SmartHawk

5.8

高危

52 个模型检测该样本为恶意！

重新分析

下载样本

1f161873dd125a5e0f11345efc60611cb3bd45d79fae7a7f10f97bc2a986938c

9582c6a0d86706108fd580909527c950.exe

分析耗时

26s

最近分析

文件大小

965.0KB

静态报毒动态报毒 8GW@ACSRKNBI AGEN AGENTTESLA AI SCORE=82 AIDETECTVM AUTO BSCOPE CLASSIC CONFIDENCE DELF DELPHILESS EMZL ENAK FAREIT FAREITIH HIGH CONFIDENCE HQMR HSFIAS KRYPTIK LOKI LOKIBOT MALWARE2 MALWARE@#2OC7QNVLQ910G S15671543 SCORE SIGGEN2 SUSGEN SUSPICIOUS PE UNSAFE X2094 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FPQ!9582C6A0D867	20201024	6.0.6.653
Baidu		20190318	1.0.0.2
Avast		20201024	18.4.3895.0
Alibaba	Trojan:Win32/Kryptik.19302e41	20190527	0.3.0.5
Tencent	Win32.Trojan.Inject.Auto	20201024	1.0.0.1
Kingsoft		20201024	2013.8.14.323
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619805959.330751 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x750ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a 9582c6a0d86706108fd580909527c950+0x543f8 @ 0x4543f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74a04b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74a05d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfd8714ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619805959.330751
__exception__

stacktrace:

RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x750ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
9582c6a0d86706108fd580909527c950+0x543f8 @ 0x4543f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74a04b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74a05d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd8714ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (27 个事件)

Time & API	Arguments	Status
1619805956.706001 NtAllocateVirtualMemory	process_identifier: 1564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02410000	success
1619805956.799001 NtProtectVirtualMemory	process_identifier: 1564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 77824 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00475000	success
1619805956.799001 NtAllocateVirtualMemory	process_identifier: 1564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02430000	success
1619805958.705751 NtAllocateVirtualMemory	process_identifier: 1476 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01d70000	success
1619805958.705751 NtAllocateVirtualMemory	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e80000	success
1619805958.705751 NtAllocateVirtualMemory	process_identifier: 1476 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d70000	success
1619805958.705751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 286720 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d72000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00512000	success
1619805959.314751 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.7362062866697086

section

{'size_of_data': '0x0005de00', 'virtual_address': '0x0009a000', 'entropy': 7.7362062866697086, 'name': '.rsrc', 'virtual_size': '0x0005dc78'}

description

A section with a high entropy has been found

entropy

0.3895228215767635

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1564 called NtSetContextThread to modify thread in remote process 1476
1619805957.456001 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4510399 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1476	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1564 resumed a thread in remote process 1476
1619805957.940001 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1476	success	0	0

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619805957.284001 CreateProcessInternalW	thread_identifier: 3068 thread_handle: 0x00000110 process_identifier: 1476 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\9582c6a0d86706108fd580909527c950.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000114 inherit_handles: 0	success	1
1619805957.284001 NtUnmapViewOfSection	process_identifier: 1476 region_size: 4096 process_handle: 0x00000114 base_address: 0x00400000	success	0
1619805957.362001 NtMapViewOfSection	section_handle: 0x0000011c process_identifier: 1476 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000114 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619805957.456001 NtGetContextThread	thread_handle: 0x00000110	success	0
1619805957.456001 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4510399 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1476	success	0
1619805957.940001 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1476	success	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Delf.FareIt.Gen.12
FireEye	Generic.mg.9582c6a0d8670610
CAT-QuickHeal	Trojan.FareitIH.S15671543
McAfee	Fareit-FPQ!9582C6A0D867
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.Delf.FareIt.Gen.12
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.0d8670
Cyren	W32/Injector.HQMR-8108
Symantec	Infostealer.Lokibot!43
APEX	Malicious
ClamAV	Win.Keylogger.AgentTesla-9372622-1
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
Alibaba	Trojan:Win32/Kryptik.19302e41
NANO-Antivirus	Trojan.Win32.Kryptik.hsfias
AegisLab	Trojan.Multi.Generic.4!c
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Trojan.Delf.FareIt.Gen.12
Comodo	Malware@#2oc7qnvlq910g
MaxSecure	Trojan.Malware.300983.susgen
DrWeb	Trojan.PWS.Siggen2.53719
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Fareit.dc
Sophos	Mal/Generic-S
Ikarus	Trojan.Inject
Jiangmin	Trojan.Kryptik.ccn
Avira	HEUR/AGEN.1138160
MAX	malware (ai score=82)
Microsoft	Trojan:Win32/Fareit.VD!MTB
Arcabit	Trojan.Delf.FareIt.Gen.12
SUPERAntiSpyware	Trojan.Agent/Gen-Loki
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.Delf.FareIt.Gen.12
AhnLab-V3	Suspicious/Win.Delphiless.X2094
BitDefenderTheta	Gen:NN.ZelphiF.34590.8GW@aCsrknbi
ALYac	Trojan.Delf.FareIt.Gen.12
VBA32	BScope.Trojan.Crypt
Panda	Trj/Agent.PM
ESET-NOD32	a variant of Win32/Injector.ENAK
Rising	Trojan.Injector!1.CA8A (CLASSIC)
SentinelOne	DFI - Suspicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Injector.EMZL!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x48c168 DeleteCriticalSection

• 0x48c16c LeaveCriticalSection

• 0x48c170 EnterCriticalSection

• 0x48c174 InitializeCriticalSection

• 0x48c178 VirtualFree

• 0x48c17c VirtualAlloc

• 0x48c180 LocalFree

• 0x48c184 LocalAlloc

• 0x48c188 GetVersion

• 0x48c18c GetCurrentThreadId

• 0x48c190 InterlockedDecrement

• 0x48c194 InterlockedIncrement

• 0x48c198 VirtualQuery

• 0x48c19c WideCharToMultiByte

• 0x48c1a0 MultiByteToWideChar

• 0x48c1a4 lstrlenA

• 0x48c1a8 lstrcpynA

• 0x48c1ac LoadLibraryExA

• 0x48c1b0 GetThreadLocale

• 0x48c1b4 GetStartupInfoA

• 0x48c1b8 GetProcAddress

• 0x48c1bc GetModuleHandleA

• 0x48c1c0 GetModuleFileNameA

• 0x48c1c4 GetLocaleInfoA

• 0x48c1c8 GetCommandLineA

• 0x48c1cc FreeLibrary

• 0x48c1d0 FindFirstFileA

• 0x48c1d4 FindClose

• 0x48c1d8 ExitProcess

• 0x48c1dc WriteFile

• 0x48c1e0 UnhandledExceptionFilter

• 0x48c1e4 RtlUnwind

• 0x48c1e8 RaiseException

• 0x48c1ec GetStdHandle

Library user32.dll:

• 0x48c1f4 GetKeyboardType

• 0x48c1f8 LoadStringA

• 0x48c1fc MessageBoxA

• 0x48c200 CharNextA

Library advapi32.dll:

• 0x48c208 RegQueryValueExA

• 0x48c20c RegOpenKeyExA

• 0x48c210 RegCloseKey

Library oleaut32.dll:

• 0x48c218 SysFreeString

• 0x48c21c SysReAllocStringLen

• 0x48c220 SysAllocStringLen

Library kernel32.dll:

• 0x48c228 TlsSetValue

• 0x48c22c TlsGetValue

• 0x48c230 LocalAlloc

• 0x48c234 GetModuleHandleA

Library advapi32.dll:

• 0x48c23c RegQueryValueExA

• 0x48c240 RegOpenKeyExA

• 0x48c244 RegCloseKey

Library kernel32.dll:

• 0x48c24c lstrcpyA

• 0x48c250 WriteFile

• 0x48c254 WaitForSingleObject

• 0x48c258 VirtualQuery

• 0x48c25c VirtualProtect

• 0x48c260 VirtualAlloc

• 0x48c264 Sleep

• 0x48c268 SizeofResource

• 0x48c26c SetThreadLocale

• 0x48c270 SetFilePointer

• 0x48c274 SetEvent

• 0x48c278 SetErrorMode

• 0x48c27c SetEndOfFile

• 0x48c280 ResetEvent

• 0x48c284 ReadFile

• 0x48c288 MultiByteToWideChar

• 0x48c28c MulDiv

• 0x48c290 LockResource

• 0x48c294 LoadResource

• 0x48c298 LoadLibraryA

• 0x48c29c LeaveCriticalSection

• 0x48c2a0 InitializeCriticalSection

• 0x48c2a4 GlobalUnlock

• 0x48c2a8 GlobalReAlloc

• 0x48c2ac GlobalHandle

• 0x48c2b0 GlobalLock

• 0x48c2b4 GlobalFree

• 0x48c2b8 GlobalFindAtomA

• 0x48c2bc GlobalDeleteAtom

• 0x48c2c0 GlobalAlloc

• 0x48c2c4 GlobalAddAtomA

• 0x48c2c8 GetVersionExA

• 0x48c2cc GetVersion

• 0x48c2d0 GetTickCount

• 0x48c2d4 GetThreadLocale

• 0x48c2d8 GetSystemTimeAsFileTime

• 0x48c2dc GetSystemInfo

• 0x48c2e0 GetStringTypeExA

• 0x48c2e4 GetStdHandle

• 0x48c2e8 GetProcAddress

• 0x48c2ec GetModuleHandleA

• 0x48c2f0 GetModuleFileNameA

• 0x48c2f4 GetLocaleInfoA

• 0x48c2f8 GetLocalTime

• 0x48c2fc GetLastError

• 0x48c300 GetFullPathNameA

• 0x48c304 GetFileAttributesA

• 0x48c308 GetDiskFreeSpaceA

• 0x48c30c GetDateFormatA

• 0x48c310 GetCurrentThreadId

• 0x48c314 GetCurrentProcessId

• 0x48c318 GetCPInfo

• 0x48c31c GetACP

• 0x48c320 FreeResource

• 0x48c324 InterlockedIncrement

• 0x48c328 InterlockedExchange

• 0x48c32c InterlockedDecrement

• 0x48c330 FreeLibrary

• 0x48c334 FormatMessageA

• 0x48c338 FindResourceA

• 0x48c33c FindFirstFileA

• 0x48c340 FindClose

• 0x48c344 FileTimeToSystemTime

• 0x48c348 FileTimeToLocalFileTime

• 0x48c34c FileTimeToDosDateTime

• 0x48c350 EnumCalendarInfoA

• 0x48c354 EnterCriticalSection

• 0x48c358 DeleteCriticalSection

• 0x48c35c CreateThread

• 0x48c360 CreateFileA

• 0x48c364 CreateEventA

• 0x48c368 CompareStringA

• 0x48c36c CloseHandle

Library version.dll:

• 0x48c374 VerQueryValueA

• 0x48c378 GetFileVersionInfoSizeA

• 0x48c37c GetFileVersionInfoA

Library gdi32.dll:

• 0x48c384 UnrealizeObject

• 0x48c388 StretchBlt

• 0x48c38c SetWindowOrgEx

• 0x48c390 SetWinMetaFileBits

• 0x48c394 SetViewportOrgEx

• 0x48c398 SetTextColor

• 0x48c39c SetStretchBltMode

• 0x48c3a0 SetROP2

• 0x48c3a4 SetPixel

• 0x48c3a8 SetEnhMetaFileBits

• 0x48c3ac SetDIBColorTable

• 0x48c3b0 SetBrushOrgEx

• 0x48c3b4 SetBkMode

• 0x48c3b8 SetBkColor

• 0x48c3bc SelectPalette

• 0x48c3c0 SelectObject

• 0x48c3c4 SelectClipRgn

• 0x48c3c8 SaveDC

• 0x48c3cc RestoreDC

• 0x48c3d0 Rectangle

• 0x48c3d4 RectVisible

• 0x48c3d8 RealizePalette

• 0x48c3dc Polyline

• 0x48c3e0 PlayEnhMetaFile

• 0x48c3e4 PatBlt

• 0x48c3e8 MoveToEx

• 0x48c3ec MaskBlt

• 0x48c3f0 LineTo

• 0x48c3f4 IntersectClipRect

• 0x48c3f8 GetWindowOrgEx

• 0x48c3fc GetWinMetaFileBits

• 0x48c400 GetTextMetricsA

• 0x48c404 GetTextExtentPoint32A

• 0x48c408 GetSystemPaletteEntries

• 0x48c40c GetStockObject

• 0x48c410 GetPixel

• 0x48c414 GetPaletteEntries

• 0x48c418 GetObjectA

• 0x48c41c GetEnhMetaFilePaletteEntries

• 0x48c420 GetEnhMetaFileHeader

• 0x48c424 GetEnhMetaFileBits

• 0x48c428 GetDeviceCaps

• 0x48c42c GetDIBits

• 0x48c430 GetDIBColorTable

• 0x48c434 GetDCOrgEx

• 0x48c438 GetCurrentPositionEx

• 0x48c43c GetClipRgn

• 0x48c440 GetClipBox

• 0x48c444 GetBrushOrgEx

• 0x48c448 GetBitmapBits

• 0x48c44c ExtTextOutA

• 0x48c450 ExcludeClipRect

• 0x48c454 DeleteObject

• 0x48c458 DeleteEnhMetaFile

• 0x48c45c DeleteDC

• 0x48c460 CreateSolidBrush

• 0x48c464 CreateRectRgn

• 0x48c468 CreatePenIndirect

• 0x48c46c CreatePalette

• 0x48c470 CreateHalftonePalette

• 0x48c474 CreateFontIndirectA

• 0x48c478 CreateDIBitmap

• 0x48c47c CreateDIBSection

• 0x48c480 CreateCompatibleDC

• 0x48c484 CreateCompatibleBitmap

• 0x48c488 CreateBrushIndirect

• 0x48c48c CreateBitmap

• 0x48c490 CopyEnhMetaFileA

• 0x48c494 BitBlt

Library opengl32.dll:

• 0x48c49c wglDeleteContext

Library user32.dll:

• 0x48c4a4 CreateWindowExA

• 0x48c4a8 WindowFromPoint

• 0x48c4ac WinHelpA

• 0x48c4b0 WaitMessage

• 0x48c4b4 UpdateWindow

• 0x48c4b8 UnregisterClassA

• 0x48c4bc UnhookWindowsHookEx

• 0x48c4c0 TranslateMessage

• 0x48c4c4 TranslateMDISysAccel

• 0x48c4c8 TrackPopupMenu

• 0x48c4cc SystemParametersInfoA

• 0x48c4d0 ShowWindow

• 0x48c4d4 ShowScrollBar

• 0x48c4d8 ShowOwnedPopups

• 0x48c4dc ShowCursor

• 0x48c4e0 SetWindowsHookExA

• 0x48c4e4 SetWindowPos

• 0x48c4e8 SetWindowPlacement

• 0x48c4ec SetWindowLongA

• 0x48c4f0 SetTimer

• 0x48c4f4 SetScrollRange

• 0x48c4f8 SetScrollPos

• 0x48c4fc SetScrollInfo

• 0x48c500 SetRect

• 0x48c504 SetPropA

• 0x48c508 SetParent

• 0x48c50c SetMenuItemInfoA

• 0x48c510 SetMenu

• 0x48c514 SetForegroundWindow

• 0x48c518 SetFocus

• 0x48c51c SetCursor

• 0x48c520 SetClassLongA

• 0x48c524 SetCapture

• 0x48c528 SetActiveWindow

• 0x48c52c SendMessageA

• 0x48c530 ScrollWindow

• 0x48c534 ScreenToClient

• 0x48c538 RemovePropA

• 0x48c53c RemoveMenu

• 0x48c540 ReleaseDC

• 0x48c544 ReleaseCapture

• 0x48c548 RegisterWindowMessageA

• 0x48c54c RegisterClipboardFormatA

• 0x48c550 RegisterClassA

• 0x48c554 RedrawWindow

• 0x48c558 PtInRect

• 0x48c55c PostQuitMessage

• 0x48c560 PostMessageA

• 0x48c564 PeekMessageA

• 0x48c568 OffsetRect

• 0x48c56c OemToCharA

• 0x48c570 MessageBoxA

• 0x48c574 MapWindowPoints

• 0x48c578 MapVirtualKeyA

• 0x48c57c LoadStringA

• 0x48c580 LoadKeyboardLayoutA

• 0x48c584 LoadIconA

• 0x48c588 LoadCursorA

• 0x48c58c LoadBitmapA

• 0x48c590 KillTimer

• 0x48c594 IsZoomed

• 0x48c598 IsWindowVisible

• 0x48c59c IsWindowEnabled

• 0x48c5a0 IsWindow

• 0x48c5a4 IsRectEmpty

• 0x48c5a8 IsIconic

• 0x48c5ac IsDialogMessageA

• 0x48c5b0 IsChild

• 0x48c5b4 InvalidateRect

• 0x48c5b8 IntersectRect

• 0x48c5bc InsertMenuItemA

• 0x48c5c0 InsertMenuA

• 0x48c5c4 InflateRect

• 0x48c5c8 GetWindowThreadProcessId

• 0x48c5cc GetWindowTextA

• 0x48c5d0 GetWindowRect

• 0x48c5d4 GetWindowPlacement

• 0x48c5d8 GetWindowLongA

• 0x48c5dc GetWindowDC

• 0x48c5e0 GetTopWindow

• 0x48c5e4 GetSystemMetrics

• 0x48c5e8 GetSystemMenu

• 0x48c5ec GetSysColorBrush

• 0x48c5f0 GetSysColor

• 0x48c5f4 GetSubMenu

• 0x48c5f8 GetScrollRange

• 0x48c5fc GetScrollPos

• 0x48c600 GetScrollInfo

• 0x48c604 GetPropA

• 0x48c608 GetParent

• 0x48c60c GetWindow

• 0x48c610 GetMenuStringA

• 0x48c614 GetMenuState

• 0x48c618 GetMenuItemInfoA

• 0x48c61c GetMenuItemID

• 0x48c620 GetMenuItemCount

• 0x48c624 GetMenu

• 0x48c628 GetLastActivePopup

• 0x48c62c GetKeyboardState

• 0x48c630 GetKeyboardLayoutList

• 0x48c634 GetKeyboardLayout

• 0x48c638 GetKeyState

• 0x48c63c GetKeyNameTextA

• 0x48c640 GetIconInfo

• 0x48c644 GetForegroundWindow

• 0x48c648 GetFocus

• 0x48c64c GetDlgItem

• 0x48c650 GetDesktopWindow

• 0x48c654 GetDCEx

• 0x48c658 GetDC

• 0x48c65c GetCursorPos

• 0x48c660 GetCursor

• 0x48c664 GetClipboardData

• 0x48c668 GetClientRect

• 0x48c66c GetClassNameA

• 0x48c670 GetClassInfoA

• 0x48c674 GetCapture

• 0x48c678 GetActiveWindow

• 0x48c67c FrameRect

• 0x48c680 FindWindowA

• 0x48c684 FillRect

• 0x48c688 EqualRect

• 0x48c68c EnumWindows

• 0x48c690 EnumThreadWindows

• 0x48c694 EndPaint

• 0x48c698 EnableWindow

• 0x48c69c EnableScrollBar

• 0x48c6a0 EnableMenuItem

• 0x48c6a4 DrawTextA

• 0x48c6a8 DrawMenuBar

• 0x48c6ac DrawIconEx

• 0x48c6b0 DrawIcon

• 0x48c6b4 DrawFrameControl

• 0x48c6b8 DrawFocusRect

• 0x48c6bc DrawEdge

• 0x48c6c0 DispatchMessageA

• 0x48c6c4 DestroyWindow

• 0x48c6c8 DestroyMenu

• 0x48c6cc DestroyIcon

• 0x48c6d0 DestroyCursor

• 0x48c6d4 DeleteMenu

• 0x48c6d8 DefWindowProcA

• 0x48c6dc DefMDIChildProcA

• 0x48c6e0 DefFrameProcA

• 0x48c6e4 CreatePopupMenu

• 0x48c6e8 CreateMenu

• 0x48c6ec CreateIcon

• 0x48c6f0 ClientToScreen

• 0x48c6f4 CheckMenuItem

• 0x48c6f8 CallWindowProcA

• 0x48c6fc CallNextHookEx

• 0x48c700 BeginPaint

• 0x48c704 CharNextA

• 0x48c708 CharLowerBuffA

• 0x48c70c CharLowerA

• 0x48c710 CharToOemA

• 0x48c714 AdjustWindowRectEx

• 0x48c718 ActivateKeyboardLayout

Library kernel32.dll:

• 0x48c720 Sleep

Library oleaut32.dll:

• 0x48c728 SafeArrayPtrOfIndex

• 0x48c72c SafeArrayGetUBound

• 0x48c730 SafeArrayGetLBound

• 0x48c734 SafeArrayCreate

• 0x48c738 VariantChangeType

• 0x48c73c VariantCopy

• 0x48c740 VariantClear

• 0x48c744 VariantInit

Library ole32.dll:

• 0x48c74c CoCreateInstance

• 0x48c750 CoUninitialize

• 0x48c754 CoInitialize

Library oleaut32.dll:

• 0x48c75c CreateErrorInfo

• 0x48c760 GetErrorInfo

• 0x48c764 SetErrorInfo

• 0x48c768 SysFreeString

Library comctl32.dll:

• 0x48c770 ImageList_SetIconSize

• 0x48c774 ImageList_GetIconSize

• 0x48c778 ImageList_Write

• 0x48c77c ImageList_Read

• 0x48c780 ImageList_GetDragImage

• 0x48c784 ImageList_DragShowNolock

• 0x48c788 ImageList_SetDragCursorImage

• 0x48c78c ImageList_DragMove

• 0x48c790 ImageList_DragLeave

• 0x48c794 ImageList_DragEnter

• 0x48c798 ImageList_EndDrag

• 0x48c79c ImageList_BeginDrag

• 0x48c7a0 ImageList_Remove

• 0x48c7a4 ImageList_DrawEx

• 0x48c7a8 ImageList_Replace

• 0x48c7ac ImageList_Draw

• 0x48c7b0 ImageList_GetBkColor

• 0x48c7b4 ImageList_SetBkColor

• 0x48c7b8 ImageList_ReplaceIcon

• 0x48c7bc ImageList_Add

• 0x48c7c0 ImageList_GetImageCount

• 0x48c7c4 ImageList_Destroy

• 0x48c7c8 ImageList_Create

Library comdlg32.dll:

• 0x48c7d0 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49714	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.