SmartHawk

10.2

0-day

60 个模型检测该样本为恶意！

重新分析

下载样本

a9990e98039ba3491532d56cef0b55982b162a0b67c77eeae8c128a2f98652a6

89aaf9fc5bb15426d80ffb8c983f1d14.exe

分析耗时

74s

最近分析

文件大小

610.5KB

静态报毒动态报毒 AI SCORE=83 ALI2000015 AUTO CLOUD CONFIDENCE DELF DELFINJECT DELPHI DELPHILESS ELDORADO EMOP FAREIT HIGH HIGH CONFIDENCE HNBRIZ HPLOKI IVIZL LOKIBOT MALWARE@#27N60ZP7L8ZDZ MGW@ACLCNAFI PUTTY SCORE SIGGEN2 SMBD SUSGEN TSCOPE TSGENERIC TSPY UNSAFE X2079 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20200718	18.4.3895.0
Tencent	Win32.Backdoor.Fareit.Auto	20200718	1.0.0.1
Kingsoft		20200718	2013.8.14.323
McAfee	Fareit-FTB!89AAF9FC5BB1	20200718	6.0.6.653

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619686138.337767 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619686144.978767 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619686150.244767 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686136.603767 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686134.618829 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 33554244 registers.edi: 0 registers.eax: 0 registers.ebp: 33554312 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 3693150208 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 89aaf9fc5bb15426d80ffb8c983f1d14+0x5d9ce exception.instruction: div eax exception.module: 89aaf9fc5bb15426d80ffb8c983f1d14.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619686134.430829 NtAllocateVirtualMemory	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619686134.618829 NtProtectVirtualMemory	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0045d000	success
1619686134.618829 NtAllocateVirtualMemory	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02050000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686150.212767 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\89aaf9fc5bb15426d80ffb8c983f1d14.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\89aaf9fc5bb15426d80ffb8c983f1d14.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.110045458570087

section

{'size_of_data': '0x00028200', 'virtual_address': '0x00076000', 'entropy': 7.110045458570087, 'name': '.rsrc', 'virtual_size': '0x0002809c'}

description

A section with a high entropy has been found

entropy

0.26333059885151766

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686144.916767 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2404 called NtSetContextThread to modify thread in remote process 1912
1619686134.884829 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1912	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2404 resumed a thread in remote process 1912
1619686135.805829 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 1912	success	0	0

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619686134.868829 CreateProcessInternalW	thread_identifier: 2620 thread_handle: 0x000000fc process_identifier: 1912 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\89aaf9fc5bb15426d80ffb8c983f1d14.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619686134.868829 NtUnmapViewOfSection	process_identifier: 1912 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619686134.868829 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 1912 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619686134.884829 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619686134.884829 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1912	success	0
1619686135.805829 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 1912	success	0
1619686137.166767 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1912	success	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)

MicroWorld-eScan	Trojan.Delf.FareIt.Gen.7
FireEye	Generic.mg.89aaf9fc5bb15426
CAT-QuickHeal	Trojan.Multi
ALYac	Trojan.Delf.FareIt.Gen.7
Cylance	Unsafe
Zillya	Dropper.Agent.Win32.430725
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Delf.FareIt.Gen.7
Invincea	heuristic
F-Prot	W32/Injector.ABY.gen!Eldorado
Symantec	Infostealer.Lokibot!43
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Trojan.Fareit-8723799-0
Kaspersky	HEUR:Trojan.Win32.Crypt.gen
BitDefender	Trojan.Delf.FareIt.Gen.7
NANO-Antivirus	Trojan.Win32.Crypt.hnbriz
Paloalto	generic.ml
AegisLab	Trojan.Win32.Crypt.4!c
Tencent	Win32.Backdoor.Fareit.Auto
Ad-Aware	Trojan.Delf.FareIt.Gen.7
Sophos	Mal/Generic-S
Comodo	Malware@#27n60zp7l8zdz
F-Secure	Dropper.DR/Delphi.ivizl
DrWeb	Trojan.PWS.Siggen2.51483
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TSPY_HPLOKI.SMBD
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.Delf.FareIt.Gen.7 (B)
Cyren	W32/Injector.ABY.gen!Eldorado
Webroot	W32.Trojan.Gen
Avira	DR/Delphi.ivizl
eGambit	Unsafe.AI_Score_99%
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.TSGeneric
Microsoft	PWS:Win32/Fareit.AO!MTB
Endgame	malicious (high confidence)
ZoneAlarm	HEUR:Trojan.Win32.Crypt.gen
GData	Trojan.Delf.FareIt.Gen.7
AhnLab-V3	Suspicious/Win.Delphiless.X2079
Acronis	suspicious
McAfee	Fareit-FTB!89AAF9FC5BB1
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
Zoner	Trojan.Win32.91477
ESET-NOD32	a variant of Win32/Injector.EMOP

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x46a12c DeleteCriticalSection

• 0x46a130 LeaveCriticalSection

• 0x46a134 EnterCriticalSection

• 0x46a138 InitializeCriticalSection

• 0x46a13c VirtualFree

• 0x46a140 VirtualAlloc

• 0x46a144 LocalFree

• 0x46a148 LocalAlloc

• 0x46a14c GetVersion

• 0x46a150 GetCurrentThreadId

• 0x46a154 InterlockedDecrement

• 0x46a158 InterlockedIncrement

• 0x46a15c VirtualQuery

• 0x46a160 WideCharToMultiByte

• 0x46a164 MultiByteToWideChar

• 0x46a168 lstrlenA

• 0x46a16c lstrcpynA

• 0x46a170 LoadLibraryExA

• 0x46a174 GetThreadLocale

• 0x46a178 GetStartupInfoA

• 0x46a17c GetProcAddress

• 0x46a180 GetModuleHandleA

• 0x46a184 GetModuleFileNameA

• 0x46a188 GetLocaleInfoA

• 0x46a18c GetCommandLineA

• 0x46a190 FreeLibrary

• 0x46a194 FindFirstFileA

• 0x46a198 FindClose

• 0x46a19c ExitProcess

• 0x46a1a0 WriteFile

• 0x46a1a4 UnhandledExceptionFilter

• 0x46a1a8 RtlUnwind

• 0x46a1ac RaiseException

• 0x46a1b0 GetStdHandle

Library user32.dll:

• 0x46a1b8 GetKeyboardType

• 0x46a1bc LoadStringA

• 0x46a1c0 MessageBoxA

• 0x46a1c4 CharNextA

Library advapi32.dll:

• 0x46a1cc RegQueryValueExA

• 0x46a1d0 RegOpenKeyExA

• 0x46a1d4 RegCloseKey

Library oleaut32.dll:

• 0x46a1dc SysFreeString

• 0x46a1e0 SysReAllocStringLen

• 0x46a1e4 SysAllocStringLen

Library kernel32.dll:

• 0x46a1ec TlsSetValue

• 0x46a1f0 TlsGetValue

• 0x46a1f4 LocalAlloc

• 0x46a1f8 GetModuleHandleA

Library advapi32.dll:

• 0x46a200 RegQueryValueExA

• 0x46a204 RegOpenKeyExA

• 0x46a208 RegCloseKey

Library kernel32.dll:

• 0x46a210 lstrcpyA

• 0x46a214 WriteFile

• 0x46a218 WaitForSingleObject

• 0x46a21c VirtualQuery

• 0x46a220 VirtualProtectEx

• 0x46a224 VirtualAlloc

• 0x46a228 Sleep

• 0x46a22c SizeofResource

• 0x46a230 SetThreadLocale

• 0x46a234 SetFilePointer

• 0x46a238 SetEvent

• 0x46a23c SetErrorMode

• 0x46a240 SetEndOfFile

• 0x46a244 ResetEvent

• 0x46a248 ReadFile

• 0x46a24c MulDiv

• 0x46a250 LockResource

• 0x46a254 LoadResource

• 0x46a258 LoadLibraryA

• 0x46a25c LeaveCriticalSection

• 0x46a260 InitializeCriticalSection

• 0x46a264 GlobalUnlock

• 0x46a268 GlobalReAlloc

• 0x46a26c GlobalHandle

• 0x46a270 GlobalLock

• 0x46a274 GlobalFree

• 0x46a278 GlobalFindAtomA

• 0x46a27c GlobalDeleteAtom

• 0x46a280 GlobalAlloc

• 0x46a284 GlobalAddAtomA

• 0x46a288 GetVersionExA

• 0x46a28c GetVersion

• 0x46a290 GetTickCount

• 0x46a294 GetThreadLocale

• 0x46a298 GetSystemInfo

• 0x46a29c GetStringTypeExA

• 0x46a2a0 GetStdHandle

• 0x46a2a4 GetProcAddress

• 0x46a2a8 GetModuleHandleA

• 0x46a2ac GetModuleFileNameA

• 0x46a2b0 GetLocaleInfoA

• 0x46a2b4 GetLocalTime

• 0x46a2b8 GetLastError

• 0x46a2bc GetFullPathNameA

• 0x46a2c0 GetFileType

• 0x46a2c4 GetFileAttributesA

• 0x46a2c8 GetDiskFreeSpaceA

• 0x46a2cc GetDateFormatA

• 0x46a2d0 GetCurrentThreadId

• 0x46a2d4 GetCurrentProcessId

• 0x46a2d8 GetCurrentProcess

• 0x46a2dc GetCPInfo

• 0x46a2e0 GetACP

• 0x46a2e4 FreeResource

• 0x46a2e8 InterlockedExchange

• 0x46a2ec FreeLibrary

• 0x46a2f0 FormatMessageA

• 0x46a2f4 FindResourceA

• 0x46a2f8 FindFirstFileA

• 0x46a2fc FindClose

• 0x46a300 FileTimeToLocalFileTime

• 0x46a304 FileTimeToDosDateTime

• 0x46a308 EnumCalendarInfoA

• 0x46a30c EnterCriticalSection

• 0x46a310 DeleteCriticalSection

• 0x46a314 CreateThread

• 0x46a318 CreateFileA

• 0x46a31c CreateEventA

• 0x46a320 CompareStringA

• 0x46a324 CloseHandle

Library version.dll:

• 0x46a32c VerQueryValueA

• 0x46a330 GetFileVersionInfoSizeA

• 0x46a334 GetFileVersionInfoA

Library gdi32.dll:

• 0x46a33c UnrealizeObject

• 0x46a340 StretchBlt

• 0x46a344 SetWindowOrgEx

• 0x46a348 SetWinMetaFileBits

• 0x46a34c SetViewportOrgEx

• 0x46a350 SetTextColor

• 0x46a354 SetStretchBltMode

• 0x46a358 SetROP2

• 0x46a35c SetPixel

• 0x46a360 SetEnhMetaFileBits

• 0x46a364 SetDIBColorTable

• 0x46a368 SetBrushOrgEx

• 0x46a36c SetBkMode

• 0x46a370 SetBkColor

• 0x46a374 SelectPalette

• 0x46a378 SelectObject

• 0x46a37c SelectClipRgn

• 0x46a380 SaveDC

• 0x46a384 RestoreDC

• 0x46a388 Rectangle

• 0x46a38c RectVisible

• 0x46a390 RealizePalette

• 0x46a394 Polyline

• 0x46a398 PlayEnhMetaFile

• 0x46a39c PatBlt

• 0x46a3a0 MoveToEx

• 0x46a3a4 MaskBlt

• 0x46a3a8 LineTo

• 0x46a3ac IntersectClipRect

• 0x46a3b0 GetWindowOrgEx

• 0x46a3b4 GetWinMetaFileBits

• 0x46a3b8 GetTextMetricsA

• 0x46a3bc GetTextExtentPoint32A

• 0x46a3c0 GetSystemPaletteEntries

• 0x46a3c4 GetStockObject

• 0x46a3c8 GetPixel

• 0x46a3cc GetPaletteEntries

• 0x46a3d0 GetObjectA

• 0x46a3d4 GetEnhMetaFilePaletteEntries

• 0x46a3d8 GetEnhMetaFileHeader

• 0x46a3dc GetEnhMetaFileBits

• 0x46a3e0 GetDeviceCaps

• 0x46a3e4 GetDIBits

• 0x46a3e8 GetDIBColorTable

• 0x46a3ec GetDCOrgEx

• 0x46a3f0 GetCurrentPositionEx

• 0x46a3f4 GetClipRgn

• 0x46a3f8 GetClipBox

• 0x46a3fc GetBrushOrgEx

• 0x46a400 GetBitmapBits

• 0x46a404 ExcludeClipRect

• 0x46a408 DeleteObject

• 0x46a40c DeleteEnhMetaFile

• 0x46a410 DeleteDC

• 0x46a414 CreateSolidBrush

• 0x46a418 CreateRectRgn

• 0x46a41c CreatePenIndirect

• 0x46a420 CreatePalette

• 0x46a424 CreateHalftonePalette

• 0x46a428 CreateFontIndirectA

• 0x46a42c CreateDIBitmap

• 0x46a430 CreateDIBSection

• 0x46a434 CreateCompatibleDC

• 0x46a438 CreateCompatibleBitmap

• 0x46a43c CreateBrushIndirect

• 0x46a440 CreateBitmap

• 0x46a444 CopyEnhMetaFileA

• 0x46a448 BitBlt

Library user32.dll:

• 0x46a450 CreateWindowExA

• 0x46a454 WindowFromPoint

• 0x46a458 WinHelpA

• 0x46a45c WaitMessage

• 0x46a460 UpdateWindow

• 0x46a464 UnregisterClassA

• 0x46a468 UnhookWindowsHookEx

• 0x46a46c TranslateMessage

• 0x46a470 TranslateMDISysAccel

• 0x46a474 TrackPopupMenu

• 0x46a478 SystemParametersInfoA

• 0x46a47c ShowWindow

• 0x46a480 ShowScrollBar

• 0x46a484 ShowOwnedPopups

• 0x46a488 ShowCursor

• 0x46a48c SetWindowsHookExA

• 0x46a490 SetWindowPos

• 0x46a494 SetWindowPlacement

• 0x46a498 SetWindowLongA

• 0x46a49c SetTimer

• 0x46a4a0 SetScrollRange

• 0x46a4a4 SetScrollPos

• 0x46a4a8 SetScrollInfo

• 0x46a4ac SetRect

• 0x46a4b0 SetPropA

• 0x46a4b4 SetParent

• 0x46a4b8 SetMenuItemInfoA

• 0x46a4bc SetMenu

• 0x46a4c0 SetForegroundWindow

• 0x46a4c4 SetFocus

• 0x46a4c8 SetCursor

• 0x46a4cc SetClassLongA

• 0x46a4d0 SetCapture

• 0x46a4d4 SetActiveWindow

• 0x46a4d8 SendMessageA

• 0x46a4dc ScrollWindow

• 0x46a4e0 ScreenToClient

• 0x46a4e4 RemovePropA

• 0x46a4e8 RemoveMenu

• 0x46a4ec ReleaseDC

• 0x46a4f0 ReleaseCapture

• 0x46a4f4 RegisterWindowMessageA

• 0x46a4f8 RegisterClipboardFormatA

• 0x46a4fc RegisterClassA

• 0x46a500 RedrawWindow

• 0x46a504 PtInRect

• 0x46a508 PostQuitMessage

• 0x46a50c PostMessageA

• 0x46a510 PeekMessageA

• 0x46a514 OffsetRect

• 0x46a518 OemToCharA

• 0x46a51c MessageBoxA

• 0x46a520 MapWindowPoints

• 0x46a524 MapVirtualKeyA

• 0x46a528 LoadStringA

• 0x46a52c LoadKeyboardLayoutA

• 0x46a530 LoadIconA

• 0x46a534 LoadCursorA

• 0x46a538 LoadBitmapA

• 0x46a53c KillTimer

• 0x46a540 IsZoomed

• 0x46a544 IsWindowVisible

• 0x46a548 IsWindowEnabled

• 0x46a54c IsWindow

• 0x46a550 IsRectEmpty

• 0x46a554 IsIconic

• 0x46a558 IsDialogMessageA

• 0x46a55c IsChild

• 0x46a560 InvalidateRect

• 0x46a564 IntersectRect

• 0x46a568 InsertMenuItemA

• 0x46a56c InsertMenuA

• 0x46a570 InflateRect

• 0x46a574 GetWindowThreadProcessId

• 0x46a578 GetWindowTextA

• 0x46a57c GetWindowRect

• 0x46a580 GetWindowPlacement

• 0x46a584 GetWindowLongA

• 0x46a588 GetWindowDC

• 0x46a58c GetTopWindow

• 0x46a590 GetSystemMetrics

• 0x46a594 GetSystemMenu

• 0x46a598 GetSysColorBrush

• 0x46a59c GetSysColor

• 0x46a5a0 GetSubMenu

• 0x46a5a4 GetScrollRange

• 0x46a5a8 GetScrollPos

• 0x46a5ac GetScrollInfo

• 0x46a5b0 GetPropA

• 0x46a5b4 GetParent

• 0x46a5b8 GetWindow

• 0x46a5bc GetMenuStringA

• 0x46a5c0 GetMenuState

• 0x46a5c4 GetMenuItemInfoA

• 0x46a5c8 GetMenuItemID

• 0x46a5cc GetMenuItemCount

• 0x46a5d0 GetMenu

• 0x46a5d4 GetLastActivePopup

• 0x46a5d8 GetKeyboardState

• 0x46a5dc GetKeyboardLayoutList

• 0x46a5e0 GetKeyboardLayout

• 0x46a5e4 GetKeyState

• 0x46a5e8 GetKeyNameTextA

• 0x46a5ec GetIconInfo

• 0x46a5f0 GetForegroundWindow

• 0x46a5f4 GetFocus

• 0x46a5f8 GetDlgItem

• 0x46a5fc GetDesktopWindow

• 0x46a600 GetDCEx

• 0x46a604 GetDC

• 0x46a608 GetCursorPos

• 0x46a60c GetCursor

• 0x46a610 GetClipboardData

• 0x46a614 GetClientRect

• 0x46a618 GetClassNameA

• 0x46a61c GetClassInfoA

• 0x46a620 GetCapture

• 0x46a624 GetActiveWindow

• 0x46a628 FrameRect

• 0x46a62c FindWindowA

• 0x46a630 FillRect

• 0x46a634 EqualRect

• 0x46a638 EnumWindows

• 0x46a63c EnumThreadWindows

• 0x46a640 EndPaint

• 0x46a644 EnableWindow

• 0x46a648 EnableScrollBar

• 0x46a64c EnableMenuItem

• 0x46a650 DrawTextA

• 0x46a654 DrawMenuBar

• 0x46a658 DrawIconEx

• 0x46a65c DrawIcon

• 0x46a660 DrawFrameControl

• 0x46a664 DrawFocusRect

• 0x46a668 DrawEdge

• 0x46a66c DispatchMessageA

• 0x46a670 DestroyWindow

• 0x46a674 DestroyMenu

• 0x46a678 DestroyIcon

• 0x46a67c DestroyCursor

• 0x46a680 DeleteMenu

• 0x46a684 DefWindowProcA

• 0x46a688 DefMDIChildProcA

• 0x46a68c DefFrameProcA

• 0x46a690 CreatePopupMenu

• 0x46a694 CreateMenu

• 0x46a698 CreateIcon

• 0x46a69c ClientToScreen

• 0x46a6a0 CheckMenuItem

• 0x46a6a4 CallWindowProcA

• 0x46a6a8 CallNextHookEx

• 0x46a6ac BeginPaint

• 0x46a6b0 CharNextA

• 0x46a6b4 CharLowerBuffA

• 0x46a6b8 CharLowerA

• 0x46a6bc CharToOemA

• 0x46a6c0 AdjustWindowRectEx

• 0x46a6c4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x46a6cc Sleep

Library oleaut32.dll:

• 0x46a6d4 SafeArrayPtrOfIndex

• 0x46a6d8 SafeArrayGetUBound

• 0x46a6dc SafeArrayGetLBound

• 0x46a6e0 SafeArrayCreate

• 0x46a6e4 VariantChangeType

• 0x46a6e8 VariantCopy

• 0x46a6ec VariantClear

• 0x46a6f0 VariantInit

Library comctl32.dll:

• 0x46a6f8 ImageList_SetIconSize

• 0x46a6fc ImageList_GetIconSize

• 0x46a700 ImageList_Write

• 0x46a704 ImageList_Read

• 0x46a708 ImageList_GetDragImage

• 0x46a70c ImageList_DragShowNolock

• 0x46a710 ImageList_SetDragCursorImage

• 0x46a714 ImageList_DragMove

• 0x46a718 ImageList_DragLeave

• 0x46a71c ImageList_DragEnter

• 0x46a720 ImageList_EndDrag

• 0x46a724 ImageList_BeginDrag

• 0x46a728 ImageList_Remove

• 0x46a72c ImageList_DrawEx

• 0x46a730 ImageList_Replace

• 0x46a734 ImageList_Draw

• 0x46a738 ImageList_GetBkColor

• 0x46a73c ImageList_SetBkColor

• 0x46a740 ImageList_ReplaceIcon

• 0x46a744 ImageList_Add

• 0x46a748 ImageList_GetImageCount

• 0x46a74c ImageList_Destroy

• 0x46a750 ImageList_Create

Library comdlg32.dll:

• 0x46a758 GetSaveFileNameA

• 0x46a75c GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
rostovafile.ga
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.