SmartHawk

7.0

高危

53 个模型检测该样本为恶意！

重新分析

下载样本

f7c64b437d10f5483b3a78cbf4a08f22cd829c60515c312d2bd21e1a37e250ce

8b13b35d3207a2dd036004fa35a91606.exe

分析耗时

21s

最近分析

文件大小

1.2MB

静态报毒动态报毒 AI SCORE=84 AIDETECTVM APJG CEEINJECT CLOUD CONFIDENCE CRYPTIH DELF DELPHILESS EMWL EMZL FAREIT GENETIC HIGH CONFIDENCE HQKFJH MALWARE2 PHW@AUPJ3QPI QVM05 R002C0PH520 S15413978 SIGGEN2 SUSGEN SUSPICIOUS PE TROJAN3 TSCOPE UNCLASSIFIEDMALWARE@0 UNSAFE UPAN X2091 ZELPHIF ZUSY 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FPQ!8B13B35D3207	20200819	6.0.6.653
Alibaba	Trojan:Win32/Injector.f9c074ef	20190527	0.3.0.5
Avast	Win32:Malware-gen	20200819	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20200819	2013.8.14.323
Tencent		20200819	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686134.903955 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a 8b13b35d3207a2dd036004fa35a91606+0xcc3f8 @ 0x4cc3f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d 8b13b35d3207a2dd036004fa35a91606+0x17005c @ 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff4b14ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619686134.903955
__exception__

stacktrace:

RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
8b13b35d3207a2dd036004fa35a91606+0xcc3f8 @ 0x4cc3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
8b13b35d3207a2dd036004fa35a91606+0x17005c @ 0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4b14ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (28 个事件)

Time & API	Arguments	Status
1619686132.733372 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01d50000	success
1619686132.889372 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 81920 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00475000	success
1619686132.904372 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d90000	success
1619686134.122955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619686134.200955 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x020f0000	success
1619686134.200955 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x021d0000	success
1619686134.200955 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 802816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x020f0000	success
1619686134.200955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 778240 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x020f2000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f52000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f52000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f52000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f52000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f52000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f52000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f52000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f52000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f52000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f52000	success
1619686134.872955 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686132.920372 Process32NextW	process_name: taskhost.exe snapshot_handle: 0x000000f4 process_identifier: 2256	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.608720150596338

section

{'size_of_data': '0x000a9200', 'virtual_address': '0x0009c000', 'entropy': 7.608720150596338, 'name': '.rsrc', 'virtual_size': '0x000a911c'}

description

A section with a high entropy has been found

entropy

0.5312131919905771

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3000 called NtSetContextThread to modify thread in remote process 2976
1619686133.139372 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5871744 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2976	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3000 resumed a thread in remote process 2976
1619686134.092372 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 2976	success	0	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619686133.029372 CreateProcessInternalW	thread_identifier: 3064 thread_handle: 0x000000f8 process_identifier: 2976 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8b13b35d3207a2dd036004fa35a91606.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000fc inherit_handles: 0	success	1
1619686133.029372 NtUnmapViewOfSection	process_identifier: 2976 region_size: 4096 process_handle: 0x000000fc base_address: 0x00400000	success	0
1619686133.045372 NtMapViewOfSection	section_handle: 0x00000104 process_identifier: 2976 commit_size: 1683456 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000fc allocation_type: 0 () section_offset: 0 view_size: 1683456 base_address: 0x00400000	success	0
1619686133.139372 NtGetContextThread	thread_handle: 0x000000f8	success	0
1619686133.139372 NtSetContextThread	thread_handle: 0x000000f8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5871744 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2976	success	0
1619686134.092372 NtResumeThread	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 2976	success	0

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Siggen2.53083
FireEye	Generic.mg.8b13b35d3207a2dd
CAT-QuickHeal	Trojan.CryptIH.S15413978
McAfee	Fareit-FPQ!8B13B35D3207
Cylance	Unsafe
Zillya	Trojan.Agent.Win32.1362051
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Injector.f9c074ef
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.b1e629
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZelphiF.34182.pHW@aupJ3qpi
F-Prot	W32/Trojan3.APJG
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/Injector.EMWL
TrendMicro-HouseCall	TROJ_GEN.R002C0PH520
Paloalto	generic.ml
GData	Gen:Variant.Zusy.310651
Kaspersky	HEUR:Trojan.Win32.Crypt.gen
BitDefender	Gen:Variant.Zusy.310651
NANO-Antivirus	Trojan.Win32.Crypt.hqkfjh
MicroWorld-eScan	Gen:Variant.Zusy.310651
Avast	Win32:Malware-gen
Rising	Trojan.Injector!1.C961 (CLOUD)
Ad-Aware	Gen:Variant.Zusy.310651
Comodo	.UnclassifiedMalware@0
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PH520
Sophos	Mal/Generic-S
Ikarus	Trojan.Inject
Cyren	W32/Trojan.UPAN-4710
Jiangmin	Trojan.Crypt.dvd
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Win32.Injector
Arcabit	Trojan.Zusy.D4BD7B
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan.Win32.Crypt.gen
Microsoft	VirTool:Win32/CeeInject.JJ!rfn
AhnLab-V3	Suspicious/Win.Delphiless.X2091
Acronis	suspicious
VBA32	TScope.Trojan.Delf
ALYac	Gen:Variant.Zusy.310651
Malwarebytes	Trojan.MalPack.DLF
APEX	Malicious
SentinelOne	DFI - Suspicious PE
MaxSecure	Trojan.Malware.10374761.susgen
Fortinet	W32/Injector.EMZL!tr
AVG	Win32:Malware-gen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x48d12c DeleteCriticalSection

• 0x48d130 LeaveCriticalSection

• 0x48d134 EnterCriticalSection

• 0x48d138 InitializeCriticalSection

• 0x48d13c VirtualFree

• 0x48d140 VirtualAlloc

• 0x48d144 LocalFree

• 0x48d148 LocalAlloc

• 0x48d14c GetTickCount

• 0x48d150 QueryPerformanceCounter

• 0x48d154 GetVersion

• 0x48d158 GetCurrentThreadId

• 0x48d15c InterlockedDecrement

• 0x48d160 InterlockedIncrement

• 0x48d164 VirtualQuery

• 0x48d168 WideCharToMultiByte

• 0x48d16c MultiByteToWideChar

• 0x48d170 lstrlenA

• 0x48d174 lstrcpynA

• 0x48d178 LoadLibraryExA

• 0x48d17c GetThreadLocale

• 0x48d180 GetStartupInfoA

• 0x48d184 GetProcAddress

• 0x48d188 GetModuleHandleA

• 0x48d18c GetModuleFileNameA

• 0x48d190 GetLocaleInfoA

• 0x48d194 GetCommandLineA

• 0x48d198 FreeLibrary

• 0x48d19c FindFirstFileA

• 0x48d1a0 FindClose

• 0x48d1a4 ExitProcess

• 0x48d1a8 ExitThread

• 0x48d1ac CreateThread

• 0x48d1b0 WriteFile

• 0x48d1b4 UnhandledExceptionFilter

• 0x48d1b8 RtlUnwind

• 0x48d1bc RaiseException

• 0x48d1c0 GetStdHandle

Library user32.dll:

• 0x48d1c8 GetKeyboardType

• 0x48d1cc LoadStringA

• 0x48d1d0 MessageBoxA

• 0x48d1d4 CharNextA

Library advapi32.dll:

• 0x48d1dc RegQueryValueExA

• 0x48d1e0 RegOpenKeyExA

• 0x48d1e4 RegCloseKey

Library oleaut32.dll:

• 0x48d1ec SysFreeString

• 0x48d1f0 SysReAllocStringLen

• 0x48d1f4 SysAllocStringLen

Library kernel32.dll:

• 0x48d1fc TlsSetValue

• 0x48d200 TlsGetValue

• 0x48d204 LocalAlloc

• 0x48d208 GetModuleHandleA

Library advapi32.dll:

• 0x48d210 RegQueryValueExA

• 0x48d214 RegQueryInfoKeyA

• 0x48d218 RegOpenKeyExA

• 0x48d21c RegFlushKey

• 0x48d220 RegEnumKeyExA

• 0x48d224 RegCloseKey

Library kernel32.dll:

• 0x48d22c lstrcpyA

• 0x48d230 WriteFile

• 0x48d234 WaitForSingleObject

• 0x48d238 VirtualQuery

• 0x48d23c VirtualProtect

• 0x48d240 VirtualAlloc

• 0x48d244 SuspendThread

• 0x48d248 Sleep

• 0x48d24c SizeofResource

• 0x48d250 SetThreadPriority

• 0x48d254 SetThreadLocale

• 0x48d258 SetFilePointer

• 0x48d25c SetEvent

• 0x48d260 SetErrorMode

• 0x48d264 SetEndOfFile

• 0x48d268 ResumeThread

• 0x48d26c ResetEvent

• 0x48d270 ReadFile

• 0x48d274 MulDiv

• 0x48d278 LockResource

• 0x48d27c LoadResource

• 0x48d280 LoadLibraryA

• 0x48d284 LeaveCriticalSection

• 0x48d288 InitializeCriticalSection

• 0x48d28c GlobalUnlock

• 0x48d290 GlobalReAlloc

• 0x48d294 GlobalHandle

• 0x48d298 GlobalLock

• 0x48d29c GlobalFree

• 0x48d2a0 GlobalFindAtomA

• 0x48d2a4 GlobalDeleteAtom

• 0x48d2a8 GlobalAlloc

• 0x48d2ac GlobalAddAtomA

• 0x48d2b0 GetVersionExA

• 0x48d2b4 GetVersion

• 0x48d2b8 GetTimeZoneInformation

• 0x48d2bc GetTickCount

• 0x48d2c0 GetThreadLocale

• 0x48d2c4 GetTempPathA

• 0x48d2c8 GetSystemTimeAsFileTime

• 0x48d2cc GetSystemInfo

• 0x48d2d0 GetStringTypeExA

• 0x48d2d4 GetStdHandle

• 0x48d2d8 GetProcAddress

• 0x48d2dc GetModuleHandleA

• 0x48d2e0 GetModuleFileNameA

• 0x48d2e4 GetLocaleInfoA

• 0x48d2e8 GetLocalTime

• 0x48d2ec GetLastError

• 0x48d2f0 GetFullPathNameA

• 0x48d2f4 GetFileSize

• 0x48d2f8 GetExitCodeThread

• 0x48d2fc GetDiskFreeSpaceA

• 0x48d300 GetDateFormatA

• 0x48d304 GetCurrentThreadId

• 0x48d308 GetCurrentProcessId

• 0x48d30c GetCPInfo

• 0x48d310 GetACP

• 0x48d314 FreeResource

• 0x48d318 InterlockedIncrement

• 0x48d31c InterlockedExchange

• 0x48d320 InterlockedDecrement

• 0x48d324 FreeLibrary

• 0x48d328 FormatMessageA

• 0x48d32c FindResourceA

• 0x48d330 FindFirstFileA

• 0x48d334 FindClose

• 0x48d338 FileTimeToSystemTime

• 0x48d33c FileTimeToLocalFileTime

• 0x48d340 FileTimeToDosDateTime

• 0x48d344 EnumCalendarInfoA

• 0x48d348 EnterCriticalSection

• 0x48d34c DeleteCriticalSection

• 0x48d350 CreateThread

• 0x48d354 CreateFileA

• 0x48d358 CreateEventA

• 0x48d35c CompareStringA

• 0x48d360 CloseHandle

Library version.dll:

• 0x48d368 VerQueryValueA

• 0x48d36c GetFileVersionInfoSizeA

• 0x48d370 GetFileVersionInfoA

Library gdi32.dll:

• 0x48d378 UnrealizeObject

• 0x48d37c StretchBlt

• 0x48d380 SetWindowOrgEx

• 0x48d384 SetViewportOrgEx

• 0x48d388 SetTextColor

• 0x48d38c SetStretchBltMode

• 0x48d390 SetROP2

• 0x48d394 SetPixel

• 0x48d398 SetDIBColorTable

• 0x48d39c SetBrushOrgEx

• 0x48d3a0 SetBkMode

• 0x48d3a4 SetBkColor

• 0x48d3a8 SelectPalette

• 0x48d3ac SelectObject

• 0x48d3b0 SaveDC

• 0x48d3b4 RestoreDC

• 0x48d3b8 Rectangle

• 0x48d3bc RectVisible

• 0x48d3c0 RealizePalette

• 0x48d3c4 PatBlt

• 0x48d3c8 MoveToEx

• 0x48d3cc MaskBlt

• 0x48d3d0 LineTo

• 0x48d3d4 IntersectClipRect

• 0x48d3d8 GetWindowOrgEx

• 0x48d3dc GetTextMetricsA

• 0x48d3e0 GetTextExtentPoint32A

• 0x48d3e4 GetSystemPaletteEntries

• 0x48d3e8 GetStockObject

• 0x48d3ec GetPixel

• 0x48d3f0 GetPaletteEntries

• 0x48d3f4 GetObjectA

• 0x48d3f8 GetDeviceCaps

• 0x48d3fc GetDIBits

• 0x48d400 GetDIBColorTable

• 0x48d404 GetDCOrgEx

• 0x48d408 GetCurrentPositionEx

• 0x48d40c GetClipBox

• 0x48d410 GetBrushOrgEx

• 0x48d414 GetBitmapBits

• 0x48d418 ExcludeClipRect

• 0x48d41c DeleteObject

• 0x48d420 DeleteDC

• 0x48d424 CreateSolidBrush

• 0x48d428 CreatePenIndirect

• 0x48d42c CreatePen

• 0x48d430 CreatePalette

• 0x48d434 CreateHalftonePalette

• 0x48d438 CreateFontIndirectA

• 0x48d43c CreateDIBitmap

• 0x48d440 CreateDIBSection

• 0x48d444 CreateCompatibleDC

• 0x48d448 CreateCompatibleBitmap

• 0x48d44c CreateBrushIndirect

• 0x48d450 CreateBitmap

• 0x48d454 BitBlt

Library user32.dll:

• 0x48d45c CreateWindowExA

• 0x48d460 WindowFromPoint

• 0x48d464 WinHelpA

• 0x48d468 WaitMessage

• 0x48d46c ValidateRect

• 0x48d470 UpdateWindow

• 0x48d474 UnregisterClassA

• 0x48d478 UnhookWindowsHookEx

• 0x48d47c TranslateMessage

• 0x48d480 TranslateMDISysAccel

• 0x48d484 TrackPopupMenu

• 0x48d488 SystemParametersInfoA

• 0x48d48c ShowWindow

• 0x48d490 ShowScrollBar

• 0x48d494 ShowOwnedPopups

• 0x48d498 ShowCursor

• 0x48d49c SetWindowsHookExA

• 0x48d4a0 SetWindowTextA

• 0x48d4a4 SetWindowPos

• 0x48d4a8 SetWindowPlacement

• 0x48d4ac SetWindowLongA

• 0x48d4b0 SetTimer

• 0x48d4b4 SetScrollRange

• 0x48d4b8 SetScrollPos

• 0x48d4bc SetScrollInfo

• 0x48d4c0 SetRect

• 0x48d4c4 SetPropA

• 0x48d4c8 SetParent

• 0x48d4cc SetMenuItemInfoA

• 0x48d4d0 SetMenu

• 0x48d4d4 SetForegroundWindow

• 0x48d4d8 SetFocus

• 0x48d4dc SetCursor

• 0x48d4e0 SetClassLongA

• 0x48d4e4 SetCapture

• 0x48d4e8 SetActiveWindow

• 0x48d4ec SendMessageA

• 0x48d4f0 ScrollWindow

• 0x48d4f4 ScreenToClient

• 0x48d4f8 RemovePropA

• 0x48d4fc RemoveMenu

• 0x48d500 ReleaseDC

• 0x48d504 ReleaseCapture

• 0x48d508 RegisterWindowMessageA

• 0x48d50c RegisterClipboardFormatA

• 0x48d510 RegisterClassA

• 0x48d514 RedrawWindow

• 0x48d518 PtInRect

• 0x48d51c PostQuitMessage

• 0x48d520 PostMessageA

• 0x48d524 PeekMessageA

• 0x48d528 OffsetRect

• 0x48d52c OemToCharA

• 0x48d530 MsgWaitForMultipleObjects

• 0x48d534 MessageBoxA

• 0x48d538 MessageBeep

• 0x48d53c MapWindowPoints

• 0x48d540 MapVirtualKeyA

• 0x48d544 LoadStringA

• 0x48d548 LoadKeyboardLayoutA

• 0x48d54c LoadIconA

• 0x48d550 LoadCursorA

• 0x48d554 LoadBitmapA

• 0x48d558 KillTimer

• 0x48d55c IsZoomed

• 0x48d560 IsWindowVisible

• 0x48d564 IsWindowEnabled

• 0x48d568 IsWindow

• 0x48d56c IsRectEmpty

• 0x48d570 IsIconic

• 0x48d574 IsDialogMessageA

• 0x48d578 IsChild

• 0x48d57c InvalidateRect

• 0x48d580 IntersectRect

• 0x48d584 InsertMenuItemA

• 0x48d588 InsertMenuA

• 0x48d58c InflateRect

• 0x48d590 GetWindowThreadProcessId

• 0x48d594 GetWindowTextA

• 0x48d598 GetWindowRect

• 0x48d59c GetWindowPlacement

• 0x48d5a0 GetWindowLongA

• 0x48d5a4 GetWindowDC

• 0x48d5a8 GetTopWindow

• 0x48d5ac GetSystemMetrics

• 0x48d5b0 GetSystemMenu

• 0x48d5b4 GetSysColorBrush

• 0x48d5b8 GetSysColor

• 0x48d5bc GetSubMenu

• 0x48d5c0 GetScrollRange

• 0x48d5c4 GetScrollPos

• 0x48d5c8 GetScrollInfo

• 0x48d5cc GetPropA

• 0x48d5d0 GetParent

• 0x48d5d4 GetWindow

• 0x48d5d8 GetMessageTime

• 0x48d5dc GetMenuStringA

• 0x48d5e0 GetMenuState

• 0x48d5e4 GetMenuItemInfoA

• 0x48d5e8 GetMenuItemID

• 0x48d5ec GetMenuItemCount

• 0x48d5f0 GetMenu

• 0x48d5f4 GetLastActivePopup

• 0x48d5f8 GetKeyboardState

• 0x48d5fc GetKeyboardLayoutList

• 0x48d600 GetKeyboardLayout

• 0x48d604 GetKeyState

• 0x48d608 GetKeyNameTextA

• 0x48d60c GetIconInfo

• 0x48d610 GetForegroundWindow

• 0x48d614 GetFocus

• 0x48d618 GetDlgItem

• 0x48d61c GetDesktopWindow

• 0x48d620 GetDCEx

• 0x48d624 GetDC

• 0x48d628 GetCursorPos

• 0x48d62c GetCursor

• 0x48d630 GetClientRect

• 0x48d634 GetClassNameA

• 0x48d638 GetClassInfoA

• 0x48d63c GetCapture

• 0x48d640 GetActiveWindow

• 0x48d644 FrameRect

• 0x48d648 FindWindowA

• 0x48d64c FillRect

• 0x48d650 EqualRect

• 0x48d654 EnumWindows

• 0x48d658 EnumThreadWindows

• 0x48d65c EndPaint

• 0x48d660 EnableWindow

• 0x48d664 EnableScrollBar

• 0x48d668 EnableMenuItem

• 0x48d66c DrawTextA

• 0x48d670 DrawMenuBar

• 0x48d674 DrawIconEx

• 0x48d678 DrawIcon

• 0x48d67c DrawFrameControl

• 0x48d680 DrawFocusRect

• 0x48d684 DrawEdge

• 0x48d688 DispatchMessageA

• 0x48d68c DestroyWindow

• 0x48d690 DestroyMenu

• 0x48d694 DestroyIcon

• 0x48d698 DestroyCursor

• 0x48d69c DeleteMenu

• 0x48d6a0 DefWindowProcA

• 0x48d6a4 DefMDIChildProcA

• 0x48d6a8 DefFrameProcA

• 0x48d6ac CreatePopupMenu

• 0x48d6b0 CreateMenu

• 0x48d6b4 CreateIcon

• 0x48d6b8 ClientToScreen

• 0x48d6bc CheckMenuItem

• 0x48d6c0 CallWindowProcA

• 0x48d6c4 CallNextHookEx

• 0x48d6c8 BeginPaint

• 0x48d6cc CharNextA

• 0x48d6d0 CharLowerBuffA

• 0x48d6d4 CharLowerA

• 0x48d6d8 CharUpperBuffA

• 0x48d6dc CharToOemA

• 0x48d6e0 AdjustWindowRectEx

• 0x48d6e4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x48d6ec Sleep

Library oleaut32.dll:

• 0x48d6f4 SafeArrayPtrOfIndex

• 0x48d6f8 SafeArrayGetUBound

• 0x48d6fc SafeArrayGetLBound

• 0x48d700 SafeArrayCreate

• 0x48d704 VariantChangeType

• 0x48d708 VariantCopy

• 0x48d70c VariantClear

• 0x48d710 VariantInit

Library comctl32.dll:

• 0x48d718 ImageList_SetIconSize

• 0x48d71c ImageList_GetIconSize

• 0x48d720 ImageList_Write

• 0x48d724 ImageList_Read

• 0x48d728 ImageList_GetDragImage

• 0x48d72c ImageList_DragShowNolock

• 0x48d730 ImageList_SetDragCursorImage

• 0x48d734 ImageList_DragMove

• 0x48d738 ImageList_DragLeave

• 0x48d73c ImageList_DragEnter

• 0x48d740 ImageList_EndDrag

• 0x48d744 ImageList_BeginDrag

• 0x48d748 ImageList_Remove

• 0x48d74c ImageList_DrawEx

• 0x48d750 ImageList_Replace

• 0x48d754 ImageList_Draw

• 0x48d758 ImageList_GetBkColor

• 0x48d75c ImageList_SetBkColor

• 0x48d760 ImageList_ReplaceIcon

• 0x48d764 ImageList_Add

• 0x48d768 ImageList_GetImageCount

• 0x48d76c ImageList_Destroy

• 0x48d770 ImageList_Create

• 0x48d774 InitCommonControls

Library comdlg32.dll:

• 0x48d77c GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702
192.168.56.101	65005	239.255.255.250	3702
192.168.56.101	65007	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.