SmartHawk

7.2

高危

58 个模型检测该样本为恶意！

重新分析

下载样本

29e5d8196d419e7731d97b71a59f0cb5f4158cf3c7e285241bf74d05815b734c

836f77a9d93dd6a9b197cb8faedfd7ed.exe

分析耗时

90s

最近分析

文件大小

726.0KB

静态报毒动态报毒 AI SCORE=81 AUTOIT AVSARHER BUBC58 CLASSIC CONFIDENCE DATASTEALER DELF DELPHI DELPHILESS DZAD EMTN EMUK FAREIT FORMBOOK GENERICKDZ HIGH CONFIDENCE HPCXYF KCLOUD KPIBO KRYPTIK LOKIBOT MALWARE@#2NI26A0G7OU6Y NANOCORE QVM05 SCORE STATIC AI SUSGEN SUSPICIOUS PE TGW@AIMJTIPI TSCOPE UNSAFE UOXO X2094 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/FormBook.3ea9af37	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201226	21.1.5827.0
Kingsoft	Win32.Troj.Undef.(kcloud)	20201226	2017.9.26.565
McAfee	Fareit-FPQ!836F77A9D93D	20201226	6.0.6.653
Tencent	Win32.Trojan.Injector.Dzad	20201226	1.0.0.1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619707444.802125 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a 836f77a9d93dd6a9b197cb8faedfd7ed+0x523f8 @ 0x4523f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe7c14ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619707444.802125
__exception__

stacktrace:

RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
836f77a9d93dd6a9b197cb8faedfd7ed+0x523f8 @ 0x4523f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe7c14ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (28 个事件)

Time & API	Arguments	Status
1619707439.754375 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00360000	success
1619707439.973375 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 77824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x005d0000	success
1619707439.973375 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00600000	success
1619707440.552125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619707440.567125 NtAllocateVirtualMemory	process_identifier: 2740 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01fb0000	success
1619707440.567125 NtAllocateVirtualMemory	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02170000	success
1619707440.567125 NtAllocateVirtualMemory	process_identifier: 2740 region_size: 303104 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00500000	success
1619707440.583125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 278528 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fa2000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fa2000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fa2000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fa2000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fa2000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fa2000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fa2000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fa2000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fa2000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fa2000	success
1619707444.770125 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.55274358013966

section

{'size_of_data': '0x0003b200', 'virtual_address': '0x00080000', 'entropy': 7.55274358013966, 'name': '.rsrc', 'virtual_size': '0x0003b078'}

description

A section with a high entropy has been found

entropy

0.32620689655172413

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2104 called NtSetContextThread to modify thread in remote process 2740
1619707440.332375 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4848336 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2740	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2104 resumed a thread in remote process 2740
1619707440.363375 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 2740	success	0	0

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619707440.301375 CreateProcessInternalW	thread_identifier: 732 thread_handle: 0x000000f8 process_identifier: 2740 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\836f77a9d93dd6a9b197cb8faedfd7ed.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000fc inherit_handles: 0	success	1
1619707440.301375 NtUnmapViewOfSection	process_identifier: 2740 region_size: 4096 process_handle: 0x000000fc base_address: 0x00400000	success	0
1619707440.301375 NtMapViewOfSection	section_handle: 0x00000104 process_identifier: 2740 commit_size: 659456 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000fc allocation_type: 0 () section_offset: 0 view_size: 659456 base_address: 0x00400000	success	0
1619707440.332375 NtGetContextThread	thread_handle: 0x000000f8	success	0
1619707440.332375 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4848336 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2740	success	0
1619707440.363375 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 2740	success	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69102
FireEye	Generic.mg.836f77a9d93dd6a9
ALYac	Trojan.GenericKDZ.69102
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.754865
Sangfor	Malware
K7AntiVirus	Trojan ( 0056b6131 )
Alibaba	Trojan:Win32/FormBook.3ea9af37
K7GW	Trojan ( 0056b6131 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Generic.D10DEE
BitDefenderTheta	Gen:NN.ZelphiF.34700.TGW@aiMjTipi
Cyren	W32/Trojan.UOXO-1515
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Dropper.Nanocore-9235748-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.GenericKDZ.69102
NANO-Antivirus	Trojan.Win32.Stealer.hpcxyf
Paloalto	generic.ml
Rising	Trojan.Injector!1.C99D (CLASSIC)
Ad-Aware	Trojan.GenericKDZ.69102
Emsisoft	Trojan.GenericKDZ.69102 (B)
Comodo	Malware@#2ni26a0g7ou6y
F-Secure	Dropper.DR/Delphi.kpibo
DrWeb	Trojan.PWS.Stealer.19347
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Fareit.bh
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.Kryptik.byu
Avira	DR/Delphi.kpibo
MAX	malware (ai score=81)
Antiy-AVL	Trojan/Win32.Kryptik
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Kryptik.oa
Microsoft	Trojan:Win32/DataStealer.VD!MTB
AegisLab	Trojan.Win32.Kryptik.4!c
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.GenericKDZ.69102
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2094
Acronis	suspicious
McAfee	Fareit-FPQ!836F77A9D93D
VBA32	TScope.Trojan.Delf
Malwarebytes	Spyware.LokiBot
Zoner	Trojan.Win32.91606
ESET-NOD32	a variant of Win32/Injector.EMUK

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	216.58.200.238:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47412c DeleteCriticalSection

• 0x474130 LeaveCriticalSection

• 0x474134 EnterCriticalSection

• 0x474138 InitializeCriticalSection

• 0x47413c VirtualFree

• 0x474140 VirtualAlloc

• 0x474144 LocalFree

• 0x474148 LocalAlloc

• 0x47414c GetVersion

• 0x474150 GetCurrentThreadId

• 0x474154 InterlockedDecrement

• 0x474158 InterlockedIncrement

• 0x47415c VirtualQuery

• 0x474160 WideCharToMultiByte

• 0x474164 MultiByteToWideChar

• 0x474168 lstrlenA

• 0x47416c lstrcpynA

• 0x474170 LoadLibraryExA

• 0x474174 GetThreadLocale

• 0x474178 GetStartupInfoA

• 0x47417c GetProcAddress

• 0x474180 GetModuleHandleA

• 0x474184 GetModuleFileNameA

• 0x474188 GetLocaleInfoA

• 0x47418c GetCommandLineA

• 0x474190 FreeLibrary

• 0x474194 FindFirstFileA

• 0x474198 FindClose

• 0x47419c ExitProcess

• 0x4741a0 WriteFile

• 0x4741a4 UnhandledExceptionFilter

• 0x4741a8 RtlUnwind

• 0x4741ac RaiseException

• 0x4741b0 GetStdHandle

Library user32.dll:

• 0x4741b8 GetKeyboardType

• 0x4741bc LoadStringA

• 0x4741c0 MessageBoxA

• 0x4741c4 CharNextA

Library advapi32.dll:

• 0x4741cc RegQueryValueExA

• 0x4741d0 RegOpenKeyExA

• 0x4741d4 RegCloseKey

Library oleaut32.dll:

• 0x4741dc SysFreeString

• 0x4741e0 SysReAllocStringLen

• 0x4741e4 SysAllocStringLen

Library kernel32.dll:

• 0x4741ec TlsSetValue

• 0x4741f0 TlsGetValue

• 0x4741f4 LocalAlloc

• 0x4741f8 GetModuleHandleA

Library advapi32.dll:

• 0x474200 RegQueryValueExA

• 0x474204 RegOpenKeyExA

• 0x474208 RegCloseKey

Library kernel32.dll:

• 0x474210 lstrcpyA

• 0x474214 WriteFile

• 0x474218 WaitForSingleObject

• 0x47421c VirtualQuery

• 0x474220 VirtualAlloc

• 0x474224 Sleep

• 0x474228 SizeofResource

• 0x47422c SetThreadLocale

• 0x474230 SetFilePointer

• 0x474234 SetEvent

• 0x474238 SetErrorMode

• 0x47423c SetEndOfFile

• 0x474240 ResetEvent

• 0x474244 ReadFile

• 0x474248 MulDiv

• 0x47424c LockResource

• 0x474250 LoadResource

• 0x474254 LoadLibraryA

• 0x474258 LeaveCriticalSection

• 0x47425c InitializeCriticalSection

• 0x474260 GlobalUnlock

• 0x474264 GlobalReAlloc

• 0x474268 GlobalHandle

• 0x47426c GlobalLock

• 0x474270 GlobalFree

• 0x474274 GlobalFindAtomA

• 0x474278 GlobalDeleteAtom

• 0x47427c GlobalAlloc

• 0x474280 GlobalAddAtomA

• 0x474284 GetVersionExA

• 0x474288 GetVersion

• 0x47428c GetTickCount

• 0x474290 GetThreadLocale

• 0x474294 GetSystemInfo

• 0x474298 GetStringTypeExA

• 0x47429c GetStdHandle

• 0x4742a0 GetProcAddress

• 0x4742a4 GetModuleHandleA

• 0x4742a8 GetModuleFileNameA

• 0x4742ac GetLocaleInfoA

• 0x4742b0 GetLocalTime

• 0x4742b4 GetLastError

• 0x4742b8 GetFullPathNameA

• 0x4742bc GetDiskFreeSpaceA

• 0x4742c0 GetDateFormatA

• 0x4742c4 GetCurrentThreadId

• 0x4742c8 GetCurrentProcessId

• 0x4742cc GetCPInfo

• 0x4742d0 GetACP

• 0x4742d4 FreeResource

• 0x4742d8 InterlockedExchange

• 0x4742dc FreeLibrary

• 0x4742e0 FormatMessageA

• 0x4742e4 FindResourceA

• 0x4742e8 EnumCalendarInfoA

• 0x4742ec EnterCriticalSection

• 0x4742f0 DeleteCriticalSection

• 0x4742f4 CreateThread

• 0x4742f8 CreateFileA

• 0x4742fc CreateEventA

• 0x474300 CompareStringA

• 0x474304 CloseHandle

Library version.dll:

• 0x47430c VerQueryValueA

• 0x474310 GetFileVersionInfoSizeA

• 0x474314 GetFileVersionInfoA

Library gdi32.dll:

• 0x47431c UnrealizeObject

• 0x474320 StretchBlt

• 0x474324 SetWindowOrgEx

• 0x474328 SetViewportOrgEx

• 0x47432c SetTextColor

• 0x474330 SetStretchBltMode

• 0x474334 SetROP2

• 0x474338 SetPixel

• 0x47433c SetDIBColorTable

• 0x474340 SetBrushOrgEx

• 0x474344 SetBkMode

• 0x474348 SetBkColor

• 0x47434c SelectPalette

• 0x474350 SelectObject

• 0x474354 SaveDC

• 0x474358 RestoreDC

• 0x47435c Rectangle

• 0x474360 RectVisible

• 0x474364 RealizePalette

• 0x474368 PtVisible

• 0x47436c PatBlt

• 0x474370 MoveToEx

• 0x474374 MaskBlt

• 0x474378 LineTo

• 0x47437c IntersectClipRect

• 0x474380 GetWindowOrgEx

• 0x474384 GetTextMetricsA

• 0x474388 GetTextExtentPoint32A

• 0x47438c GetSystemPaletteEntries

• 0x474390 GetStockObject

• 0x474394 GetPixel

• 0x474398 GetPaletteEntries

• 0x47439c GetObjectA

• 0x4743a0 GetDeviceCaps

• 0x4743a4 GetDIBits

• 0x4743a8 GetDIBColorTable

• 0x4743ac GetDCOrgEx

• 0x4743b0 GetCurrentPositionEx

• 0x4743b4 GetClipBox

• 0x4743b8 GetBrushOrgEx

• 0x4743bc GetBitmapBits

• 0x4743c0 ExcludeClipRect

• 0x4743c4 DeleteObject

• 0x4743c8 DeleteDC

• 0x4743cc CreateSolidBrush

• 0x4743d0 CreatePenIndirect

• 0x4743d4 CreatePen

• 0x4743d8 CreatePalette

• 0x4743dc CreateHalftonePalette

• 0x4743e0 CreateFontIndirectA

• 0x4743e4 CreateDIBitmap

• 0x4743e8 CreateDIBSection

• 0x4743ec CreateCompatibleDC

• 0x4743f0 CreateCompatibleBitmap

• 0x4743f4 CreateBrushIndirect

• 0x4743f8 CreateBitmap

• 0x4743fc BitBlt

Library user32.dll:

• 0x474404 CreateWindowExA

• 0x474408 WindowFromPoint

• 0x47440c WinHelpA

• 0x474410 WaitMessage

• 0x474414 ValidateRect

• 0x474418 UpdateWindow

• 0x47441c UnregisterClassA

• 0x474420 UnhookWindowsHookEx

• 0x474424 TranslateMessage

• 0x474428 TranslateMDISysAccel

• 0x47442c TrackPopupMenu

• 0x474430 SystemParametersInfoA

• 0x474434 ShowWindow

• 0x474438 ShowScrollBar

• 0x47443c ShowOwnedPopups

• 0x474440 ShowCursor

• 0x474444 SetWindowsHookExA

• 0x474448 SetWindowTextA

• 0x47444c SetWindowPos

• 0x474450 SetWindowPlacement

• 0x474454 SetWindowLongA

• 0x474458 SetTimer

• 0x47445c SetScrollRange

• 0x474460 SetScrollPos

• 0x474464 SetScrollInfo

• 0x474468 SetRect

• 0x47446c SetPropA

• 0x474470 SetParent

• 0x474474 SetMenuItemInfoA

• 0x474478 SetMenu

• 0x47447c SetForegroundWindow

• 0x474480 SetFocus

• 0x474484 SetCursor

• 0x474488 SetClassLongA

• 0x47448c SetCapture

• 0x474490 SetActiveWindow

• 0x474494 SendMessageA

• 0x474498 ScrollWindow

• 0x47449c ScreenToClient

• 0x4744a0 RemovePropA

• 0x4744a4 RemoveMenu

• 0x4744a8 ReleaseDC

• 0x4744ac ReleaseCapture

• 0x4744b0 RegisterWindowMessageA

• 0x4744b4 RegisterClipboardFormatA

• 0x4744b8 RegisterClassA

• 0x4744bc RedrawWindow

• 0x4744c0 PtInRect

• 0x4744c4 PostQuitMessage

• 0x4744c8 PostMessageA

• 0x4744cc PeekMessageA

• 0x4744d0 OffsetRect

• 0x4744d4 OemToCharA

• 0x4744d8 MessageBoxA

• 0x4744dc MessageBeep

• 0x4744e0 MapWindowPoints

• 0x4744e4 MapVirtualKeyA

• 0x4744e8 LoadStringA

• 0x4744ec LoadKeyboardLayoutA

• 0x4744f0 LoadIconA

• 0x4744f4 LoadCursorA

• 0x4744f8 LoadBitmapA

• 0x4744fc KillTimer

• 0x474500 IsZoomed

• 0x474504 IsWindowVisible

• 0x474508 IsWindowEnabled

• 0x47450c IsWindow

• 0x474510 IsRectEmpty

• 0x474514 IsIconic

• 0x474518 IsDialogMessageA

• 0x47451c IsChild

• 0x474520 InvalidateRect

• 0x474524 IntersectRect

• 0x474528 InsertMenuItemA

• 0x47452c InsertMenuA

• 0x474530 InflateRect

• 0x474534 GetWindowThreadProcessId

• 0x474538 GetWindowTextA

• 0x47453c GetWindowRect

• 0x474540 GetWindowPlacement

• 0x474544 GetWindowLongA

• 0x474548 GetWindowDC

• 0x47454c GetTopWindow

• 0x474550 GetSystemMetrics

• 0x474554 GetSystemMenu

• 0x474558 GetSysColorBrush

• 0x47455c GetSysColor

• 0x474560 GetSubMenu

• 0x474564 GetScrollRange

• 0x474568 GetScrollPos

• 0x47456c GetScrollInfo

• 0x474570 GetPropA

• 0x474574 GetParent

• 0x474578 GetWindow

• 0x47457c GetMenuStringA

• 0x474580 GetMenuState

• 0x474584 GetMenuItemInfoA

• 0x474588 GetMenuItemID

• 0x47458c GetMenuItemCount

• 0x474590 GetMenu

• 0x474594 GetLastActivePopup

• 0x474598 GetKeyboardState

• 0x47459c GetKeyboardLayoutList

• 0x4745a0 GetKeyboardLayout

• 0x4745a4 GetKeyState

• 0x4745a8 GetKeyNameTextA

• 0x4745ac GetIconInfo

• 0x4745b0 GetForegroundWindow

• 0x4745b4 GetFocus

• 0x4745b8 GetDlgItem

• 0x4745bc GetDesktopWindow

• 0x4745c0 GetDCEx

• 0x4745c4 GetDC

• 0x4745c8 GetCursorPos

• 0x4745cc GetCursor

• 0x4745d0 GetClientRect

• 0x4745d4 GetClassNameA

• 0x4745d8 GetClassInfoA

• 0x4745dc GetCapture

• 0x4745e0 GetActiveWindow

• 0x4745e4 FrameRect

• 0x4745e8 FindWindowA

• 0x4745ec FillRect

• 0x4745f0 EqualRect

• 0x4745f4 EnumWindows

• 0x4745f8 EnumThreadWindows

• 0x4745fc EndPaint

• 0x474600 EnableWindow

• 0x474604 EnableScrollBar

• 0x474608 EnableMenuItem

• 0x47460c DrawTextA

• 0x474610 DrawMenuBar

• 0x474614 DrawIconEx

• 0x474618 DrawIcon

• 0x47461c DrawFrameControl

• 0x474620 DrawFocusRect

• 0x474624 DrawEdge

• 0x474628 DispatchMessageA

• 0x47462c DestroyWindow

• 0x474630 DestroyMenu

• 0x474634 DestroyIcon

• 0x474638 DestroyCursor

• 0x47463c DeleteMenu

• 0x474640 DefWindowProcA

• 0x474644 DefMDIChildProcA

• 0x474648 DefFrameProcA

• 0x47464c CreatePopupMenu

• 0x474650 CreateMenu

• 0x474654 CreateIcon

• 0x474658 ClientToScreen

• 0x47465c CheckMenuItem

• 0x474660 CallWindowProcA

• 0x474664 CallNextHookEx

• 0x474668 BeginPaint

• 0x47466c CharNextA

• 0x474670 CharLowerA

• 0x474674 CharToOemA

• 0x474678 AdjustWindowRectEx

• 0x47467c ActivateKeyboardLayout

Library kernel32.dll:

• 0x474684 Sleep

Library oleaut32.dll:

• 0x47468c SafeArrayPtrOfIndex

• 0x474690 SafeArrayGetUBound

• 0x474694 SafeArrayGetLBound

• 0x474698 SafeArrayCreate

• 0x47469c VariantChangeType

• 0x4746a0 VariantCopy

• 0x4746a4 VariantClear

• 0x4746a8 VariantInit

Library comctl32.dll:

• 0x4746b0 ImageList_SetIconSize

• 0x4746b4 ImageList_GetIconSize

• 0x4746b8 ImageList_Write

• 0x4746bc ImageList_Read

• 0x4746c0 ImageList_GetDragImage

• 0x4746c4 ImageList_DragShowNolock

• 0x4746c8 ImageList_SetDragCursorImage

• 0x4746cc ImageList_DragMove

• 0x4746d0 ImageList_DragLeave

• 0x4746d4 ImageList_DragEnter

• 0x4746d8 ImageList_EndDrag

• 0x4746dc ImageList_BeginDrag

• 0x4746e0 ImageList_Remove

• 0x4746e4 ImageList_DrawEx

• 0x4746e8 ImageList_Replace

• 0x4746ec ImageList_Draw

• 0x4746f0 ImageList_GetBkColor

• 0x4746f4 ImageList_SetBkColor

• 0x4746f8 ImageList_ReplaceIcon

• 0x4746fc ImageList_Add

• 0x474700 ImageList_GetImageCount

• 0x474704 ImageList_Destroy

• 0x474708 ImageList_Create

• 0x47470c InitCommonControls

Library comdlg32.dll:

• 0x474714 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238	216.58.200.238
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.