SmartHawk

7.2

高危

58 个模型检测该样本为恶意！

重新分析

下载样本

65ba735b51860a27d7b7880d4f3153ebb4817e162141ceb4624f4f10862d2cfa

a2aa0eb68dac3d9af868672964477355.exe

分析耗时

34s

最近分析

文件大小

1.4MB

静态报毒动态报毒 AGEN AGENTTESLA AI SCORE=81 AIDETECTVM AUTO AVSARHER BTOMTW CEEINJECT CHW@AMPRCKEI CLASSIC CONFIDENCE DELF DELPHILESS ELXR EMJE FAREIT FORMBOOK GDSDA GENERICKD HIGH CONFIDENCE HLATDZ JBVN LOKI MALWARE2 MALWARE@#7FEWRQUXR2SK MASSLOGGER SCARSI SCORE SIGGEN9 SMTHG STATIC AI SUSPICIOUS PE TRJGEN TSCOPE UNSAFE X2066 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201210	21.1.5827.0
Alibaba	VirTool:Win32/CeeInject.3e290748	20190527	0.3.0.5
Tencent	Win32.Trojan.Inject.Auto	20201211	1.0.0.1
Kingsoft		20201211	2017.9.26.565
McAfee	Fareit-FTB!A2AA0EB68DAC	20201211	6.0.6.653
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619783645.374875 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a a2aa0eb68dac3d9af868672964477355+0xb83f8 @ 0x4b83f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d a2aa0eb68dac3d9af868672964477355+0x17005c @ 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe8114ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619783645.374875
__exception__

stacktrace:

RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
a2aa0eb68dac3d9af868672964477355+0xb83f8 @ 0x4b83f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d
a2aa0eb68dac3d9af868672964477355+0x17005c @ 0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe8114ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (28 个事件)

Time & API	Arguments	Status
1619781420.499375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d0000	success
1619781420.827375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00700000	success
1619781420.827375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00720000	success
1619783644.546875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619783644.577875 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02110000	success
1619783644.577875 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022b0000	success
1619783644.577875 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02000000	success
1619783644.577875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 696320 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02002000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01ff2000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01ff2000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01ff2000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01ff2000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01ff2000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01ff2000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01ff2000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01ff2000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01ff2000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01ff2000	success
1619783645.311875 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 个事件)

Time & API	Arguments	Status	Return
1619781420.843375 Process32NextW	process_name: taskhost.exe snapshot_handle: 0x000000f8 process_identifier: 192	success	1
1619781420.843375 Process32NextW	process_name: pythonw.exe snapshot_handle: 0x000000f8 process_identifier: 2308	success	1
1619781420.843375 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x000000f8 process_identifier: 2856	success	1
1619781420.843375 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x000000f8 process_identifier: 3060	success	1
1619781420.843375 Process32NextW	process_name: a2aa0eb68dac3d9af868672964477355.exe snapshot_handle: 0x000000f8 process_identifier: 2996	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.481398885396224

section

{'size_of_data': '0x000c1400', 'virtual_address': '0x000b5000', 'entropy': 7.481398885396224, 'name': '.rsrc', 'virtual_size': '0x000c1264'}

description

A section with a high entropy has been found

entropy

0.524245506951509

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2996 called NtSetContextThread to modify thread in remote process 2040
1619781420.984375 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5723264 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2040	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2996 resumed a thread in remote process 2040
1619781421.093375 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2040	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.27.142:443

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619781420.968375 CreateProcessInternalW	thread_identifier: 1688 thread_handle: 0x000000fc process_identifier: 2040 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a2aa0eb68dac3d9af868672964477355.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619781420.968375 NtUnmapViewOfSection	process_identifier: 2040 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619781420.968375 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 2040 commit_size: 1536000 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 1536000 base_address: 0x00400000	success	0
1619781420.984375 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619781420.984375 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5723264 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2040	success	0
1619781421.093375 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2040	success	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34006750
FireEye	Generic.mg.a2aa0eb68dac3d9a
ALYac	Trojan.Agent.Masslogger
Cylance	Unsafe
AegisLab	Trojan.Win32.Scarsi.4!c
Sangfor	Malware
K7AntiVirus	Trojan ( 005686cb1 )
BitDefender	Trojan.GenericKD.34006750
K7GW	Trojan ( 005686cb1 )
Cybereason	malicious.46660e
Arcabit	Trojan.Generic.D206E6DE
Cyren	W32/Trojan.JBVN-7083
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Malware.AgentTesla-8016717-1
Kaspersky	HEUR:Trojan.Win32.Scarsi.gen
Alibaba	VirTool:Win32/CeeInject.3e290748
NANO-Antivirus	Trojan.Win32.TrjGen.hlatdz
ViRobot	Trojan.Win32.S.Infostealer.1510912
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Trojan.GenericKD.34006750
Sophos	Mal/Generic-S
Comodo	Malware@#7fewrquxr2sk
F-Secure	Heuristic.HEUR/AGEN.1137421
DrWeb	Trojan.Siggen9.53048
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.LOKI.SMTHG
McAfee-GW-Edition	BehavesLike.Win32.Fareit.tc
Emsisoft	Trojan.GenericKD.34006750 (B)
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.Scarsi.ciw
Avira	HEUR/AGEN.1137421
Antiy-AVL	Trojan/Win32.Scarsi
Gridinsoft	Trojan.Win32.Packed.vb
Microsoft	Trojan:Win32/FormBook.CR!MTB
ZoneAlarm	HEUR:Trojan.Win32.Scarsi.gen
GData	Trojan.GenericKD.34006750
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2066
McAfee	Fareit-FTB!A2AA0EB68DAC
TACHYON	Trojan/W32.DP-Agent.1510912.C
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Injector.EMJE
TrendMicro-HouseCall	TrojanSpy.Win32.LOKI.SMTHG
Rising	Trojan.Injector!1.CB27 (CLASSIC)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4a4154 DeleteCriticalSection

• 0x4a4158 LeaveCriticalSection

• 0x4a415c EnterCriticalSection

• 0x4a4160 InitializeCriticalSection

• 0x4a4164 VirtualFree

• 0x4a4168 VirtualAlloc

• 0x4a416c LocalFree

• 0x4a4170 LocalAlloc

• 0x4a4174 GetVersion

• 0x4a4178 GetCurrentThreadId

• 0x4a417c InterlockedDecrement

• 0x4a4180 InterlockedIncrement

• 0x4a4184 VirtualQuery

• 0x4a4188 WideCharToMultiByte

• 0x4a418c MultiByteToWideChar

• 0x4a4190 lstrlenA

• 0x4a4194 lstrcpynA

• 0x4a4198 LoadLibraryExA

• 0x4a419c GetThreadLocale

• 0x4a41a0 GetStartupInfoA

• 0x4a41a4 GetProcAddress

• 0x4a41a8 GetModuleHandleA

• 0x4a41ac GetModuleFileNameA

• 0x4a41b0 GetLocaleInfoA

• 0x4a41b4 GetCommandLineA

• 0x4a41b8 FreeLibrary

• 0x4a41bc FindFirstFileA

• 0x4a41c0 FindClose

• 0x4a41c4 ExitProcess

• 0x4a41c8 WriteFile

• 0x4a41cc UnhandledExceptionFilter

• 0x4a41d0 RtlUnwind

• 0x4a41d4 RaiseException

• 0x4a41d8 GetStdHandle

Library user32.dll:

• 0x4a41e0 GetKeyboardType

• 0x4a41e4 LoadStringA

• 0x4a41e8 MessageBoxA

• 0x4a41ec CharNextA

Library advapi32.dll:

• 0x4a41f4 RegQueryValueExA

• 0x4a41f8 RegOpenKeyExA

• 0x4a41fc RegCloseKey

Library oleaut32.dll:

• 0x4a4204 SysFreeString

• 0x4a4208 SysReAllocStringLen

• 0x4a420c SysAllocStringLen

Library kernel32.dll:

• 0x4a4214 TlsSetValue

• 0x4a4218 TlsGetValue

• 0x4a421c LocalAlloc

• 0x4a4220 GetModuleHandleA

Library advapi32.dll:

• 0x4a4228 RegQueryValueExA

• 0x4a422c RegOpenKeyExA

• 0x4a4230 RegCloseKey

Library kernel32.dll:

• 0x4a4238 lstrcpyA

• 0x4a423c WriteFile

• 0x4a4240 WaitForSingleObjectEx

• 0x4a4244 WaitForSingleObject

• 0x4a4248 VirtualQuery

• 0x4a424c VirtualAlloc

• 0x4a4250 Sleep

• 0x4a4254 SizeofResource

• 0x4a4258 SetThreadLocale

• 0x4a425c SetFilePointer

• 0x4a4260 SetEvent

• 0x4a4264 SetErrorMode

• 0x4a4268 SetEndOfFile

• 0x4a426c SearchPathA

• 0x4a4270 ResetEvent

• 0x4a4274 ReleaseMutex

• 0x4a4278 ReadFile

• 0x4a427c OpenFileMappingA

• 0x4a4280 MultiByteToWideChar

• 0x4a4284 MulDiv

• 0x4a4288 LockResource

• 0x4a428c LoadResource

• 0x4a4290 LoadLibraryA

• 0x4a4294 LeaveCriticalSection

• 0x4a4298 IsDBCSLeadByte

• 0x4a429c InitializeCriticalSection

• 0x4a42a0 GlobalUnlock

• 0x4a42a4 GlobalReAlloc

• 0x4a42a8 GlobalHandle

• 0x4a42ac GlobalLock

• 0x4a42b0 GlobalFree

• 0x4a42b4 GlobalFindAtomA

• 0x4a42b8 GlobalDeleteAtom

• 0x4a42bc GlobalAlloc

• 0x4a42c0 GlobalAddAtomA

• 0x4a42c4 GetVersionExA

• 0x4a42c8 GetVersion

• 0x4a42cc GetTickCount

• 0x4a42d0 GetThreadLocale

• 0x4a42d4 GetSystemTimeAsFileTime

• 0x4a42d8 GetSystemTime

• 0x4a42dc GetSystemInfo

• 0x4a42e0 GetStringTypeExA

• 0x4a42e4 GetStdHandle

• 0x4a42e8 GetProcAddress

• 0x4a42ec GetModuleHandleA

• 0x4a42f0 GetModuleFileNameA

• 0x4a42f4 GetLocaleInfoA

• 0x4a42f8 GetLocalTime

• 0x4a42fc GetLastError

• 0x4a4300 GetFullPathNameA

• 0x4a4304 GetFileAttributesA

• 0x4a4308 GetDiskFreeSpaceA

• 0x4a430c GetDateFormatA

• 0x4a4310 GetCurrentThreadId

• 0x4a4314 GetCurrentProcessId

• 0x4a4318 GetCurrentDirectoryA

• 0x4a431c GetCPInfo

• 0x4a4320 GetACP

• 0x4a4324 FreeResource

• 0x4a4328 InterlockedIncrement

• 0x4a432c InterlockedExchange

• 0x4a4330 InterlockedDecrement

• 0x4a4334 FreeLibrary

• 0x4a4338 FormatMessageA

• 0x4a433c FindResourceA

• 0x4a4340 FindFirstFileA

• 0x4a4344 FindClose

• 0x4a4348 FileTimeToLocalFileTime

• 0x4a434c FileTimeToDosDateTime

• 0x4a4350 FatalAppExitA

• 0x4a4354 ExitThread

• 0x4a4358 EnumCalendarInfoA

• 0x4a435c EnterCriticalSection

• 0x4a4360 DeleteCriticalSection

• 0x4a4364 CreateThread

• 0x4a4368 CreateMutexA

• 0x4a436c CreateFileA

• 0x4a4370 CreateEventA

• 0x4a4374 CompareStringA

• 0x4a4378 CloseHandle

Library version.dll:

• 0x4a4380 VerQueryValueA

• 0x4a4384 GetFileVersionInfoSizeA

• 0x4a4388 GetFileVersionInfoA

Library gdi32.dll:

• 0x4a4390 UnrealizeObject

• 0x4a4394 StretchBlt

• 0x4a4398 SetWindowOrgEx

• 0x4a439c SetWinMetaFileBits

• 0x4a43a0 SetViewportOrgEx

• 0x4a43a4 SetTextColor

• 0x4a43a8 SetStretchBltMode

• 0x4a43ac SetROP2

• 0x4a43b0 SetPixel

• 0x4a43b4 SetEnhMetaFileBits

• 0x4a43b8 SetDIBColorTable

• 0x4a43bc SetBrushOrgEx

• 0x4a43c0 SetBkMode

• 0x4a43c4 SetBkColor

• 0x4a43c8 SelectPalette

• 0x4a43cc SelectObject

• 0x4a43d0 SaveDC

• 0x4a43d4 RestoreDC

• 0x4a43d8 Rectangle

• 0x4a43dc RectVisible

• 0x4a43e0 RealizePalette

• 0x4a43e4 Polyline

• 0x4a43e8 PlayEnhMetaFile

• 0x4a43ec PatBlt

• 0x4a43f0 MoveToEx

• 0x4a43f4 MaskBlt

• 0x4a43f8 LineTo

• 0x4a43fc IntersectClipRect

• 0x4a4400 GetWindowOrgEx

• 0x4a4404 GetWinMetaFileBits

• 0x4a4408 GetTextMetricsA

• 0x4a440c GetTextExtentPoint32A

• 0x4a4410 GetSystemPaletteEntries

• 0x4a4414 GetStockObject

• 0x4a4418 GetPixel

• 0x4a441c GetPaletteEntries

• 0x4a4420 GetObjectA

• 0x4a4424 GetEnhMetaFilePaletteEntries

• 0x4a4428 GetEnhMetaFileHeader

• 0x4a442c GetEnhMetaFileBits

• 0x4a4430 GetDeviceCaps

• 0x4a4434 GetDIBits

• 0x4a4438 GetDIBColorTable

• 0x4a443c GetDCOrgEx

• 0x4a4440 GetCurrentPositionEx

• 0x4a4444 GetClipBox

• 0x4a4448 GetBrushOrgEx

• 0x4a444c GetBitmapBits

• 0x4a4450 ExcludeClipRect

• 0x4a4454 DeleteObject

• 0x4a4458 DeleteEnhMetaFile

• 0x4a445c DeleteDC

• 0x4a4460 CreateSolidBrush

• 0x4a4464 CreatePenIndirect

• 0x4a4468 CreatePalette

• 0x4a446c CreateHalftonePalette

• 0x4a4470 CreateFontIndirectA

• 0x4a4474 CreateDIBitmap

• 0x4a4478 CreateDIBSection

• 0x4a447c CreateCompatibleDC

• 0x4a4480 CreateCompatibleBitmap

• 0x4a4484 CreateBrushIndirect

• 0x4a4488 CreateBitmap

• 0x4a448c CopyEnhMetaFileA

• 0x4a4490 BitBlt

Library user32.dll:

• 0x4a4498 CreateWindowExA

• 0x4a449c WindowFromPoint

• 0x4a44a0 WinHelpA

• 0x4a44a4 WaitMessage

• 0x4a44a8 UpdateWindow

• 0x4a44ac UnregisterClassA

• 0x4a44b0 UnhookWindowsHookEx

• 0x4a44b4 TranslateMessage

• 0x4a44b8 TranslateMDISysAccel

• 0x4a44bc TrackPopupMenu

• 0x4a44c0 SystemParametersInfoA

• 0x4a44c4 ShowWindow

• 0x4a44c8 ShowScrollBar

• 0x4a44cc ShowOwnedPopups

• 0x4a44d0 ShowCursor

• 0x4a44d4 SetWindowsHookExA

• 0x4a44d8 SetWindowPos

• 0x4a44dc SetWindowPlacement

• 0x4a44e0 SetWindowLongA

• 0x4a44e4 SetTimer

• 0x4a44e8 SetScrollRange

• 0x4a44ec SetScrollPos

• 0x4a44f0 SetScrollInfo

• 0x4a44f4 SetRect

• 0x4a44f8 SetPropA

• 0x4a44fc SetParent

• 0x4a4500 SetMenuItemInfoA

• 0x4a4504 SetMenu

• 0x4a4508 SetForegroundWindow

• 0x4a450c SetFocus

• 0x4a4510 SetCursor

• 0x4a4514 SetClassLongA

• 0x4a4518 SetCapture

• 0x4a451c SetActiveWindow

• 0x4a4520 SendMessageA

• 0x4a4524 ScrollWindow

• 0x4a4528 ScreenToClient

• 0x4a452c RemovePropA

• 0x4a4530 RemoveMenu

• 0x4a4534 ReleaseDC

• 0x4a4538 ReleaseCapture

• 0x4a453c RegisterWindowMessageA

• 0x4a4540 RegisterClipboardFormatA

• 0x4a4544 RegisterClassA

• 0x4a4548 RedrawWindow

• 0x4a454c PtInRect

• 0x4a4550 PostQuitMessage

• 0x4a4554 PostMessageA

• 0x4a4558 PeekMessageA

• 0x4a455c OffsetRect

• 0x4a4560 OemToCharBuffA

• 0x4a4564 OemToCharA

• 0x4a4568 MessageBoxA

• 0x4a456c MapWindowPoints

• 0x4a4570 MapVirtualKeyA

• 0x4a4574 LoadStringA

• 0x4a4578 LoadKeyboardLayoutA

• 0x4a457c LoadIconA

• 0x4a4580 LoadCursorA

• 0x4a4584 LoadBitmapA

• 0x4a4588 KillTimer

• 0x4a458c IsZoomed

• 0x4a4590 IsWindowVisible

• 0x4a4594 IsWindowEnabled

• 0x4a4598 IsWindow

• 0x4a459c IsRectEmpty

• 0x4a45a0 IsIconic

• 0x4a45a4 IsDialogMessageA

• 0x4a45a8 IsChild

• 0x4a45ac InvalidateRect

• 0x4a45b0 IntersectRect

• 0x4a45b4 InsertMenuItemA

• 0x4a45b8 InsertMenuA

• 0x4a45bc InflateRect

• 0x4a45c0 GetWindowThreadProcessId

• 0x4a45c4 GetWindowTextA

• 0x4a45c8 GetWindowRect

• 0x4a45cc GetWindowPlacement

• 0x4a45d0 GetWindowLongA

• 0x4a45d4 GetWindowDC

• 0x4a45d8 GetTopWindow

• 0x4a45dc GetSystemMetrics

• 0x4a45e0 GetSystemMenu

• 0x4a45e4 GetSysColorBrush

• 0x4a45e8 GetSysColor

• 0x4a45ec GetSubMenu

• 0x4a45f0 GetScrollRange

• 0x4a45f4 GetScrollPos

• 0x4a45f8 GetScrollInfo

• 0x4a45fc GetPropA

• 0x4a4600 GetParent

• 0x4a4604 GetWindow

• 0x4a4608 GetMenuStringA

• 0x4a460c GetMenuState

• 0x4a4610 GetMenuItemInfoA

• 0x4a4614 GetMenuItemID

• 0x4a4618 GetMenuItemCount

• 0x4a461c GetMenu

• 0x4a4620 GetLastActivePopup

• 0x4a4624 GetKeyboardState

• 0x4a4628 GetKeyboardLayoutList

• 0x4a462c GetKeyboardLayout

• 0x4a4630 GetKeyState

• 0x4a4634 GetKeyNameTextA

• 0x4a4638 GetIconInfo

• 0x4a463c GetForegroundWindow

• 0x4a4640 GetFocus

• 0x4a4644 GetDlgItem

• 0x4a4648 GetDesktopWindow

• 0x4a464c GetDCEx

• 0x4a4650 GetDC

• 0x4a4654 GetCursorPos

• 0x4a4658 GetCursor

• 0x4a465c GetClipboardData

• 0x4a4660 GetClientRect

• 0x4a4664 GetClassNameA

• 0x4a4668 GetClassInfoA

• 0x4a466c GetCapture

• 0x4a4670 GetActiveWindow

• 0x4a4674 FrameRect

• 0x4a4678 FindWindowA

• 0x4a467c FillRect

• 0x4a4680 EqualRect

• 0x4a4684 EnumWindows

• 0x4a4688 EnumThreadWindows

• 0x4a468c EndPaint

• 0x4a4690 EnableWindow

• 0x4a4694 EnableScrollBar

• 0x4a4698 EnableMenuItem

• 0x4a469c DrawTextA

• 0x4a46a0 DrawMenuBar

• 0x4a46a4 DrawIconEx

• 0x4a46a8 DrawIcon

• 0x4a46ac DrawFrameControl

• 0x4a46b0 DrawEdge

• 0x4a46b4 DispatchMessageA

• 0x4a46b8 DestroyWindow

• 0x4a46bc DestroyMenu

• 0x4a46c0 DestroyIcon

• 0x4a46c4 DestroyCursor

• 0x4a46c8 DeleteMenu

• 0x4a46cc DefWindowProcA

• 0x4a46d0 DefMDIChildProcA

• 0x4a46d4 DefFrameProcA

• 0x4a46d8 CreatePopupMenu

• 0x4a46dc CreateMenu

• 0x4a46e0 CreateIcon

• 0x4a46e4 ClientToScreen

• 0x4a46e8 CheckMenuItem

• 0x4a46ec CallWindowProcA

• 0x4a46f0 CallNextHookEx

• 0x4a46f4 BeginPaint

• 0x4a46f8 CharNextA

• 0x4a46fc CharLowerBuffA

• 0x4a4700 CharLowerA

• 0x4a4704 CharUpperBuffA

• 0x4a4708 CharToOemBuffA

• 0x4a470c CharToOemA

• 0x4a4710 AdjustWindowRectEx

• 0x4a4714 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4a471c Sleep

Library oleaut32.dll:

• 0x4a4724 SafeArrayPtrOfIndex

• 0x4a4728 SafeArrayPutElement

• 0x4a472c SafeArrayGetElement

• 0x4a4730 SafeArrayUnaccessData

• 0x4a4734 SafeArrayAccessData

• 0x4a4738 SafeArrayGetUBound

• 0x4a473c SafeArrayGetLBound

• 0x4a4740 SafeArrayCreate

• 0x4a4744 VariantChangeType

• 0x4a4748 VariantCopyInd

• 0x4a474c VariantCopy

• 0x4a4750 VariantClear

• 0x4a4754 VariantInit

Library ole32.dll:

• 0x4a475c CoCreateInstance

• 0x4a4760 CoUninitialize

• 0x4a4764 CoInitialize

Library oleaut32.dll:

• 0x4a476c GetErrorInfo

• 0x4a4770 SysFreeString

Library comctl32.dll:

• 0x4a4778 ImageList_SetIconSize

• 0x4a477c ImageList_GetIconSize

• 0x4a4780 ImageList_Write

• 0x4a4784 ImageList_Read

• 0x4a4788 ImageList_GetDragImage

• 0x4a478c ImageList_DragShowNolock

• 0x4a4790 ImageList_SetDragCursorImage

• 0x4a4794 ImageList_DragMove

• 0x4a4798 ImageList_DragLeave

• 0x4a479c ImageList_DragEnter

• 0x4a47a0 ImageList_EndDrag

• 0x4a47a4 ImageList_BeginDrag

• 0x4a47a8 ImageList_Remove

• 0x4a47ac ImageList_DrawEx

• 0x4a47b0 ImageList_Replace

• 0x4a47b4 ImageList_Draw

• 0x4a47b8 ImageList_GetBkColor

• 0x4a47bc ImageList_SetBkColor

• 0x4a47c0 ImageList_ReplaceIcon

• 0x4a47c4 ImageList_Add

• 0x4a47c8 ImageList_GetImageCount

• 0x4a47cc ImageList_Destroy

• 0x4a47d0 ImageList_Create

• 0x4a47d4 InitCommonControls

Library comdlg32.dll:

• 0x4a47dc GetSaveFileNameA

• 0x4a47e0 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com		127.0.0.1
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142	172.217.160.78

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49236	239.255.255.250	3702
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56542	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.