SmartHawk

6.8

高危

43 个模型检测该样本为恶意！

重新分析

下载样本

79345a94382dfdb4b9471deb0b39545d9067aa935071c76eb88bd7b6e22d6dfd

9572f15281f98b437b1f737a5fab47a7.exe

分析耗时

80s

最近分析

文件大小

927.0KB

静态报毒动态报毒 5Y0@AS4UCYHK 6BHZRX4LT5D AI SCORE=84 CONFIDENCE DOWNLOADER34 ELDORADO EMOTET GENCIRC GENERICKD GENETIC GENKRYPTIK HFWW HGFT HIGH CONFIDENCE HSFEQL KRYPTIK MALWARE@#3F4FD3QEXOTEB MALWAREX OSIHS QVM41 R348049 ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Emotet.6feaf4c1	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_60% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20201023	18.4.3895.0
Kingsoft		20201023	2013.8.14.323
McAfee	Emotet-FRV!9572F15281F9	20201023	6.0.6.653
Tencent	Malware.Win32.Gencirc.10cde863	20201023	1.0.0.1

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619789586.105 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619789576.793 CryptGenKey	crypto_handle: 0x00596398 algorithm_identifier: 0x0000660e () provider_handle: 0x005959b0 flags: 1 key: fK<RWÕ¿ö>V à^	success	1
1619789586.121 CryptExportKey	crypto_handle: 0x00596398 crypto_export_handle: 0x00595a78 buffer: f¤ÛN\ûkN«âûÝ!_*AÞ/yP!ìPG¹$z,éb§Ö¬#õ+.5ö<Yø"zÖ=E÷eJõJâaÐA ·¨¥ZF\îêõ]÷ùi æÒUç}Ï blob_type: 1 flags: 64	success	1
1619789621.355 CryptExportKey	crypto_handle: 0x00596398 crypto_export_handle: 0x00595a78 buffer: f¤É¡J¨!ekDo2Ä±ç>Qw mùl¸Ã,uVkµÛi)T.½ï(H\&;âÁ¬»Uù(AOÎ£v@÷.õÐ²ï!^\|êxÀÄU)X5+P blob_type: 1 flags: 64	success	1
1619789627.465 CryptExportKey	crypto_handle: 0x00596398 crypto_export_handle: 0x00595a78 buffer: f¤GñR8Ñº!`!4oóòK±9åäBìæ±-¤â¾zÎ¤!]rª$4õóÐô¿÷©çN[®{?1\|§AKÜ2÷Dà~Ú³lH®È1µkhÜZª blob_type: 1 flags: 64	success	1
1619789633.543 CryptExportKey	crypto_handle: 0x00596398 crypto_export_handle: 0x00595a78 buffer: f¤%'åüøÎ£¿\|µpOLÃ3B¦)ËÅcsÆdsKGb¾Ãôþs4ü9\¹dØQÏÇ)ºößè=huÅø óúiÁ\Ç:>V]TâLØ-yq blob_type: 1 flags: 64	success	1

This executable has a PDB path (1 个事件)

pdb_path

c:\Users\Mr.Anderson\Desktop\2008\14.8.20\ExpandingCheck_demo\ExpCheckTest\Release\ExpCheckTest.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.didat

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619789575.824 NtAllocateVirtualMemory	process_identifier: 2452 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00540000	success	0	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619789576.433 Process32NextW	process_name: wsqmcons.exe snapshot_handle: 0x0000016c process_identifier: 1704	success	1	0
1619789586.121 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x00000178 process_identifier: 2256	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619789586.59 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

9572f15281f98b437b1f737a5fab47a7.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619789586.277 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	168.235.82.183
host	172.217.24.14
host	181.113.229.139
host	185.86.148.68
host	71.57.180.213

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619789589.168 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619789589.168 RegSetValueExA	key_handle: 0x000003c0 value: ðc_=× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619789589.168 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619789589.168 RegSetValueExW	key_handle: 0x000003c0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619789589.168 RegSetValueExA	key_handle: 0x000003d8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619789589.168 RegSetValueExA	key_handle: 0x000003d8 value: ðc_=× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619789589.168 RegSetValueExA	key_handle: 0x000003d8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619789589.199 RegSetValueExW	key_handle: 0x000003bc value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34365308
FireEye	Trojan.GenericKD.34365308
ALYac	Trojan.GenericKD.34365308
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Emotet.6feaf4c1
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_60% (W)
Arcabit	Trojan.Generic.D20C5F7C
Cyren	W32/Emotet.APV.gen!Eldorado
Symantec	Trojan.Emotet
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Packed.Emotet-9629270-0
Kaspersky	HEUR:Backdoor.Win32.Emotet.vho
BitDefender	Trojan.GenericKD.34365308
NANO-Antivirus	Trojan.Win32.Emotet.hsfeql
Paloalto	generic.ml
Rising	Trojan.Emotet!8.B95 (TFE:5:6bHZrx4lt5D)
Ad-Aware	Trojan.GenericKD.34365308
Comodo	Malware@#3f4fd3qexoteb
DrWeb	Trojan.DownLoader34.24386
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Emotet.dm
Sophos	Mal/Generic-S
Jiangmin	Trojan.Banker.Emotet.ods
Avira	TR/AD.Emotet.osihs
MAX	malware (ai score=84)
Microsoft	Trojan:Win32/Emotet!rfn
ZoneAlarm	HEUR:Backdoor.Win32.Emotet.vho
GData	Trojan.GenericKD.34365308
AhnLab-V3	Trojan/Win32.Emotet.R348049
McAfee	Emotet-FRV!9572F15281F9
ESET-NOD32	a variant of Win32/Kryptik.HGFT
Tencent	Malware.Win32.Gencirc.10cde863
Ikarus	Trojan-Banker.Emotet
Fortinet	W32/GenKryptik.HFWW!tr
BitDefenderTheta	Gen:NN.ZexaF.34570.5y0@aS4UCyhk
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/Genetic.gen
Qihoo-360	Generic/HEUR/QVM41.2.42AB.Malware.Gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 个事件)

dead_host	192.168.56.101:49179
dead_host	192.168.56.101:49178
dead_host	71.57.180.213:80
dead_host	185.86.148.68:443
dead_host	168.235.82.183:8080

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-15 02:33:57

Imports

Library KERNEL32.dll:

• 0x4a7e50 GetCommandLineA

• 0x4a7e54 GetStartupInfoA

• 0x4a7e58 HeapAlloc

• 0x4a7e5c HeapFree

• 0x4a7e60 RaiseException

• 0x4a7e64 Sleep

• 0x4a7e68 ExitThread

• 0x4a7e6c CreateThread

• 0x4a7e70 VirtualProtect

• 0x4a7e74 VirtualAlloc

• 0x4a7e78 GetSystemInfo

• 0x4a7e7c VirtualQuery

• 0x4a7e80 HeapReAlloc

• 0x4a7e84 HeapSize

• 0x4a7e88 TerminateProcess

• 0x4a7e8c UnhandledExceptionFilter

• 0x4a7e90 SetUnhandledExceptionFilter

• 0x4a7e94 IsDebuggerPresent

• 0x4a7e98 GetACP

• 0x4a7e9c IsValidCodePage

• 0x4a7ea0 LCMapStringW

• 0x4a7ea4 GetStdHandle

• 0x4a7ea8 FreeEnvironmentStringsA

• 0x4a7eac GetEnvironmentStrings

• 0x4a7eb0 FreeEnvironmentStringsW

• 0x4a7eb4 GetEnvironmentStringsW

• 0x4a7eb8 SetHandleCount

• 0x4a7ebc RtlUnwind

• 0x4a7ec0 HeapCreate

• 0x4a7ec4 HeapDestroy

• 0x4a7ec8 VirtualFree

• 0x4a7ecc QueryPerformanceCounter

• 0x4a7ed0 GetTickCount

• 0x4a7ed4 GetSystemTimeAsFileTime

• 0x4a7ed8 FatalAppExitA

• 0x4a7edc SetConsoleCtrlHandler

• 0x4a7ee0 InitializeCriticalSectionAndSpinCount

• 0x4a7ee4 GetTimeZoneInformation

• 0x4a7ee8 LCMapStringA

• 0x4a7eec GetStringTypeA

• 0x4a7ef0 GetStringTypeW

• 0x4a7ef4 GetTimeFormatA

• 0x4a7ef8 GetDateFormatA

• 0x4a7efc GetUserDefaultLCID

• 0x4a7f00 EnumSystemLocalesA

• 0x4a7f04 IsValidLocale

• 0x4a7f08 GetLocaleInfoW

• 0x4a7f0c GetConsoleCP

• 0x4a7f10 GetConsoleMode

• 0x4a7f14 SetStdHandle

• 0x4a7f18 WriteConsoleA

• 0x4a7f1c GetConsoleOutputCP

• 0x4a7f20 WriteConsoleW

• 0x4a7f24 CompareStringW

• 0x4a7f28 SetEnvironmentVariableA

• 0x4a7f2c GetFileTime

• 0x4a7f30 GetFileSizeEx

• 0x4a7f34 GetFileAttributesA

• 0x4a7f38 SetFileAttributesA

• 0x4a7f3c SetFileTime

• 0x4a7f40 LocalFileTimeToFileTime

• 0x4a7f44 FileTimeToLocalFileTime

• 0x4a7f48 SetErrorMode

• 0x4a7f4c SystemTimeToFileTime

• 0x4a7f50 FileTimeToSystemTime

• 0x4a7f54 GetModuleHandleW

• 0x4a7f58 CreateFileA

• 0x4a7f5c GetShortPathNameA

• 0x4a7f60 GetFullPathNameA

• 0x4a7f64 GetVolumeInformationA

• 0x4a7f68 FindFirstFileA

• 0x4a7f6c FindClose

• 0x4a7f70 GetCurrentProcess

• 0x4a7f74 DuplicateHandle

• 0x4a7f78 GetFileSize

• 0x4a7f7c SetEndOfFile

• 0x4a7f80 UnlockFile

• 0x4a7f84 LockFile

• 0x4a7f88 FlushFileBuffers

• 0x4a7f8c SetFilePointer

• 0x4a7f90 WriteFile

• 0x4a7f94 ReadFile

• 0x4a7f98 lstrcmpiA

• 0x4a7f9c GetThreadLocale

• 0x4a7fa0 GetStringTypeExA

• 0x4a7fa4 DeleteFileA

• 0x4a7fa8 MoveFileA

• 0x4a7fac GetCurrentDirectoryA

• 0x4a7fb0 GetPrivateProfileStringA

• 0x4a7fb4 WritePrivateProfileStringA

• 0x4a7fb8 GetPrivateProfileIntA

• 0x4a7fbc GetAtomNameA

• 0x4a7fc0 GetOEMCP

• 0x4a7fc4 GetCPInfo

• 0x4a7fc8 InterlockedIncrement

• 0x4a7fcc GlobalFlags

• 0x4a7fd0 CopyFileA

• 0x4a7fd4 GlobalSize

• 0x4a7fd8 FormatMessageA

• 0x4a7fdc lstrlenW

• 0x4a7fe0 TlsFree

• 0x4a7fe4 DeleteCriticalSection

• 0x4a7fe8 LocalReAlloc

• 0x4a7fec TlsSetValue

• 0x4a7ff0 TlsAlloc

• 0x4a7ff4 InitializeCriticalSection

• 0x4a7ff8 GlobalHandle

• 0x4a7ffc GlobalReAlloc

• 0x4a8000 EnterCriticalSection

• 0x4a8004 TlsGetValue

• 0x4a8008 LeaveCriticalSection

• 0x4a800c LocalFree

• 0x4a8010 LocalAlloc

• 0x4a8014 InterlockedDecrement

• 0x4a8018 GetModuleFileNameW

• 0x4a801c GlobalFree

• 0x4a8020 GetCurrentProcessId

• 0x4a8024 CreateEventA

• 0x4a8028 SuspendThread

• 0x4a802c SetEvent

• 0x4a8030 WaitForSingleObject

• 0x4a8034 ResumeThread

• 0x4a8038 SetThreadPriority

• 0x4a803c CloseHandle

• 0x4a8040 GetCurrentThread

• 0x4a8044 ConvertDefaultLocale

• 0x4a8048 EnumResourceLanguagesA

• 0x4a804c GetModuleFileNameA

• 0x4a8050 GetLocaleInfoA

• 0x4a8054 InterlockedExchange

• 0x4a8058 GlobalAlloc

• 0x4a805c GlobalLock

• 0x4a8060 GlobalUnlock

• 0x4a8064 MulDiv

• 0x4a8068 lstrcmpA

• 0x4a806c FreeResource

• 0x4a8070 GetCurrentThreadId

• 0x4a8074 GlobalGetAtomNameA

• 0x4a8078 GlobalAddAtomA

• 0x4a807c GlobalFindAtomA

• 0x4a8080 GlobalDeleteAtom

• 0x4a8084 FreeLibrary

• 0x4a8088 WideCharToMultiByte

• 0x4a808c CompareStringA

• 0x4a8090 LoadLibraryA

• 0x4a8094 MultiByteToWideChar

• 0x4a8098 lstrcmpW

• 0x4a809c GetModuleHandleA

• 0x4a80a0 GetProcAddress

• 0x4a80a4 GetVersionExA

• 0x4a80a8 FindResourceA

• 0x4a80ac LoadResource

• 0x4a80b0 LockResource

• 0x4a80b4 SizeofResource

• 0x4a80b8 lstrlenA

• 0x4a80bc GetLastError

• 0x4a80c0 SetLastError

• 0x4a80c4 GetFileType

• 0x4a80c8 ExitProcess

Library USER32.dll:

• 0x4a82e4 ReuseDDElParam

• 0x4a82e8 UnpackDDElParam

• 0x4a82ec SetRect

• 0x4a82f0 SetTimer

• 0x4a82f4 KillTimer

• 0x4a82f8 GetKeyNameTextA

• 0x4a82fc MapVirtualKeyA

• 0x4a8300 IsRectEmpty

• 0x4a8304 GetSystemMenu

• 0x4a8308 SetParent

• 0x4a830c UnionRect

• 0x4a8310 GetDCEx

• 0x4a8314 LockWindowUpdate

• 0x4a8318 DestroyIcon

• 0x4a831c WaitMessage

• 0x4a8320 ReleaseCapture

• 0x4a8324 WindowFromPoint

• 0x4a8328 SetCapture

• 0x4a832c DeleteMenu

• 0x4a8330 LoadCursorA

• 0x4a8334 GetSysColorBrush

• 0x4a8338 DestroyMenu

• 0x4a833c GetMenuItemInfoA

• 0x4a8340 InflateRect

• 0x4a8344 GetMenuStringA

• 0x4a8348 AppendMenuA

• 0x4a834c InsertMenuA

• 0x4a8350 RemoveMenu

• 0x4a8354 GetDesktopWindow

• 0x4a8358 CreateDialogIndirectParamA

• 0x4a835c GetNextDlgTabItem

• 0x4a8360 EndDialog

• 0x4a8364 GetWindowThreadProcessId

• 0x4a8368 ShowOwnedPopups

• 0x4a836c SetCursor

• 0x4a8370 GetMessageA

• 0x4a8374 TranslateMessage

• 0x4a8378 GetActiveWindow

• 0x4a837c GetCursorPos

• 0x4a8380 ValidateRect

• 0x4a8384 PostQuitMessage

• 0x4a8388 EndPaint

• 0x4a838c BeginPaint

• 0x4a8390 GetWindowDC

• 0x4a8394 ReleaseDC

• 0x4a8398 GetDC

• 0x4a839c ClientToScreen

• 0x4a83a0 GrayStringA

• 0x4a83a4 DrawTextExA

• 0x4a83a8 DrawTextA

• 0x4a83ac TabbedTextOutA

• 0x4a83b0 FillRect

• 0x4a83b4 SetMenuItemBitmaps

• 0x4a83b8 GetMenuCheckMarkDimensions

• 0x4a83bc LoadBitmapA

• 0x4a83c0 ModifyMenuA

• 0x4a83c4 GetMenuState

• 0x4a83c8 EnableMenuItem

• 0x4a83cc CheckMenuItem

• 0x4a83d0 LoadMenuA

• 0x4a83d4 WinHelpA

• 0x4a83d8 GetCapture

• 0x4a83dc SetWindowsHookExA

• 0x4a83e0 CallNextHookEx

• 0x4a83e4 GetClassLongA

• 0x4a83e8 GetClassNameA

• 0x4a83ec SetPropA

• 0x4a83f0 GetPropA

• 0x4a83f4 RemovePropA

• 0x4a83f8 GetForegroundWindow

• 0x4a83fc GetLastActivePopup

• 0x4a8400 SetActiveWindow

• 0x4a8404 DispatchMessageA

• 0x4a8408 BeginDeferWindowPos

• 0x4a840c EndDeferWindowPos

• 0x4a8410 GetTopWindow

• 0x4a8414 DestroyWindow

• 0x4a8418 UnhookWindowsHookEx

• 0x4a841c GetMessageTime

• 0x4a8420 GetMessagePos

• 0x4a8424 PeekMessageA

• 0x4a8428 MapWindowPoints

• 0x4a842c ScrollWindow

• 0x4a8430 TrackPopupMenuEx

• 0x4a8434 TrackPopupMenu

• 0x4a8438 GetKeyState

• 0x4a843c SetMenu

• 0x4a8440 SetScrollRange

• 0x4a8444 GetScrollRange

• 0x4a8448 SetScrollPos

• 0x4a844c GetScrollPos

• 0x4a8450 SetForegroundWindow

• 0x4a8454 ShowScrollBar

• 0x4a8458 IsWindowVisible

• 0x4a845c UpdateWindow

• 0x4a8460 PostMessageA

• 0x4a8464 GetSubMenu

• 0x4a8468 GetMenuItemID

• 0x4a846c GetMenuItemCount

• 0x4a8470 MessageBoxA

• 0x4a8474 CreateWindowExA

• 0x4a8478 GetClassInfoExA

• 0x4a847c GetClassInfoA

• 0x4a8480 RegisterClassA

• 0x4a8484 GetWindowRect

• 0x4a8488 GetParent

• 0x4a848c EnableWindow

• 0x4a8490 SendMessageA

• 0x4a8494 GetSysColor

• 0x4a8498 AdjustWindowRectEx

• 0x4a849c ScreenToClient

• 0x4a84a0 EqualRect

• 0x4a84a4 DeferWindowPos

• 0x4a84a8 GetScrollInfo

• 0x4a84ac SetScrollInfo

• 0x4a84b0 CopyRect

• 0x4a84b4 PtInRect

• 0x4a84b8 SetWindowPlacement

• 0x4a84bc DefWindowProcA

• 0x4a84c0 CallWindowProcA

• 0x4a84c4 GetMenu

• 0x4a84c8 GetMenuBarInfo

• 0x4a84cc LoadAcceleratorsA

• 0x4a84d0 InsertMenuItemA

• 0x4a84d4 CreatePopupMenu

• 0x4a84d8 BringWindowToTop

• 0x4a84dc TranslateAcceleratorA

• 0x4a84e0 InvalidateRect

• 0x4a84e4 SetRectEmpty

• 0x4a84e8 UnregisterClassA

• 0x4a84ec GetDialogBaseUnits

• 0x4a84f0 RegisterWindowMessageA

• 0x4a84f4 CharUpperA

• 0x4a84f8 MoveWindow

• 0x4a84fc ShowWindow

• 0x4a8500 RedrawWindow

• 0x4a8504 GetWindowLongA

• 0x4a8508 EnumChildWindows

• 0x4a850c IsWindow

• 0x4a8510 DrawIcon

• 0x4a8514 IsIconic

• 0x4a8518 GetClientRect

• 0x4a851c LoadIconA

• 0x4a8520 GetSystemMetrics

• 0x4a8524 GetWindow

• 0x4a8528 CheckDlgButton

• 0x4a852c CheckRadioButton

• 0x4a8530 GetDlgItem

• 0x4a8534 GetDlgItemInt

• 0x4a8538 GetDlgItemTextA

• 0x4a853c SendDlgItemMessageA

• 0x4a8540 SetDlgItemInt

• 0x4a8544 SetDlgItemTextA

• 0x4a8548 OffsetRect

• 0x4a854c IntersectRect

• 0x4a8550 SystemParametersInfoA

• 0x4a8554 GetWindowPlacement

• 0x4a8558 GetWindowTextLengthA

• 0x4a855c GetWindowTextA

• 0x4a8560 GetFocus

• 0x4a8564 SetWindowPos

• 0x4a8568 ScrollWindowEx

• 0x4a856c SetFocus

• 0x4a8570 IsWindowEnabled

• 0x4a8574 SetWindowLongA

• 0x4a8578 GetDlgCtrlID

• 0x4a857c SetWindowTextA

• 0x4a8580 IsDialogMessageA

• 0x4a8584 IsDlgButtonChecked

• 0x4a8588 IsChild

Library GDI32.dll:

• 0x4a7c80 ExtSelectClipRgn

• 0x4a7c84 DeleteDC

• 0x4a7c88 CreateDIBPatternBrushPt

• 0x4a7c8c CreatePatternBrush

• 0x4a7c90 CreateCompatibleDC

• 0x4a7c94 GetStockObject

• 0x4a7c98 SelectPalette

• 0x4a7c9c PlayMetaFileRecord

• 0x4a7ca0 GetObjectType

• 0x4a7ca4 EnumMetaFile

• 0x4a7ca8 PlayMetaFile

• 0x4a7cac GetDeviceCaps

• 0x4a7cb0 CreatePen

• 0x4a7cb4 ExtCreatePen

• 0x4a7cb8 CreateSolidBrush

• 0x4a7cbc CreateHatchBrush

• 0x4a7cc0 PolyBezierTo

• 0x4a7cc4 CreateDCA

• 0x4a7cc8 CreateFontIndirectA

• 0x4a7ccc GetTextExtentPoint32A

• 0x4a7cd0 CreateRectRgnIndirect

• 0x4a7cd4 SetRectRgn

• 0x4a7cd8 CombineRgn

• 0x4a7cdc GetMapMode

• 0x4a7ce0 PatBlt

• 0x4a7ce4 DPtoLP

• 0x4a7ce8 GetTextMetricsA

• 0x4a7cec GetCharWidthA

• 0x4a7cf0 CreateFontA

• 0x4a7cf4 StretchDIBits

• 0x4a7cf8 CreateCompatibleBitmap

• 0x4a7cfc GetBkColor

• 0x4a7d00 PolyDraw

• 0x4a7d04 PolylineTo

• 0x4a7d08 ArcTo

• 0x4a7d0c GetCurrentPositionEx

• 0x4a7d10 ScaleWindowExtEx

• 0x4a7d14 SetWindowExtEx

• 0x4a7d18 OffsetWindowOrgEx

• 0x4a7d1c Escape

• 0x4a7d20 SetWindowOrgEx

• 0x4a7d24 ScaleViewportExtEx

• 0x4a7d28 SetViewportExtEx

• 0x4a7d2c OffsetViewportOrgEx

• 0x4a7d30 SetViewportOrgEx

• 0x4a7d34 CopyMetaFileA

• 0x4a7d38 GetDCOrgEx

• 0x4a7d3c ExtTextOutA

• 0x4a7d40 TextOutA

• 0x4a7d44 RectVisible

• 0x4a7d48 PtVisible

• 0x4a7d4c StartDocA

• 0x4a7d50 GetPixel

• 0x4a7d54 BitBlt

• 0x4a7d58 GetWindowExtEx

• 0x4a7d5c GetViewportExtEx

• 0x4a7d60 SelectClipPath

• 0x4a7d64 CreateRectRgn

• 0x4a7d68 GetClipRgn

• 0x4a7d6c SelectClipRgn

• 0x4a7d70 DeleteObject

• 0x4a7d74 SetColorAdjustment

• 0x4a7d78 SetArcDirection

• 0x4a7d7c SetMapperFlags

• 0x4a7d80 SetTextCharacterExtra

• 0x4a7d84 SetTextJustification

• 0x4a7d88 SetTextAlign

• 0x4a7d8c MoveToEx

• 0x4a7d90 LineTo

• 0x4a7d94 OffsetClipRgn

• 0x4a7d98 IntersectClipRect

• 0x4a7d9c ExcludeClipRect

• 0x4a7da0 SetMapMode

• 0x4a7da4 ModifyWorldTransform

• 0x4a7da8 SetWorldTransform

• 0x4a7dac SetGraphicsMode

• 0x4a7db0 SetStretchBltMode

• 0x4a7db4 SetROP2

• 0x4a7db8 SetPolyFillMode

• 0x4a7dbc SetBkMode

• 0x4a7dc0 RestoreDC

• 0x4a7dc4 SaveDC

• 0x4a7dc8 CreateBitmap

• 0x4a7dcc GetObjectA

• 0x4a7dd0 SetBkColor

• 0x4a7dd4 SetTextColor

• 0x4a7dd8 GetClipBox

• 0x4a7ddc SelectObject

Library COMDLG32.dll:

• 0x4a7c50 GetFileTitleA

Library WINSPOOL.DRV:

• 0x4a8640 DocumentPropertiesA

• 0x4a8644 OpenPrinterA

• 0x4a8648 ClosePrinter

Library ADVAPI32.dll:

• 0x4a7bec RegDeleteValueA

• 0x4a7bf0 RegSetValueExA

• 0x4a7bf4 RegCreateKeyExA

• 0x4a7bf8 RegSetValueA

• 0x4a7bfc RegQueryValueA

• 0x4a7c00 RegOpenKeyA

• 0x4a7c04 RegEnumKeyA

• 0x4a7c08 RegDeleteKeyA

• 0x4a7c0c RegOpenKeyExA

• 0x4a7c10 RegQueryValueExA

• 0x4a7c14 RegCloseKey

• 0x4a7c18 RegCreateKeyA

Library SHELL32.dll:

• 0x4a8260 ExtractIconA

• 0x4a8264 DragFinish

• 0x4a8268 DragQueryFileA

• 0x4a826c SHGetFileInfoA

Library SHLWAPI.dll:

• 0x4a829c PathFindFileNameA

• 0x4a82a0 PathStripToRootA

• 0x4a82a4 PathIsUNCA

• 0x4a82a8 PathFindExtensionA

• 0x4a82ac PathRemoveExtensionA

• 0x4a82b0 PathRemoveFileSpecW

Library ole32.dll:

• 0x4a8678 StringFromGUID2

• 0x4a867c CoDisconnectObject

• 0x4a8680 OleDuplicateData

• 0x4a8684 CoTaskMemAlloc

• 0x4a8688 ReleaseStgMedium

• 0x4a868c CreateBindCtx

• 0x4a8690 CoTreatAsClass

• 0x4a8694 CoCreateInstance

• 0x4a8698 ReadClassStg

• 0x4a869c ReadFmtUserTypeStg

• 0x4a86a0 OleRegGetUserType

• 0x4a86a4 WriteClassStg

• 0x4a86a8 WriteFmtUserTypeStg

• 0x4a86ac SetConvertStg

• 0x4a86b0 CoTaskMemFree

• 0x4a86b4 CLSIDFromString

• 0x4a86b8 CoUninitialize

• 0x4a86bc CoInitializeEx

• 0x4a86c0 StringFromCLSID

Library OLEAUT32.dll:

• 0x4a8174 VariantClear

• 0x4a8178 VariantChangeType

• 0x4a817c VariantInit

• 0x4a8180 SysAllocStringLen

• 0x4a8184 SysFreeString

• 0x4a8188 SysStringLen

• 0x4a818c SysAllocStringByteLen

• 0x4a8190 SysStringByteLen

• 0x4a8194 RegisterTypeLib

• 0x4a8198 LoadTypeLib

• 0x4a819c LoadRegTypeLib

• 0x4a81a0 SafeArrayUnaccessData

• 0x4a81a4 SafeArrayAccessData

• 0x4a81a8 SafeArrayGetUBound

• 0x4a81ac SafeArrayGetLBound

• 0x4a81b0 SafeArrayGetElemsize

• 0x4a81b4 SafeArrayGetDim

• 0x4a81b8 SafeArrayCreate

• 0x4a81bc SafeArrayRedim

• 0x4a81c0 VariantCopy

• 0x4a81c4 SafeArrayAllocData

• 0x4a81c8 SafeArrayAllocDescriptor

• 0x4a81cc SafeArrayCopy

• 0x4a81d0 SafeArrayGetElement

• 0x4a81d4 SafeArrayPtrOfIndex

• 0x4a81d8 SafeArrayPutElement

• 0x4a81dc SafeArrayLock

• 0x4a81e0 SafeArrayUnlock

• 0x4a81e4 SafeArrayDestroy

• 0x4a81e8 SafeArrayDestroyData

• 0x4a81ec SafeArrayDestroyDescriptor

• 0x4a81f0 VariantTimeToSystemTime

• 0x4a81f4 SystemTimeToVariantTime

• 0x4a81f8 SysReAllocStringLen

• 0x4a81fc VarDateFromStr

• 0x4a8200 VarBstrFromCy

• 0x4a8204 VarBstrFromDec

• 0x4a8208 VarDecFromStr

• 0x4a820c VarCyFromStr

• 0x4a8210 VarBstrFromDate

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	50005	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.