SmartHawk

7.0

高危

60 个模型检测该样本为恶意！

重新分析

下载样本

1cac7d841736846ca4d7ab5fa75c04b050c8634bf0c1eb048186a32d00b78021

8b4ebf0fa518d7aa53a53e9d5a5692c0.exe

分析耗时

23s

最近分析

文件大小

978.5KB

静态报毒动态报毒 9GW@A4W47SAI AGENTTESLA AI SCORE=82 AIDETECTVM AVSARHER BTOMTW CLASSIC CONFIDENCE DELF DELPHI DELPHILESS DYNAMER EBHE ELXR EMJE FAREIT FORMBOOK GDSDA GENERICKD GENKRYPTIK HIGH CONFIDENCE HLATDZ JBVN KRYPT KRYPTIK LOKI MALWARE2 MALWARE@#3O8AD53WBVYK1 SCARSI SCORE SIGGEN9 SMTHG STATIC AI SUSGEN SUSPICIOUS PE TRJGEN TSCOPE UNSAFE WTXOW X2066 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FTB!8B4EBF0FA518	20201211	6.0.6.653
Alibaba	Trojan:Win32/Dynamer.c75a673c	20190527	0.3.0.5
Avast	Win32:Trojan-gen	20201210	21.1.5827.0
Baidu		20190318	1.0.0.2
Tencent	Win32.Trojan.Scarsi.Ebhe	20201211	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619692565.929501 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3 8b4ebf0fa518d7aa53a53e9d5a5692c0+0x58a4d @ 0x458a4d 8b4ebf0fa518d7aa53a53e9d5a5692c0+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfda814ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619692565.929501
__exception__

stacktrace:

CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
8b4ebf0fa518d7aa53a53e9d5a5692c0+0x58a4d @ 0x458a4d
8b4ebf0fa518d7aa53a53e9d5a5692c0+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfda814ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (30 个事件)

Time & API	Arguments	Status
1619686132.569633 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d0000	success
1619686132.725633 NtAllocateVirtualMemory	process_identifier: 648 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00580000	success
1619686132.740633 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x005a0000	success
1619692565.054501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619692565.085501 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01e60000	success
1619692565.085501 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f50000	success
1619692565.085501 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00510000	success
1619692565.085501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 299008 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619692565.445501 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02180000	success
1619692565.445501 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02330000	success
1619692565.882501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619692565.882501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619692565.882501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619692565.882501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619692565.882501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619692565.882501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619692565.898501 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686132.772633 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x000000f8 process_identifier: 3048	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.308364725656286

section

{'size_of_data': '0x00045000', 'virtual_address': '0x000b5000', 'entropy': 7.308364725656286, 'name': '.rsrc', 'virtual_size': '0x00044f08'}

description

A section with a high entropy has been found

entropy

0.2823529411764706

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 648 called NtSetContextThread to modify thread in remote process 2248
1619686133.725633 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4893840 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2248	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 648 resumed a thread in remote process 2248
1619686134.037633 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2248	success	0	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619686133.569633 CreateProcessInternalW	thread_identifier: 2252 thread_handle: 0x000000fc process_identifier: 2248 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8b4ebf0fa518d7aa53a53e9d5a5692c0.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619686133.569633 NtUnmapViewOfSection	process_identifier: 2248 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619686133.584633 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 2248 commit_size: 704512 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 704512 base_address: 0x00400000	success	0
1619686133.725633 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619686133.725633 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4893840 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2248	success	0
1619686134.037633 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2248	success	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen9.53048
MicroWorld-eScan	Trojan.GenericKD.43321182
FireEye	Generic.mg.8b4ebf0fa518d7aa
McAfee	Fareit-FTB!8B4EBF0FA518
Cylance	Unsafe
Zillya	Trojan.GenKryptik.Win32.49378
Sangfor	Malware
K7AntiVirus	Trojan ( 005686cb1 )
Alibaba	Trojan:Win32/Dynamer.c75a673c
K7GW	Trojan ( 005686cb1 )
Cybereason	malicious.f3c8af
Arcabit	Trojan.Generic.D295075E
BitDefenderTheta	Gen:NN.ZelphiF.34670.9GW@a4w47Sai
Cyren	W32/Trojan.JBVN-7083
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/Injector.EMJE
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Malware.AgentTesla-8016717-1
Kaspersky	HEUR:Trojan.Win32.Scarsi.gen
BitDefender	Trojan.GenericKD.43321182
NANO-Antivirus	Trojan.Win32.TrjGen.hlatdz
Paloalto	generic.ml
AegisLab	Trojan.Multi.Generic.4!c
Rising	Trojan.Injector!1.CB27 (CLASSIC)
Ad-Aware	Trojan.GenericKD.43321182
Emsisoft	Trojan.GenericKD.43321182 (B)
Comodo	Malware@#3o8ad53wbvyk1
F-Secure	Dropper.DR/Delphi.wtxow
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.LOKI.SMTHG
McAfee-GW-Edition	BehavesLike.Win32.Fareit.dc
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.Scarsi.cig
Avira	DR/Delphi.wtxow
Antiy-AVL	Trojan/Win32.Scarsi
Gridinsoft	Trojan.Win32.Kryptik.dd!i
Microsoft	Trojan:Win32/FormBook.CR!MTB
ZoneAlarm	HEUR:Trojan.Win32.Scarsi.gen
GData	Trojan.GenericKD.43321182
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2066
VBA32	TScope.Trojan.Delf
ALYac	Trojan.GenericKD.43321182
MAX	malware (ai score=82)
Malwarebytes	Trojan.MalPack.DLF
TrendMicro-HouseCall	TrojanSpy.Win32.LOKI.SMTHG

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4a4154 DeleteCriticalSection

• 0x4a4158 LeaveCriticalSection

• 0x4a415c EnterCriticalSection

• 0x4a4160 InitializeCriticalSection

• 0x4a4164 VirtualFree

• 0x4a4168 VirtualAlloc

• 0x4a416c LocalFree

• 0x4a4170 LocalAlloc

• 0x4a4174 GetVersion

• 0x4a4178 GetCurrentThreadId

• 0x4a417c InterlockedDecrement

• 0x4a4180 InterlockedIncrement

• 0x4a4184 VirtualQuery

• 0x4a4188 WideCharToMultiByte

• 0x4a418c MultiByteToWideChar

• 0x4a4190 lstrlenA

• 0x4a4194 lstrcpynA

• 0x4a4198 LoadLibraryExA

• 0x4a419c GetThreadLocale

• 0x4a41a0 GetStartupInfoA

• 0x4a41a4 GetProcAddress

• 0x4a41a8 GetModuleHandleA

• 0x4a41ac GetModuleFileNameA

• 0x4a41b0 GetLocaleInfoA

• 0x4a41b4 GetCommandLineA

• 0x4a41b8 FreeLibrary

• 0x4a41bc FindFirstFileA

• 0x4a41c0 FindClose

• 0x4a41c4 ExitProcess

• 0x4a41c8 WriteFile

• 0x4a41cc UnhandledExceptionFilter

• 0x4a41d0 RtlUnwind

• 0x4a41d4 RaiseException

• 0x4a41d8 GetStdHandle

Library user32.dll:

• 0x4a41e0 GetKeyboardType

• 0x4a41e4 LoadStringA

• 0x4a41e8 MessageBoxA

• 0x4a41ec CharNextA

Library advapi32.dll:

• 0x4a41f4 RegQueryValueExA

• 0x4a41f8 RegOpenKeyExA

• 0x4a41fc RegCloseKey

Library oleaut32.dll:

• 0x4a4204 SysFreeString

• 0x4a4208 SysReAllocStringLen

• 0x4a420c SysAllocStringLen

Library kernel32.dll:

• 0x4a4214 TlsSetValue

• 0x4a4218 TlsGetValue

• 0x4a421c LocalAlloc

• 0x4a4220 GetModuleHandleA

Library advapi32.dll:

• 0x4a4228 RegQueryValueExA

• 0x4a422c RegOpenKeyExA

• 0x4a4230 RegCloseKey

Library kernel32.dll:

• 0x4a4238 lstrcpyA

• 0x4a423c WriteFile

• 0x4a4240 WaitForSingleObjectEx

• 0x4a4244 WaitForSingleObject

• 0x4a4248 VirtualQuery

• 0x4a424c VirtualAlloc

• 0x4a4250 Sleep

• 0x4a4254 SizeofResource

• 0x4a4258 SetThreadLocale

• 0x4a425c SetFilePointer

• 0x4a4260 SetEvent

• 0x4a4264 SetErrorMode

• 0x4a4268 SetEndOfFile

• 0x4a426c SearchPathA

• 0x4a4270 ResetEvent

• 0x4a4274 ReleaseMutex

• 0x4a4278 ReadFile

• 0x4a427c OpenFileMappingA

• 0x4a4280 MultiByteToWideChar

• 0x4a4284 MulDiv

• 0x4a4288 LockResource

• 0x4a428c LoadResource

• 0x4a4290 LoadLibraryA

• 0x4a4294 LeaveCriticalSection

• 0x4a4298 IsDBCSLeadByte

• 0x4a429c InitializeCriticalSection

• 0x4a42a0 GlobalUnlock

• 0x4a42a4 GlobalReAlloc

• 0x4a42a8 GlobalHandle

• 0x4a42ac GlobalLock

• 0x4a42b0 GlobalFree

• 0x4a42b4 GlobalFindAtomA

• 0x4a42b8 GlobalDeleteAtom

• 0x4a42bc GlobalAlloc

• 0x4a42c0 GlobalAddAtomA

• 0x4a42c4 GetVersionExA

• 0x4a42c8 GetVersion

• 0x4a42cc GetTickCount

• 0x4a42d0 GetThreadLocale

• 0x4a42d4 GetSystemTimeAsFileTime

• 0x4a42d8 GetSystemTime

• 0x4a42dc GetSystemInfo

• 0x4a42e0 GetStringTypeExA

• 0x4a42e4 GetStdHandle

• 0x4a42e8 GetProcAddress

• 0x4a42ec GetModuleHandleA

• 0x4a42f0 GetModuleFileNameA

• 0x4a42f4 GetLocaleInfoA

• 0x4a42f8 GetLocalTime

• 0x4a42fc GetLastError

• 0x4a4300 GetFullPathNameA

• 0x4a4304 GetFileAttributesA

• 0x4a4308 GetDiskFreeSpaceA

• 0x4a430c GetDateFormatA

• 0x4a4310 GetCurrentThreadId

• 0x4a4314 GetCurrentProcessId

• 0x4a4318 GetCurrentDirectoryA

• 0x4a431c GetCPInfo

• 0x4a4320 GetACP

• 0x4a4324 FreeResource

• 0x4a4328 InterlockedIncrement

• 0x4a432c InterlockedExchange

• 0x4a4330 InterlockedDecrement

• 0x4a4334 FreeLibrary

• 0x4a4338 FormatMessageA

• 0x4a433c FindResourceA

• 0x4a4340 FindFirstFileA

• 0x4a4344 FindClose

• 0x4a4348 FileTimeToLocalFileTime

• 0x4a434c FileTimeToDosDateTime

• 0x4a4350 FatalAppExitA

• 0x4a4354 ExitThread

• 0x4a4358 EnumCalendarInfoA

• 0x4a435c EnterCriticalSection

• 0x4a4360 DeleteCriticalSection

• 0x4a4364 CreateThread

• 0x4a4368 CreateMutexA

• 0x4a436c CreateFileA

• 0x4a4370 CreateEventA

• 0x4a4374 CompareStringA

• 0x4a4378 CloseHandle

Library version.dll:

• 0x4a4380 VerQueryValueA

• 0x4a4384 GetFileVersionInfoSizeA

• 0x4a4388 GetFileVersionInfoA

Library gdi32.dll:

• 0x4a4390 UnrealizeObject

• 0x4a4394 StretchBlt

• 0x4a4398 SetWindowOrgEx

• 0x4a439c SetWinMetaFileBits

• 0x4a43a0 SetViewportOrgEx

• 0x4a43a4 SetTextColor

• 0x4a43a8 SetStretchBltMode

• 0x4a43ac SetROP2

• 0x4a43b0 SetPixel

• 0x4a43b4 SetEnhMetaFileBits

• 0x4a43b8 SetDIBColorTable

• 0x4a43bc SetBrushOrgEx

• 0x4a43c0 SetBkMode

• 0x4a43c4 SetBkColor

• 0x4a43c8 SelectPalette

• 0x4a43cc SelectObject

• 0x4a43d0 SaveDC

• 0x4a43d4 RestoreDC

• 0x4a43d8 Rectangle

• 0x4a43dc RectVisible

• 0x4a43e0 RealizePalette

• 0x4a43e4 Polyline

• 0x4a43e8 PlayEnhMetaFile

• 0x4a43ec PatBlt

• 0x4a43f0 MoveToEx

• 0x4a43f4 MaskBlt

• 0x4a43f8 LineTo

• 0x4a43fc IntersectClipRect

• 0x4a4400 GetWindowOrgEx

• 0x4a4404 GetWinMetaFileBits

• 0x4a4408 GetTextMetricsA

• 0x4a440c GetTextExtentPoint32A

• 0x4a4410 GetSystemPaletteEntries

• 0x4a4414 GetStockObject

• 0x4a4418 GetPixel

• 0x4a441c GetPaletteEntries

• 0x4a4420 GetObjectA

• 0x4a4424 GetEnhMetaFilePaletteEntries

• 0x4a4428 GetEnhMetaFileHeader

• 0x4a442c GetEnhMetaFileBits

• 0x4a4430 GetDeviceCaps

• 0x4a4434 GetDIBits

• 0x4a4438 GetDIBColorTable

• 0x4a443c GetDCOrgEx

• 0x4a4440 GetCurrentPositionEx

• 0x4a4444 GetClipBox

• 0x4a4448 GetBrushOrgEx

• 0x4a444c GetBitmapBits

• 0x4a4450 ExcludeClipRect

• 0x4a4454 DeleteObject

• 0x4a4458 DeleteEnhMetaFile

• 0x4a445c DeleteDC

• 0x4a4460 CreateSolidBrush

• 0x4a4464 CreatePenIndirect

• 0x4a4468 CreatePalette

• 0x4a446c CreateHalftonePalette

• 0x4a4470 CreateFontIndirectA

• 0x4a4474 CreateDIBitmap

• 0x4a4478 CreateDIBSection

• 0x4a447c CreateCompatibleDC

• 0x4a4480 CreateCompatibleBitmap

• 0x4a4484 CreateBrushIndirect

• 0x4a4488 CreateBitmap

• 0x4a448c CopyEnhMetaFileA

• 0x4a4490 BitBlt

Library user32.dll:

• 0x4a4498 CreateWindowExA

• 0x4a449c WindowFromPoint

• 0x4a44a0 WinHelpA

• 0x4a44a4 WaitMessage

• 0x4a44a8 UpdateWindow

• 0x4a44ac UnregisterClassA

• 0x4a44b0 UnhookWindowsHookEx

• 0x4a44b4 TranslateMessage

• 0x4a44b8 TranslateMDISysAccel

• 0x4a44bc TrackPopupMenu

• 0x4a44c0 SystemParametersInfoA

• 0x4a44c4 ShowWindow

• 0x4a44c8 ShowScrollBar

• 0x4a44cc ShowOwnedPopups

• 0x4a44d0 ShowCursor

• 0x4a44d4 SetWindowsHookExA

• 0x4a44d8 SetWindowPos

• 0x4a44dc SetWindowPlacement

• 0x4a44e0 SetWindowLongA

• 0x4a44e4 SetTimer

• 0x4a44e8 SetScrollRange

• 0x4a44ec SetScrollPos

• 0x4a44f0 SetScrollInfo

• 0x4a44f4 SetRect

• 0x4a44f8 SetPropA

• 0x4a44fc SetParent

• 0x4a4500 SetMenuItemInfoA

• 0x4a4504 SetMenu

• 0x4a4508 SetForegroundWindow

• 0x4a450c SetFocus

• 0x4a4510 SetCursor

• 0x4a4514 SetClassLongA

• 0x4a4518 SetCapture

• 0x4a451c SetActiveWindow

• 0x4a4520 SendMessageA

• 0x4a4524 ScrollWindow

• 0x4a4528 ScreenToClient

• 0x4a452c RemovePropA

• 0x4a4530 RemoveMenu

• 0x4a4534 ReleaseDC

• 0x4a4538 ReleaseCapture

• 0x4a453c RegisterWindowMessageA

• 0x4a4540 RegisterClipboardFormatA

• 0x4a4544 RegisterClassA

• 0x4a4548 RedrawWindow

• 0x4a454c PtInRect

• 0x4a4550 PostQuitMessage

• 0x4a4554 PostMessageA

• 0x4a4558 PeekMessageA

• 0x4a455c OffsetRect

• 0x4a4560 OemToCharBuffA

• 0x4a4564 OemToCharA

• 0x4a4568 MessageBoxA

• 0x4a456c MapWindowPoints

• 0x4a4570 MapVirtualKeyA

• 0x4a4574 LoadStringA

• 0x4a4578 LoadKeyboardLayoutA

• 0x4a457c LoadIconA

• 0x4a4580 LoadCursorA

• 0x4a4584 LoadBitmapA

• 0x4a4588 KillTimer

• 0x4a458c IsZoomed

• 0x4a4590 IsWindowVisible

• 0x4a4594 IsWindowEnabled

• 0x4a4598 IsWindow

• 0x4a459c IsRectEmpty

• 0x4a45a0 IsIconic

• 0x4a45a4 IsDialogMessageA

• 0x4a45a8 IsChild

• 0x4a45ac InvalidateRect

• 0x4a45b0 IntersectRect

• 0x4a45b4 InsertMenuItemA

• 0x4a45b8 InsertMenuA

• 0x4a45bc InflateRect

• 0x4a45c0 GetWindowThreadProcessId

• 0x4a45c4 GetWindowTextA

• 0x4a45c8 GetWindowRect

• 0x4a45cc GetWindowPlacement

• 0x4a45d0 GetWindowLongA

• 0x4a45d4 GetWindowDC

• 0x4a45d8 GetTopWindow

• 0x4a45dc GetSystemMetrics

• 0x4a45e0 GetSystemMenu

• 0x4a45e4 GetSysColorBrush

• 0x4a45e8 GetSysColor

• 0x4a45ec GetSubMenu

• 0x4a45f0 GetScrollRange

• 0x4a45f4 GetScrollPos

• 0x4a45f8 GetScrollInfo

• 0x4a45fc GetPropA

• 0x4a4600 GetParent

• 0x4a4604 GetWindow

• 0x4a4608 GetMenuStringA

• 0x4a460c GetMenuState

• 0x4a4610 GetMenuItemInfoA

• 0x4a4614 GetMenuItemID

• 0x4a4618 GetMenuItemCount

• 0x4a461c GetMenu

• 0x4a4620 GetLastActivePopup

• 0x4a4624 GetKeyboardState

• 0x4a4628 GetKeyboardLayoutList

• 0x4a462c GetKeyboardLayout

• 0x4a4630 GetKeyState

• 0x4a4634 GetKeyNameTextA

• 0x4a4638 GetIconInfo

• 0x4a463c GetForegroundWindow

• 0x4a4640 GetFocus

• 0x4a4644 GetDlgItem

• 0x4a4648 GetDesktopWindow

• 0x4a464c GetDCEx

• 0x4a4650 GetDC

• 0x4a4654 GetCursorPos

• 0x4a4658 GetCursor

• 0x4a465c GetClipboardData

• 0x4a4660 GetClientRect

• 0x4a4664 GetClassNameA

• 0x4a4668 GetClassInfoA

• 0x4a466c GetCapture

• 0x4a4670 GetActiveWindow

• 0x4a4674 FrameRect

• 0x4a4678 FindWindowA

• 0x4a467c FillRect

• 0x4a4680 EqualRect

• 0x4a4684 EnumWindows

• 0x4a4688 EnumThreadWindows

• 0x4a468c EndPaint

• 0x4a4690 EnableWindow

• 0x4a4694 EnableScrollBar

• 0x4a4698 EnableMenuItem

• 0x4a469c DrawTextA

• 0x4a46a0 DrawMenuBar

• 0x4a46a4 DrawIconEx

• 0x4a46a8 DrawIcon

• 0x4a46ac DrawFrameControl

• 0x4a46b0 DrawEdge

• 0x4a46b4 DispatchMessageA

• 0x4a46b8 DestroyWindow

• 0x4a46bc DestroyMenu

• 0x4a46c0 DestroyIcon

• 0x4a46c4 DestroyCursor

• 0x4a46c8 DeleteMenu

• 0x4a46cc DefWindowProcA

• 0x4a46d0 DefMDIChildProcA

• 0x4a46d4 DefFrameProcA

• 0x4a46d8 CreatePopupMenu

• 0x4a46dc CreateMenu

• 0x4a46e0 CreateIcon

• 0x4a46e4 ClientToScreen

• 0x4a46e8 CheckMenuItem

• 0x4a46ec CallWindowProcA

• 0x4a46f0 CallNextHookEx

• 0x4a46f4 BeginPaint

• 0x4a46f8 CharNextA

• 0x4a46fc CharLowerBuffA

• 0x4a4700 CharLowerA

• 0x4a4704 CharUpperBuffA

• 0x4a4708 CharToOemBuffA

• 0x4a470c CharToOemA

• 0x4a4710 AdjustWindowRectEx

• 0x4a4714 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4a471c Sleep

Library oleaut32.dll:

• 0x4a4724 SafeArrayPtrOfIndex

• 0x4a4728 SafeArrayPutElement

• 0x4a472c SafeArrayGetElement

• 0x4a4730 SafeArrayUnaccessData

• 0x4a4734 SafeArrayAccessData

• 0x4a4738 SafeArrayGetUBound

• 0x4a473c SafeArrayGetLBound

• 0x4a4740 SafeArrayCreate

• 0x4a4744 VariantChangeType

• 0x4a4748 VariantCopyInd

• 0x4a474c VariantCopy

• 0x4a4750 VariantClear

• 0x4a4754 VariantInit

Library ole32.dll:

• 0x4a475c CoCreateInstance

• 0x4a4760 CoUninitialize

• 0x4a4764 CoInitialize

Library oleaut32.dll:

• 0x4a476c GetErrorInfo

• 0x4a4770 SysFreeString

Library comctl32.dll:

• 0x4a4778 ImageList_SetIconSize

• 0x4a477c ImageList_GetIconSize

• 0x4a4780 ImageList_Write

• 0x4a4784 ImageList_Read

• 0x4a4788 ImageList_GetDragImage

• 0x4a478c ImageList_DragShowNolock

• 0x4a4790 ImageList_SetDragCursorImage

• 0x4a4794 ImageList_DragMove

• 0x4a4798 ImageList_DragLeave

• 0x4a479c ImageList_DragEnter

• 0x4a47a0 ImageList_EndDrag

• 0x4a47a4 ImageList_BeginDrag

• 0x4a47a8 ImageList_Remove

• 0x4a47ac ImageList_DrawEx

• 0x4a47b0 ImageList_Replace

• 0x4a47b4 ImageList_Draw

• 0x4a47b8 ImageList_GetBkColor

• 0x4a47bc ImageList_SetBkColor

• 0x4a47c0 ImageList_ReplaceIcon

• 0x4a47c4 ImageList_Add

• 0x4a47c8 ImageList_GetImageCount

• 0x4a47cc ImageList_Destroy

• 0x4a47d0 ImageList_Create

• 0x4a47d4 InitCommonControls

Library comdlg32.dll:

• 0x4a47dc GetSaveFileNameA

• 0x4a47e0 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	51809	239.255.255.250	3702
192.168.56.101	51811	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.