SmartHawk

5.8

高危

51 个模型检测该样本为恶意！

重新分析

下载样本

d35aeec2558b2fbbfddb761ecdef94c1c6b085af83d6905ab7851af1217c1543

832abaa101095edfed93fcefe033116f.exe

分析耗时

90s

最近分析

文件大小

785.0KB

静态报毒动态报毒 100% 5TSYF+YBLQTXDPAMBOBXEA 91BOJ551ESG AI SCORE=86 AIDETECTVM BSCOPE CONFIDENCE DELF DXMO EMIJ FAREIT GENERIC@ML GENERICKD GENERICRXKX GENKRYPT GENKRYPTIK GULOADER HIGH CONFIDENCE HOGAVT MALWARE1 MALWARE@#2IMJYTJTX4TZI RDMK REMCOS SIGGEN2 STATIC AI SUSGEN SUSPICIOUS PE TROJANX UNSAFE XGW@AEEZNVPI XNSG ZELPHICO 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXKX-QJ!832ABAA10109	20201211	6.0.6.653
Alibaba	Backdoor:Win32/Injector.1f8c7e86	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20201210	21.1.5827.0
Tencent	Win32.Backdoor.Remcos.Dxmo	20201211	1.0.0.1
Kingsoft		20201211	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619705148.505751 __exception__	stacktrace: 0x1fe41aa 0x369fe6c registers.esp: 57277464 registers.edi: 0 registers.eax: 0 registers.ebp: 57277492 registers.edx: 0 registers.ebx: 0 registers.esi: 57277508 registers.ecx: 4294967294 exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 44 exception.instruction: mov eax, dword ptr [eax + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1fe8e01	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619705097.286751 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005d0000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619705124.771751 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (2 个事件)

host	113.108.239.196
host	172.217.24.14

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619705127.333751 RegSetValueExA	key_handle: 0x000003c4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619705127.333751 RegSetValueExA	key_handle: 0x000003c4 value: °'¶Ô<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619705127.333751 RegSetValueExA	key_handle: 0x000003c4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619705127.333751 RegSetValueExW	key_handle: 0x000003c4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619705127.333751 RegSetValueExA	key_handle: 0x000003dc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619705127.333751 RegSetValueExA	key_handle: 0x000003dc value: °'¶Ô<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619705127.333751 RegSetValueExA	key_handle: 0x000003dc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619705127.380751 RegSetValueExW	key_handle: 0x000003c0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.33961469
FireEye	Generic.mg.832abaa101095edf
McAfee	GenericRXKX-QJ!832ABAA10109
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 00567ff81 )
Alibaba	Backdoor:Win32/Injector.1f8c7e86
K7GW	Trojan ( 00567ff81 )
Cybereason	malicious.959edd
Arcabit	Trojan.Generic.D20635FD
Cyren	W32/Genkrypt.XNSG-5272
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
BitDefender	Trojan.GenericKD.33961469
NANO-Antivirus	Trojan.Win32.Remcos.hogavt
Paloalto	generic.ml
Tencent	Win32.Backdoor.Remcos.Dxmo
Ad-Aware	Trojan.GenericKD.33961469
Emsisoft	Trojan.GenericKD.33961469 (B)
Comodo	Malware@#2imjytjtx4tzi
DrWeb	Trojan.PWS.Siggen2.49886
Zillya	Backdoor.Remcos.Win32.2626
McAfee-GW-Edition	GenericRXKX-QJ!832ABAA10109
Sophos	Mal/Generic-S
Ikarus	Trojan.Inject
Antiy-AVL	Trojan[Backdoor]/Win32.Remcos
Microsoft	PWS:Win32/Fareit.ART!MTB
AegisLab	Trojan.Win32.Generic.4!c
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Trojan.GenericKD.33961469
BitDefenderTheta	Gen:NN.ZelphiCO.34670.XGW@aeEZnvpi
ALYac	Trojan.GenericKD.33961469
MAX	malware (ai score=86)
VBA32	BScope.Backdoor.Remcos
Malwarebytes	Trojan.GuLoader
Zoner	Trojan.Win32.89769
ESET-NOD32	a variant of Win32/Injector.EMIJ
Rising	Trojan.Generic@ML.83 (RDMK:5tsYf+YBLqtxDPAmbobXEA)
Yandex	Trojan.GenKryptik!91BoJ551ESg
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.9833444.susgen
Fortinet	W32/Delf.BZL!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_100% (W)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	31.13.83.1:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x48317c DeleteCriticalSection

• 0x483180 LeaveCriticalSection

• 0x483184 EnterCriticalSection

• 0x483188 InitializeCriticalSection

• 0x48318c VirtualFree

• 0x483190 VirtualAlloc

• 0x483194 LocalFree

• 0x483198 LocalAlloc

• 0x48319c GetTickCount

• 0x4831a0 QueryPerformanceCounter

• 0x4831a4 GetVersion

• 0x4831a8 GetCurrentThreadId

• 0x4831ac InterlockedDecrement

• 0x4831b0 InterlockedIncrement

• 0x4831b4 VirtualQuery

• 0x4831b8 WideCharToMultiByte

• 0x4831bc MultiByteToWideChar

• 0x4831c0 lstrlenA

• 0x4831c4 lstrcpynA

• 0x4831c8 LoadLibraryExA

• 0x4831cc GetThreadLocale

• 0x4831d0 GetStartupInfoA

• 0x4831d4 GetProcAddress

• 0x4831d8 GetModuleHandleA

• 0x4831dc GetModuleFileNameA

• 0x4831e0 GetLocaleInfoA

• 0x4831e4 GetLastError

• 0x4831e8 GetCommandLineA

• 0x4831ec FreeLibrary

• 0x4831f0 FindFirstFileA

• 0x4831f4 FindClose

• 0x4831f8 ExitProcess

• 0x4831fc WriteFile

• 0x483200 UnhandledExceptionFilter

• 0x483204 SetFilePointer

• 0x483208 SetEndOfFile

• 0x48320c RtlUnwind

• 0x483210 ReadFile

• 0x483214 RaiseException

• 0x483218 GetStdHandle

• 0x48321c GetFileSize

• 0x483220 GetFileType

• 0x483224 CreateFileA

• 0x483228 CloseHandle

Library user32.dll:

• 0x483230 GetKeyboardType

• 0x483234 LoadStringA

• 0x483238 MessageBoxA

• 0x48323c CharNextA

Library advapi32.dll:

• 0x483244 RegQueryValueExA

• 0x483248 RegOpenKeyExA

• 0x48324c RegCloseKey

Library oleaut32.dll:

• 0x483254 SysFreeString

• 0x483258 SysReAllocStringLen

• 0x48325c SysAllocStringLen

Library kernel32.dll:

• 0x483264 TlsSetValue

• 0x483268 TlsGetValue

• 0x48326c LocalAlloc

• 0x483270 GetModuleHandleA

Library advapi32.dll:

• 0x483278 RegQueryValueExA

• 0x48327c RegOpenKeyExA

• 0x483280 RegCloseKey

Library kernel32.dll:

• 0x483288 lstrcpyA

• 0x48328c WriteFile

• 0x483290 WaitForSingleObject

• 0x483294 VirtualQuery

• 0x483298 VirtualProtect

• 0x48329c VirtualAlloc

• 0x4832a0 Sleep

• 0x4832a4 SizeofResource

• 0x4832a8 SetThreadLocale

• 0x4832ac SetFilePointer

• 0x4832b0 SetEvent

• 0x4832b4 SetErrorMode

• 0x4832b8 SetEndOfFile

• 0x4832bc ResetEvent

• 0x4832c0 ReadFile

• 0x4832c4 MultiByteToWideChar

• 0x4832c8 MulDiv

• 0x4832cc LockResource

• 0x4832d0 LoadResource

• 0x4832d4 LoadLibraryA

• 0x4832d8 LeaveCriticalSection

• 0x4832dc InitializeCriticalSection

• 0x4832e0 GlobalUnlock

• 0x4832e4 GlobalSize

• 0x4832e8 GlobalReAlloc

• 0x4832ec GlobalHandle

• 0x4832f0 GlobalLock

• 0x4832f4 GlobalFree

• 0x4832f8 GlobalFindAtomA

• 0x4832fc GlobalDeleteAtom

• 0x483300 GlobalAlloc

• 0x483304 GlobalAddAtomA

• 0x483308 GetVersionExA

• 0x48330c GetVersion

• 0x483310 GetUserDefaultLCID

• 0x483314 GetTickCount

• 0x483318 GetThreadLocale

• 0x48331c GetSystemInfo

• 0x483320 GetStringTypeExA

• 0x483324 GetStdHandle

• 0x483328 GetProcAddress

• 0x48332c GetModuleHandleA

• 0x483330 GetModuleFileNameA

• 0x483334 GetLocaleInfoA

• 0x483338 GetLocalTime

• 0x48333c GetLastError

• 0x483340 GetFullPathNameA

• 0x483344 GetDiskFreeSpaceA

• 0x483348 GetDateFormatA

• 0x48334c GetCurrentThreadId

• 0x483350 GetCurrentProcessId

• 0x483354 GetCPInfo

• 0x483358 GetACP

• 0x48335c FreeResource

• 0x483360 InterlockedExchange

• 0x483364 FreeLibrary

• 0x483368 FormatMessageA

• 0x48336c FindResourceA

• 0x483370 EnumCalendarInfoA

• 0x483374 EnterCriticalSection

• 0x483378 DeleteCriticalSection

• 0x48337c CreateThread

• 0x483380 CreateFileA

• 0x483384 CreateEventA

• 0x483388 CompareStringA

• 0x48338c CloseHandle

Library version.dll:

• 0x483394 VerQueryValueA

• 0x483398 GetFileVersionInfoSizeA

• 0x48339c GetFileVersionInfoA

Library gdi32.dll:

• 0x4833a4 UnrealizeObject

• 0x4833a8 StretchBlt

• 0x4833ac SetWindowOrgEx

• 0x4833b0 SetWinMetaFileBits

• 0x4833b4 SetViewportOrgEx

• 0x4833b8 SetTextColor

• 0x4833bc SetStretchBltMode

• 0x4833c0 SetROP2

• 0x4833c4 SetPixel

• 0x4833c8 SetEnhMetaFileBits

• 0x4833cc SetDIBColorTable

• 0x4833d0 SetBrushOrgEx

• 0x4833d4 SetBkMode

• 0x4833d8 SetBkColor

• 0x4833dc SelectPalette

• 0x4833e0 SelectObject

• 0x4833e4 SelectClipRgn

• 0x4833e8 SaveDC

• 0x4833ec RestoreDC

• 0x4833f0 Rectangle

• 0x4833f4 RectVisible

• 0x4833f8 RealizePalette

• 0x4833fc Polyline

• 0x483400 PlayEnhMetaFile

• 0x483404 PatBlt

• 0x483408 MoveToEx

• 0x48340c MaskBlt

• 0x483410 LineTo

• 0x483414 IntersectClipRect

• 0x483418 GetWindowOrgEx

• 0x48341c GetWinMetaFileBits

• 0x483420 GetTextMetricsA

• 0x483424 GetTextExtentPoint32A

• 0x483428 GetSystemPaletteEntries

• 0x48342c GetStockObject

• 0x483430 GetPixel

• 0x483434 GetPaletteEntries

• 0x483438 GetObjectA

• 0x48343c GetEnhMetaFilePaletteEntries

• 0x483440 GetEnhMetaFileHeader

• 0x483444 GetEnhMetaFileDescriptionA

• 0x483448 GetEnhMetaFileBits

• 0x48344c GetDeviceCaps

• 0x483450 GetDIBits

• 0x483454 GetDIBColorTable

• 0x483458 GetDCOrgEx

• 0x48345c GetCurrentPositionEx

• 0x483460 GetClipBox

• 0x483464 GetBrushOrgEx

• 0x483468 GetBitmapBits

• 0x48346c GdiFlush

• 0x483470 ExtTextOutA

• 0x483474 ExcludeClipRect

• 0x483478 DeleteObject

• 0x48347c DeleteEnhMetaFile

• 0x483480 DeleteDC

• 0x483484 CreateSolidBrush

• 0x483488 CreatePenIndirect

• 0x48348c CreatePalette

• 0x483490 CreateHalftonePalette

• 0x483494 CreateFontIndirectA

• 0x483498 CreateEnhMetaFileA

• 0x48349c CreateDIBitmap

• 0x4834a0 CreateDIBSection

• 0x4834a4 CreateCompatibleDC

• 0x4834a8 CreateCompatibleBitmap

• 0x4834ac CreateBrushIndirect

• 0x4834b0 CreateBitmap

• 0x4834b4 CopyEnhMetaFileA

• 0x4834b8 CloseEnhMetaFile

• 0x4834bc BitBlt

Library user32.dll:

• 0x4834c4 CreateWindowExA

• 0x4834c8 WindowFromPoint

• 0x4834cc WinHelpA

• 0x4834d0 WaitMessage

• 0x4834d4 UpdateWindow

• 0x4834d8 UnregisterClassA

• 0x4834dc UnhookWindowsHookEx

• 0x4834e0 TranslateMessage

• 0x4834e4 TranslateMDISysAccel

• 0x4834e8 TrackPopupMenu

• 0x4834ec SystemParametersInfoA

• 0x4834f0 ShowWindow

• 0x4834f4 ShowScrollBar

• 0x4834f8 ShowOwnedPopups

• 0x4834fc ShowCursor

• 0x483500 SetWindowsHookExA

• 0x483504 SetWindowTextA

• 0x483508 SetWindowPos

• 0x48350c SetWindowPlacement

• 0x483510 SetWindowLongA

• 0x483514 SetTimer

• 0x483518 SetScrollRange

• 0x48351c SetScrollPos

• 0x483520 SetScrollInfo

• 0x483524 SetRect

• 0x483528 SetPropA

• 0x48352c SetParent

• 0x483530 SetMenuItemInfoA

• 0x483534 SetMenu

• 0x483538 SetForegroundWindow

• 0x48353c SetFocus

• 0x483540 SetCursor

• 0x483544 SetClassLongA

• 0x483548 SetCapture

• 0x48354c SetActiveWindow

• 0x483550 SendMessageA

• 0x483554 ScrollWindow

• 0x483558 ScreenToClient

• 0x48355c RemovePropA

• 0x483560 RemoveMenu

• 0x483564 ReleaseDC

• 0x483568 ReleaseCapture

• 0x48356c RegisterWindowMessageA

• 0x483570 RegisterClipboardFormatA

• 0x483574 RegisterClassA

• 0x483578 RedrawWindow

• 0x48357c PtInRect

• 0x483580 PostQuitMessage

• 0x483584 PostMessageA

• 0x483588 PeekMessageA

• 0x48358c OffsetRect

• 0x483590 OemToCharA

• 0x483594 MessageBoxA

• 0x483598 MapWindowPoints

• 0x48359c MapVirtualKeyA

• 0x4835a0 LoadStringA

• 0x4835a4 LoadKeyboardLayoutA

• 0x4835a8 LoadIconA

• 0x4835ac LoadCursorA

• 0x4835b0 LoadBitmapA

• 0x4835b4 KillTimer

• 0x4835b8 IsZoomed

• 0x4835bc IsWindowVisible

• 0x4835c0 IsWindowEnabled

• 0x4835c4 IsWindow

• 0x4835c8 IsRectEmpty

• 0x4835cc IsIconic

• 0x4835d0 IsDialogMessageA

• 0x4835d4 IsChild

• 0x4835d8 InvalidateRect

• 0x4835dc IntersectRect

• 0x4835e0 InsertMenuItemA

• 0x4835e4 InsertMenuA

• 0x4835e8 InflateRect

• 0x4835ec GetWindowThreadProcessId

• 0x4835f0 GetWindowTextA

• 0x4835f4 GetWindowRect

• 0x4835f8 GetWindowPlacement

• 0x4835fc GetWindowLongA

• 0x483600 GetWindowDC

• 0x483604 GetTopWindow

• 0x483608 GetSystemMetrics

• 0x48360c GetSystemMenu

• 0x483610 GetSysColorBrush

• 0x483614 GetSysColor

• 0x483618 GetSubMenu

• 0x48361c GetScrollRange

• 0x483620 GetScrollPos

• 0x483624 GetScrollInfo

• 0x483628 GetPropA

• 0x48362c GetParent

• 0x483630 GetWindow

• 0x483634 GetMessageTime

• 0x483638 GetMenuStringA

• 0x48363c GetMenuState

• 0x483640 GetMenuItemInfoA

• 0x483644 GetMenuItemID

• 0x483648 GetMenuItemCount

• 0x48364c GetMenu

• 0x483650 GetLastActivePopup

• 0x483654 GetKeyboardState

• 0x483658 GetKeyboardLayoutList

• 0x48365c GetKeyboardLayout

• 0x483660 GetKeyState

• 0x483664 GetKeyNameTextA

• 0x483668 GetIconInfo

• 0x48366c GetForegroundWindow

• 0x483670 GetFocus

• 0x483674 GetDlgItem

• 0x483678 GetDesktopWindow

• 0x48367c GetDCEx

• 0x483680 GetDC

• 0x483684 GetCursorPos

• 0x483688 GetCursor

• 0x48368c GetClipboardData

• 0x483690 GetClientRect

• 0x483694 GetClassNameA

• 0x483698 GetClassInfoA

• 0x48369c GetCapture

• 0x4836a0 GetActiveWindow

• 0x4836a4 FrameRect

• 0x4836a8 FindWindowA

• 0x4836ac FillRect

• 0x4836b0 EqualRect

• 0x4836b4 EnumWindows

• 0x4836b8 EnumThreadWindows

• 0x4836bc EndPaint

• 0x4836c0 EnableWindow

• 0x4836c4 EnableScrollBar

• 0x4836c8 EnableMenuItem

• 0x4836cc DrawTextA

• 0x4836d0 DrawMenuBar

• 0x4836d4 DrawIconEx

• 0x4836d8 DrawIcon

• 0x4836dc DrawFrameControl

• 0x4836e0 DrawFocusRect

• 0x4836e4 DrawEdge

• 0x4836e8 DispatchMessageA

• 0x4836ec DestroyWindow

• 0x4836f0 DestroyMenu

• 0x4836f4 DestroyIcon

• 0x4836f8 DestroyCursor

• 0x4836fc DeleteMenu

• 0x483700 DefWindowProcA

• 0x483704 DefMDIChildProcA

• 0x483708 DefFrameProcA

• 0x48370c CreatePopupMenu

• 0x483710 CreateMenu

• 0x483714 CreateIcon

• 0x483718 ClientToScreen

• 0x48371c CheckMenuItem

• 0x483720 CallWindowProcA

• 0x483724 CallNextHookEx

• 0x483728 BeginPaint

• 0x48372c CharNextA

• 0x483730 CharLowerBuffA

• 0x483734 CharLowerA

• 0x483738 CharToOemA

• 0x48373c AdjustWindowRectEx

• 0x483740 ActivateKeyboardLayout

Library kernel32.dll:

• 0x483748 Sleep

Library oleaut32.dll:

• 0x483750 SafeArrayPtrOfIndex

• 0x483754 SafeArrayGetUBound

• 0x483758 SafeArrayGetLBound

• 0x48375c SafeArrayCreate

• 0x483760 VariantChangeType

• 0x483764 VariantCopy

• 0x483768 VariantClear

• 0x48376c VariantInit

Library ole32.dll:

• 0x483774 CreateStreamOnHGlobal

• 0x483778 IsAccelerator

• 0x48377c OleDraw

• 0x483780 OleSetMenuDescriptor

• 0x483784 CoCreateInstance

• 0x483788 CoGetClassObject

• 0x48378c CoUninitialize

• 0x483790 CoInitialize

• 0x483794 IsEqualGUID

Library oleaut32.dll:

• 0x48379c GetErrorInfo

• 0x4837a0 SysFreeString

Library comctl32.dll:

• 0x4837a8 ImageList_SetIconSize

• 0x4837ac ImageList_GetIconSize

• 0x4837b0 ImageList_Write

• 0x4837b4 ImageList_Read

• 0x4837b8 ImageList_GetDragImage

• 0x4837bc ImageList_DragShowNolock

• 0x4837c0 ImageList_SetDragCursorImage

• 0x4837c4 ImageList_DragMove

• 0x4837c8 ImageList_DragLeave

• 0x4837cc ImageList_DragEnter

• 0x4837d0 ImageList_EndDrag

• 0x4837d4 ImageList_BeginDrag

• 0x4837d8 ImageList_Remove

• 0x4837dc ImageList_DrawEx

• 0x4837e0 ImageList_Draw

• 0x4837e4 ImageList_GetBkColor

• 0x4837e8 ImageList_SetBkColor

• 0x4837ec ImageList_ReplaceIcon

• 0x4837f0 ImageList_Add

• 0x4837f4 ImageList_SetImageCount

• 0x4837f8 ImageList_GetImageCount

• 0x4837fc ImageList_Destroy

• 0x483800 ImageList_Create

Library comdlg32.dll:

• 0x483808 ChooseColorA

• 0x48380c GetSaveFileNameA

• 0x483810 GetOpenFileNameA

Library advapi32.dll:

• 0x483818 QueryServiceStatus

• 0x48381c OpenServiceA

• 0x483820 OpenSCManagerA

• 0x483824 CloseServiceHandle

Library URL.DLL:

• 0x48382c InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.160.78
drive.google.com	A 31.13.83.1	128.121.243.228
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.