SmartHawk

5.4

中危

54 个模型检测该样本为恶意！

重新分析

下载样本

753ad89a35cb5d2f51f15d0b88919c090594652c00478ef2937691281a64ff22

91ab9e74f4671904b09e9ddbb1163ceb.exe

分析耗时

130s

最近分析

文件大小

596.5KB

静态报毒动态报毒 100% AI SCORE=89 AIDETECTVM ASHIFY ATTRIBUTE CLASSIC CONFIDENCE DELF DOWNLOADER33 EKLE ELDORADO FAKEXLS@CV GDSDA GENERICKD GENKRYPTIK HIGH CONFIDENCE HIGHCONFIDENCE HJZQQH IIVC03CP53C ILLBN KRYPTIK LGX@AIJG0MKK MALWARE1 MALWARE@#34812OE8L3C0P R066C0PIK20 R335627 REMCOS STATIC AI SUSGEN SUSPICIOUS PE TSCOPE UNSAFE WACATAC ZELPHICO 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	RDN/Generic Downloader.x	20201211	6.0.6.653
Alibaba	TrojanDownloader:Win32/Remcos.f2aaef85	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201210	21.1.5827.0
Tencent		20201211	1.0.0.1
Kingsoft		20201211	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691249.573374 __exception__	stacktrace: 0x54 registers.esp: 57212388 registers.edi: 0 registers.eax: 0 registers.ebp: 57212416 registers.edx: 0 registers.ebx: 0 registers.esi: 57212432 registers.ecx: 0 exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 44 exception.instruction: mov eax, dword ptr [eax + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1fc87b6	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691197.198374 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b0000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691217.777374 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (4 个事件)

host	162.255.119.102
host	172.217.24.14
host	208.100.26.245
host	23.80.253.233

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619691220.339374 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619691220.339374 RegSetValueExA	key_handle: 0x000003c0 value: Ð²cÄ<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619691220.339374 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619691220.339374 RegSetValueExW	key_handle: 0x000003c0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619691220.339374 RegSetValueExA	key_handle: 0x000003d8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619691220.339374 RegSetValueExA	key_handle: 0x000003d8 value: Ð²cÄ<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619691220.355374 RegSetValueExA	key_handle: 0x000003d8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619691220.370374 RegSetValueExW	key_handle: 0x000003bc value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.91ab9e74f4671904
McAfee	RDN/Generic Downloader.x
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanDownloader:Win32/Remcos.f2aaef85
K7GW	Riskware ( 0040eff71 )
Arcabit	Trojan.Generic.D291DB18
Cyren	W32/Delf.KN.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
BitDefender	Trojan.GenericKD.43113240
NANO-Antivirus	Trojan.Win32.Delf.hjzqqh
Paloalto	generic.ml
MicroWorld-eScan	Trojan.GenericKD.43113240
Ad-Aware	Trojan.GenericKD.43113240
Emsisoft	Trojan.GenericKD.43113240 (B)
Comodo	Malware@#34812oe8l3c0p
F-Secure	Trojan.TR/Dldr.Delf.illbn
DrWeb	Trojan.DownLoader33.39552
Zillya	Downloader.Delf.Win32.59015
TrendMicro	TROJ_GEN.R066C0PIK20
McAfee-GW-Edition	RDN/Generic Downloader.x
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Avira	TR/Dldr.Delf.illbn
Antiy-AVL	Trojan/Win32.Wacatac
Gridinsoft	Trojan.Win32.Kryptik.vb!s1
Microsoft	Trojan:Win32/Ashify.J!ibt
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Trojan.GenericKD.43113240
AhnLab-V3	Backdoor/Win32.Remcos.R335627
BitDefenderTheta	Gen:NN.ZelphiCO.34670.LGX@aiJG0mkk
ALYac	Trojan.GenericKD.43113240
MAX	malware (ai score=89)
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.SMY.Generic
ESET-NOD32	Win32/TrojanDownloader.Delf.CXM
TrendMicro-HouseCall	TROJ_GEN.R066C0PIK20
Rising	Malware.FakeXLS@CV!1.9C3D (CLASSIC)
Yandex	Trojan.DL.Delf!iivc03Cp53c
Ikarus	Trojan.Inject
MaxSecure	Trojan.Malware.9833444.susgen
Fortinet	W32/GenKryptik.EKLE!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.160.110:443
dead_host	59.24.3.173:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47f17c DeleteCriticalSection

• 0x47f180 LeaveCriticalSection

• 0x47f184 EnterCriticalSection

• 0x47f188 InitializeCriticalSection

• 0x47f18c VirtualFree

• 0x47f190 VirtualAlloc

• 0x47f194 LocalFree

• 0x47f198 LocalAlloc

• 0x47f19c GetVersion

• 0x47f1a0 GetCurrentThreadId

• 0x47f1a4 InterlockedDecrement

• 0x47f1a8 InterlockedIncrement

• 0x47f1ac VirtualQuery

• 0x47f1b0 WideCharToMultiByte

• 0x47f1b4 MultiByteToWideChar

• 0x47f1b8 lstrlenA

• 0x47f1bc lstrcpynA

• 0x47f1c0 LoadLibraryExA

• 0x47f1c4 GetThreadLocale

• 0x47f1c8 GetStartupInfoA

• 0x47f1cc GetProcAddress

• 0x47f1d0 GetModuleHandleA

• 0x47f1d4 GetModuleFileNameA

• 0x47f1d8 GetLocaleInfoA

• 0x47f1dc GetCommandLineA

• 0x47f1e0 FreeLibrary

• 0x47f1e4 FindFirstFileA

• 0x47f1e8 FindClose

• 0x47f1ec ExitProcess

• 0x47f1f0 WriteFile

• 0x47f1f4 UnhandledExceptionFilter

• 0x47f1f8 RtlUnwind

• 0x47f1fc RaiseException

• 0x47f200 GetStdHandle

Library user32.dll:

• 0x47f208 GetKeyboardType

• 0x47f20c LoadStringA

• 0x47f210 MessageBoxA

• 0x47f214 CharNextA

Library advapi32.dll:

• 0x47f21c RegQueryValueExA

• 0x47f220 RegOpenKeyExA

• 0x47f224 RegCloseKey

Library oleaut32.dll:

• 0x47f22c SysFreeString

• 0x47f230 SysReAllocStringLen

• 0x47f234 SysAllocStringLen

Library kernel32.dll:

• 0x47f23c TlsSetValue

• 0x47f240 TlsGetValue

• 0x47f244 LocalAlloc

• 0x47f248 GetModuleHandleA

Library advapi32.dll:

• 0x47f250 RegQueryValueExA

• 0x47f254 RegOpenKeyExA

• 0x47f258 RegCloseKey

Library kernel32.dll:

• 0x47f260 lstrcpyA

• 0x47f264 lstrcmpA

• 0x47f268 WriteFile

• 0x47f26c WaitForSingleObject

• 0x47f270 VirtualQuery

• 0x47f274 VirtualProtect

• 0x47f278 VirtualAlloc

• 0x47f27c TerminateProcess

• 0x47f280 Sleep

• 0x47f284 SizeofResource

• 0x47f288 SetThreadLocale

• 0x47f28c SetFilePointer

• 0x47f290 SetEvent

• 0x47f294 SetErrorMode

• 0x47f298 SetEndOfFile

• 0x47f29c ResetEvent

• 0x47f2a0 ReadFile

• 0x47f2a4 OpenProcess

• 0x47f2a8 MulDiv

• 0x47f2ac LockResource

• 0x47f2b0 LoadResource

• 0x47f2b4 LoadLibraryA

• 0x47f2b8 LeaveCriticalSection

• 0x47f2bc InitializeCriticalSection

• 0x47f2c0 HeapAlloc

• 0x47f2c4 GlobalUnlock

• 0x47f2c8 GlobalReAlloc

• 0x47f2cc GlobalHandle

• 0x47f2d0 GlobalLock

• 0x47f2d4 GlobalFree

• 0x47f2d8 GlobalFindAtomA

• 0x47f2dc GlobalDeleteAtom

• 0x47f2e0 GlobalAlloc

• 0x47f2e4 GlobalAddAtomA

• 0x47f2e8 GetVersionExA

• 0x47f2ec GetVersion

• 0x47f2f0 GetTickCount

• 0x47f2f4 GetThreadLocale

• 0x47f2f8 GetSystemInfo

• 0x47f2fc GetStringTypeExA

• 0x47f300 GetStdHandle

• 0x47f304 GetProcessHeap

• 0x47f308 GetProcAddress

• 0x47f30c GetModuleHandleA

• 0x47f310 GetModuleFileNameA

• 0x47f314 GetLocaleInfoA

• 0x47f318 GetLocalTime

• 0x47f31c GetLastError

• 0x47f320 GetFullPathNameA

• 0x47f324 GetDiskFreeSpaceA

• 0x47f328 GetDateFormatA

• 0x47f32c GetCurrentThreadId

• 0x47f330 GetCurrentProcessId

• 0x47f334 GetCPInfo

• 0x47f338 GetACP

• 0x47f33c FreeResource

• 0x47f340 InterlockedExchange

• 0x47f344 FreeLibrary

• 0x47f348 FormatMessageA

• 0x47f34c FindResourceA

• 0x47f350 EnumCalendarInfoA

• 0x47f354 EnterCriticalSection

• 0x47f358 DeleteCriticalSection

• 0x47f35c CreateThread

• 0x47f360 CreateFileA

• 0x47f364 CreateEventA

• 0x47f368 CompareStringA

• 0x47f36c CloseHandle

Library version.dll:

• 0x47f374 VerQueryValueA

• 0x47f378 GetFileVersionInfoSizeA

• 0x47f37c GetFileVersionInfoA

Library gdi32.dll:

• 0x47f384 UnrealizeObject

• 0x47f388 StretchBlt

• 0x47f38c SetWindowOrgEx

• 0x47f390 SetWinMetaFileBits

• 0x47f394 SetViewportOrgEx

• 0x47f398 SetTextColor

• 0x47f39c SetStretchBltMode

• 0x47f3a0 SetROP2

• 0x47f3a4 SetPixel

• 0x47f3a8 SetEnhMetaFileBits

• 0x47f3ac SetDIBColorTable

• 0x47f3b0 SetBrushOrgEx

• 0x47f3b4 SetBkMode

• 0x47f3b8 SetBkColor

• 0x47f3bc SelectPalette

• 0x47f3c0 SelectObject

• 0x47f3c4 SelectClipRgn

• 0x47f3c8 SaveDC

• 0x47f3cc RestoreDC

• 0x47f3d0 Rectangle

• 0x47f3d4 RectVisible

• 0x47f3d8 RealizePalette

• 0x47f3dc PlayEnhMetaFile

• 0x47f3e0 PatBlt

• 0x47f3e4 MoveToEx

• 0x47f3e8 MaskBlt

• 0x47f3ec LineTo

• 0x47f3f0 IntersectClipRect

• 0x47f3f4 GetWindowOrgEx

• 0x47f3f8 GetWinMetaFileBits

• 0x47f3fc GetTextMetricsA

• 0x47f400 GetTextExtentPointA

• 0x47f404 GetTextExtentPoint32A

• 0x47f408 GetSystemPaletteEntries

• 0x47f40c GetStockObject

• 0x47f410 GetPixel

• 0x47f414 GetPaletteEntries

• 0x47f418 GetObjectA

• 0x47f41c GetEnhMetaFilePaletteEntries

• 0x47f420 GetEnhMetaFileHeader

• 0x47f424 GetEnhMetaFileBits

• 0x47f428 GetDeviceCaps

• 0x47f42c GetDIBits

• 0x47f430 GetDIBColorTable

• 0x47f434 GetDCOrgEx

• 0x47f438 GetCurrentPositionEx

• 0x47f43c GetClipBox

• 0x47f440 GetBrushOrgEx

• 0x47f444 GetBitmapBits

• 0x47f448 ExtTextOutA

• 0x47f44c ExcludeClipRect

• 0x47f450 DeleteObject

• 0x47f454 DeleteEnhMetaFile

• 0x47f458 DeleteDC

• 0x47f45c CreateSolidBrush

• 0x47f460 CreateRectRgn

• 0x47f464 CreatePenIndirect

• 0x47f468 CreatePalette

• 0x47f46c CreateHalftonePalette

• 0x47f470 CreateFontIndirectA

• 0x47f474 CreateDIBitmap

• 0x47f478 CreateDIBSection

• 0x47f47c CreateCompatibleDC

• 0x47f480 CreateCompatibleBitmap

• 0x47f484 CreateBrushIndirect

• 0x47f488 CreateBitmap

• 0x47f48c CopyEnhMetaFileA

• 0x47f490 BitBlt

Library user32.dll:

• 0x47f498 CreateWindowExA

• 0x47f49c WindowFromPoint

• 0x47f4a0 WinHelpA

• 0x47f4a4 WaitMessage

• 0x47f4a8 UpdateWindow

• 0x47f4ac UnregisterClassA

• 0x47f4b0 UnhookWindowsHookEx

• 0x47f4b4 TranslateMessage

• 0x47f4b8 TranslateMDISysAccel

• 0x47f4bc TrackPopupMenu

• 0x47f4c0 SystemParametersInfoA

• 0x47f4c4 ShowWindow

• 0x47f4c8 ShowScrollBar

• 0x47f4cc ShowOwnedPopups

• 0x47f4d0 ShowCursor

• 0x47f4d4 SetWindowsHookExA

• 0x47f4d8 SetWindowTextA

• 0x47f4dc SetWindowPos

• 0x47f4e0 SetWindowPlacement

• 0x47f4e4 SetWindowLongA

• 0x47f4e8 SetTimer

• 0x47f4ec SetScrollRange

• 0x47f4f0 SetScrollPos

• 0x47f4f4 SetScrollInfo

• 0x47f4f8 SetRect

• 0x47f4fc SetPropA

• 0x47f500 SetParent

• 0x47f504 SetMenuItemInfoA

• 0x47f508 SetMenu

• 0x47f50c SetForegroundWindow

• 0x47f510 SetFocus

• 0x47f514 SetCursor

• 0x47f518 SetClipboardData

• 0x47f51c SetClassLongA

• 0x47f520 SetCapture

• 0x47f524 SetActiveWindow

• 0x47f528 SendMessageA

• 0x47f52c ScrollWindow

• 0x47f530 ScreenToClient

• 0x47f534 RemovePropA

• 0x47f538 RemoveMenu

• 0x47f53c ReleaseDC

• 0x47f540 ReleaseCapture

• 0x47f544 RegisterWindowMessageA

• 0x47f548 RegisterClipboardFormatA

• 0x47f54c RegisterClassA

• 0x47f550 RedrawWindow

• 0x47f554 PtInRect

• 0x47f558 PostQuitMessage

• 0x47f55c PostMessageA

• 0x47f560 PeekMessageA

• 0x47f564 OpenClipboard

• 0x47f568 OffsetRect

• 0x47f56c OemToCharA

• 0x47f570 MessageBoxA

• 0x47f574 MessageBeep

• 0x47f578 MapWindowPoints

• 0x47f57c MapVirtualKeyA

• 0x47f580 LoadStringA

• 0x47f584 LoadKeyboardLayoutA

• 0x47f588 LoadIconA

• 0x47f58c LoadCursorA

• 0x47f590 LoadBitmapA

• 0x47f594 KillTimer

• 0x47f598 IsZoomed

• 0x47f59c IsWindowVisible

• 0x47f5a0 IsWindowEnabled

• 0x47f5a4 IsWindow

• 0x47f5a8 IsRectEmpty

• 0x47f5ac IsIconic

• 0x47f5b0 IsDialogMessageA

• 0x47f5b4 IsChild

• 0x47f5b8 InvalidateRect

• 0x47f5bc IntersectRect

• 0x47f5c0 InsertMenuItemA

• 0x47f5c4 InsertMenuA

• 0x47f5c8 InflateRect

• 0x47f5cc GetWindowThreadProcessId

• 0x47f5d0 GetWindowTextA

• 0x47f5d4 GetWindowRect

• 0x47f5d8 GetWindowPlacement

• 0x47f5dc GetWindowLongA

• 0x47f5e0 GetWindowDC

• 0x47f5e4 GetTopWindow

• 0x47f5e8 GetSystemMetrics

• 0x47f5ec GetSystemMenu

• 0x47f5f0 GetSysColorBrush

• 0x47f5f4 GetSysColor

• 0x47f5f8 GetSubMenu

• 0x47f5fc GetScrollRange

• 0x47f600 GetScrollPos

• 0x47f604 GetScrollInfo

• 0x47f608 GetPropA

• 0x47f60c GetParent

• 0x47f610 GetWindow

• 0x47f614 GetMessagePos

• 0x47f618 GetMenuStringA

• 0x47f61c GetMenuState

• 0x47f620 GetMenuItemInfoA

• 0x47f624 GetMenuItemID

• 0x47f628 GetMenuItemCount

• 0x47f62c GetMenu

• 0x47f630 GetLastActivePopup

• 0x47f634 GetKeyboardState

• 0x47f638 GetKeyboardLayoutList

• 0x47f63c GetKeyboardLayout

• 0x47f640 GetKeyState

• 0x47f644 GetKeyNameTextA

• 0x47f648 GetIconInfo

• 0x47f64c GetForegroundWindow

• 0x47f650 GetFocus

• 0x47f654 GetDlgItem

• 0x47f658 GetDesktopWindow

• 0x47f65c GetDCEx

• 0x47f660 GetDC

• 0x47f664 GetCursorPos

• 0x47f668 GetCursor

• 0x47f66c GetClipboardData

• 0x47f670 GetClientRect

• 0x47f674 GetClassNameA

• 0x47f678 GetClassInfoA

• 0x47f67c GetCapture

• 0x47f680 GetActiveWindow

• 0x47f684 FrameRect

• 0x47f688 FindWindowA

• 0x47f68c FillRect

• 0x47f690 EqualRect

• 0x47f694 EnumWindows

• 0x47f698 EnumThreadWindows

• 0x47f69c EndPaint

• 0x47f6a0 EnableWindow

• 0x47f6a4 EnableScrollBar

• 0x47f6a8 EnableMenuItem

• 0x47f6ac EmptyClipboard

• 0x47f6b0 DrawTextA

• 0x47f6b4 DrawMenuBar

• 0x47f6b8 DrawIconEx

• 0x47f6bc DrawIcon

• 0x47f6c0 DrawFrameControl

• 0x47f6c4 DrawEdge

• 0x47f6c8 DispatchMessageA

• 0x47f6cc DestroyWindow

• 0x47f6d0 DestroyMenu

• 0x47f6d4 DestroyIcon

• 0x47f6d8 DestroyCursor

• 0x47f6dc DeleteMenu

• 0x47f6e0 DefWindowProcA

• 0x47f6e4 DefMDIChildProcA

• 0x47f6e8 DefFrameProcA

• 0x47f6ec CreatePopupMenu

• 0x47f6f0 CreateMenu

• 0x47f6f4 CreateIcon

• 0x47f6f8 CloseClipboard

• 0x47f6fc ClientToScreen

• 0x47f700 ChildWindowFromPoint

• 0x47f704 CheckMenuItem

• 0x47f708 CallWindowProcA

• 0x47f70c CallNextHookEx

• 0x47f710 BeginPaint

• 0x47f714 CharNextA

• 0x47f718 CharLowerBuffA

• 0x47f71c CharLowerA

• 0x47f720 CharUpperBuffA

• 0x47f724 CharToOemA

• 0x47f728 AdjustWindowRectEx

• 0x47f72c ActivateKeyboardLayout

Library kernel32.dll:

• 0x47f734 Sleep

Library oleaut32.dll:

• 0x47f73c SafeArrayPtrOfIndex

• 0x47f740 SafeArrayGetUBound

• 0x47f744 SafeArrayGetLBound

• 0x47f748 SafeArrayCreate

• 0x47f74c VariantChangeType

• 0x47f750 VariantCopy

• 0x47f754 VariantClear

• 0x47f758 VariantInit

Library ole32.dll:

• 0x47f760 CoTaskMemAlloc

• 0x47f764 CoCreateInstance

• 0x47f768 CoUninitialize

• 0x47f76c CoInitialize

Library comctl32.dll:

• 0x47f774 ImageList_SetIconSize

• 0x47f778 ImageList_GetIconSize

• 0x47f77c ImageList_Write

• 0x47f780 ImageList_Read

• 0x47f784 ImageList_GetDragImage

• 0x47f788 ImageList_DragShowNolock

• 0x47f78c ImageList_SetDragCursorImage

• 0x47f790 ImageList_DragMove

• 0x47f794 ImageList_DragLeave

• 0x47f798 ImageList_DragEnter

• 0x47f79c ImageList_EndDrag

• 0x47f7a0 ImageList_BeginDrag

• 0x47f7a4 ImageList_Remove

• 0x47f7a8 ImageList_DrawEx

• 0x47f7ac ImageList_Draw

• 0x47f7b0 ImageList_GetBkColor

• 0x47f7b4 ImageList_SetBkColor

• 0x47f7b8 ImageList_ReplaceIcon

• 0x47f7bc ImageList_Add

• 0x47f7c0 ImageList_SetImageCount

• 0x47f7c4 ImageList_GetImageCount

• 0x47f7c8 ImageList_Destroy

• 0x47f7cc ImageList_Create

• 0x47f7d0 InitCommonControls

Library shell32.dll:

• 0x47f7d8 ShellExecuteA

Library comdlg32.dll:

• 0x47f7e0 GetOpenFileNameA

Library advapi32.dll:

• 0x47f7e8 QueryServiceConfigA

• 0x47f7ec OpenServiceA

• 0x47f7f0 OpenSCManagerA

• 0x47f7f4 EnumServicesStatusA

• 0x47f7f8 ControlService

• 0x47f7fc CloseServiceHandle

Library URL.DLL:

• 0x47f804 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
drive.google.com	A 59.24.3.173	59.24.3.173
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.110
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.