SmartHawk

6.0

高危

64 个模型检测该样本为恶意！

重新分析

下载样本

18070e7166c579ac54913700b73717f750f06ce4bb780876f60541471433fbea

8becdf26fc14c52531dd3c4701806b54.exe

分析耗时

73s

最近分析

文件大小

27.0KB

静态报毒动态报毒 100% A + TROJ AHNL AI SCORE=82 BADUR BQW@AEUXXPK CLASSIC CONFIDENCE CRYPTED DBPKLQ E3KPB2ANLRW ELDORADO FAMVT FLOOD FLOODER GEN@24TBUS GENASA GENERICKDZ GENETIC HIGH CONFIDENCE ILCP M4VU MALICIOUS PE MUPX SCORE STATIC AI TINY UNSAFE UPATRE VFLOODER VTFLOODER VTFODSVM XPACK ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Vtflooder.6c984f8e	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu	Win32.Trojan-Downloader.Tiny.c	20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201210	21.1.5827.0
Kingsoft		20201211	2017.9.26.565
McAfee	VTFlooder!8BECDF26FC14	20201211	6.0.6.653
Tencent	Trojan.Win32.VtFlooder.a	20201211	1.0.0.1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686134.872334 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.imports

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST http://www.virustotal.com/vtapi/v2/file/scan

Performs some HTTP requests (1 个事件)

request

POST http://www.virustotal.com/vtapi/v2/file/scan

Sends data using the HTTP POST Method (1 个事件)

request

POST http://www.virustotal.com/vtapi/v2/file/scan

Allocates read-write-execute memory (usually to unpack itself) (50 out of 95 个事件)

Time & API	Arguments	Status
1619686134.856334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686137.340334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686138.075334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686138.653334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686139.168334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686140.559334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686141.122334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686141.684334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686142.309334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686142.872334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686143.434334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686144.090334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686144.653334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686145.293334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686145.872334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686146.418334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686146.965334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686147.528334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686148.043334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686148.668334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686149.325334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686149.887334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686150.434334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686150.997334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686151.840334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686152.528334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686153.075334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686153.903334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686154.559334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686155.137334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686156.372334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686157.012334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686158.090334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686158.637334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686159.153334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686159.809334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686160.372334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686160.918334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686161.465334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686162.028334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686162.653334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686163.325334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686163.887334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686164.481334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686165.043334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686165.590334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686166.153334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686166.747334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686167.309334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619686167.872334 NtAllocateVirtualMemory	process_identifier: 732 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

7.222721013023776

section

{'size_of_data': '0x00000e00', 'virtual_address': '0x00007000', 'entropy': 7.222721013023776, 'name': 'UPX1', 'virtual_size': '0x00001000'}

description

A section with a high entropy has been found

The executable is compressed using UPX (3 个事件)

section	UPX0	description	Section name indicates UPX
section	UPX1	description	Section name indicates UPX
section	UPX2	description	Section name indicates UPX

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

31.13.68.1:80

File has been identified by 64 AntiVirus engines on VirusTotal as malicious (50 out of 64 个事件)

Bkav	W32.FamVT.VtfodsVM.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.71392
FireEye	Generic.mg.8becdf26fc14c525
CAT-QuickHeal	Trojan.Vflooder.E3
Qihoo-360	Win32/Trojan.Flooder.8e7
ALYac	Trojan.GenericKDZ.71392
Cylance	Unsafe
Zillya	Trojan.Vtflooder.Win32.868
Sangfor	Malware
K7AntiVirus	Spyware ( 0049c3e41 )
Alibaba	Trojan:Win32/Vtflooder.6c984f8e
K7GW	Spyware ( 0049c3e41 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D116E0
Baidu	Win32.Trojan-Downloader.Tiny.c
Cyren	W32/S-528c72e4!Eldorado
Symantec	Downloader.Upatre
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Malware.Vtflooder-6723768-0
Kaspersky	Trojan.Win32.Vtflooder.cft
BitDefender	Trojan.GenericKDZ.71392
NANO-Antivirus	Trojan.Win32.Crypted.dbpklq
Paloalto	generic.ml
AegisLab	Trojan.Win32.Generic.m4vu
Rising	Trojan.Win32.Vflooder.b (CLASSIC)
Ad-Aware	Trojan.GenericKDZ.71392
TACHYON	Trojan/W32.Vtflooder.27648.B
Sophos	ML/PE-A + Troj/Agent-AHNL
Comodo	Packed.Win32.MUPX.Gen@24tbus
F-Secure	Trojan.TR/Crypt.XPACK.Gen
DrWeb	Trojan.Flood.22062
VIPRE	Trojan.Win32.Vflooder.a (v)
TrendMicro	Trojan.Win32.VFLOODER.SM
McAfee-GW-Edition	BehavesLike.Win32.VTFlooder.mz
Emsisoft	Trojan.GenericKDZ.71392 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan/Badur.cky
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Win32.Badur
Gridinsoft	Trojan.Win32.Agent.bot!s2
Microsoft	Trojan:Win32/Vflooder.A
ZoneAlarm	Trojan.Win32.Vtflooder.cft
GData	Win32.Trojan.Vflooder.A
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Vflooder.C1453219
Acronis	suspicious
McAfee	VTFlooder!8BECDF26FC14
MAX	malware (ai score=82)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2014-07-21 17:12:37

Imports

Library KERNEL32.DLL:

• 0x402000 Sleep

• 0x402004 lstrlenA

• 0x402008 CreateThread

• 0x40200c VirtualFree

• 0x402010 GetModuleFileNameW

• 0x402014 GetTickCount

• 0x402018 ExitProcess

• 0x40201c GetFileSize

• 0x402020 VirtualAlloc

• 0x402024 ReadFile

• 0x402028 CloseHandle

• 0x40202c CreateFileW

• 0x402030 lstrlenW

• 0x402034 MultiByteToWideChar

Library ntdll.dll:

• 0x402078 memset

• 0x40207c _wtoi

• 0x402080 memcpy

Library ole32.dll:

• 0x402088 CreateStreamOnHGlobal

Library SHLWAPI.dll:

• 0x40203c StrStrA

Library USER32.dll:

• 0x402044 wsprintfA

• 0x402048 wsprintfW

Library WINHTTP.dll:

• 0x402050 WinHttpCrackUrl

• 0x402054 WinHttpOpen

• 0x402058 WinHttpConnect

• 0x40205c WinHttpOpenRequest

• 0x402060 WinHttpSendRequest

• 0x402064 WinHttpQueryHeaders

• 0x402068 WinHttpReadData

• 0x40206c WinHttpCloseHandle

• 0x402070 WinHttpReceiveResponse

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
www.virustotal.com	CNAME ghs-svc-https-c46.ghs-ssl.googlehosted.com A 74.125.34.46	74.125.34.46
twitter.com	A 31.13.68.1	202.160.129.6
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49173	74.125.34.46 www.virustotal.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

URI	Data
http://www.virustotal.com/vtapi/v2/file/scan	POST /vtapi/v2/file/scan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=------000000022899406 User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14 Content-Length: 28006 Host: www.virustotal.com
http://www.virustotal.com/vtapi/v2/file/scan	POST /vtapi/v2/file/scan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=------000000022919750 User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14 Content-Length: 28006 Host: www.virustotal.com
http://www.virustotal.com/vtapi/v2/file/scan	POST /vtapi/v2/file/scan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=------000000022946453 User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14 Content-Length: 28006 Host: www.virustotal.com
http://www.virustotal.com/vtapi/v2/file/scan	POST /vtapi/v2/file/scan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=------000000022913343 User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14 Content-Length: 28006 Host: www.virustotal.com
http://www.virustotal.com/vtapi/v2/file/scan	POST /vtapi/v2/file/scan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=------000000022898296 User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14 Content-Length: 28006 Host: www.virustotal.com
http://www.virustotal.com/vtapi/v2/file/scan	POST /vtapi/v2/file/scan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=------000000022894187 User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14 Content-Length: 28006 Host: www.virustotal.com
http://www.virustotal.com/vtapi/v2/file/scan	POST /vtapi/v2/file/scan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=------000000022925078 User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14 Content-Length: 28006 Host: www.virustotal.com
http://www.virustotal.com/vtapi/v2/file/scan	POST /vtapi/v2/file/scan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=------000000022926281 User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14 Content-Length: 28006 Host: www.virustotal.com
http://www.virustotal.com/vtapi/v2/file/scan	POST /vtapi/v2/file/scan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=------000000022903718 User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14 Content-Length: 28006 Host: www.virustotal.com
http://www.virustotal.com/vtapi/v2/file/scan	POST /vtapi/v2/file/scan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=------000000022922843 User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14 Content-Length: 28006 Host: www.virustotal.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.