1.2
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.83
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Evo-gen [Susp] | 20200126 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200126 | 2013.8.14.323 |
| McAfee | BackDoor-AXJ.gen | 20200126 | 6.0.6.653 |
| Tencent | None | 20200126 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .ajelhf |
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x0000b7d0', 'size_of_data': '0x0000b7d0', 'entropy': 7.1390850112652995} | entropy | 7.1390850112652995 | description | 发现高熵的节 | |||||||||
| entropy | 0.7209658638230066 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 60 个反病毒引擎识别为恶意
(50 out of 60 个事件)
| APEX | Malicious |
| AVG | Win32:Evo-gen [Susp] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Peed.Gen |
| AhnLab-V3 | Win-Trojan/Berbew.51712 |
| Antiy-AVL | Trojan[Proxy]/Win32.Qukart.gen |
| Arcabit | Trojan.Peed.Gen |
| Avast | Win32:Evo-gen [Susp] |
| Avira | TR/Crypt.XDR.Gen |
| BitDefender | Trojan.Peed.Gen |
| BitDefenderTheta | AI:Packer.775A196A1E |
| Bkav | W32.HfsAutoB. |
| CAT-QuickHeal | Worm.Dorkbot.A |
| ClamAV | Win.Trojan.Crypted-29 |
| Comodo | Worm.Win32.Qukart.K@565w5t |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.1d2b00 |
| Cylance | Unsafe |
| Cyren | W32/S-c46e6d2d!Eldorado |
| DrWeb | BackDoor.HangUp.5 |
| ESET-NOD32 | Win32/Padodor.NAM |
| Emsisoft | Trojan.Peed.Gen (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-c46e6d2d!Eldorado |
| F-Secure | Trojan.TR/Crypt.XDR.Gen |
| FireEye | Generic.mg.7aa8f051d2b00f6b |
| Fortinet | W32/GenKryptik.BJQV!tr |
| GData | Trojan.Peed.Gen |
| Ikarus | Backdoor.Win32.Padodor |
| Invincea | heuristic |
| K7AntiVirus | Proxy-Program ( 00557ea51 ) |
| K7GW | Proxy-Program ( 00557ea51 ) |
| Kaspersky | Backdoor.Win32.Padodor.gen |
| MAX | malware (ai score=89) |
| Malwarebytes | Backdoor.Padodor |
| MaxSecure | Backdoor.Win32.Padodor.gen |
| McAfee | BackDoor-AXJ.gen |
| McAfee-GW-Edition | BehavesLike.Win32.Backdoor.kc |
| MicroWorld-eScan | Trojan.Peed.Gen |
| Microsoft | Backdoor:Win32/Berbew.AA!MTB |
| NANO-Antivirus | Trojan.Win32.Padodor.foufls |
| Panda | Bck/Webber.gen |
| Qihoo-360 | HEUR/QVM19.1.D1A5.Malware.Gen |
| Rising | Malware.Heuristic!ET#100% (RDMK:cmRtazpgEU7IqErRLDDFKf0JVPDE) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Padodor-M |
| Symantec | ML.Attribute.HighConfidence |
| TotalDefense | Win32/Webber.W |
| Trapmine | malicious.high.ml.score |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2020-07-11 11:39:59
PE Imphash
26babd76bbb7f9c516a338b0601b4c9f
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0000b7d0 | 0x0000b7d0 | 7.1390850112652995 |
| .bss | 0x0000d000 | 0x0001e81c | 0x00000000 | 0.0 |
| .data | 0x0002c000 | 0x00003314 | 0x00003314 | 6.09873504456682 |
| .idata | 0x00030000 | 0x00001210 | 0x00001210 | 4.968075144922723 |
| .ajelhf | 0x00032000 | 0x00001000 | 0x00000200 | 2.32687435277427 |
Imports
Library wsock32.dll:
• 0x43039c WSAGetLastError
• 0x4303a0 WSAStartup
• 0x4303a4 __WSAFDIsSet
• 0x4303a8 accept
• 0x4303ac bind
• 0x4303b0 closesocket
• 0x4303b4 connect
• 0x4303b8 gethostbyname
• 0x4303bc htonl
• 0x4303c0 htons
• 0x4303c4 inet_addr
• 0x4303c8 ioctlsocket
• 0x4303cc listen
• 0x4303d0 recv
• 0x4303d4 select
• 0x4303d8 send
• 0x4303dc socket
Library ole32.DLL:
• 0x4303e8 CoCreateInstance
• 0x4303ec CLSIDFromString
• 0x4303f0 CoTaskMemFree
• 0x4303f4 CoInitialize
• 0x4303f8 CoUninitialize
Library OLEAUT32.DLL:
• 0x430404 SysAllocString
Library WININET.DLL:
• 0x430410 DeleteUrlCacheEntry
• 0x430414 FindFirstUrlCacheEntryA
• 0x430418 FindNextUrlCacheEntryA
Library KERNEL32.DLL:
• 0x430424 ExitProcess
• 0x430428 ExitThread
• 0x43042c ExpandEnvironmentStringsA
• 0x430430 FileTimeToLocalFileTime
• 0x430434 FileTimeToSystemTime
• 0x430438 FindClose
• 0x43043c FindFirstFileA
• 0x430440 FindNextFileA
• 0x430444 FreeLibrary
• 0x430448 GetCommandLineA
• 0x43044c GetCurrentProcessId
• 0x430450 GetCurrentThreadId
• 0x430454 GetExitCodeProcess
• 0x430458 GetExitCodeThread
• 0x43045c GetFileAttributesA
• 0x430460 GetFileSize
• 0x430464 GetFileTime
• 0x430468 GetLocalTime
• 0x43046c GetModuleFileNameA
• 0x430470 GetModuleHandleA
• 0x430474 CloseHandle
• 0x430478 GetProcAddress
• 0x43047c GetSystemDirectoryA
• 0x430480 GetTempPathA
• 0x430484 GetTickCount
• 0x430488 GetTimeZoneInformation
• 0x43048c GetVersion
• 0x430490 GetVersionExA
• 0x430494 GetWindowsDirectoryA
• 0x430498 GlobalMemoryStatus
• 0x43049c CopyFileA
• 0x4304a0 InterlockedIncrement
• 0x4304a4 IsBadReadPtr
• 0x4304a8 IsBadWritePtr
• 0x4304ac LoadLibraryA
• 0x4304b0 CreateDirectoryA
• 0x4304b4 LocalAlloc
• 0x4304b8 LocalFree
• 0x4304bc OpenFile
• 0x4304c0 OpenMutexA
• 0x4304c4 OpenProcess
• 0x4304c8 PeekNamedPipe
• 0x4304cc CreateFileA
• 0x4304d0 ReadFile
• 0x4304d4 RemoveDirectoryA
• 0x4304d8 RtlUnwind
• 0x4304dc SetFileAttributesA
• 0x4304e0 SetFilePointer
• 0x4304e4 CreateMutexA
• 0x4304e8 Sleep
• 0x4304ec TerminateProcess
• 0x4304f0 TerminateThread
• 0x4304f4 CreatePipe
• 0x4304f8 VirtualQuery
• 0x4304fc CreateProcessA
• 0x430500 WaitForSingleObject
• 0x430504 WideCharToMultiByte
• 0x430508 WinExec
• 0x43050c WriteFile
• 0x430510 lstrlenA
• 0x430514 lstrlenW
• 0x430518 CreateThread
• 0x43051c DeleteFileA
Library USER32.DLL:
• 0x430528 GetWindowTextA
• 0x43052c GetWindowRect
• 0x430530 FindWindowA
• 0x430534 GetWindow
• 0x430538 IsWindowVisible
• 0x43053c GetClassNameA
• 0x430540 GetForegroundWindow
• 0x430544 LoadCursorA
• 0x430548 SetTimer
• 0x43054c KillTimer
• 0x430550 RegisterClassA
• 0x430554 GetMessageA
• 0x430558 CreateDesktopA
• 0x43055c SetThreadDesktop
• 0x430560 GetThreadDesktop
• 0x430564 TranslateMessage
• 0x430568 DispatchMessageA
• 0x43056c SendMessageA
• 0x430570 CharUpperBuffA
• 0x430574 OemToCharA
• 0x430578 PostQuitMessage
• 0x43057c ShowWindow
• 0x430580 CreateWindowExA
• 0x430584 DestroyWindow
• 0x430588 DefWindowProcA
Library ADVAPI32.DLL:
• 0x4305a4 RegCreateKeyExA
• 0x4305a8 RegCloseKey
• 0x4305ac RegOpenKeyExA
• 0x4305b0 RegQueryValueExA
• 0x4305b4 RegSetValueExA
• 0x4305b8 GetSecurityInfo
• 0x4305bc SetSecurityInfo
• 0x4305c0 SetEntriesInAclA
Library CRTDLL.DLL:
• 0x4305cc _itoa
• 0x4305d0 __GetMainArgs
• 0x4305d4 _sleep
• 0x4305d8 _strcmpi
• 0x4305dc _stricmp
• 0x4305e0 atoi
• 0x4305e4 exit
• 0x4305e8 memcpy
• 0x4305ec memset
• 0x4305f0 raise
• 0x4305f4 rand
• 0x4305f8 signal
• 0x4305fc sprintf
• 0x430600 srand
• 0x430604 sscanf
• 0x430608 strcat
• 0x43060c strchr
• 0x430610 strncmp
L!This program cannot be run in DOS mode.
.idata
.ajelhf
=v(7v4
;v4BKE.JKE3v4^(tS9rY=+
%cHtr~
tT^uIO
]*+v4mk_
/v4RKE'v4bKEv
z0nGSuv4
`vKEGt
;v3wr=3>
;vI3s~
=+3tIe
IttGI#tIv4~
MvtAN_{~
vtOT{\
It3tIS.F
t&ItgvX-BnV%P=+g;N
waLqJ_Af/
?3s]Pc
V?|wOi?
tIf>bA=3wtwIt
rL_yzgs@
?3s(u#
!|QvKE
yE c<Kt
?Y+HR?Q
I%rtq~
=pt1=ntT
vY+HR?
86_h??
!s6NLrmv
BF&SD4D
;3{W^!
Kr{vroR
=pt1=ft
KrGKG]c3vQ?AtGKX-Bnv
KES.nHKEv
7I KEv
w0D43tI&c4MtrzIvrv4
P=ItP?|?SH
=3{W=Nt
4?|?_H
=3>3tI
nwSuv4
}*v4W=FtQ=3
t5SKvnh3tIHX-BnV%P
ItW^wI/
3tI&cbKtrz
}Zv|??H
ItW=Nt
;vtvu^
Zva55H
ItW^ssIO
vrz3tI
;vcAtrzIvs
nGSuy<
t;vHof
7rvMKu
ItW=NtPBr
ItW=NtPrr
ItW=FtQ`v3tI&D43tI&
ItW=Ntfv
Itu3tI&
BJS.nH
`(v3tI&
Itu.It
IsH)73tI&c vrz
{Itu>It3tI&
D43tI&c vrb
+?3wnh3
S.nH3tI&
u>gItZf
6ItP=ItPw
5HnwSu
sItWyE
wItW=Nt
WItWvtBu=H
'?3wnh3:tIH
.tIv+v
ItW`yE
Ku5tG6J
It2svH
.u+Ht=
"u~tZu=oHZuwI
ItW=FtQH`v
Vu~bpNtX-BnmI
zV5KOvrxtI`)q3k
LBjf?|?3S
KyP?|?3wq
)EKvtr
vrfv4m
3sGK)7~
wrOMpwo
ZZ1^3rvP?t
HUo$v|?3sp
PsGtq\
pvF_{pe"vX-Bnru
ctxvKEx~vE
u;Cnv2
ruSv|?H
zE>Itt
?[Hntnu^g
S6nH6v
vnGSu=v
v4nGSu
HtW;WHm>It#uIIOH
tzu?3scs
Jt3uI&
u?3s3tI6ItcrI
?3wnh3&wIH
ItWvtrB
Hm>It#wIIKH
BN#I3vU
OJtu=v
BJHXvvj
ItWvtrB
cJtW;gH
3tI&t.u;#H
wIIs v
3wI&c)vow
u5vv3wI&I
wtvv3uI&I
Hc(Ltr
\trzIv
tI>It<twG43uI&c_trVIv
;#H8t5:I
??tbuqH
u32wI7
ItW;#Hoc
vtbu73=v
HtW^cIO
upIt+IH
@vtrsv
BJ>Itp
02swI3wI&G43vI&c
*vKEy<A&t
3wI&c-vNGsqy<A
JtW;uIot
>Ktaq3u
3utuv4v3E
Ht>raI3u
KEv46v6`
?3wKEv
mWv]z*
{P?*v4X-BnZFQ
1Vv|?3ouv4m
BFS6nHm^
v`P=3kprpr
zcPtrfy
=3kppr
I3kBJOt
I3wn_Su3wp]d
u_S6nH
BNw{WI
|07#jvt
BJ&8ym
BBLKEs6NLov
=3s)sv|?3gq)BnZ>
u v|?3gq/v
=3o,xv
c`#vov
=3c,vs3W:w
_m c$"vp
pv`&p3X
t ct%vQ^
Nl3uILm7m=3c,
RR_IU=#k,,ovW;7Io"
?3Km&7I
IC{vc$vqk
Is vCG4o
G4ov^pI|vo
/t5Xu#
BJLt??
5'vt2F
)BnZzQ
bs6NLrJE
y=Bc]>3|
YHR?3'w
=wItJt?
=wItJt?
ItrJES.nH
Jtu6KtGe
#vI6KtGe
w4nGSu.Jt
HtWtcx=v3uI&T
;bHQ^C
bvrJE6Jt
Jt2sbHrJE
W;bHP^
h3wIH6v
vIv3wI&
Bv|?kH
_uS6nHm>Jt3wI&
5tr!c?vu
h3wIHQ^/
Ks!c0?vn_SuGKG]cbJt6vnh3wIHX-BnZbP=
`sIsv3
5W;3qW^w
7Gv(BnP
/Ts.NLrJEy=B&trI
w4NGsq)nV
w45r{v3D
?3wrJE
w4N_sq
]B23di
my=Qy=Iy<w
pqYT~{56v)\
eLvrJE c
t5N_sqGKG]ot
GKX-BnZn
rR7h?vMEtsQ
It3uIs
;xIrc$0vY
rJEs6NLN
y=Et]y30vQ
vc0vT!
w4T^uII
BNI.t5I
;VIrcT3v6v6bHv
v|bN?3sT^5uI%c:HttF
m%cFJtr~_
BNI6tDwKk
%cKt^?
v%crKt^=
>p2C+f
>%T^5vIO
w4Ns;f6
r]r7YHR?Q
~cH5vzs
vc 5vrJE
GK<v|?3wq)u#
FMP^qI/t
Ksy<@&tp
BNM6v6`x7'mvt
4vuy<<vm!cBtrf]
BNMX-BnZzQsq
Q^ypII6t
vNt5t6
]}nt3tq[
Gvtq;v
tHMw:Isv
tGKLvX-B
?|?3oq
B[Gy<BH Kvsvm
vc5vus6NLT^
hv|?3sq
(v4~JEv
vc`3vrzt
brJEsQ?~JE)u#
~JKEUvFv
Is v6H
_BtI97
bv~GCw97
F#vbHt
v~_Cw97
bv~wCw97
s/v3vW?
F6`:Is v`2
z@pK5skzv
5Sczv{A=cczv
>r37Fkzv
BBJFv` ?
FO7umv4F_S
C6~JYHR?Q,!
Is vp4
ME cdv&
ME cTv6
ME cDv
?|?3wq
q3c vnh
;3#LBB6
ptrR yv
=3oWwv|?3
Sg#q3w
bBv?#g
;3sW;3cWI
?3o|bR?3wu#
Is vtr
Zv46Iy=
y=BIy=
OIrq\u`
5prs^rpodvss^s
<IYHR?
%PIs v
r6IHr1
5KEy=Ri
=J76ms
n&c]@t^Is vivsKb
?3sDwQ.fq
l_[LwQ
?3sEbh
#Ttt3CEI
S"vc<vT!cOt3TIvcv:vqMUt
6hIsy=Et6J~4
;z~4V^
htkv#dI
;zi~4Vw#UI
htc{zv
Ety=Et
itKE6it
vc5Ot3TIv4#TIX]`JS
M@wJ?NtH
\3UI&cTvKE.Yt
tvtZtISIc
wTtRJ5<
vuktvuS
gItIs vtnt^W
=b7#dI.Yt
IJR_tJu=z:ccI
6|3dI6Yt
ht#UIu3UI
itWIWIcv3TIO
it3TIw
it\zov
I'I`Is v#dIi
=WIbt?z77
5tF3TI
A3dIws.F1Rt
TI>itt5
;w2ccI
Ety=Et
3YpI)\
S'P=3a?3x
-v|?3sqv4
3lvbt3bFjv
sqvNwsq)BnZz
~~4TNl
*D7$vt
lt3fFkv3
ICvcvn3Eivt
(BnZRQck>
rAElvvrAElv
;3cW;3gWICvcvpu
sqvsdcvaI3u
r cdvNl
|3It1w
tBHy<BHsX
wF4Q^1IO
tBHy<BHsX
wD4Q^1IO
vIvsy<B.7&cv^?3
pN_sqv4Q^k
=5X-Bnr
Mtuv4nGSu
L@uvLrwv
IFcpvKE
v3pIK v
By<G&cNt^vcHvKE
;v?sH30vU
Mt3pIH
MtW;tHd
=sHMtIv
y<DvsHa?yKbvKEov
By<G&c At^vcvnwSuIcv~
<It"stH
#tIO[{m
LBHvy<BHy<@u?<Mt2{tH
It3tISU
wF43tI&c$
trzIvs6It
ItW^>IO
#tIO[{|y<@usH3tII3>vU
_ItIv43tIt
yKqMEu
It3pIy=Eu
y=Eu&F43tI&c
It2stH
3u:stH
tI7:Ewcov
yK#tIy<JH_Afa?yK3tIM
Itsy<BupIt@6xHjY
&q?bHt
ttF43tI&c
Iu5tG6J
NuIs v
;tHt5q
tBHy<BH
ItEwF43tI&c
;ItW^9IO
Iu>ItaI3u
3u#tI4
ItW^39IO
Mtuy<BHKtvd
3u2stHt5qL
r3tIv4m
ItW;CJ
5nh3pI
wD43tI&cX
trzIvs
;tHt52sCJm
vtZw;OJ
Nf5cJtr
By<G&cFt^vcHvn_Suv4
ItW^';IO
jw5tG6J
;v;tHNu
tI!zF4
pI!cvrft
@S.nHaqSJ
Nu5sHs
vcvnh3pI
Mtu6It
kp5tG6J
rc@v3pI6Mtncxv:Q
UCtKES.nH;pIC
IAcv3pI6MtIcv:Q
vtNu;tH
vT!0!V
v4nGSu.It
~tw \v
6W^(fI/
=3v,=3
6W^XfI/
truBvsuKvsuAv
:Hvy<Jv
ItLwI2KbM
xvMtIvt
;uK<t5:I
h3tIHm
:Kwy<Jv3w>q
Jv_vIxxvnGSu;uK
3tI&ctv
wlF43tI&c
trnIvrSU
IFcv3tIs`c<v:Q
6W^aI/
;vHt5qHvIt
tI&c\v3tI
wtF43tI&c trj
Zw7tv =sJ
Itm;uK
_pIZ8v|?WJ
Is vf
;vvQ=+cQv
waLqJ_Af/
HtFw{p
uI~pI*
3stIEMt{
FM3uI&
QE&c,vFw{p
vIOPvt
;tIov^2
vbX4ov^~
;3sW;3wWv8ym
Ptv|?3wq
Av|?3sq
H5x[)\
6vNwsq
ftr cvQ^
BNLXHR?
2Js.NLm
?3{?3{
NLX-BnV%P
wrOHm%tr cvm
vX-BnZFQ\*
zD5P4v
szvhBZ
y=BHy=C
=;c~]A
I.73sv
RN;Cv2
5ry=DITq
#~=cEr
uRzv|bN?3s
uvry=BI)\
`_zIvGLGqnvKEbxEx&
y=RIr.g|?
;u.|n_Su
Bw{W;3}
3Ot(u#
uKV?|Jr
BV&trI
mE!cvm
mEuP4>
3smEGX(
zny<?di
aP4FG{p
BBr*P4
?BFP46{P?
BFr*P4
#mEP4L
mE&cJtr~
B^&trV%trRGJvtrRwLv
m|^7wdv
v9EOOv
{rsy<BH K'v~3E
~3E#Lv
5{aCW?
IHR?W
P&eE!c4vrz`A
qry<BH>M
`}C7zv
vcvNwsq)nZVQD
ICvc vm
BRLaq3{
;3{WIC[vc(vq(
BF&cvrn
;3gW;3{WIC[vcvpddvH:v
^vIHN[
?BNwsq
:eE H'v~3E
&cXvr~`
BVLt(u#
pHt)63t
rMX43uI&c tp
JtsMX43uI&c tp
Ity<LtpHt
vT!44qX
kv|?sI
Jtrz3vQ
HtW=3vj}tI
3uI&BX43uI&cPvrj
+uI%c$vm
MNwsqu\<X4<1
NL3uI&c<vm&
IAc(vQ^;
vQ{_d4
&cLtrz
&cwLtz
HtWSeE
&cOtNGsq
53uI&cv3uIMPw
3uI&cv
I@cdvN_sq
3uI&clv
I@c(vNwsqo
5W^sI{P
53uI&cpvqITw
?3wN7feECv
4~tw8v
EvtrJ/Fv
s.NL6NLz
HtW=3GzI
L|v3uI&c
5W^}IsQ
X4+9v3avQ
IEctvN_sq
cvNl3uIL
rc,vNwsqOrcvo@
kGvtrNGvYHR?3w
6{HtmE
vx79v[487
&c#Ctrz
vm&[4~tpw;v`
p;H3uI&
S6nH3uI&c vm&
3uI&cLv3uI&3uI&3uI&3uI&
HtPIkI
vt56dt
6wKt05PfE6HtP^
tI'Hcvn_Su
5W;qIMt5$v
7QJv`%
3uI&c;Gtrz
GKX-BnZbQ
Ha?+yFK
rcvN95
I@cvrc$vNl
LvNwsq1v|?
T^{I/MvwIv
Jt??wI
3pI&cvm
[43vwI&c
?trzMvwIv
wq[43vwI&c>trzIvs
;Iht52sI3pIKT$u
(vxKB3;t
KH"[[U"
vb+v:7T
ss[43vwI&c1trzIvs
;Idt5:I
JtSvz0J
swI[]6
Jt"sIt^t=oI^t
t5Wvjt5NGsq=
t5Wt&t5Nwsq
KsSvjo
W;wI+3vb
WMeE4B
V)v|?cI
vc<vm&
X43vbv
&4t5YS
v<X4@A
??I[4dA
IEcvY2
^t?bvnK
6@v|?oI
#qI$t4^_
%cYtr~
WWfEpD
WrfE<D
??b=LtX-BnV%P
cv|?3wq
??YHR?
rs6NLaq]I
?OIZ4W^
Dvtrt^
PrGKrv
tt?[ILntw
s6NL6m5o
nt>Ht#uI
3uI&tftICIM
HtWIkI3uI&o)
s.NL'>HtE
??trt^
y<`t(u#
J"{6FM6m}v
BJ&tp5v
fcDvF_{py
tIsxIc
vFm3IM34I&
w34I&t0^
vev]t(trR?
f4pNGsq cPv>n
6v6`<<r
=3wX-BnZz
;wIm `&6m
v3vwI&t1^
MtWpZ4~cPvA
=wIMvwIv
Nt?Z43vwI&c
Nwsq%cvm&{*vb6vNGsq
v#vwI$cvNp{v
5wINGsq
JtvpHE
_vtJt^qI/x
#vwI$t1^
#vwI$tq'7v
_quI)\
nZNQ*DfQ3vQ??
vcvrz3
N_sqy<B&c
LBZtm%cv
v|bJ;r
?|?3CqIYI
tZi7(v
s.NLq\
78pvtr
/_)??tqo,vtqW,vtq_,v
wtq*vtq7,v
NLbcXvm&tr
~c6vrnZu#
;3sW;3wWv
ftrJ)vztrJ)v]a3vQ?trJ)v)BnZbP=
KsGK
5Kcvs;.vtZ
?3sN_sqcvBN
6v6`J7@v
ICcvcdv3
BJ)u(g
Mr{.FMz
MrsO6J
B6`3?B&c
??(Zu#
PZgE!cLvrb
$YHR?3;t
;wHzcgtr~
nv=WKjv
m3tIM~
#tIwqU^bIO
vrb]4b
7~vMvt.It
zvCKJu
=GK~v<?2
r8|w#tI\q
vI!+Z4
vI!cHvrbt~v7CK
tW=sHo
vtBu=wHzvI
Zv=3 }6
wrOLa?aK
vty<\v;ItW^
v3tI&c
3tI>ItntFu=sHo
tI"vtBu;
tI%cLtrz
?oKtNu^
tI>ItxS
??tRv^
7ovYHR?
v\43uI&
sv<\4o
6PICG4ok
q@)^??
*ts6NL~
?y 53vI
v3vIDv|?I
BMps R
=#tE?+I
#vI c@v3
vI>KtR
?It.t^S
gvcv3vIs6NLm
v3vI&_4o
Kr cv6v
s6NL6v
v_43uI&cvNwsq
KtW;wI4S
v3uIvA-
j3uIwN_sq
HtW^~|I/
;wIm%v
I I]4o2
vIv`)79v
vc8vow
cDvNwsq
vIG'vt
?tro'v
fy<R@w[
fWvcvpGKj
&c vm .
Kr>Vtzcdv6v6`a7evL
Kr>Vtzc
vNGsqGKG]z``
vYHR?3
~4NwsqGsq
l3TILGC
GwZV^IO
INGsqG}~
KtN_sqw
^|If6v|?
v3vI&_4o
3uI&cPv
HtCv3uIw
S3uIwO
HtWvcv
I+I]4o2
53pIv`)7$
vc\v3pIw
v3wI&xm
JtW^IO
v3pI& t5
vm>Kt3pI&cv3vI&t"t^
HIMNwsq>Ktm
Yvcv+vI`=H
E%t"t^IIO
*t5W>Kt t5N_sq cvNwsq
v3vI&c
I/Icv3vI)\
s6NLQ?l
c0vT^W
8#v|?3{q cvQ^
vQ?YHR?W
sQ?`~vcv
Nvctvo
BNs.NLX`
uv|?3sq)\
vpU^-uIO
3qd7dv
v3PvQ?
BR&cPvm
KEv4@?
v=73|I&cv-
Ft5tG6J
52K{Im
kv^43sI&cvFG{p
3sI&c[
wrOLqtm
Iy<,t;JtW;
_c$vueJ\q
w.|[^?<
v3sI&c
v^43sI&cvrb`Dv
{6FM3sI&u^43uI&cvo
53uI&c,v1
Jt5W;wIo
kv@^43sI&cvrf
Bt2swI
FM3sI&c
I6HtP^
6BtqP6cv3sIe
v3sI&tBt^
;sIm>Nto
&c`vF_{p
JtW>Nt
3jwI>Ntd
v3uI&t2R
BN&cv|`
BF&cvQ^3
>t5p]v4z(v|?7I
cBRtN_sq
[v&^4o
=m??|?
kv^43uI&cvKE~Z""
t?3wYi
BJy<BJ&
tQ;sIb
t5NGsq cvKE~Z""
;3wW|cE
Nl3uILmcE
v=73uI&cTYtrn
^4ov^~hIO
KEv4XU
73}I&cvm
ga~wILsJ_[WIC3v;7
uI!ctX
XtW;wI.tv
HtW^ fIOo?cI
5cIsv4@h
FM6v)u#
kv^43uI&c`v3uI&
42t5Nwsq)B
vtfR?P
5ts.NLKE~Z""
3uI&cv
??bvE#
?RJ$trN/
OMuhv4
Ia?c#v
Ia?c'v
kvclvFG{p
KtWICozvc
v43RpI vt
(JtFm3jpIM3IwIw`7^
2Jt4pIFw{p
3vI&cv3]pI&cu
tFm3npIM3YwI&c
?3WF_{p
yvQ4oU
v^Q4o&
<7vFw{p
FIclvq
7.\vcPvq
HtW^zI}v3uI&;7oF
]IKE&c7tX
tI^4oV
{.FM3uI&cHvm
K v*v>E
^hyIv4t7
^IO'(uvt"*u
wm&cj\tX
/{/WjF
/CC/d/
/e[/e[/e[/e[/Z/Z/\/\/e[/e[/e[/e[/Z/Z/\/Q]/e[/e[/e[/e[/Z/Z/\/\/e[/e[/e[/e[/Z/Z/\/\/e[/e[/e[/e[/Z/Z/Z/\/e[/e[/e[/e[/Z/Z/Z/\/e[/e[/e[/e[/Z/Z/Z/\/e[/e[/e[/e[/Z/Z/Z/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/e[/e[/Z/Z/VZ/]/
]/]/Z/]/\/\/\/\/Z/Z/Z/Z/Z/Z/Z/Z/Z/Z/Z/Z/Z/Z/Z/Z/]/]/]/]/e[/e[/e[/e[/e[/e[/e[/e[/e[/e[/e[/e[/\/\/\/\/\/\/\/\/\/\/]/\/\/\/\/\/
]/\/\/\/\/Z/
]/\/\/\/\/\/\/Z/Z/Z/Z/Z/Z/Z/Z/
]/]/]/.]/\/e[/e[/]/]/<]/\/.]/\/\/{[/\/\/e[/e[/e[/e[/Z/Z/\/\/e[/e[/e[/e[/e[/e[/e[/e[/Z/Z/Z/Z/Z/Z/Z/Z/
]/]/Z/\/\/\/\/
Z/H]/*Z/*Z/\/\/Z/Z/\/\/\/\/\/\/e[/e[/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/K
RvwKuKu}uAmAzKJ]w/mAxy|`JLpAW`||zFwaT_pX
[W|xZMkj]v/L}WpJ}
]z\*aa/
/mZk|jJPIkNpA
%wKuKu/
JwC+Ku/lJ*
/j]+Ku/
FmNI@|[
JZ]|[kLjf
J}JjHX/
JwC+Kul@{W/
9 9@wLpA|[{FqK
o&N8c.{p
xAmM9Z9A]|tK7"=/
/I/U)7
/7Jm/1/
/9/7Km/M/
/9/7Nx//
/Y/C7Km//
/y/C7Jv//
/9/7Km/Q/
Pk9Pw#
yLPr'tY)
b|k#$| +
7r@LRO
/k/
&|mEN3
/mR"6JuZ
hMR"6JuZ
/$ |l'^
bH`rRRtRk$
`^}$@(
`^}$@tP
RRtRC$
g|Rk/06
w|RRRtR+$
`^}$@(
Cb/tR $
g|RtR;$
m/tR3$
`^}$@q$/
`^}$@0
`^}$@s
`^}$@(
RR;F/8
%|IV$<.
=c;,@I
/xL|HpDt@Ej~C
/5/%/M/i/////
/9/1/-/%/Q/
/5/%/M/i/////
/9/1/-/%/Q/
vJj/hmZkAM]xf
/hmAp@tAJ]w\
lvJxK|/&hmVmBpJm]X/LhmFr@w/`|bmW
}uApKxwWz/p}_w/VpiAvIxK|/
/y]pJ~\mZ
/v\xKh\kN
#iKqsY
/)/}Gu_mWe
/)/-/!/}C}CQ/%/
/FFTFY
r:`>dj.(
/+h/k/;k/
/x/|/x/i/x/l/l/l/|/z/v/|/
@mN|bz@v[P
p]jI7@6\i
|F7C&]$Jx
|JkGx@mMxD|H+Gm
zKm[q[#
pZu\7@6_uHi_q[#
pZu\7@6FuHi_<
+/oj^c<sz[+Km
E\|Jp/uY
9\E@tA7@
\zBxKiIEB7W
\zKiI# lJ~
Jp[kJoLI@|\r]|
Vv%Lp[
Am@9^1T|Ii]w
vNpA;\"\mF|Z1^n
A@KL(/\]t/jZ4bz@v[P[kJ9Wu]ks|_vJ|J
Xksp]jIEjJ[i|m_[@jan]z\
k_zM|_xKsp]jIEF}XEZkAO]pA\_vJE]nJ|
vJjhvNLJVIpJJIn]EFk\
spKnsl]wykFwfm]|
|[w\(
`Mn\bz@v[NAv\Z]|[|\vswJw[J[pHE@|sl
lLpAhX0KzBw
"\mF|Z1^n
Qn'{Mj<
%{Mj%gX
m/jLzMpKlJ
]z\9w</K`#m}
w8_z/iL
9n\%I@|\+Jm
]xJvC|_+AiGmdKj*
9fXvi%+ XlP_
}%+ I_
<s<]aXkW9
r%( [aK
/#/j/|
oA9@~]JIn]EFk\
spKnsl]wykFw||C|Yz`sL]C`@}nx[|[M]xF~@|/Z|]
EAkL|Yk
<sjKuT l)
)bu@tKK^|[
]~N9@zL|%v[w
`J9JmGt"
[@j]jA9N
Q\9@9@w"INt
lwJm[i
mW6[u%
Qn'{Mj\]k %{Mj%gX
[k'G']v
v[xJ]|u@l
xC}lWjMcW{#
jlWjM%\/xG4@m@#%kW4"
m_6/Q{6
/_]JH|[I
j/vBlHj
\9@tZ~\
`Mn\bz@v[P[kJ9Wu]kbp/|/l@lHj/V{XjTLv@mxw@jlkJmJj@EWu]knmltCm/L{W
amAtNqKx\vK
\</jtj
aCk]I[kl|[P\xL
bz@v[P[kJ9Wu]k/
>76| 6
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
closesocket
connect
gethostbyname
inet_addr
ioctlsocket
listen
select
socket
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
GetStockObject
DeleteObject
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_strcmpi
_stricmp
memcpy
memset
signal
sprintf
sscanf
strcat
strchr
strncmp
wsock32.dll
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
L < C < C < C
P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C
d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.