SmartHawk

6.0

高危

52 个模型检测该样本为恶意！

重新分析

下载样本

d451ccbf03a26ade8ebf9ac8ab623025dd3148b45dd1bfc85e5761e13226308d

a162f390c06775db352e460cf39938dc.exe

分析耗时

111s

最近分析

文件大小

898.5KB

静态报毒动态报毒 4GW@AYUQV0BI AI SCORE=81 ATTRIBUTE BSCOPE CLOUD CONFIDENCE DELF DOWNLOADER33 GDSDA GENCIRC GENERICRXKQ GRAFTOR HESV HIGH CONFIDENCE HIGHCONFIDENCE KRYPTIK LHUNA MALICIOUS MALREP R337020 REMCOS RQOF SCORE SUSPICIOUS PE THEBOBO TIGGRE UNSAFE ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXKQ-YP!A162F390C067	20200603	6.0.6.653
Alibaba	TrojanDownloader:Win32/Remcos.7d215938	20190527	0.3.0.5
Avast	Win32:Trojan-gen	20200603	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20200603	2013.8.14.323
Tencent	Malware.Win32.Gencirc.1178fd65	20200603	1.0.0.1
CrowdStrike	win/malicious_confidence_60% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781490.421125 __exception__	stacktrace: 0x3491722 0x3491755 0x3491672 0x344f654 0x34928cd 0x3492d92 0x345e2ba gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x775a7bca 0x348f34c 0x3492fe3 a162f390c06775db352e460cf39938dc+0x56d0f @ 0x456d0f 0x3440338 registers.esp: 1633948 registers.edi: 0 registers.eax: 1633948 registers.ebp: 1634028 registers.edx: 0 registers.ebx: 1635704 registers.esi: 56835068 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success	0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:3330572639&cup2hreq=ce612cccd70ca70d3bcafaed3004c56f422152dcb876e98c05e1aa5d1c3f1297

Performs some HTTP requests (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:3330572639&cup2hreq=ce612cccd70ca70d3bcafaed3004c56f422152dcb876e98c05e1aa5d1c3f1297

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:3330572639&cup2hreq=ce612cccd70ca70d3bcafaed3004c56f422152dcb876e98c05e1aa5d1c3f1297

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781446.328125 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00390000	success	0	0
1619781454.046125 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ff0000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Communicates with host for which no DNS query was performed (2 个事件)

host	115.238.187.35
host	172.217.24.14

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

DrWeb	Trojan.DownLoader33.45237
MicroWorld-eScan	Gen:Variant.Graftor.752783
FireEye	Gen:Variant.Graftor.752783
CAT-QuickHeal	Backdoor.Remcos
McAfee	GenericRXKQ-YP!A162F390C067
Cylance	Unsafe
Zillya	Downloader.Delf.Win32.59170
K7AntiVirus	Trojan-Downloader ( 0056707f1 )
Alibaba	TrojanDownloader:Win32/Remcos.7d215938
K7GW	Trojan-Downloader ( 0056707f1 )
Arcabit	Trojan.Graftor.DB7C8F
BitDefenderTheta	Gen:NN.ZelphiF.34122.4GW@ayUqv0bi
F-Prot	W32/Delf.AGL
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
BitDefender	Gen:Variant.Graftor.752783
Paloalto	generic.ml
AegisLab	Trojan.Win32.Remcos.m!c
Rising	Trojan.Kryptik!1.C56D (CLOUD)
Endgame	malicious (high confidence)
Emsisoft	Gen:Variant.Graftor.752783 (B)
F-Secure	Trojan.TR/Dldr.Delf.lhuna
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.MALREP.THEBOBO
McAfee-GW-Edition	BehavesLike.Win32.Worm.ch
Sophos	Mal/Generic-S
SentinelOne	DFI - Suspicious PE
Cyren	W32/Delf.RQOF-8418
Avira	TR/Dldr.Delf.lhuna
MAX	malware (ai score=81)
Antiy-AVL	Trojan/Win32.Hesv
Microsoft	Trojan:Win32/Tiggre!rfn
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Gen:Variant.Graftor.752783
AhnLab-V3	Trojan/Win32.Remcos.R337020
Acronis	suspicious
VBA32	BScope.TrojanDropper.Agent
ALYac	Backdoor.Remcos.A
Ad-Aware	Gen:Variant.Graftor.752783
Malwarebytes	Trojan.Downloader
ESET-NOD32	Win32/TrojanDownloader.Delf.BZL
TrendMicro-HouseCall	Trojan.Win32.MALREP.THEBOBO
Tencent	Malware.Win32.Gencirc.1178fd65
Ikarus	Trojan-Dropper.Win32.Delf
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Delf.BZL!tr
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	199.96.59.61:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4b6140 DeleteCriticalSection

• 0x4b6144 LeaveCriticalSection

• 0x4b6148 EnterCriticalSection

• 0x4b614c InitializeCriticalSection

• 0x4b6150 VirtualFree

• 0x4b6154 VirtualAlloc

• 0x4b6158 LocalFree

• 0x4b615c LocalAlloc

• 0x4b6160 GetVersion

• 0x4b6164 GetCurrentThreadId

• 0x4b6168 InterlockedDecrement

• 0x4b616c InterlockedIncrement

• 0x4b6170 VirtualQuery

• 0x4b6174 WideCharToMultiByte

• 0x4b6178 MultiByteToWideChar

• 0x4b617c lstrlenA

• 0x4b6180 lstrcpynA

• 0x4b6184 LoadLibraryExA

• 0x4b6188 GetThreadLocale

• 0x4b618c GetStartupInfoA

• 0x4b6190 GetProcAddress

• 0x4b6194 GetModuleHandleA

• 0x4b6198 GetModuleFileNameA

• 0x4b619c GetLocaleInfoA

• 0x4b61a0 GetCommandLineA

• 0x4b61a4 FreeLibrary

• 0x4b61a8 FindFirstFileA

• 0x4b61ac FindClose

• 0x4b61b0 ExitProcess

• 0x4b61b4 WriteFile

• 0x4b61b8 UnhandledExceptionFilter

• 0x4b61bc RtlUnwind

• 0x4b61c0 RaiseException

• 0x4b61c4 GetStdHandle

Library user32.dll:

• 0x4b61cc GetKeyboardType

• 0x4b61d0 LoadStringA

• 0x4b61d4 MessageBoxA

• 0x4b61d8 CharNextA

Library advapi32.dll:

• 0x4b61e0 RegQueryValueExA

• 0x4b61e4 RegOpenKeyExA

• 0x4b61e8 RegCloseKey

Library oleaut32.dll:

• 0x4b61f0 SysFreeString

• 0x4b61f4 SysReAllocStringLen

• 0x4b61f8 SysAllocStringLen

Library kernel32.dll:

• 0x4b6200 TlsSetValue

• 0x4b6204 TlsGetValue

• 0x4b6208 LocalAlloc

• 0x4b620c GetModuleHandleA

Library advapi32.dll:

• 0x4b6214 RegQueryValueExA

• 0x4b6218 RegOpenKeyExA

• 0x4b621c RegCloseKey

Library kernel32.dll:

• 0x4b6224 lstrcpyA

• 0x4b6228 WriteFile

• 0x4b622c WaitForSingleObject

• 0x4b6230 VirtualQuery

• 0x4b6234 VirtualProtect

• 0x4b6238 VirtualAlloc

• 0x4b623c Sleep

• 0x4b6240 SizeofResource

• 0x4b6244 SetThreadLocale

• 0x4b6248 SetFilePointer

• 0x4b624c SetEvent

• 0x4b6250 SetErrorMode

• 0x4b6254 SetEndOfFile

• 0x4b6258 ResetEvent

• 0x4b625c ReadFile

• 0x4b6260 MulDiv

• 0x4b6264 LockResource

• 0x4b6268 LoadResource

• 0x4b626c LoadLibraryA

• 0x4b6270 LeaveCriticalSection

• 0x4b6274 InitializeCriticalSection

• 0x4b6278 GlobalUnlock

• 0x4b627c GlobalReAlloc

• 0x4b6280 GlobalHandle

• 0x4b6284 GlobalLock

• 0x4b6288 GlobalFree

• 0x4b628c GlobalFindAtomA

• 0x4b6290 GlobalDeleteAtom

• 0x4b6294 GlobalAlloc

• 0x4b6298 GlobalAddAtomA

• 0x4b629c GetVersionExA

• 0x4b62a0 GetVersion

• 0x4b62a4 GetTickCount

• 0x4b62a8 GetThreadLocale

• 0x4b62ac GetSystemInfo

• 0x4b62b0 GetStringTypeExA

• 0x4b62b4 GetStdHandle

• 0x4b62b8 GetProcAddress

• 0x4b62bc GetModuleHandleA

• 0x4b62c0 GetModuleFileNameA

• 0x4b62c4 GetLocaleInfoA

• 0x4b62c8 GetLocalTime

• 0x4b62cc GetLastError

• 0x4b62d0 GetFullPathNameA

• 0x4b62d4 GetDiskFreeSpaceA

• 0x4b62d8 GetDateFormatA

• 0x4b62dc GetCurrentThreadId

• 0x4b62e0 GetCurrentProcessId

• 0x4b62e4 GetCPInfo

• 0x4b62e8 GetACP

• 0x4b62ec FreeResource

• 0x4b62f0 InterlockedExchange

• 0x4b62f4 FreeLibrary

• 0x4b62f8 FormatMessageA

• 0x4b62fc FindResourceA

• 0x4b6300 EnumCalendarInfoA

• 0x4b6304 EnterCriticalSection

• 0x4b6308 DeleteCriticalSection

• 0x4b630c CreateThread

• 0x4b6310 CreateFileA

• 0x4b6314 CreateEventA

• 0x4b6318 CompareStringA

• 0x4b631c CloseHandle

Library version.dll:

• 0x4b6324 VerQueryValueA

• 0x4b6328 GetFileVersionInfoSizeA

• 0x4b632c GetFileVersionInfoA

Library gdi32.dll:

• 0x4b6334 UnrealizeObject

• 0x4b6338 StretchBlt

• 0x4b633c SetWindowOrgEx

• 0x4b6340 SetWinMetaFileBits

• 0x4b6344 SetViewportOrgEx

• 0x4b6348 SetTextColor

• 0x4b634c SetStretchBltMode

• 0x4b6350 SetROP2

• 0x4b6354 SetPixel

• 0x4b6358 SetEnhMetaFileBits

• 0x4b635c SetDIBColorTable

• 0x4b6360 SetBrushOrgEx

• 0x4b6364 SetBkMode

• 0x4b6368 SetBkColor

• 0x4b636c SelectPalette

• 0x4b6370 SelectObject

• 0x4b6374 SaveDC

• 0x4b6378 RestoreDC

• 0x4b637c Rectangle

• 0x4b6380 RectVisible

• 0x4b6384 RealizePalette

• 0x4b6388 PlayEnhMetaFile

• 0x4b638c PatBlt

• 0x4b6390 MoveToEx

• 0x4b6394 MaskBlt

• 0x4b6398 LineTo

• 0x4b639c IntersectClipRect

• 0x4b63a0 GetWindowOrgEx

• 0x4b63a4 GetWinMetaFileBits

• 0x4b63a8 GetTextMetricsA

• 0x4b63ac GetTextExtentPointA

• 0x4b63b0 GetTextExtentPoint32A

• 0x4b63b4 GetSystemPaletteEntries

• 0x4b63b8 GetStockObject

• 0x4b63bc GetPixel

• 0x4b63c0 GetPaletteEntries

• 0x4b63c4 GetObjectA

• 0x4b63c8 GetEnhMetaFilePaletteEntries

• 0x4b63cc GetEnhMetaFileHeader

• 0x4b63d0 GetEnhMetaFileBits

• 0x4b63d4 GetDeviceCaps

• 0x4b63d8 GetDIBits

• 0x4b63dc GetDIBColorTable

• 0x4b63e0 GetDCOrgEx

• 0x4b63e4 GetCurrentPositionEx

• 0x4b63e8 GetClipBox

• 0x4b63ec GetBrushOrgEx

• 0x4b63f0 GetBitmapBits

• 0x4b63f4 ExcludeClipRect

• 0x4b63f8 DeleteObject

• 0x4b63fc DeleteEnhMetaFile

• 0x4b6400 DeleteDC

• 0x4b6404 CreateSolidBrush

• 0x4b6408 CreatePenIndirect

• 0x4b640c CreatePalette

• 0x4b6410 CreateHalftonePalette

• 0x4b6414 CreateFontIndirectA

• 0x4b6418 CreateDIBitmap

• 0x4b641c CreateDIBSection

• 0x4b6420 CreateCompatibleDC

• 0x4b6424 CreateCompatibleBitmap

• 0x4b6428 CreateBrushIndirect

• 0x4b642c CreateBitmap

• 0x4b6430 CopyEnhMetaFileA

• 0x4b6434 BitBlt

Library user32.dll:

• 0x4b643c CreateWindowExA

• 0x4b6440 WindowFromPoint

• 0x4b6444 WinHelpA

• 0x4b6448 WaitMessage

• 0x4b644c UpdateWindow

• 0x4b6450 UnregisterClassA

• 0x4b6454 UnhookWindowsHookEx

• 0x4b6458 TranslateMessage

• 0x4b645c TranslateMDISysAccel

• 0x4b6460 TrackPopupMenu

• 0x4b6464 SystemParametersInfoA

• 0x4b6468 ShowWindow

• 0x4b646c ShowScrollBar

• 0x4b6470 ShowOwnedPopups

• 0x4b6474 ShowCursor

• 0x4b6478 SetWindowsHookExA

• 0x4b647c SetWindowPos

• 0x4b6480 SetWindowPlacement

• 0x4b6484 SetWindowLongA

• 0x4b6488 SetTimer

• 0x4b648c SetScrollRange

• 0x4b6490 SetScrollPos

• 0x4b6494 SetScrollInfo

• 0x4b6498 SetRect

• 0x4b649c SetPropA

• 0x4b64a0 SetParent

• 0x4b64a4 SetMenuItemInfoA

• 0x4b64a8 SetMenu

• 0x4b64ac SetForegroundWindow

• 0x4b64b0 SetFocus

• 0x4b64b4 SetCursor

• 0x4b64b8 SetClipboardData

• 0x4b64bc SetClassLongA

• 0x4b64c0 SetCapture

• 0x4b64c4 SetActiveWindow

• 0x4b64c8 SendMessageA

• 0x4b64cc ScrollWindow

• 0x4b64d0 ScreenToClient

• 0x4b64d4 RemovePropA

• 0x4b64d8 RemoveMenu

• 0x4b64dc ReleaseDC

• 0x4b64e0 ReleaseCapture

• 0x4b64e4 RegisterWindowMessageA

• 0x4b64e8 RegisterClipboardFormatA

• 0x4b64ec RegisterClassA

• 0x4b64f0 RedrawWindow

• 0x4b64f4 PtInRect

• 0x4b64f8 PostQuitMessage

• 0x4b64fc PostMessageA

• 0x4b6500 PeekMessageA

• 0x4b6504 OpenClipboard

• 0x4b6508 OffsetRect

• 0x4b650c OemToCharA

• 0x4b6510 MessageBoxA

• 0x4b6514 MessageBeep

• 0x4b6518 MapWindowPoints

• 0x4b651c MapVirtualKeyA

• 0x4b6520 LoadStringA

• 0x4b6524 LoadKeyboardLayoutA

• 0x4b6528 LoadIconA

• 0x4b652c LoadCursorA

• 0x4b6530 LoadBitmapA

• 0x4b6534 KillTimer

• 0x4b6538 IsZoomed

• 0x4b653c IsWindowVisible

• 0x4b6540 IsWindowEnabled

• 0x4b6544 IsWindow

• 0x4b6548 IsRectEmpty

• 0x4b654c IsIconic

• 0x4b6550 IsDialogMessageA

• 0x4b6554 IsChild

• 0x4b6558 InvalidateRect

• 0x4b655c IntersectRect

• 0x4b6560 InsertMenuItemA

• 0x4b6564 InsertMenuA

• 0x4b6568 InflateRect

• 0x4b656c GetWindowThreadProcessId

• 0x4b6570 GetWindowTextA

• 0x4b6574 GetWindowRect

• 0x4b6578 GetWindowPlacement

• 0x4b657c GetWindowLongA

• 0x4b6580 GetWindowDC

• 0x4b6584 GetTopWindow

• 0x4b6588 GetSystemMetrics

• 0x4b658c GetSystemMenu

• 0x4b6590 GetSysColorBrush

• 0x4b6594 GetSysColor

• 0x4b6598 GetSubMenu

• 0x4b659c GetScrollRange

• 0x4b65a0 GetScrollPos

• 0x4b65a4 GetScrollInfo

• 0x4b65a8 GetPropA

• 0x4b65ac GetParent

• 0x4b65b0 GetWindow

• 0x4b65b4 GetMenuStringA

• 0x4b65b8 GetMenuState

• 0x4b65bc GetMenuItemInfoA

• 0x4b65c0 GetMenuItemID

• 0x4b65c4 GetMenuItemCount

• 0x4b65c8 GetMenu

• 0x4b65cc GetLastActivePopup

• 0x4b65d0 GetKeyboardState

• 0x4b65d4 GetKeyboardLayoutList

• 0x4b65d8 GetKeyboardLayout

• 0x4b65dc GetKeyState

• 0x4b65e0 GetKeyNameTextA

• 0x4b65e4 GetIconInfo

• 0x4b65e8 GetForegroundWindow

• 0x4b65ec GetFocus

• 0x4b65f0 GetDlgItem

• 0x4b65f4 GetDesktopWindow

• 0x4b65f8 GetDCEx

• 0x4b65fc GetDC

• 0x4b6600 GetCursorPos

• 0x4b6604 GetCursor

• 0x4b6608 GetClipboardData

• 0x4b660c GetClientRect

• 0x4b6610 GetClassNameA

• 0x4b6614 GetClassInfoA

• 0x4b6618 GetCapture

• 0x4b661c GetActiveWindow

• 0x4b6620 FrameRect

• 0x4b6624 FindWindowA

• 0x4b6628 FillRect

• 0x4b662c EqualRect

• 0x4b6630 EnumWindows

• 0x4b6634 EnumThreadWindows

• 0x4b6638 EndPaint

• 0x4b663c EnableWindow

• 0x4b6640 EnableScrollBar

• 0x4b6644 EnableMenuItem

• 0x4b6648 EmptyClipboard

• 0x4b664c DrawTextA

• 0x4b6650 DrawMenuBar

• 0x4b6654 DrawIconEx

• 0x4b6658 DrawIcon

• 0x4b665c DrawFrameControl

• 0x4b6660 DrawEdge

• 0x4b6664 DispatchMessageA

• 0x4b6668 DestroyWindow

• 0x4b666c DestroyMenu

• 0x4b6670 DestroyIcon

• 0x4b6674 DestroyCursor

• 0x4b6678 DeleteMenu

• 0x4b667c DefWindowProcA

• 0x4b6680 DefMDIChildProcA

• 0x4b6684 DefFrameProcA

• 0x4b6688 CreatePopupMenu

• 0x4b668c CreateMenu

• 0x4b6690 CreateIcon

• 0x4b6694 CloseClipboard

• 0x4b6698 ClientToScreen

• 0x4b669c CheckMenuItem

• 0x4b66a0 CallWindowProcA

• 0x4b66a4 CallNextHookEx

• 0x4b66a8 BeginPaint

• 0x4b66ac CharNextA

• 0x4b66b0 CharLowerBuffA

• 0x4b66b4 CharLowerA

• 0x4b66b8 CharUpperBuffA

• 0x4b66bc CharToOemA

• 0x4b66c0 AdjustWindowRectEx

• 0x4b66c4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4b66cc Sleep

Library oleaut32.dll:

• 0x4b66d4 SafeArrayPtrOfIndex

• 0x4b66d8 SafeArrayGetUBound

• 0x4b66dc SafeArrayGetLBound

• 0x4b66e0 SafeArrayCreate

• 0x4b66e4 VariantChangeType

• 0x4b66e8 VariantCopy

• 0x4b66ec VariantClear

• 0x4b66f0 VariantInit

Library comctl32.dll:

• 0x4b66f8 ImageList_SetIconSize

• 0x4b66fc ImageList_GetIconSize

• 0x4b6700 ImageList_Write

• 0x4b6704 ImageList_Read

• 0x4b6708 ImageList_GetDragImage

• 0x4b670c ImageList_DragShowNolock

• 0x4b6710 ImageList_SetDragCursorImage

• 0x4b6714 ImageList_DragMove

• 0x4b6718 ImageList_DragLeave

• 0x4b671c ImageList_DragEnter

• 0x4b6720 ImageList_EndDrag

• 0x4b6724 ImageList_BeginDrag

• 0x4b6728 ImageList_Remove

• 0x4b672c ImageList_DrawEx

• 0x4b6730 ImageList_Replace

• 0x4b6734 ImageList_Draw

• 0x4b6738 ImageList_GetBkColor

• 0x4b673c ImageList_SetBkColor

• 0x4b6740 ImageList_ReplaceIcon

• 0x4b6744 ImageList_Add

• 0x4b6748 ImageList_SetImageCount

• 0x4b674c ImageList_GetImageCount

• 0x4b6750 ImageList_Destroy

• 0x4b6754 ImageList_Create

Library comdlg32.dll:

• 0x4b675c GetOpenFileNameA

Library URL.DLL:

• 0x4b6764 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	216.58.200.238
drive.google.com	A 199.96.59.61	104.31.143.88
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.40.98	203.208.41.34
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49185	203.208.40.98 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	58970	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	62191	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	54178	224.0.0.252	5355
192.168.56.101	54260	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57236	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.