SmartHawk

6.8

高危

54 个模型检测该样本为恶意！

重新分析

下载样本

b5ee40571989424f67a13db35b790879bf3b1673bb7499e8ec3a3565fbd66980

ad53306bb39d283712c4db293409b6b3.exe

分析耗时

75s

最近分析

文件大小

300.0KB

静态报毒动态报毒 100% AI SCORE=88 ARDAMAXNBI ATRAPS CONFIDENCE DOWNLOADER34 ELDORADO EMOTEPMF EMOTET GENCIRC GENERICKD HCEJ HIGH CONFIDENCE HRWBUM IWOTEBQAKYE KRYPTIK MALWARE@#3E9I62XNDB7YP R + TROJ R348787 S15521191 SCORE THIOGBO UJ7+94MM78 UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRV!AD53306BB39D	20201024	6.0.6.653
Alibaba	Trojan:Win32/Emotet.ff564742	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201024	18.4.3895.0
Tencent	Malware.Win32.Gencirc.10cdeacd	20201024	1.0.0.1
Kingsoft		20201024	2013.8.14.323
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826898.819633 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619826882.866633 CryptGenKey	crypto_handle: 0x02c100a0 algorithm_identifier: 0x0000660e () provider_handle: 0x006df710 flags: 1 key: f;T P ëÂ M7$&k	success	1
1619826898.834633 CryptExportKey	crypto_handle: 0x02c100a0 crypto_export_handle: 0x02c10060 buffer: f¤}hüçÎSlµlç/÷MY«¤{%3Cï!ª9WyPâ< w4+5ñ×aö"¿9¢:àÔ%Ö_Ã&0¼2éCïÕõ¡Ìßt×ÃCk!é¹ÇÜ¤ blob_type: 1 flags: 64	success	1
1619826933.459633 CryptExportKey	crypto_handle: 0x02c100a0 crypto_export_handle: 0x02c10060 buffer: f¤¤}à× ëÞÉ¹&ñÌW26mqÖ÷XüÝ¢î*îüa?§¨.û[#8åË½{Àh.±q @Ô¯å×é¢¡aàdU&ZØj¢< blob_type: 1 flags: 64	success	1
1619826938.100633 CryptExportKey	crypto_handle: 0x02c100a0 crypto_export_handle: 0x02c10060 buffer: f¤tÍ@tW¾c ùºKUiMzèáÒ½b nO(sG>ôáËãûú¿ÝEzæ¸¨Zr¶hg[$£eê\|òG©¿ªü2C¹9eOí½e! blob_type: 1 flags: 64	success	1
1619826943.459633 CryptExportKey	crypto_handle: 0x02c100a0 crypto_export_handle: 0x02c10060 buffer: f¤²BhTOUî¤ ÙS7õµìÈ(TÊ¦Ï}E9§ÿk2?Cv ^"©Ñ{/ü$xj1?H(oLAmÑG²½£hû¤3¸óüL(MS±÷©VüÀb^ blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826882.303633 NtAllocateVirtualMemory	process_identifier: 2864 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d30000	success	0	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826943.459633 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000001c8 process_identifier: 2944	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826899.334633 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

ad53306bb39d283712c4db293409b6b3.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826898.991633 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	116.202.234.183
host	172.217.24.14
host	185.94.252.104
host	69.30.203.214
host	70.121.172.89

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619826901.897633 RegSetValueExA	key_handle: 0x000003c4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619826901.897633 RegSetValueExA	key_handle: 0x000003c4 value: ð¬ÙÉ/>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619826901.897633 RegSetValueExA	key_handle: 0x000003c4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619826901.897633 RegSetValueExW	key_handle: 0x000003c4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619826901.897633 RegSetValueExA	key_handle: 0x000003dc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619826901.897633 RegSetValueExA	key_handle: 0x000003dc value: ð¬ÙÉ/>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619826901.897633 RegSetValueExA	key_handle: 0x000003dc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619826901.928633 RegSetValueExW	key_handle: 0x000003c0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Bkav	W32.ArdamaxNBI.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34394128
FireEye	Trojan.GenericKD.34394128
CAT-QuickHeal	Trojan.EmotePMF.S15521191
McAfee	Emotet-FRV!AD53306BB39D
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 0056e06c1 )
Alibaba	Trojan:Win32/Emotet.ff564742
K7GW	Trojan ( 0056e06c1 )
Arcabit	Trojan.Generic.D20CD010
Invincea	Mal/Generic-R + Troj/Emotet-CLM
Cyren	W32/Emotet.AQN.gen!Eldorado
Symantec	Trojan.Emotet
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Packed.Atraps-9427203-0
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.vho
BitDefender	Trojan.GenericKD.34394128
NANO-Antivirus	Trojan.Win32.Emotet.hrwbum
Tencent	Malware.Win32.Gencirc.10cdeacd
Ad-Aware	Trojan.GenericKD.34394128
TACHYON	Backdoor/W32.Emotet.307200.B
Emsisoft	Trojan.Emotet (A)
Comodo	Malware@#3e9i62xndb7yp
F-Secure	Trojan.TR/ATRAPS.Gen
DrWeb	Trojan.DownLoader34.26135
Zillya	Trojan.Emotet.Win32.24753
TrendMicro	TrojanSpy.Win32.EMOTET.THIOGBO
McAfee-GW-Edition	Emotet-FRV!AD53306BB39D
Sophos	Troj/Emotet-CLM
Jiangmin	Backdoor.Emotet.sg
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan[Banker]/Win32.Emotet
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
ViRobot	Trojan.Win32.Emotet.307200.D
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.vho
GData	Trojan.GenericKD.34394128
Cynet	Malicious (score: 90)
AhnLab-V3	Trojan/Win32.Emotet.R348787
MAX	malware (ai score=88)
VBA32	Trojan.Downloader
Malwarebytes	Trojan.MalPack.TRE
ESET-NOD32	Win32/Emotet.CD
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.THIOGBO
Rising	Trojan.Kryptik!8.8 (TFE:5:iWoteBqaKyE)
Yandex	Trojan.Emotet!/Uj7+94mm78
Ikarus	Trojan-Banker.Emotet
Fortinet	W32/Kryptik.HCEJ!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 个事件)

dead_host	69.30.203.214:8080
dead_host	70.121.172.89:80
dead_host	116.202.234.183:8080
dead_host	192.168.56.101:49177
dead_host	192.168.56.101:49179

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-20 05:57:16

Imports

Library KERNEL32.dll:

• 0x42a0bc GetCommandLineA

• 0x42a0c0 TerminateProcess

• 0x42a0c4 RaiseException

• 0x42a0c8 HeapReAlloc

• 0x42a0cc HeapSize

• 0x42a0d0 GetACP

• 0x42a0d4 GetTimeZoneInformation

• 0x42a0d8 HeapDestroy

• 0x42a0dc HeapCreate

• 0x42a0e0 VirtualFree

• 0x42a0e4 VirtualAlloc

• 0x42a0e8 IsBadWritePtr

• 0x42a0ec LCMapStringA

• 0x42a0f0 LCMapStringW

• 0x42a0f4 Sleep

• 0x42a0f8 CompareStringA

• 0x42a0fc CompareStringW

• 0x42a100 UnhandledExceptionFilter

• 0x42a104 GetStartupInfoA

• 0x42a108 FreeEnvironmentStringsW

• 0x42a10c GetEnvironmentStrings

• 0x42a110 GetEnvironmentStringsW

• 0x42a114 SetHandleCount

• 0x42a118 GetStdHandle

• 0x42a11c GetFileType

• 0x42a120 SetUnhandledExceptionFilter

• 0x42a124 GetStringTypeA

• 0x42a128 GetStringTypeW

• 0x42a12c IsBadReadPtr

• 0x42a130 IsBadCodePtr

• 0x42a134 SetStdHandle

• 0x42a138 SetEnvironmentVariableA

• 0x42a13c RtlUnwind

• 0x42a140 HeapAlloc

• 0x42a144 HeapFree

• 0x42a148 GetProfileStringA

• 0x42a14c InterlockedExchange

• 0x42a150 GetFileTime

• 0x42a154 GetFileSize

• 0x42a158 GetFileAttributesA

• 0x42a15c GetTickCount

• 0x42a160 FileTimeToLocalFileTime

• 0x42a164 FileTimeToSystemTime

• 0x42a168 GetFullPathNameA

• 0x42a16c GetVolumeInformationA

• 0x42a170 FindFirstFileA

• 0x42a174 FindClose

• 0x42a178 SetEndOfFile

• 0x42a17c UnlockFile

• 0x42a180 LockFile

• 0x42a184 FlushFileBuffers

• 0x42a188 SetFilePointer

• 0x42a18c WriteFile

• 0x42a190 ReadFile

• 0x42a194 CreateFileA

• 0x42a198 GetCurrentProcess

• 0x42a19c DuplicateHandle

• 0x42a1a0 SetErrorMode

• 0x42a1a4 GetOEMCP

• 0x42a1a8 GetCPInfo

• 0x42a1ac GetThreadLocale

• 0x42a1b0 SizeofResource

• 0x42a1b4 GetProcessVersion

• 0x42a1b8 WritePrivateProfileStringA

• 0x42a1bc GlobalFlags

• 0x42a1c0 TlsGetValue

• 0x42a1c4 LocalReAlloc

• 0x42a1c8 TlsSetValue

• 0x42a1cc EnterCriticalSection

• 0x42a1d0 GlobalReAlloc

• 0x42a1d4 LeaveCriticalSection

• 0x42a1d8 TlsFree

• 0x42a1dc GlobalHandle

• 0x42a1e0 DeleteCriticalSection

• 0x42a1e4 TlsAlloc

• 0x42a1e8 InitializeCriticalSection

• 0x42a1ec LocalAlloc

• 0x42a1f0 lstrcpynA

• 0x42a1f4 GetLastError

• 0x42a1f8 FormatMessageA

• 0x42a1fc LocalFree

• 0x42a200 MulDiv

• 0x42a204 MultiByteToWideChar

• 0x42a208 WideCharToMultiByte

• 0x42a20c lstrlenA

• 0x42a210 InterlockedIncrement

• 0x42a214 InterlockedDecrement

• 0x42a218 LoadLibraryA

• 0x42a21c FreeLibrary

• 0x42a220 GetVersion

• 0x42a224 lstrcatA

• 0x42a228 GlobalGetAtomNameA

• 0x42a22c GlobalAddAtomA

• 0x42a230 GlobalFindAtomA

• 0x42a234 lstrcpyA

• 0x42a238 GetModuleHandleA

• 0x42a23c GetProcAddress

• 0x42a240 GlobalUnlock

• 0x42a244 GlobalFree

• 0x42a248 LockResource

• 0x42a24c FindResourceA

• 0x42a250 LoadResource

• 0x42a254 CloseHandle

• 0x42a258 GetModuleFileNameA

• 0x42a25c GlobalLock

• 0x42a260 GlobalAlloc

• 0x42a264 GlobalDeleteAtom

• 0x42a268 lstrcmpA

• 0x42a26c lstrcmpiA

• 0x42a270 GetCurrentThread

• 0x42a274 GetCurrentThreadId

• 0x42a278 ExitProcess

• 0x42a27c FreeEnvironmentStringsA

• 0x42a280 SetLastError

Library USER32.dll:

• 0x42a2b8 GetNextDlgGroupItem

• 0x42a2bc MessageBeep

• 0x42a2c0 InvalidateRect

• 0x42a2c4 CharUpperA

• 0x42a2c8 InflateRect

• 0x42a2cc RegisterClipboardFormatA

• 0x42a2d0 PostThreadMessageA

• 0x42a2d4 GetSysColor

• 0x42a2d8 SetFocus

• 0x42a2dc AdjustWindowRectEx

• 0x42a2e0 ScreenToClient

• 0x42a2e4 CopyRect

• 0x42a2e8 GetTopWindow

• 0x42a2ec IsChild

• 0x42a2f0 GetCapture

• 0x42a2f4 WinHelpA

• 0x42a2f8 wsprintfA

• 0x42a2fc GetClassInfoA

• 0x42a300 RegisterClassA

• 0x42a304 GetMenu

• 0x42a308 GetMenuItemCount

• 0x42a30c GetSubMenu

• 0x42a310 GetMenuItemID

• 0x42a314 GetWindowTextLengthA

• 0x42a318 GetWindowTextA

• 0x42a31c GetDlgCtrlID

• 0x42a320 DefWindowProcA

• 0x42a324 CreateWindowExA

• 0x42a328 GetClassLongA

• 0x42a32c SetPropA

• 0x42a330 UnhookWindowsHookEx

• 0x42a334 GetPropA

• 0x42a338 CallWindowProcA

• 0x42a33c RemovePropA

• 0x42a340 SetRect

• 0x42a344 GetMessagePos

• 0x42a348 GetForegroundWindow

• 0x42a34c PtInRect

• 0x42a350 SetWindowLongA

• 0x42a354 RegisterWindowMessageA

• 0x42a358 OffsetRect

• 0x42a35c IntersectRect

• 0x42a360 SystemParametersInfoA

• 0x42a364 GetWindowPlacement

• 0x42a368 GetWindowRect

• 0x42a36c MapDialogRect

• 0x42a370 SetWindowPos

• 0x42a374 GetWindow

• 0x42a378 SetWindowContextHelpId

• 0x42a37c EndDialog

• 0x42a380 SetActiveWindow

• 0x42a384 IsWindow

• 0x42a388 CreateDialogIndirectParamA

• 0x42a38c GetDlgItem

• 0x42a390 GetMenuCheckMarkDimensions

• 0x42a394 LoadBitmapA

• 0x42a398 GetMenuState

• 0x42a39c ModifyMenuA

• 0x42a3a0 SetMenuItemBitmaps

• 0x42a3a4 CheckMenuItem

• 0x42a3a8 EnableMenuItem

• 0x42a3ac GetFocus

• 0x42a3b0 GetNextDlgTabItem

• 0x42a3b4 GetMessageA

• 0x42a3b8 TranslateMessage

• 0x42a3bc DispatchMessageA

• 0x42a3c0 GetActiveWindow

• 0x42a3c4 GetKeyState

• 0x42a3c8 CallNextHookEx

• 0x42a3cc ValidateRect

• 0x42a3d0 IsWindowVisible

• 0x42a3d4 PeekMessageA

• 0x42a3d8 GetCursorPos

• 0x42a3dc ShowWindow

• 0x42a3e0 GetSystemMetrics

• 0x42a3e4 DrawIcon

• 0x42a3e8 UnregisterClassA

• 0x42a3ec HideCaret

• 0x42a3f0 ShowCaret

• 0x42a3f4 ExcludeUpdateRgn

• 0x42a3f8 DrawFocusRect

• 0x42a3fc SetWindowsHookExA

• 0x42a400 GetParent

• 0x42a404 GetLastActivePopup

• 0x42a408 IsWindowEnabled

• 0x42a40c GetWindowLongA

• 0x42a410 MessageBoxA

• 0x42a414 SetCursor

• 0x42a418 PostQuitMessage

• 0x42a41c PostMessageA

• 0x42a420 LoadIconA

• 0x42a424 EnableWindow

• 0x42a428 GetClientRect

• 0x42a42c CopyAcceleratorTableA

• 0x42a430 CharNextA

• 0x42a434 GetSysColorBrush

• 0x42a438 GetMessageTime

• 0x42a43c IsIconic

• 0x42a440 GetSystemMenu

• 0x42a444 DefDlgProcA

• 0x42a448 IsWindowUnicode

• 0x42a44c AppendMenuA

• 0x42a450 SendMessageA

• 0x42a454 GetClassNameA

• 0x42a458 GetDesktopWindow

• 0x42a45c LoadCursorA

• 0x42a460 DestroyMenu

• 0x42a464 GrayStringA

• 0x42a468 DrawTextA

• 0x42a46c TabbedTextOutA

• 0x42a470 EndPaint

• 0x42a474 BeginPaint

• 0x42a478 GetWindowDC

• 0x42a47c ReleaseDC

• 0x42a480 GetDC

• 0x42a484 ClientToScreen

• 0x42a488 LoadStringA

• 0x42a48c MoveWindow

• 0x42a490 SetWindowTextA

• 0x42a494 IsDialogMessageA

• 0x42a498 IsDlgButtonChecked

• 0x42a49c MapWindowPoints

• 0x42a4a0 DestroyWindow

• 0x42a4a4 CheckRadioButton

• 0x42a4a8 UpdateWindow

• 0x42a4ac SetForegroundWindow

• 0x42a4b0 SendDlgItemMessageA

Library GDI32.dll:

• 0x42a01c SetMapMode

• 0x42a020 SetViewportOrgEx

• 0x42a024 OffsetViewportOrgEx

• 0x42a028 SetViewportExtEx

• 0x42a02c ScaleViewportExtEx

• 0x42a030 SetWindowExtEx

• 0x42a034 ScaleWindowExtEx

• 0x42a038 IntersectClipRect

• 0x42a03c DeleteObject

• 0x42a040 GetDeviceCaps

• 0x42a044 GetViewportExtEx

• 0x42a048 GetWindowExtEx

• 0x42a04c CreateSolidBrush

• 0x42a050 PtVisible

• 0x42a054 RectVisible

• 0x42a058 TextOutA

• 0x42a05c ExtTextOutA

• 0x42a060 Escape

• 0x42a064 GetTextColor

• 0x42a068 GetBkColor

• 0x42a06c DPtoLP

• 0x42a070 LPtoDP

• 0x42a074 GetMapMode

• 0x42a078 PatBlt

• 0x42a07c SetBkMode

• 0x42a080 GetStockObject

• 0x42a084 SelectObject

• 0x42a088 RestoreDC

• 0x42a08c SaveDC

• 0x42a090 DeleteDC

• 0x42a094 GetObjectA

• 0x42a098 SetBkColor

• 0x42a09c SetTextColor

• 0x42a0a0 GetClipBox

• 0x42a0a4 CreateDIBitmap

• 0x42a0a8 GetTextExtentPointA

• 0x42a0ac BitBlt

• 0x42a0b0 CreateCompatibleDC

• 0x42a0b4 CreateBitmap

Library comdlg32.dll:

• 0x42a4c8 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42a4b8 ClosePrinter

• 0x42a4bc DocumentPropertiesA

• 0x42a4c0 OpenPrinterA

Library ADVAPI32.dll:

• 0x42a000 RegCloseKey

• 0x42a004 RegSetValueExA

• 0x42a008 RegOpenKeyExA

• 0x42a00c RegCreateKeyExA

Library COMCTL32.dll:

• 0x42a014

Library oledlg.dll:

• 0x42a510

Library ole32.dll:

• 0x42a4d0 CoFreeUnusedLibraries

• 0x42a4d4 OleInitialize

• 0x42a4d8 CoTaskMemAlloc

• 0x42a4dc CoTaskMemFree

• 0x42a4e0 CreateILockBytesOnHGlobal

• 0x42a4e4 StgCreateDocfileOnILockBytes

• 0x42a4e8 StgOpenStorageOnILockBytes

• 0x42a4ec CoGetClassObject

• 0x42a4f0 CLSIDFromString

• 0x42a4f4 CLSIDFromProgID

• 0x42a4f8 CoRegisterMessageFilter

• 0x42a4fc CoRevokeClassObject

• 0x42a500 OleFlushClipboard

• 0x42a504 OleIsCurrentClipboard

• 0x42a508 OleUninitialize

Library OLEPRO32.DLL:

• 0x42a2b0

Library OLEAUT32.dll:

• 0x42a288 VariantCopy

• 0x42a28c VariantClear

• 0x42a290 SysAllocStringLen

• 0x42a294 SysFreeString

• 0x42a298 VariantChangeType

• 0x42a29c SysAllocString

• 0x42a2a0 SysAllocStringByteLen

• 0x42a2a4 SysStringLen

• 0x42a2a8 VariantTimeToSystemTime

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.