vÿ@@Ãë`1ÛKë[·G·O]äSQPÿ@@Àt EìPSÿ@@Àt1ÀPPEìPÿwÿ@@ÿwÿp@@1ÛÀ·GÃà'fGPVÿ@@ØÄ^_[]ÃÌUåV1ötÿd@@VjPÿ@@^]ÃÌUåSWVì¶MuEUðÇÁRjPQèbÄÇ»nÿMðÿuÿuhE@èAÇÿuwÿuEÇWèÄÀûtYM1ÿÉtL·ø"uDQSèvÄør5·LCþù"u+EìCÙ»lPÿuQèqÄÀtEìMfÇDAü1Ûë1ÿ»oMð~èðÄ^_[]ÃUåSWVäøìu\|$¶^ F$ÿuÿuD$PÿvSWèìþÿÿÄO}ÀOt&~!t 1ÀÛÀÿuÿuÿt$hA@PWèµþÿÿÄøeô^_[]ÃUåSWVäðìpu]}T$WÀ1ÀL$(AAAAAAA AA(A$A0A,A8A4A@A<ÇD)RQPPhPPPWSÿ@@Àt/ÿt$ÿp@@ÇD$jÿÿt$ÿ@@Àt+¿kÿ @@ëAÿ @@ÇSÿ¤@@ÿt1ÿu>Më*D$Pÿt$ÿ¨@@ÀtÂÿt$ÿp@@\|$1À>ëMFðeô^_[]ÃE~ëìUåEÀt0MÉt)UúÿtRPhQè3ÄëPhQèÈÄ]ÃUåWVu·ø"u5·FfÀtlÆ·Àø"·t#ÆfÀuíëT·Èù tù t·FÆfÀuçfÀt6}·Àø tø thÄB@hWèTÄÀtWhû@VèµÄ^_]ÃUåSWVì}ÿuìñÿuÿuÿuèñè=1öÀt\|Mìè7Àtp1öàýÿÿf³f3ÿ7hSèÄÀtJÿuhSèÃÄÀt5MìSèÿÀt(h0D@]SèZÄÀt"àýÿÿPhÿwë21öðÄ^_[]Âh>D@Sè&ÄÀtßàýÿÿPhÿwèÄÀtÄ1öFë¿UåSWVäøì`}u\$ 1ÀffVhSèÛÄÀShD@hSèú request_handle: 0x00cc000c	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)

Time & API	Arguments	Status
1620962929.741 RegSetValueExA	key_handle: 0x00000338 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620962929.741 RegSetValueExA	key_handle: 0x00000338 value: ÐØö>H× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620962929.741 RegSetValueExA	key_handle: 0x00000338 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620962929.741 RegSetValueExW	key_handle: 0x00000338 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620962929.741 RegSetValueExA	key_handle: 0x00000350 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620962929.741 RegSetValueExA	key_handle: 0x00000350 value: ÐØö>H× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620962929.741 RegSetValueExA	key_handle: 0x00000350 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620962929.866 RegSetValueExW	key_handle: 0x00000334 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success
1620962931.163 RegSetValueExA	key_handle: 0x000003d4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620962931.163 RegSetValueExA	key_handle: 0x000003d4 value: c³÷>H× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620962931.163 RegSetValueExA	key_handle: 0x000003d4 value: 0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620962931.163 RegSetValueExW	key_handle: 0x000003d4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620962931.163 RegSetValueExA	key_handle: 0x000003d8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620962931.163 RegSetValueExA	key_handle: 0x000003d8 value: c³÷>H× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620962931.163 RegSetValueExA	key_handle: 0x000003d8 value: 0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success

Generates some ICMP traffic

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2018-04-03 20:15:13

Imports

Library KERNEL32.dll:

• 0x431050 UnmapViewOfFile

• 0x431054 CreateFileMappingW

• 0x431058 MapViewOfFile

• 0x43105c VirtualQuery

• 0x431060 GetModuleFileNameW

• 0x431064 GetACP

• 0x431068 GetModuleHandleW

• 0x43106c GetProcAddress

• 0x431070 InterlockedCompareExchange

• 0x431074 CreateDirectoryW

• 0x431078 RemoveDirectoryW

• 0x43107c GetFileAttributesW

• 0x431080 DeleteFileW

• 0x431084 GetCurrentProcessId

• 0x431088 GlobalAlloc

• 0x43108c GlobalLock

• 0x431090 GlobalUnlock

• 0x431094 GetStartupInfoW

• 0x431098 CreateProcessW

• 0x43109c GetExitCodeProcess

• 0x4310a0 GetTempPathW

• 0x4310a4 SizeofResource

• 0x4310a8 FreeResource

• 0x4310ac LockResource

• 0x4310b0 LoadLibraryW

• 0x4310b4 LoadResource

• 0x4310b8 FindResourceW

• 0x4310bc FreeLibrary

• 0x4310c0 MultiByteToWideChar

• 0x4310c4 MoveFileExW

• 0x4310c8 WideCharToMultiByte

• 0x4310cc MoveFileW

• 0x4310d0 GetCurrentProcess

• 0x4310d4 GetVersionExW

• 0x4310d8 GetNativeSystemInfo

• 0x4310dc SetFileAttributesW

• 0x4310e0 lstrcmpiW

• 0x4310e4 CreateFileW

• 0x4310e8 SetEnvironmentVariableA

• 0x4310ec FreeEnvironmentStringsW

• 0x4310f0 GetEnvironmentStringsW

• 0x4310f4 GetCommandLineA

• 0x4310f8 GetOEMCP

• 0x4310fc IsValidCodePage

• 0x431100 EnterCriticalSection

• 0x431104 FindFirstFileExW

• 0x431108 FindClose

• 0x43110c WriteConsoleW

• 0x431110 GetFullPathNameW

• 0x431114 GetCurrentDirectoryW

• 0x431118 GetTimeZoneInformation

• 0x43111c SetStdHandle

• 0x431120 EnumSystemLocalesW

• 0x431124 GetUserDefaultLCID

• 0x431128 IsValidLocale

• 0x43112c GetStdHandle

• 0x431130 ExitProcess

• 0x431134 SetEndOfFile

• 0x431138 SetFilePointerEx

• 0x43113c GetConsoleCP

• 0x431140 WriteFile

• 0x431144 FileTimeToSystemTime

• 0x431148 SystemTimeToTzSpecificLocalTime

• 0x43114c PeekNamedPipe

• 0x431150 GetFileType

• 0x431154 GetDriveTypeW

• 0x431158 ReadConsoleW

• 0x43115c GetConsoleMode

• 0x431160 ReadFile

• 0x431164 CopyFileW

• 0x431168 GetProcessHeap

• 0x43116c LocalFree

• 0x431170 HeapAlloc

• 0x431174 HeapReAlloc

• 0x431178 HeapSize

• 0x43117c GetCommandLineW

• 0x431180 HeapFree

• 0x431184 CloseHandle

• 0x431188 GetCurrentThreadId

• 0x43118c LeaveCriticalSection

• 0x431190 SetLastError

• 0x431194 DeleteCriticalSection

• 0x431198 DecodePointer

• 0x43119c RaiseException

• 0x4311a0 GetLastError

• 0x4311a4 SystemTimeToFileTime

• 0x4311a8 TzSpecificLocalTimeToSystemTime

• 0x4311ac SetFileTime

• 0x4311b0 GetModuleHandleExW

• 0x4311b4 FreeLibraryAndExitThread

• 0x4311b8 ExitThread

• 0x4311bc CreateThread

• 0x4311c0 LoadLibraryExW

• 0x4311c4 RtlUnwind

• 0x4311c8 FlushFileBuffers

• 0x4311cc QueryPerformanceCounter

• 0x4311d0 TerminateProcess

• 0x4311d4 FindNextFileW

• 0x4311d8 InitializeCriticalSectionAndSpinCount

• 0x4311dc SetUnhandledExceptionFilter

• 0x4311e0 UnhandledExceptionFilter

• 0x4311e4 WaitForSingleObjectEx

• 0x4311e8 ResetEvent

• 0x4311ec SetEvent

• 0x4311f0 LoadLibraryExA

• 0x4311f4 VirtualFree

• 0x4311f8 VirtualAlloc

• 0x4311fc IsProcessorFeaturePresent

• 0x431200 FlushInstructionCache

• 0x431204 InterlockedPushEntrySList

• 0x431208 InterlockedPopEntrySList

• 0x43120c InitializeSListHead

• 0x431210 OutputDebugStringW

• 0x431214 IsDebuggerPresent

• 0x431218 GetCPInfo

• 0x43121c GetLocaleInfoW

• 0x431220 LCMapStringW

• 0x431224 CompareStringW

• 0x431228 GetSystemTimeAsFileTime

• 0x43122c TlsFree

• 0x431230 TlsSetValue

• 0x431234 TlsGetValue

• 0x431238 TlsAlloc

• 0x43123c CreateEventW

• 0x431240 EncodePointer

• 0x431244 GetStringTypeW

Library USER32.dll:

• 0x431264 ReleaseCapture

• 0x431268 PtInRect

• 0x43126c DialogBoxParamW

• 0x431270 GetParent

• 0x431274 UpdateLayeredWindow

• 0x431278 GetDlgItem

• 0x43127c GetClientRect

• 0x431280 SetWindowLongW

• 0x431284 wsprintfW

• 0x431288 MoveWindow

• 0x43128c MapWindowPoints

• 0x431290 ClientToScreen

• 0x431294 CopyRect

• 0x431298 GetMonitorInfoW

• 0x43129c GetCapture

• 0x4312a0 IsWindow

• 0x4312a4 ShowWindow

• 0x4312a8 WindowFromPoint

• 0x4312ac SetWindowTextW

• 0x4312b0 GetSystemMetrics

• 0x4312b4 EndDialog

• 0x4312b8 SendMessageW

• 0x4312bc ScreenToClient

• 0x4312c0 FillRect

• 0x4312c4 MonitorFromWindow

• 0x4312c8 SetWindowPos

• 0x4312cc IsWindowVisible

• 0x4312d0 GetWindowRect

• 0x4312d4 GetWindow

• 0x4312d8 CallWindowProcW

• 0x4312dc DefWindowProcW

• 0x4312e0 GetWindowLongW

• 0x4312e4 UnregisterClassW

• 0x4312e8 EndPaint

• 0x4312ec BeginPaint

• 0x4312f0 GetCursorPos

• 0x4312f4 InvalidateRect

• 0x4312f8 KillTimer

• 0x4312fc LoadImageW

• 0x431300 SetTimer

• 0x431304 GetActiveWindow

Library GDI32.dll:

• 0x43101c SetTextColor

• 0x431020 SetBkMode

• 0x431024 BitBlt

• 0x431028 CreateCompatibleBitmap

• 0x43102c SelectObject

• 0x431030 CreateDIBSection

• 0x431034 CreateCompatibleDC

• 0x431038 DeleteDC

• 0x43103c SetViewportOrgEx

• 0x431040 DeleteObject

• 0x431044 CreateSolidBrush

• 0x431048 GetStockObject

Library ADVAPI32.dll:

• 0x431000 RegCreateKeyExW

• 0x431004 RegSetValueExW

• 0x431008 RegQueryValueExW

• 0x43100c RegCloseKey

Library SHELL32.dll:

• 0x43124c CommandLineToArgvW

• 0x431250 ShellExecuteW

Library ole32.dll:

• 0x431398 CoTaskMemFree

• 0x43139c CreateStreamOnHGlobal

• 0x4313a0 CoCreateGuid

• 0x4313a4 StringFromCLSID

Library SHLWAPI.dll:

• 0x431258 PathFileExistsW

• 0x43125c PathFindFileNameW

Library COMCTL32.dll:

• 0x431014 _TrackMouseEvent

Library gdiplus.dll:

• 0x43130c GdipCreateLineBrushFromRect

• 0x431310 GdipLoadImageFromStream

• 0x431314 GdipGetImageWidth

• 0x431318 GdipGetImageHeight

• 0x43131c GdipLoadImageFromFile

• 0x431320 GdiplusShutdown

• 0x431324 GdipSetStringFormatAlign

• 0x431328 GdipDrawImageI

• 0x43132c GdipDeleteFont

• 0x431330 GdipDeleteStringFormat

• 0x431334 GdipDeleteGraphics

• 0x431338 GdipStringFormatGetGenericDefault

• 0x43133c GdipMeasureString

• 0x431340 GdipSetTextRenderingHint

• 0x431344 GdipCreateFromHDC

• 0x431348 GdipDrawString

• 0x43134c GdipFree

• 0x431350 GdipGetGenericFontFamilySansSerif

• 0x431354 GdipCreateSolidFill

• 0x431358 GdipCreateFont

• 0x43135c GdipCreatePath

• 0x431360 GdipSetSmoothingMode

• 0x431364 GdipDisposeImage

• 0x431368 GdipDeletePath

• 0x43136c GdipCreateBitmapFromHBITMAP

• 0x431370 GdipDrawImageRectI

• 0x431374 GdipAlloc

• 0x431378 GdipDeleteBrush

• 0x43137c GdipCloneImage

• 0x431380 GdipCreateFontFamilyFromName

• 0x431384 GdipDeleteFontFamily

• 0x431388 GdipCreateStringFormat

• 0x43138c GdipFillRectangle

• 0x431390 GdiplusStartup

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
ocsp.digicert.com	CNAME cs9.wac.phicdn.net A 117.18.237.29	117.18.237.29
mrds.mail.ru	A 217.69.139.245	217.69.139.245
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
status.geotrust.com	CNAME ocsp.digicert.com CNAME cs9.wac.phicdn.net A 117.18.237.29	117.18.237.29
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
goappsdl.distribmail.ru	A 94.100.180.110 CNAME moscow.cdnmail.ru CNAME goappsdl.cdnmail.ru A 217.69.139.110	5.181.61.0
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49178	117.18.237.29 status.geotrust.com	80
192.168.56.101	49179	117.18.237.29 status.geotrust.com	80
192.168.56.101	49175	217.69.139.245 mrds.mail.ru	80
192.168.56.101	49177	94.100.180.110 goappsdl.distribmail.ru	443
192.168.56.101	49180	94.100.180.110 goappsdl.distribmail.ru	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D	GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com
http://mrds.mail.ru/update/2/version.txt?GUID={DF097E69-7F80-49F1-8D31-A87D10EC7A8A}&os=6.1&type=run_loader_run&newrfr=901406	GET /update/2/version.txt?GUID={DF097E69-7F80-49F1-8D31-A87D10EC7A8A}&os=6.1&type=run_loader_run&newrfr=901406 HTTP/1.1 User-Agent: GoLoader Host: mrds.mail.ru Cache-Control: no-cache
http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEA8Byg3xePJ2xAXD21b7Wg8%3D	GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEA8Byg3xePJ2xAXD21b7Wg8%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: status.geotrust.com

URI

Data

http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

http://mrds.mail.ru/update/2/version.txt?GUID={DF097E69-7F80-49F1-8D31-A87D10EC7A8A}&os=6.1&type=run_loader_run&newrfr=901406

GET /update/2/version.txt?GUID={DF097E69-7F80-49F1-8D31-A87D10EC7A8A}&os=6.1&type=run_loader_run&newrfr=901406 HTTP/1.1
User-Agent: GoLoader
Host: mrds.mail.ru
Cache-Control: no-cache

http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEA8Byg3xePJ2xAXD21b7Wg8%3D

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEA8Byg3xePJ2xAXD21b7Wg8%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: status.geotrust.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.