SmartHawk

10.0

0-day

62 个模型检测该样本为恶意！

重新分析

下载样本

e29aab6bf4f627b3068a69e6bb8cbe4c98d7e5994bf7ff5d53a4a2e7e98ccc20

8f4c8d16eb563ed0f2ea2602bb31cf2c.exe

分析耗时

79s

最近分析

文件大小

674.5KB

静态报毒动态报毒 AGEN AI SCORE=83 AIDETECTVM ALI2000015 AUTO BT7LUW BXXJ CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMOY EMRT FAREIT GENETIC HIGH CONFIDENCE HOACQX IGENT KCLOUD KRYPTIK LOKI MALWARE2 MALWARE@#2KWYUYQWW1OAB PUTTY PWSX QGW@AUULB7FI REMCOS SCORE SMAD1 SPYBOTNET SUSGEN TSCOPE UNSAFE X2094 ZELPHIF ZUSY 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FVZ!8F4C8D16EB56	20201211	6.0.6.653
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20201210	21.1.5827.0
Tencent	Win32.Backdoor.Fareit.Auto	20201211	1.0.0.1
Kingsoft	Win32.Troj.Undef.(kcloud)	20201211	2017.9.26.565
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619718755.318249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619718761.021249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619718766.333249 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619718751.771249 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619718748.926751 NtAllocateVirtualMemory	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success
1619718749.067751 NtProtectVirtualMemory	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0046f000	success
1619718749.082751 NtAllocateVirtualMemory	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01fa0000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619718766.255249 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8f4c8d16eb563ed0f2ea2602bb31cf2c.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8f4c8d16eb563ed0f2ea2602bb31cf2c.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.1984853597622145

section

{'size_of_data': '0x00024600', 'virtual_address': '0x0008a000', 'entropy': 7.1984853597622145, 'name': '.rsrc', 'virtual_size': '0x00024594'}

description

A section with a high entropy has been found

entropy

0.21603563474387527

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619718760.958249 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2536 called NtSetContextThread to modify thread in remote process 2620
1619718749.317751 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2620	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2536 resumed a thread in remote process 2620
1619718750.301751 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2620	success	0	0

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619718749.239751 CreateProcessInternalW	thread_identifier: 3068 thread_handle: 0x000000fc process_identifier: 2620 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8f4c8d16eb563ed0f2ea2602bb31cf2c.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619718749.239751 NtUnmapViewOfSection	process_identifier: 2620 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619718749.239751 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 2620 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619718749.317751 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619718749.317751 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2620	success	0
1619718750.301751 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2620	success	0
1619718752.833249 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2620	success	0

File has been identified by 62 AntiVirus engines on VirusTotal as malicious (50 out of 62 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.308923
FireEye	Generic.mg.8f4c8d16eb563ed0
McAfee	Fareit-FVZ!8F4C8D16EB56
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2257361
SUPERAntiSpyware	Trojan.Agent/Gen-Loki
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.c98129
Arcabit	Trojan.Zusy.D4B6BB
Cyren	W32/Injector.BXXJ-4480
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Malware.Remcos-8987122-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Gen:Variant.Zusy.308923
NANO-Antivirus	Trojan.Win32.Kryptik.hoacqx
Paloalto	generic.ml
Tencent	Win32.Backdoor.Fareit.Auto
Ad-Aware	Gen:Variant.Zusy.308923
Sophos	Mal/Generic-S
Comodo	Malware@#2kwyuyqww1oab
F-Secure	Heuristic.HEUR/AGEN.1138160
DrWeb	BackDoor.SpyBotNET.25
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.LOKI.SMAD1.hp
McAfee-GW-Edition	BehavesLike.Win32.Fareit.jh
Emsisoft	Gen:Variant.Zusy.308923 (B)
Jiangmin	Trojan.Kryptik.bwy
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1138160
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.Kryptik
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	PWS:Win32/Fareit.AQ!MTB
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Gen:Variant.Zusy.308923
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2094
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZelphiF.34670.QGW@auuLB7fi
ALYac	Gen:Variant.Zusy.308923
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47d154 DeleteCriticalSection

• 0x47d158 LeaveCriticalSection

• 0x47d15c EnterCriticalSection

• 0x47d160 InitializeCriticalSection

• 0x47d164 VirtualFree

• 0x47d168 VirtualAlloc

• 0x47d16c LocalFree

• 0x47d170 LocalAlloc

• 0x47d174 GetVersion

• 0x47d178 GetCurrentThreadId

• 0x47d17c InterlockedDecrement

• 0x47d180 InterlockedIncrement

• 0x47d184 VirtualQuery

• 0x47d188 WideCharToMultiByte

• 0x47d18c MultiByteToWideChar

• 0x47d190 lstrlenA

• 0x47d194 lstrcpynA

• 0x47d198 LoadLibraryExA

• 0x47d19c GetThreadLocale

• 0x47d1a0 GetStartupInfoA

• 0x47d1a4 GetProcAddress

• 0x47d1a8 GetModuleHandleA

• 0x47d1ac GetModuleFileNameA

• 0x47d1b0 GetLocaleInfoA

• 0x47d1b4 GetCommandLineA

• 0x47d1b8 FreeLibrary

• 0x47d1bc FindFirstFileA

• 0x47d1c0 FindClose

• 0x47d1c4 ExitProcess

• 0x47d1c8 WriteFile

• 0x47d1cc UnhandledExceptionFilter

• 0x47d1d0 RtlUnwind

• 0x47d1d4 RaiseException

• 0x47d1d8 GetStdHandle

Library user32.dll:

• 0x47d1e0 GetKeyboardType

• 0x47d1e4 LoadStringA

• 0x47d1e8 MessageBoxA

• 0x47d1ec CharNextA

Library advapi32.dll:

• 0x47d1f4 RegQueryValueExA

• 0x47d1f8 RegOpenKeyExA

• 0x47d1fc RegCloseKey

Library oleaut32.dll:

• 0x47d204 SysFreeString

• 0x47d208 SysReAllocStringLen

• 0x47d20c SysAllocStringLen

Library kernel32.dll:

• 0x47d214 TlsSetValue

• 0x47d218 TlsGetValue

• 0x47d21c LocalAlloc

• 0x47d220 GetModuleHandleA

Library advapi32.dll:

• 0x47d228 RegQueryValueExA

• 0x47d22c RegOpenKeyExA

• 0x47d230 RegCloseKey

Library kernel32.dll:

• 0x47d238 lstrcpyA

• 0x47d23c WriteFile

• 0x47d240 WaitForSingleObject

• 0x47d244 VirtualQuery

• 0x47d248 VirtualProtect

• 0x47d24c VirtualAlloc

• 0x47d250 Sleep

• 0x47d254 SizeofResource

• 0x47d258 SetThreadLocale

• 0x47d25c SetFilePointer

• 0x47d260 SetEvent

• 0x47d264 SetErrorMode

• 0x47d268 SetEndOfFile

• 0x47d26c ResetEvent

• 0x47d270 ReadFile

• 0x47d274 MultiByteToWideChar

• 0x47d278 MulDiv

• 0x47d27c LockResource

• 0x47d280 LoadResource

• 0x47d284 LoadLibraryA

• 0x47d288 LeaveCriticalSection

• 0x47d28c InitializeCriticalSection

• 0x47d290 GlobalUnlock

• 0x47d294 GlobalReAlloc

• 0x47d298 GlobalHandle

• 0x47d29c GlobalLock

• 0x47d2a0 GlobalFree

• 0x47d2a4 GlobalFindAtomA

• 0x47d2a8 GlobalDeleteAtom

• 0x47d2ac GlobalAlloc

• 0x47d2b0 GlobalAddAtomA

• 0x47d2b4 GetVersionExA

• 0x47d2b8 GetVersion

• 0x47d2bc GetTickCount

• 0x47d2c0 GetThreadLocale

• 0x47d2c4 GetSystemInfo

• 0x47d2c8 GetStringTypeExA

• 0x47d2cc GetStdHandle

• 0x47d2d0 GetProcAddress

• 0x47d2d4 GetModuleHandleA

• 0x47d2d8 GetModuleFileNameA

• 0x47d2dc GetLocaleInfoA

• 0x47d2e0 GetLocalTime

• 0x47d2e4 GetLastError

• 0x47d2e8 GetFullPathNameA

• 0x47d2ec GetFileAttributesA

• 0x47d2f0 GetDiskFreeSpaceA

• 0x47d2f4 GetDateFormatA

• 0x47d2f8 GetCurrentThreadId

• 0x47d2fc GetCurrentProcessId

• 0x47d300 GetCPInfo

• 0x47d304 GetACP

• 0x47d308 FreeResource

• 0x47d30c InterlockedIncrement

• 0x47d310 InterlockedExchange

• 0x47d314 InterlockedDecrement

• 0x47d318 FreeLibrary

• 0x47d31c FormatMessageA

• 0x47d320 FindResourceA

• 0x47d324 FindFirstFileA

• 0x47d328 FindClose

• 0x47d32c FileTimeToLocalFileTime

• 0x47d330 FileTimeToDosDateTime

• 0x47d334 EnumCalendarInfoA

• 0x47d338 EnterCriticalSection

• 0x47d33c DeleteCriticalSection

• 0x47d340 CreateThread

• 0x47d344 CreateFileA

• 0x47d348 CreateEventA

• 0x47d34c CompareStringA

• 0x47d350 CloseHandle

Library version.dll:

• 0x47d358 VerQueryValueA

• 0x47d35c GetFileVersionInfoSizeA

• 0x47d360 GetFileVersionInfoA

Library gdi32.dll:

• 0x47d368 UnrealizeObject

• 0x47d36c StretchBlt

• 0x47d370 SetWindowOrgEx

• 0x47d374 SetWinMetaFileBits

• 0x47d378 SetViewportOrgEx

• 0x47d37c SetTextColor

• 0x47d380 SetStretchBltMode

• 0x47d384 SetROP2

• 0x47d388 SetPixel

• 0x47d38c SetEnhMetaFileBits

• 0x47d390 SetDIBColorTable

• 0x47d394 SetBrushOrgEx

• 0x47d398 SetBkMode

• 0x47d39c SetBkColor

• 0x47d3a0 SelectPalette

• 0x47d3a4 SelectObject

• 0x47d3a8 SaveDC

• 0x47d3ac RestoreDC

• 0x47d3b0 Rectangle

• 0x47d3b4 RectVisible

• 0x47d3b8 RealizePalette

• 0x47d3bc Polyline

• 0x47d3c0 PlayEnhMetaFile

• 0x47d3c4 PatBlt

• 0x47d3c8 MoveToEx

• 0x47d3cc MaskBlt

• 0x47d3d0 LineTo

• 0x47d3d4 IntersectClipRect

• 0x47d3d8 GetWindowOrgEx

• 0x47d3dc GetWinMetaFileBits

• 0x47d3e0 GetTextMetricsA

• 0x47d3e4 GetTextExtentPoint32A

• 0x47d3e8 GetSystemPaletteEntries

• 0x47d3ec GetStockObject

• 0x47d3f0 GetPixel

• 0x47d3f4 GetPaletteEntries

• 0x47d3f8 GetObjectA

• 0x47d3fc GetEnhMetaFilePaletteEntries

• 0x47d400 GetEnhMetaFileHeader

• 0x47d404 GetEnhMetaFileBits

• 0x47d408 GetDeviceCaps

• 0x47d40c GetDIBits

• 0x47d410 GetDIBColorTable

• 0x47d414 GetDCOrgEx

• 0x47d418 GetCurrentPositionEx

• 0x47d41c GetClipBox

• 0x47d420 GetBrushOrgEx

• 0x47d424 GetBitmapBits

• 0x47d428 ExcludeClipRect

• 0x47d42c DeleteObject

• 0x47d430 DeleteEnhMetaFile

• 0x47d434 DeleteDC

• 0x47d438 CreateSolidBrush

• 0x47d43c CreatePenIndirect

• 0x47d440 CreatePalette

• 0x47d444 CreateHalftonePalette

• 0x47d448 CreateFontIndirectA

• 0x47d44c CreateDIBitmap

• 0x47d450 CreateDIBSection

• 0x47d454 CreateCompatibleDC

• 0x47d458 CreateCompatibleBitmap

• 0x47d45c CreateBrushIndirect

• 0x47d460 CreateBitmap

• 0x47d464 CopyEnhMetaFileA

• 0x47d468 BitBlt

Library user32.dll:

• 0x47d470 CreateWindowExA

• 0x47d474 WindowFromPoint

• 0x47d478 WinHelpA

• 0x47d47c WaitMessage

• 0x47d480 UpdateWindow

• 0x47d484 UnregisterClassA

• 0x47d488 UnhookWindowsHookEx

• 0x47d48c TranslateMessage

• 0x47d490 TranslateMDISysAccel

• 0x47d494 TrackPopupMenu

• 0x47d498 SystemParametersInfoA

• 0x47d49c ShowWindow

• 0x47d4a0 ShowScrollBar

• 0x47d4a4 ShowOwnedPopups

• 0x47d4a8 ShowCursor

• 0x47d4ac SetWindowsHookExA

• 0x47d4b0 SetWindowPos

• 0x47d4b4 SetWindowPlacement

• 0x47d4b8 SetWindowLongA

• 0x47d4bc SetTimer

• 0x47d4c0 SetScrollRange

• 0x47d4c4 SetScrollPos

• 0x47d4c8 SetScrollInfo

• 0x47d4cc SetRect

• 0x47d4d0 SetPropA

• 0x47d4d4 SetParent

• 0x47d4d8 SetMenuItemInfoA

• 0x47d4dc SetMenu

• 0x47d4e0 SetForegroundWindow

• 0x47d4e4 SetFocus

• 0x47d4e8 SetCursor

• 0x47d4ec SetClassLongA

• 0x47d4f0 SetCapture

• 0x47d4f4 SetActiveWindow

• 0x47d4f8 SendMessageA

• 0x47d4fc ScrollWindow

• 0x47d500 ScreenToClient

• 0x47d504 RemovePropA

• 0x47d508 RemoveMenu

• 0x47d50c ReleaseDC

• 0x47d510 ReleaseCapture

• 0x47d514 RegisterWindowMessageA

• 0x47d518 RegisterClipboardFormatA

• 0x47d51c RegisterClassA

• 0x47d520 RedrawWindow

• 0x47d524 PtInRect

• 0x47d528 PostQuitMessage

• 0x47d52c PostMessageA

• 0x47d530 PeekMessageA

• 0x47d534 OffsetRect

• 0x47d538 OemToCharA

• 0x47d53c MessageBoxA

• 0x47d540 MapWindowPoints

• 0x47d544 MapVirtualKeyA

• 0x47d548 LoadStringA

• 0x47d54c LoadKeyboardLayoutA

• 0x47d550 LoadIconA

• 0x47d554 LoadCursorA

• 0x47d558 LoadBitmapA

• 0x47d55c KillTimer

• 0x47d560 IsZoomed

• 0x47d564 IsWindowVisible

• 0x47d568 IsWindowEnabled

• 0x47d56c IsWindow

• 0x47d570 IsRectEmpty

• 0x47d574 IsIconic

• 0x47d578 IsDialogMessageA

• 0x47d57c IsChild

• 0x47d580 InvalidateRect

• 0x47d584 IntersectRect

• 0x47d588 InsertMenuItemA

• 0x47d58c InsertMenuA

• 0x47d590 InflateRect

• 0x47d594 GetWindowThreadProcessId

• 0x47d598 GetWindowTextA

• 0x47d59c GetWindowRect

• 0x47d5a0 GetWindowPlacement

• 0x47d5a4 GetWindowLongA

• 0x47d5a8 GetWindowDC

• 0x47d5ac GetTopWindow

• 0x47d5b0 GetSystemMetrics

• 0x47d5b4 GetSystemMenu

• 0x47d5b8 GetSysColorBrush

• 0x47d5bc GetSysColor

• 0x47d5c0 GetSubMenu

• 0x47d5c4 GetScrollRange

• 0x47d5c8 GetScrollPos

• 0x47d5cc GetScrollInfo

• 0x47d5d0 GetPropA

• 0x47d5d4 GetParent

• 0x47d5d8 GetWindow

• 0x47d5dc GetMenuStringA

• 0x47d5e0 GetMenuState

• 0x47d5e4 GetMenuItemInfoA

• 0x47d5e8 GetMenuItemID

• 0x47d5ec GetMenuItemCount

• 0x47d5f0 GetMenu

• 0x47d5f4 GetLastActivePopup

• 0x47d5f8 GetKeyboardState

• 0x47d5fc GetKeyboardLayoutList

• 0x47d600 GetKeyboardLayout

• 0x47d604 GetKeyState

• 0x47d608 GetKeyNameTextA

• 0x47d60c GetIconInfo

• 0x47d610 GetForegroundWindow

• 0x47d614 GetFocus

• 0x47d618 GetDlgItem

• 0x47d61c GetDesktopWindow

• 0x47d620 GetDCEx

• 0x47d624 GetDC

• 0x47d628 GetCursorPos

• 0x47d62c GetCursor

• 0x47d630 GetClipboardData

• 0x47d634 GetClientRect

• 0x47d638 GetClassNameA

• 0x47d63c GetClassInfoA

• 0x47d640 GetCapture

• 0x47d644 GetActiveWindow

• 0x47d648 FrameRect

• 0x47d64c FindWindowA

• 0x47d650 FillRect

• 0x47d654 EqualRect

• 0x47d658 EnumWindows

• 0x47d65c EnumThreadWindows

• 0x47d660 EndPaint

• 0x47d664 EnableWindow

• 0x47d668 EnableScrollBar

• 0x47d66c EnableMenuItem

• 0x47d670 DrawTextA

• 0x47d674 DrawMenuBar

• 0x47d678 DrawIconEx

• 0x47d67c DrawIcon

• 0x47d680 DrawFrameControl

• 0x47d684 DrawEdge

• 0x47d688 DispatchMessageA

• 0x47d68c DestroyWindow

• 0x47d690 DestroyMenu

• 0x47d694 DestroyIcon

• 0x47d698 DestroyCursor

• 0x47d69c DeleteMenu

• 0x47d6a0 DefWindowProcA

• 0x47d6a4 DefMDIChildProcA

• 0x47d6a8 DefFrameProcA

• 0x47d6ac CreatePopupMenu

• 0x47d6b0 CreateMenu

• 0x47d6b4 CreateIcon

• 0x47d6b8 ClientToScreen

• 0x47d6bc CheckMenuItem

• 0x47d6c0 CallWindowProcA

• 0x47d6c4 CallNextHookEx

• 0x47d6c8 BeginPaint

• 0x47d6cc CharNextA

• 0x47d6d0 CharLowerBuffA

• 0x47d6d4 CharLowerA

• 0x47d6d8 CharToOemA

• 0x47d6dc AdjustWindowRectEx

• 0x47d6e0 ActivateKeyboardLayout

Library kernel32.dll:

• 0x47d6e8 Sleep

Library oleaut32.dll:

• 0x47d6f0 SafeArrayPtrOfIndex

• 0x47d6f4 SafeArrayGetUBound

• 0x47d6f8 SafeArrayGetLBound

• 0x47d6fc SafeArrayCreate

• 0x47d700 VariantChangeType

• 0x47d704 VariantCopy

• 0x47d708 VariantClear

• 0x47d70c VariantInit

Library ole32.dll:

• 0x47d714 CoCreateInstance

• 0x47d718 CoUninitialize

• 0x47d71c CoInitialize

Library oleaut32.dll:

• 0x47d724 CreateErrorInfo

• 0x47d728 GetErrorInfo

• 0x47d72c SetErrorInfo

• 0x47d730 SysFreeString

Library comctl32.dll:

• 0x47d738 ImageList_SetIconSize

• 0x47d73c ImageList_GetIconSize

• 0x47d740 ImageList_Write

• 0x47d744 ImageList_Read

• 0x47d748 ImageList_GetDragImage

• 0x47d74c ImageList_DragShowNolock

• 0x47d750 ImageList_SetDragCursorImage

• 0x47d754 ImageList_DragMove

• 0x47d758 ImageList_DragLeave

• 0x47d75c ImageList_DragEnter

• 0x47d760 ImageList_EndDrag

• 0x47d764 ImageList_BeginDrag

• 0x47d768 ImageList_Remove

• 0x47d76c ImageList_DrawEx

• 0x47d770 ImageList_Replace

• 0x47d774 ImageList_Draw

• 0x47d778 ImageList_GetBkColor

• 0x47d77c ImageList_SetBkColor

• 0x47d780 ImageList_ReplaceIcon

• 0x47d784 ImageList_Add

• 0x47d788 ImageList_GetImageCount

• 0x47d78c ImageList_Destroy

• 0x47d790 ImageList_Create

Library comdlg32.dll:

• 0x47d798 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
mecharnise.ir
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	54260	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58970	224.0.0.252	5355
192.168.56.101	60221	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.