SmartHawk

6.4

高危

54 个模型检测该样本为恶意！

重新分析

下载样本

847804f6f742f5e5c7b409a0fc5a426690469cfaab8a158e41d0ecb6a774abad

acfb082446d99833d4cd3650b9fb3d28.exe

分析耗时

75s

最近分析

文件大小

300.0KB

静态报毒动态报毒 100% AI SCORE=84 ARDAMAXNBJ ATRAPS CKGENERIC CONFIDENCE DOWNLOADER34 ELDORADO EMOTET GCDK GENCIRC GENERICKD HCEJ HIGH CONFIDENCE HRWBUM IWOTEBQAKYE KRYPTIK MALREP NONAME@0 R + TROJ R348787 SCORE SUSGEN THIOGBO UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Emotet.20c64d2c	20190527	0.3.0.5
Avast	Win32:Trojan-gen	20200915	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20200915	2013.8.14.323
McAfee	Emotet-FRV!ACFB082446D9	20200915	6.0.6.653
Tencent	Malware.Win32.Gencirc.10cdead3	20200915	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826898.105495 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619826882.902495 CryptGenKey	crypto_handle: 0x005c7fc0 algorithm_identifier: 0x0000660e () provider_handle: 0x0066f740 flags: 1 key: fÐôóÚê\| SçR~Ûvx	success	1
1619826898.121495 CryptExportKey	crypto_handle: 0x005c7fc0 crypto_export_handle: 0x005c7e68 buffer: f¤ã¹cÛc²?2WÄæ' z¼H)e3âJHËîXµdìÀ«Ö\¦Ç$¤ #«=y\/¾rjôÚy_îU¶×W¼Ò\|;nÛòCU¸$"ì Q:\ blob_type: 1 flags: 64	success	1
1619826933.043495 CryptExportKey	crypto_handle: 0x005c7fc0 crypto_export_handle: 0x005c7e68 buffer: f¤%Ff%èYÄÖ ßÎBpègÝÂnKx~A¡ÿ«¿Kkö ÌÂ¯àCÊÑ¥«o¢ëf5S;0q5³«g³3Êu±hDºÛWYÚ$óíá<º blob_type: 1 flags: 64	success	1
1619826938.386495 CryptExportKey	crypto_handle: 0x005c7fc0 crypto_export_handle: 0x005c7e68 buffer: f¤©-ð)X¤àÖ4'Ö7¾`$okêàÌ>¢ò#«¿ÝÔÆqÁRaª¡>0ÞYhOÓÉÌ7bÍäqÓ4²ài©ö.múnÐ^)V-Õñx7\|Ë0T@ blob_type: 1 flags: 64	success	1
1619826943.105495 CryptExportKey	crypto_handle: 0x005c7fc0 crypto_export_handle: 0x005c7e68 buffer: f¤9²K.>Íõ"2çïÔFACÜöOÞ>Ô³»OLÕÎ1MÌNUÔö3wä6òHú¥iZT\vJ»ÎÖuÚIæ¨ÇU{2Ô(3QP©ª¶þ%!R blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826882.402495 NtAllocateVirtualMemory	process_identifier: 2732 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x006f0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826898.621495 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

acfb082446d99833d4cd3650b9fb3d28.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826898.261495 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	172.217.24.14
host	173.94.215.84
host	178.128.14.92
host	60.125.114.64
host	85.25.207.108

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619826901.183495 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619826901.183495 RegSetValueExA	key_handle: 0x000003c0 value: °,÷3>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619826901.183495 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619826901.183495 RegSetValueExW	key_handle: 0x000003c0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619826901.183495 RegSetValueExA	key_handle: 0x000003d8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619826901.183495 RegSetValueExA	key_handle: 0x000003d8 value: °,÷3>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619826901.183495 RegSetValueExA	key_handle: 0x000003d8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619826901.230495 RegSetValueExW	key_handle: 0x000003bc value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Bkav	W32.ArdamaxNBJ.Trojan
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader34.26135
MicroWorld-eScan	Trojan.GenericKD.34394127
FireEye	Generic.mg.acfb082446d99833
CAT-QuickHeal	Trojan.CKGENERIC
ALYac	Trojan.Agent.Emotet
Cylance	Unsafe
Zillya	Trojan.Emotet.Win32.24753
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Emotet.20c64d2c
K7GW	Riskware ( 0040eff71 )
Arcabit	Trojan.Generic.D20CD00F
Invincea	Mal/Generic-R + Troj/Emotet-CLM
Cyren	W32/Emotet.AQN.gen!Eldorado
Symantec	Trojan.Emotet
ESET-NOD32	Win32/Emotet.CD
TrendMicro-HouseCall	Trojan.Win32.MALREP.THIOGBO
Cynet	Malicious (score: 85)
Kaspersky	Trojan-Banker.Win32.Emotet.gcdk
BitDefender	Trojan.GenericKD.34394127
NANO-Antivirus	Trojan.Win32.Emotet.hrwbum
ViRobot	Trojan.Win32.Emotet.307200.D
Avast	Win32:Trojan-gen
Rising	Trojan.Kryptik!8.8 (TFE:5:iWoteBqaKyE)
Ad-Aware	Trojan.GenericKD.34394127
Comodo	fls.noname@0
F-Secure	Trojan.TR/ATRAPS.Gen
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.MALREP.THIOGBO
Sophos	Troj/Emotet-CLM
Ikarus	Trojan-Banker.Emotet
Jiangmin	Backdoor.Emotet.sg
MaxSecure	Trojan.Malware.105704544.susgen
Avira	TR/ATRAPS.Gen
MAX	malware (ai score=84)
Antiy-AVL	Trojan[Banker]/Win32.Emotet
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
AegisLab	Trojan.Win32.Emotet.L!c
ZoneAlarm	Trojan-Banker.Win32.Emotet.gcdk
GData	Trojan.GenericKD.34394127
AhnLab-V3	Trojan/Win32.Emotet.R348787
McAfee	Emotet-FRV!ACFB082446D9
TACHYON	Backdoor/W32.Emotet.307200.B
VBA32	Trojan.Downloader
Malwarebytes	Trojan.MalPack.TRE
APEX	Malicious
Tencent	Malware.Win32.Gencirc.10cdead3
Yandex	Trojan.Emotet!
Fortinet	W32/Kryptik.HCEJ!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 个事件)

dead_host	85.25.207.108:8080
dead_host	173.94.215.84:80
dead_host	178.128.14.92:8080
dead_host	192.168.56.101:49178
dead_host	192.168.56.101:49177

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-20 05:57:50

Imports

Library KERNEL32.dll:

• 0x42a0bc GetCommandLineA

• 0x42a0c0 TerminateProcess

• 0x42a0c4 RaiseException

• 0x42a0c8 HeapReAlloc

• 0x42a0cc HeapSize

• 0x42a0d0 GetACP

• 0x42a0d4 GetTimeZoneInformation

• 0x42a0d8 HeapDestroy

• 0x42a0dc HeapCreate

• 0x42a0e0 VirtualFree

• 0x42a0e4 VirtualAlloc

• 0x42a0e8 IsBadWritePtr

• 0x42a0ec LCMapStringA

• 0x42a0f0 LCMapStringW

• 0x42a0f4 Sleep

• 0x42a0f8 CompareStringA

• 0x42a0fc CompareStringW

• 0x42a100 UnhandledExceptionFilter

• 0x42a104 GetStartupInfoA

• 0x42a108 FreeEnvironmentStringsW

• 0x42a10c GetEnvironmentStrings

• 0x42a110 GetEnvironmentStringsW

• 0x42a114 SetHandleCount

• 0x42a118 GetStdHandle

• 0x42a11c GetFileType

• 0x42a120 SetUnhandledExceptionFilter

• 0x42a124 GetStringTypeA

• 0x42a128 GetStringTypeW

• 0x42a12c IsBadReadPtr

• 0x42a130 IsBadCodePtr

• 0x42a134 SetStdHandle

• 0x42a138 SetEnvironmentVariableA

• 0x42a13c RtlUnwind

• 0x42a140 HeapAlloc

• 0x42a144 HeapFree

• 0x42a148 GetProfileStringA

• 0x42a14c InterlockedExchange

• 0x42a150 GetFileTime

• 0x42a154 GetFileSize

• 0x42a158 GetFileAttributesA

• 0x42a15c GetTickCount

• 0x42a160 FileTimeToLocalFileTime

• 0x42a164 FileTimeToSystemTime

• 0x42a168 GetFullPathNameA

• 0x42a16c GetVolumeInformationA

• 0x42a170 FindFirstFileA

• 0x42a174 FindClose

• 0x42a178 SetEndOfFile

• 0x42a17c UnlockFile

• 0x42a180 LockFile

• 0x42a184 FlushFileBuffers

• 0x42a188 SetFilePointer

• 0x42a18c WriteFile

• 0x42a190 ReadFile

• 0x42a194 CreateFileA

• 0x42a198 GetCurrentProcess

• 0x42a19c DuplicateHandle

• 0x42a1a0 SetErrorMode

• 0x42a1a4 GetOEMCP

• 0x42a1a8 GetCPInfo

• 0x42a1ac GetThreadLocale

• 0x42a1b0 SizeofResource

• 0x42a1b4 GetProcessVersion

• 0x42a1b8 WritePrivateProfileStringA

• 0x42a1bc GlobalFlags

• 0x42a1c0 TlsGetValue

• 0x42a1c4 LocalReAlloc

• 0x42a1c8 TlsSetValue

• 0x42a1cc EnterCriticalSection

• 0x42a1d0 GlobalReAlloc

• 0x42a1d4 LeaveCriticalSection

• 0x42a1d8 TlsFree

• 0x42a1dc GlobalHandle

• 0x42a1e0 DeleteCriticalSection

• 0x42a1e4 TlsAlloc

• 0x42a1e8 InitializeCriticalSection

• 0x42a1ec LocalAlloc

• 0x42a1f0 lstrcpynA

• 0x42a1f4 GetLastError

• 0x42a1f8 FormatMessageA

• 0x42a1fc LocalFree

• 0x42a200 MulDiv

• 0x42a204 MultiByteToWideChar

• 0x42a208 WideCharToMultiByte

• 0x42a20c lstrlenA

• 0x42a210 InterlockedIncrement

• 0x42a214 InterlockedDecrement

• 0x42a218 LoadLibraryA

• 0x42a21c FreeLibrary

• 0x42a220 GetVersion

• 0x42a224 lstrcatA

• 0x42a228 GlobalGetAtomNameA

• 0x42a22c GlobalAddAtomA

• 0x42a230 GlobalFindAtomA

• 0x42a234 lstrcpyA

• 0x42a238 GetModuleHandleA

• 0x42a23c GetProcAddress

• 0x42a240 GlobalUnlock

• 0x42a244 GlobalFree

• 0x42a248 LockResource

• 0x42a24c FindResourceA

• 0x42a250 LoadResource

• 0x42a254 CloseHandle

• 0x42a258 GetModuleFileNameA

• 0x42a25c GlobalLock

• 0x42a260 GlobalAlloc

• 0x42a264 GlobalDeleteAtom

• 0x42a268 lstrcmpA

• 0x42a26c lstrcmpiA

• 0x42a270 GetCurrentThread

• 0x42a274 GetCurrentThreadId

• 0x42a278 ExitProcess

• 0x42a27c FreeEnvironmentStringsA

• 0x42a280 SetLastError

Library USER32.dll:

• 0x42a2b8 GetNextDlgGroupItem

• 0x42a2bc MessageBeep

• 0x42a2c0 InvalidateRect

• 0x42a2c4 CharUpperA

• 0x42a2c8 InflateRect

• 0x42a2cc RegisterClipboardFormatA

• 0x42a2d0 PostThreadMessageA

• 0x42a2d4 GetSysColor

• 0x42a2d8 SetFocus

• 0x42a2dc AdjustWindowRectEx

• 0x42a2e0 ScreenToClient

• 0x42a2e4 CopyRect

• 0x42a2e8 GetTopWindow

• 0x42a2ec IsChild

• 0x42a2f0 GetCapture

• 0x42a2f4 WinHelpA

• 0x42a2f8 wsprintfA

• 0x42a2fc GetClassInfoA

• 0x42a300 RegisterClassA

• 0x42a304 GetMenu

• 0x42a308 GetMenuItemCount

• 0x42a30c GetSubMenu

• 0x42a310 GetMenuItemID

• 0x42a314 GetWindowTextLengthA

• 0x42a318 GetWindowTextA

• 0x42a31c GetDlgCtrlID

• 0x42a320 DefWindowProcA

• 0x42a324 CreateWindowExA

• 0x42a328 GetClassLongA

• 0x42a32c SetPropA

• 0x42a330 UnhookWindowsHookEx

• 0x42a334 GetPropA

• 0x42a338 CallWindowProcA

• 0x42a33c RemovePropA

• 0x42a340 SetRect

• 0x42a344 GetMessagePos

• 0x42a348 GetForegroundWindow

• 0x42a34c PtInRect

• 0x42a350 SetWindowLongA

• 0x42a354 RegisterWindowMessageA

• 0x42a358 OffsetRect

• 0x42a35c IntersectRect

• 0x42a360 SystemParametersInfoA

• 0x42a364 GetWindowPlacement

• 0x42a368 GetWindowRect

• 0x42a36c MapDialogRect

• 0x42a370 SetWindowPos

• 0x42a374 GetWindow

• 0x42a378 SetWindowContextHelpId

• 0x42a37c EndDialog

• 0x42a380 SetActiveWindow

• 0x42a384 IsWindow

• 0x42a388 CreateDialogIndirectParamA

• 0x42a38c GetDlgItem

• 0x42a390 GetMenuCheckMarkDimensions

• 0x42a394 LoadBitmapA

• 0x42a398 GetMenuState

• 0x42a39c ModifyMenuA

• 0x42a3a0 SetMenuItemBitmaps

• 0x42a3a4 CheckMenuItem

• 0x42a3a8 EnableMenuItem

• 0x42a3ac GetFocus

• 0x42a3b0 GetNextDlgTabItem

• 0x42a3b4 GetMessageA

• 0x42a3b8 TranslateMessage

• 0x42a3bc DispatchMessageA

• 0x42a3c0 GetActiveWindow

• 0x42a3c4 GetKeyState

• 0x42a3c8 CallNextHookEx

• 0x42a3cc ValidateRect

• 0x42a3d0 IsWindowVisible

• 0x42a3d4 PeekMessageA

• 0x42a3d8 GetCursorPos

• 0x42a3dc ShowWindow

• 0x42a3e0 GetSystemMetrics

• 0x42a3e4 DrawIcon

• 0x42a3e8 UnregisterClassA

• 0x42a3ec HideCaret

• 0x42a3f0 ShowCaret

• 0x42a3f4 ExcludeUpdateRgn

• 0x42a3f8 DrawFocusRect

• 0x42a3fc SetWindowsHookExA

• 0x42a400 GetParent

• 0x42a404 GetLastActivePopup

• 0x42a408 IsWindowEnabled

• 0x42a40c GetWindowLongA

• 0x42a410 MessageBoxA

• 0x42a414 SetCursor

• 0x42a418 PostQuitMessage

• 0x42a41c PostMessageA

• 0x42a420 LoadIconA

• 0x42a424 EnableWindow

• 0x42a428 GetClientRect

• 0x42a42c CopyAcceleratorTableA

• 0x42a430 CharNextA

• 0x42a434 GetSysColorBrush

• 0x42a438 GetMessageTime

• 0x42a43c IsIconic

• 0x42a440 GetSystemMenu

• 0x42a444 DefDlgProcA

• 0x42a448 IsWindowUnicode

• 0x42a44c AppendMenuA

• 0x42a450 SendMessageA

• 0x42a454 GetClassNameA

• 0x42a458 GetDesktopWindow

• 0x42a45c LoadCursorA

• 0x42a460 DestroyMenu

• 0x42a464 GrayStringA

• 0x42a468 DrawTextA

• 0x42a46c TabbedTextOutA

• 0x42a470 EndPaint

• 0x42a474 BeginPaint

• 0x42a478 GetWindowDC

• 0x42a47c ReleaseDC

• 0x42a480 GetDC

• 0x42a484 ClientToScreen

• 0x42a488 LoadStringA

• 0x42a48c MoveWindow

• 0x42a490 SetWindowTextA

• 0x42a494 IsDialogMessageA

• 0x42a498 IsDlgButtonChecked

• 0x42a49c MapWindowPoints

• 0x42a4a0 DestroyWindow

• 0x42a4a4 CheckRadioButton

• 0x42a4a8 UpdateWindow

• 0x42a4ac SetForegroundWindow

• 0x42a4b0 SendDlgItemMessageA

Library GDI32.dll:

• 0x42a01c SetMapMode

• 0x42a020 SetViewportOrgEx

• 0x42a024 OffsetViewportOrgEx

• 0x42a028 SetViewportExtEx

• 0x42a02c ScaleViewportExtEx

• 0x42a030 SetWindowExtEx

• 0x42a034 ScaleWindowExtEx

• 0x42a038 IntersectClipRect

• 0x42a03c DeleteObject

• 0x42a040 GetDeviceCaps

• 0x42a044 GetViewportExtEx

• 0x42a048 GetWindowExtEx

• 0x42a04c CreateSolidBrush

• 0x42a050 PtVisible

• 0x42a054 RectVisible

• 0x42a058 TextOutA

• 0x42a05c ExtTextOutA

• 0x42a060 Escape

• 0x42a064 GetTextColor

• 0x42a068 GetBkColor

• 0x42a06c DPtoLP

• 0x42a070 LPtoDP

• 0x42a074 GetMapMode

• 0x42a078 PatBlt

• 0x42a07c SetBkMode

• 0x42a080 GetStockObject

• 0x42a084 SelectObject

• 0x42a088 RestoreDC

• 0x42a08c SaveDC

• 0x42a090 DeleteDC

• 0x42a094 GetObjectA

• 0x42a098 SetBkColor

• 0x42a09c SetTextColor

• 0x42a0a0 GetClipBox

• 0x42a0a4 CreateDIBitmap

• 0x42a0a8 GetTextExtentPointA

• 0x42a0ac BitBlt

• 0x42a0b0 CreateCompatibleDC

• 0x42a0b4 CreateBitmap

Library comdlg32.dll:

• 0x42a4c8 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42a4b8 ClosePrinter

• 0x42a4bc DocumentPropertiesA

• 0x42a4c0 OpenPrinterA

Library ADVAPI32.dll:

• 0x42a000 RegCloseKey

• 0x42a004 RegSetValueExA

• 0x42a008 RegOpenKeyExA

• 0x42a00c RegCreateKeyExA

Library COMCTL32.dll:

• 0x42a014

Library oledlg.dll:

• 0x42a510

Library ole32.dll:

• 0x42a4d0 CoFreeUnusedLibraries

• 0x42a4d4 OleInitialize

• 0x42a4d8 CoTaskMemAlloc

• 0x42a4dc CoTaskMemFree

• 0x42a4e0 CreateILockBytesOnHGlobal

• 0x42a4e4 StgCreateDocfileOnILockBytes

• 0x42a4e8 StgOpenStorageOnILockBytes

• 0x42a4ec CoGetClassObject

• 0x42a4f0 CLSIDFromString

• 0x42a4f4 CLSIDFromProgID

• 0x42a4f8 CoRegisterMessageFilter

• 0x42a4fc CoRevokeClassObject

• 0x42a500 OleFlushClipboard

• 0x42a504 OleIsCurrentClipboard

• 0x42a508 OleUninitialize

Library OLEPRO32.DLL:

• 0x42a2b0

Library OLEAUT32.dll:

• 0x42a288 VariantCopy

• 0x42a28c VariantClear

• 0x42a290 SysAllocStringLen

• 0x42a294 SysFreeString

• 0x42a298 VariantChangeType

• 0x42a29c SysAllocString

• 0x42a2a0 SysAllocStringByteLen

• 0x42a2a4 SysStringLen

• 0x42a2a8 VariantTimeToSystemTime

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.