SmartHawk

11.6

0-day

58 个模型检测该样本为恶意！

重新分析

下载样本

900c7694be31a1a2c619aa40903b7a3c928bbb49ac4ca316f1f14ab4b3ac305d

ae0cfd415950252912a7775a0cfcad8c.exe

分析耗时

87s

最近分析

文件大小

802.0KB

静态报毒动态报毒 100% AGEN AI SCORE=89 AJFK ANDROM CONFIDENCE DELF DELPHILESS DOBP5JWSWBCGPIH37GOJA EJXK EKBC FAREIT GENASA GENERIC@ML GULVSC HIGH CONFIDENCE HPLOKI IBNNDJMWDBS LMUM LOKIBOT MALWARE@#1K6ICBILNKXJ6 NANOCORE PUTTY R + MAL RDML SCORE SMBD SUSGEN TSCOPE TSPY UNSAFE YGW@AWP9E5II ZELPHIF ZFRJ 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Backdoor:Win32/Lokibot.235	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201229	21.1.5827.0
Tencent	Win32.Backdoor.Androm.Lmum	20201229	1.0.0.1
Kingsoft		20201229	2017.9.26.565
McAfee	Fareit-FRB!AE0CFD415950	20201229	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619834411.574626 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619834409.996626 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619834398.683626 __exception__	stacktrace: ae0cfd415950252912a7775a0cfcad8c+0x91022 @ 0x491022 ae0cfd415950252912a7775a0cfcad8c+0x3c5f @ 0x403c5f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4788308 registers.eax: 0 registers.ebp: 1638208 registers.edx: 9633792 registers.ebx: 106 registers.esi: 107 registers.ecx: 2010527866 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 11 e9 70 28 f7 exception.symbol: ae0cfd415950252912a7775a0cfcad8c+0x90da7 exception.instruction: div eax exception.module: ae0cfd415950252912a7775a0cfcad8c.exe exception.exception_code: 0xc0000094 exception.offset: 593319 exception.address: 0x490da7	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619834398.621626 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00380000	success
1619834408.496626 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0048b000	success
1619834408.496626 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00660000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

6.872347759790889

section

{'size_of_data': '0x00028e00', 'virtual_address': '0x000a5000', 'entropy': 6.872347759790889, 'name': '.rsrc', 'virtual_size': '0x00028d58'}

description

A section with a high entropy has been found

entropy

0.20411985018726592

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (2 个事件)

host	107.175.150.73
host	172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2248 called NtSetContextThread to modify thread in remote process 2056
1619834409.121626 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 2010382788 registers.esp: 1638384 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2056	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2248 resumed a thread in remote process 2056
1619834409.371626 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 2056	success	0	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (8 个事件)

Time & API	Arguments	Status	Return
1619834409.074626 CreateProcessInternalW	thread_identifier: 2272 thread_handle: 0x00000100 process_identifier: 2056 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ae0cfd415950252912a7775a0cfcad8c.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000104 inherit_handles: 0	success	1
1619834409.074626 NtGetContextThread	thread_handle: 0x00000100	success	0
1619834409.074626 NtUnmapViewOfSection	process_identifier: 2056 region_size: 4096 process_handle: 0x00000104 base_address: 0x00400000	success	0
1619834409.074626 NtMapViewOfSection	section_handle: 0x0000010c process_identifier: 2056 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000104 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619834409.121626 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 2056 commit_size: 4096 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000104 allocation_type: 0 () section_offset: 0 view_size: 4096 base_address: 0x001f0000	success	0
1619834409.121626 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 2010382788 registers.esp: 1638384 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2056	success	0
1619834409.371626 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 2056	success	0
1619834410.512626 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2056	success	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Agent.EKBC
FireEye	Generic.mg.ae0cfd4159502529
ALYac	Backdoor.Androm.gen
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Backdoor:Win32/Lokibot.235
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.159502
Arcabit	Trojan.Agent.EKBC
Cyren	W32/Trojan.ZFRJ-8804
Symantec	Infostealer.Lokibot!36
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Trojan.LokiBot-7565160-1
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
BitDefender	Trojan.Agent.EKBC
NANO-Antivirus	Trojan.Win32.Nanocore.gulvsc
Paloalto	generic.ml
Tencent	Win32.Backdoor.Androm.Lmum
Ad-Aware	Trojan.Agent.EKBC
Sophos	Mal/Generic-R + Mal/Fareit-V
Comodo	Malware@#1k6icbilnkxj6
F-Secure	Heuristic.HEUR/AGEN.1128138
DrWeb	Trojan.Nanocore.23
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TSPY_HPLOKI.SMBD
McAfee-GW-Edition	BehavesLike.Win32.Fareit.ch
MaxSecure	Trojan.Malware.300983.susgen
Emsisoft	Trojan.Agent.EKBC (B)
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1128138
Antiy-AVL	Trojan[Backdoor]/Win32.Androm
Gridinsoft	Trojan.Win32.Agent.ba!s1
Microsoft	PWS:Win32/Fareit.ART!MTB
AegisLab	Trojan.Win32.Generic.4!c
ZoneAlarm	HEUR:Backdoor.Win32.Androm.gen
GData	Trojan.Agent.EKBC
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Delphiless.Exp
Acronis	suspicious
McAfee	Fareit-FRB!AE0CFD415950
MAX	malware (ai score=89)
VBA32	TScope.Trojan.Delf
Malwarebytes	Spyware.MalPack.DLF
ESET-NOD32	a variant of Win32/Injector.EJXK
TrendMicro-HouseCall	TSPY_HPLOKI.SMBD
Rising	Trojan.Generic@ML.100 (RDML:/dobP5JwsWBcgPIH37GoJA)
Yandex	Trojan.GenAsa!IBnndJmwdbs

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	107.175.150.73:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-05-08 18:06:55

Imports

Library kernel32.dll:

• 0x495154 DeleteCriticalSection

• 0x495158 LeaveCriticalSection

• 0x49515c EnterCriticalSection

• 0x495160 InitializeCriticalSection

• 0x495164 VirtualFree

• 0x495168 VirtualAlloc

• 0x49516c LocalFree

• 0x495170 LocalAlloc

• 0x495174 GetVersion

• 0x495178 GetCurrentThreadId

• 0x49517c InterlockedDecrement

• 0x495180 InterlockedIncrement

• 0x495184 VirtualQuery

• 0x495188 WideCharToMultiByte

• 0x49518c MultiByteToWideChar

• 0x495190 lstrlenA

• 0x495194 lstrcpynA

• 0x495198 LoadLibraryExA

• 0x49519c GetThreadLocale

• 0x4951a0 GetStartupInfoA

• 0x4951a4 GetProcAddress

• 0x4951a8 GetModuleHandleA

• 0x4951ac GetModuleFileNameA

• 0x4951b0 GetLocaleInfoA

• 0x4951b4 GetCommandLineA

• 0x4951b8 FreeLibrary

• 0x4951bc FindFirstFileA

• 0x4951c0 FindClose

• 0x4951c4 ExitProcess

• 0x4951c8 ExitThread

• 0x4951cc CreateThread

• 0x4951d0 WriteFile

• 0x4951d4 UnhandledExceptionFilter

• 0x4951d8 RtlUnwind

• 0x4951dc RaiseException

• 0x4951e0 GetStdHandle

Library user32.dll:

• 0x4951e8 GetKeyboardType

• 0x4951ec LoadStringA

• 0x4951f0 MessageBoxA

• 0x4951f4 CharNextA

Library advapi32.dll:

• 0x4951fc RegQueryValueExA

• 0x495200 RegOpenKeyExA

• 0x495204 RegCloseKey

Library oleaut32.dll:

• 0x49520c SysFreeString

• 0x495210 SysReAllocStringLen

• 0x495214 SysAllocStringLen

Library kernel32.dll:

• 0x49521c TlsSetValue

• 0x495220 TlsGetValue

• 0x495224 LocalAlloc

• 0x495228 GetModuleHandleA

Library advapi32.dll:

• 0x495230 RegQueryValueExA

• 0x495234 RegOpenKeyExA

• 0x495238 RegCloseKey

Library kernel32.dll:

• 0x495240 lstrcpyA

• 0x495244 lstrcmpA

• 0x495248 WriteFile

• 0x49524c WaitForSingleObject

• 0x495250 VirtualQuery

• 0x495254 VirtualProtect

• 0x495258 VirtualFree

• 0x49525c VirtualAlloc

• 0x495260 SleepEx

• 0x495264 Sleep

• 0x495268 SizeofResource

• 0x49526c SetThreadLocale

• 0x495270 SetFilePointer

• 0x495274 SetEvent

• 0x495278 SetErrorMode

• 0x49527c SetEndOfFile

• 0x495280 ResumeThread

• 0x495284 ResetEvent

• 0x495288 ReadFile

• 0x49528c MulDiv

• 0x495290 LockResource

• 0x495294 LoadResource

• 0x495298 LoadLibraryA

• 0x49529c LeaveCriticalSection

• 0x4952a0 InitializeCriticalSection

• 0x4952a4 GlobalUnlock

• 0x4952a8 GlobalReAlloc

• 0x4952ac GlobalHandle

• 0x4952b0 GlobalLock

• 0x4952b4 GlobalFree

• 0x4952b8 GlobalFindAtomA

• 0x4952bc GlobalDeleteAtom

• 0x4952c0 GlobalAlloc

• 0x4952c4 GlobalAddAtomA

• 0x4952c8 GetVersionExA

• 0x4952cc GetVersion

• 0x4952d0 GetTimeZoneInformation

• 0x4952d4 GetTickCount

• 0x4952d8 GetThreadLocale

• 0x4952dc GetTempPathA

• 0x4952e0 GetSystemInfo

• 0x4952e4 GetStringTypeExA

• 0x4952e8 GetStdHandle

• 0x4952ec GetProcAddress

• 0x4952f0 GetModuleHandleA

• 0x4952f4 GetModuleFileNameA

• 0x4952f8 GetLocaleInfoA

• 0x4952fc GetLocalTime

• 0x495300 GetLastError

• 0x495304 GetFullPathNameA

• 0x495308 GetFileSize

• 0x49530c GetFileAttributesA

• 0x495310 GetExitCodeThread

• 0x495314 GetDiskFreeSpaceA

• 0x495318 GetDateFormatA

• 0x49531c GetCurrentThreadId

• 0x495320 GetCurrentProcessId

• 0x495324 GetCPInfo

• 0x495328 GetACP

• 0x49532c FreeResource

• 0x495330 InterlockedIncrement

• 0x495334 InterlockedExchange

• 0x495338 InterlockedDecrement

• 0x49533c FreeLibrary

• 0x495340 FormatMessageA

• 0x495344 FindResourceA

• 0x495348 FindFirstFileA

• 0x49534c FindClose

• 0x495350 FileTimeToLocalFileTime

• 0x495354 FileTimeToDosDateTime

• 0x495358 EnumCalendarInfoA

• 0x49535c EnterCriticalSection

• 0x495360 DeleteCriticalSection

• 0x495364 CreateThread

• 0x495368 CreateFileA

• 0x49536c CreateEventA

• 0x495370 CompareStringA

• 0x495374 CloseHandle

Library version.dll:

• 0x49537c VerQueryValueA

• 0x495380 GetFileVersionInfoSizeA

• 0x495384 GetFileVersionInfoA

Library gdi32.dll:

• 0x49538c UnrealizeObject

• 0x495390 StretchBlt

• 0x495394 SetWindowOrgEx

• 0x495398 SetWindowExtEx

• 0x49539c SetWinMetaFileBits

• 0x4953a0 SetViewportOrgEx

• 0x4953a4 SetViewportExtEx

• 0x4953a8 SetTextColor

• 0x4953ac SetStretchBltMode

• 0x4953b0 SetROP2

• 0x4953b4 SetPixel

• 0x4953b8 SetMapMode

• 0x4953bc SetEnhMetaFileBits

• 0x4953c0 SetDIBColorTable

• 0x4953c4 SetBrushOrgEx

• 0x4953c8 SetBkMode

• 0x4953cc SetBkColor

• 0x4953d0 SelectPalette

• 0x4953d4 SelectObject

• 0x4953d8 SelectClipRgn

• 0x4953dc SaveDC

• 0x4953e0 RestoreDC

• 0x4953e4 ResizePalette

• 0x4953e8 Rectangle

• 0x4953ec RectVisible

• 0x4953f0 RealizePalette

• 0x4953f4 Polyline

• 0x4953f8 PolyPolyline

• 0x4953fc PlayEnhMetaFile

• 0x495400 PatBlt

• 0x495404 MoveToEx

• 0x495408 MaskBlt

• 0x49540c LineTo

• 0x495410 IntersectClipRect

• 0x495414 GetWindowOrgEx

• 0x495418 GetWinMetaFileBits

• 0x49541c GetTextMetricsA

• 0x495420 GetTextExtentPoint32A

• 0x495424 GetSystemPaletteEntries

• 0x495428 GetStockObject

• 0x49542c GetPixel

• 0x495430 GetPaletteEntries

• 0x495434 GetObjectA

• 0x495438 GetEnhMetaFilePaletteEntries

• 0x49543c GetEnhMetaFileHeader

• 0x495440 GetEnhMetaFileBits

• 0x495444 GetDeviceCaps

• 0x495448 GetDIBits

• 0x49544c GetDIBColorTable

• 0x495450 GetDCOrgEx

• 0x495454 GetCurrentPositionEx

• 0x495458 GetClipBox

• 0x49545c GetBrushOrgEx

• 0x495460 GetBitmapBits

• 0x495464 ExtTextOutA

• 0x495468 ExtCreatePen

• 0x49546c ExcludeClipRect

• 0x495470 DeleteObject

• 0x495474 DeleteEnhMetaFile

• 0x495478 DeleteDC

• 0x49547c CreateSolidBrush

• 0x495480 CreatePenIndirect

• 0x495484 CreatePen

• 0x495488 CreatePalette

• 0x49548c CreateHalftonePalette

• 0x495490 CreateFontIndirectA

• 0x495494 CreateDIBitmap

• 0x495498 CreateDIBSection

• 0x49549c CreateCompatibleDC

• 0x4954a0 CreateCompatibleBitmap

• 0x4954a4 CreateBrushIndirect

• 0x4954a8 CreateBitmap

• 0x4954ac CopyEnhMetaFileA

• 0x4954b0 BitBlt

Library user32.dll:

• 0x4954b8 CreateWindowExA

• 0x4954bc WindowFromPoint

• 0x4954c0 WinHelpA

• 0x4954c4 WaitMessage

• 0x4954c8 ValidateRect

• 0x4954cc UpdateWindow

• 0x4954d0 UnregisterClassA

• 0x4954d4 UnionRect

• 0x4954d8 UnhookWindowsHookEx

• 0x4954dc TranslateMessage

• 0x4954e0 TranslateMDISysAccel

• 0x4954e4 TrackPopupMenu

• 0x4954e8 SystemParametersInfoA

• 0x4954ec ShowWindow

• 0x4954f0 ShowScrollBar

• 0x4954f4 ShowOwnedPopups

• 0x4954f8 ShowCursor

• 0x4954fc SetWindowsHookExA

• 0x495500 SetWindowTextA

• 0x495504 SetWindowPos

• 0x495508 SetWindowPlacement

• 0x49550c SetWindowLongA

• 0x495510 SetTimer

• 0x495514 SetScrollRange

• 0x495518 SetScrollPos

• 0x49551c SetScrollInfo

• 0x495520 SetRect

• 0x495524 SetPropA

• 0x495528 SetParent

• 0x49552c SetMenuItemInfoA

• 0x495530 SetMenu

• 0x495534 SetKeyboardState

• 0x495538 SetForegroundWindow

• 0x49553c SetFocus

• 0x495540 SetCursor

• 0x495544 SetClipboardData

• 0x495548 SetClassLongA

• 0x49554c SetCapture

• 0x495550 SetActiveWindow

• 0x495554 SendMessageA

• 0x495558 ScrollWindowEx

• 0x49555c ScrollWindow

• 0x495560 ScreenToClient

• 0x495564 RemovePropA

• 0x495568 RemoveMenu

• 0x49556c ReleaseDC

• 0x495570 ReleaseCapture

• 0x495574 RegisterWindowMessageA

• 0x495578 RegisterClipboardFormatA

• 0x49557c RegisterClassA

• 0x495580 RedrawWindow

• 0x495584 PtInRect

• 0x495588 PostQuitMessage

• 0x49558c PostMessageA

• 0x495590 PeekMessageA

• 0x495594 OpenClipboard

• 0x495598 OffsetRect

• 0x49559c OemToCharA

• 0x4955a0 MsgWaitForMultipleObjects

• 0x4955a4 MessageBoxA

• 0x4955a8 MessageBeep

• 0x4955ac MapWindowPoints

• 0x4955b0 MapVirtualKeyA

• 0x4955b4 LoadStringA

• 0x4955b8 LoadKeyboardLayoutA

• 0x4955bc LoadIconA

• 0x4955c0 LoadCursorA

• 0x4955c4 LoadBitmapA

• 0x4955c8 KillTimer

• 0x4955cc IsZoomed

• 0x4955d0 IsWindowVisible

• 0x4955d4 IsWindowEnabled

• 0x4955d8 IsWindow

• 0x4955dc IsRectEmpty

• 0x4955e0 IsIconic

• 0x4955e4 IsDialogMessageA

• 0x4955e8 IsChild

• 0x4955ec IsCharAlphaNumericA

• 0x4955f0 IsCharAlphaA

• 0x4955f4 InvalidateRect

• 0x4955f8 IntersectRect

• 0x4955fc InsertMenuItemA

• 0x495600 InsertMenuA

• 0x495604 InflateRect

• 0x495608 GetWindowThreadProcessId

• 0x49560c GetWindowTextA

• 0x495610 GetWindowRect

• 0x495614 GetWindowPlacement

• 0x495618 GetWindowLongA

• 0x49561c GetWindowDC

• 0x495620 GetTopWindow

• 0x495624 GetSystemMetrics

• 0x495628 GetSystemMenu

• 0x49562c GetSysColorBrush

• 0x495630 GetSysColor

• 0x495634 GetSubMenu

• 0x495638 GetScrollRange

• 0x49563c GetScrollPos

• 0x495640 GetScrollInfo

• 0x495644 GetPropA

• 0x495648 GetParent

• 0x49564c GetWindow

• 0x495650 GetMessageTime

• 0x495654 GetMenuStringA

• 0x495658 GetMenuState

• 0x49565c GetMenuItemInfoA

• 0x495660 GetMenuItemID

• 0x495664 GetMenuItemCount

• 0x495668 GetMenu

• 0x49566c GetLastActivePopup

• 0x495670 GetKeyboardState

• 0x495674 GetKeyboardLayoutList

• 0x495678 GetKeyboardLayout

• 0x49567c GetKeyState

• 0x495680 GetKeyNameTextA

• 0x495684 GetIconInfo

• 0x495688 GetForegroundWindow

• 0x49568c GetFocus

• 0x495690 GetDoubleClickTime

• 0x495694 GetDlgItem

• 0x495698 GetDesktopWindow

• 0x49569c GetDCEx

• 0x4956a0 GetDC

• 0x4956a4 GetCursorPos

• 0x4956a8 GetCursor

• 0x4956ac GetClipboardData

• 0x4956b0 GetClientRect

• 0x4956b4 GetClassNameA

• 0x4956b8 GetClassInfoA

• 0x4956bc GetCaretPos

• 0x4956c0 GetCapture

• 0x4956c4 GetActiveWindow

• 0x4956c8 FrameRect

• 0x4956cc FindWindowA

• 0x4956d0 FillRect

• 0x4956d4 EqualRect

• 0x4956d8 EnumWindows

• 0x4956dc EnumThreadWindows

• 0x4956e0 EnumClipboardFormats

• 0x4956e4 EndPaint

• 0x4956e8 EnableWindow

• 0x4956ec EnableScrollBar

• 0x4956f0 EnableMenuItem

• 0x4956f4 EmptyClipboard

• 0x4956f8 DrawTextA

• 0x4956fc DrawMenuBar

• 0x495700 DrawIconEx

• 0x495704 DrawIcon

• 0x495708 DrawFrameControl

• 0x49570c DrawFocusRect

• 0x495710 DrawEdge

• 0x495714 DispatchMessageA

• 0x495718 DestroyWindow

• 0x49571c DestroyMenu

• 0x495720 DestroyIcon

• 0x495724 DestroyCursor

• 0x495728 DeleteMenu

• 0x49572c DefWindowProcA

• 0x495730 DefMDIChildProcA

• 0x495734 DefFrameProcA

• 0x495738 CreatePopupMenu

• 0x49573c CreateMenu

• 0x495740 CreateIcon

• 0x495744 CloseClipboard

• 0x495748 ClientToScreen

• 0x49574c CheckMenuItem

• 0x495750 CallWindowProcA

• 0x495754 CallNextHookEx

• 0x495758 BeginPaint

• 0x49575c CharNextA

• 0x495760 CharLowerBuffA

• 0x495764 CharLowerA

• 0x495768 CharUpperBuffA

• 0x49576c CharToOemA

• 0x495770 AdjustWindowRectEx

• 0x495774 ActivateKeyboardLayout

Library kernel32.dll:

• 0x49577c Sleep

Library oleaut32.dll:

• 0x495784 SafeArrayPtrOfIndex

• 0x495788 SafeArrayGetUBound

• 0x49578c SafeArrayGetLBound

• 0x495790 SafeArrayCreate

• 0x495794 VariantChangeType

• 0x495798 VariantCopy

• 0x49579c VariantClear

• 0x4957a0 VariantInit

Library ole32.dll:

• 0x4957a8 CoTaskMemAlloc

• 0x4957ac CoCreateInstance

• 0x4957b0 CoUninitialize

• 0x4957b4 CoInitialize

Library comctl32.dll:

• 0x4957bc ImageList_SetIconSize

• 0x4957c0 ImageList_GetIconSize

• 0x4957c4 ImageList_Write

• 0x4957c8 ImageList_Read

• 0x4957cc ImageList_GetDragImage

• 0x4957d0 ImageList_DragShowNolock

• 0x4957d4 ImageList_SetDragCursorImage

• 0x4957d8 ImageList_DragMove

• 0x4957dc ImageList_DragLeave

• 0x4957e0 ImageList_DragEnter

• 0x4957e4 ImageList_EndDrag

• 0x4957e8 ImageList_BeginDrag

• 0x4957ec ImageList_Remove

• 0x4957f0 ImageList_DrawEx

• 0x4957f4 ImageList_Replace

• 0x4957f8 ImageList_Draw

• 0x4957fc ImageList_GetBkColor

• 0x495800 ImageList_SetBkColor

• 0x495804 ImageList_ReplaceIcon

• 0x495808 ImageList_Add

• 0x49580c ImageList_GetImageCount

• 0x495810 ImageList_Destroy

• 0x495814 ImageList_Create

• 0x495818 InitCommonControls

Library comdlg32.dll:

• 0x495820 GetSaveFileNameA

• 0x495824 GetOpenFileNameA

Library kernel32.dll:

• 0x49582c MulDiv

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	53945	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.