SmartHawk

5.2

中危

54 个模型检测该样本为恶意！

重新分析

下载样本

d3ea6307c607925c48b94aa06102187c9157527d70c69fb146c2904827a77162

b163f86e0a052dc10597cbeae51de878.exe

分析耗时

81s

最近分析

文件大小

795.5KB

静态报毒动态报毒 100% AGEN AI SCORE=89 AUTORUNER3 BIFROSE CLASSIC CONFIDENCE DELF ELDORADO EMPE FAREIT GDSDA HIGH CONFIDENCE HJVIKZ HLLW KCLOUD KRYPTIK MALWARE@#1T4BNF51EAZR7 OCCAMY PDBV R067C0DIK20 R335626 REMCOS SCORE SONBOKLI STATIC AI SUBILRNU3+K SUSGEN SUSPICIOUS PE UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanDownloader:Win32/Occamy.7fcb145a	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201229	21.1.5827.0
Tencent	Win32.Backdoor.Remcos.Pdbv	20201229	1.0.0.1
Kingsoft	Win32.Hack.Undef.(kcloud)	20201229	2017.9.26.565
McAfee	RDN/Generic BackDoor	20201229	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861175.448503 __exception__	stacktrace: 0x32f8fe2 DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x75113af0 timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7511a535 timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7511a434 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 57277924 registers.edi: 57277968 registers.eax: 0 registers.ebp: 57278060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 44 exception.instruction: mov eax, dword ptr [eax + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x32f8760	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619861175.448503
__exception__

stacktrace:

0x32f8fe2
DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x75113af0
timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7511a535
timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7511a434
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 57277924
registers.edi: 57277968
registers.eax: 0
registers.ebp: 57278060
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 44
exception.instruction: mov eax, dword ptr [eax + 0x3c]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x32f8760

success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861117.620503 NtAllocateVirtualMemory	process_identifier: 2368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e0000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861143.666503 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	58.63.233.69

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619861146.245503 RegSetValueExA	key_handle: 0x000003b8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619861146.245503 RegSetValueExA	key_handle: 0x000003b8 value: z >× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619861146.245503 RegSetValueExA	key_handle: 0x000003b8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619861146.245503 RegSetValueExW	key_handle: 0x000003b8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619861146.245503 RegSetValueExA	key_handle: 0x000003d0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619861146.245503 RegSetValueExA	key_handle: 0x000003d0 value: z >× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619861146.245503 RegSetValueExA	key_handle: 0x000003d0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619861146.276503 RegSetValueExW	key_handle: 0x000003b4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

202.160.130.66:443

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Empe.1.Gen
FireEye	Generic.mg.b163f86e0a052dc1
ALYac	Trojan.Empe.1.Gen
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanDownloader:Win32/Occamy.7fcb145a
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.e0a052
Arcabit	Trojan.Empe.1.Gen
Cyren	W32/Delf.KN.gen!Eldorado
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
BitDefender	Trojan.Empe.1.Gen
NANO-Antivirus	Trojan.Win32.Autoruner3.hjvikz
Paloalto	generic.ml
Tencent	Win32.Backdoor.Remcos.Pdbv
Ad-Aware	Trojan.Empe.1.Gen
Sophos	Mal/Generic-S
Comodo	Malware@#1t4bnf51eazr7
F-Secure	Heuristic.HEUR/AGEN.1136638
DrWeb	Win32.HLLW.Autoruner3.2270
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R067C0DIK20
McAfee-GW-Edition	RDN/Generic BackDoor
Emsisoft	Trojan.Empe.1.Gen (B)
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1136638
Antiy-AVL	Trojan/Win32.Sonbokli
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	PWS:Win32/Fareit.ART!MTB
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Trojan.Empe.1.Gen
Cynet	Malicious (score: 85)
AhnLab-V3	Backdoor/Win32.Remcos.R335626
McAfee	RDN/Generic BackDoor
MAX	malware (ai score=89)
VBA32	Trojan.Sonbokli
Malwarebytes	Trojan.MalPack.SMY.Generic
ESET-NOD32	Win32/TrojanDownloader.Delf.CXM
TrendMicro-HouseCall	TROJ_GEN.R067C0DIK20
Rising	Trojan.Kryptik!1.C56D (CLASSIC)
Yandex	Trojan.DL.Delf!SuBilrNu3+k
Ikarus	Backdoor.Win32.Bifrose
MaxSecure	Trojan.Malware.9833444.susgen
Fortinet	W32/Delf.CXL!tr.dldr

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4a917c DeleteCriticalSection

• 0x4a9180 LeaveCriticalSection

• 0x4a9184 EnterCriticalSection

• 0x4a9188 InitializeCriticalSection

• 0x4a918c VirtualFree

• 0x4a9190 VirtualAlloc

• 0x4a9194 LocalFree

• 0x4a9198 LocalAlloc

• 0x4a919c GetVersion

• 0x4a91a0 GetCurrentThreadId

• 0x4a91a4 InterlockedDecrement

• 0x4a91a8 InterlockedIncrement

• 0x4a91ac VirtualQuery

• 0x4a91b0 WideCharToMultiByte

• 0x4a91b4 MultiByteToWideChar

• 0x4a91b8 lstrlenA

• 0x4a91bc lstrcpynA

• 0x4a91c0 LoadLibraryExA

• 0x4a91c4 GetThreadLocale

• 0x4a91c8 GetStartupInfoA

• 0x4a91cc GetProcAddress

• 0x4a91d0 GetModuleHandleA

• 0x4a91d4 GetModuleFileNameA

• 0x4a91d8 GetLocaleInfoA

• 0x4a91dc GetCommandLineA

• 0x4a91e0 FreeLibrary

• 0x4a91e4 FindFirstFileA

• 0x4a91e8 FindClose

• 0x4a91ec ExitProcess

• 0x4a91f0 WriteFile

• 0x4a91f4 UnhandledExceptionFilter

• 0x4a91f8 RtlUnwind

• 0x4a91fc RaiseException

• 0x4a9200 GetStdHandle

Library user32.dll:

• 0x4a9208 GetKeyboardType

• 0x4a920c LoadStringA

• 0x4a9210 MessageBoxA

• 0x4a9214 CharNextA

Library advapi32.dll:

• 0x4a921c RegQueryValueExA

• 0x4a9220 RegOpenKeyExA

• 0x4a9224 RegCloseKey

Library oleaut32.dll:

• 0x4a922c SysFreeString

• 0x4a9230 SysReAllocStringLen

• 0x4a9234 SysAllocStringLen

Library kernel32.dll:

• 0x4a923c TlsSetValue

• 0x4a9240 TlsGetValue

• 0x4a9244 LocalAlloc

• 0x4a9248 GetModuleHandleA

Library advapi32.dll:

• 0x4a9250 RegQueryValueExA

• 0x4a9254 RegOpenKeyExA

• 0x4a9258 RegCloseKey

Library kernel32.dll:

• 0x4a9260 lstrcpyA

• 0x4a9264 WriteFile

• 0x4a9268 WaitForSingleObject

• 0x4a926c VirtualQuery

• 0x4a9270 VirtualProtect

• 0x4a9274 VirtualAlloc

• 0x4a9278 Sleep

• 0x4a927c SizeofResource

• 0x4a9280 SetThreadLocale

• 0x4a9284 SetFilePointer

• 0x4a9288 SetEvent

• 0x4a928c SetErrorMode

• 0x4a9290 SetEndOfFile

• 0x4a9294 ResetEvent

• 0x4a9298 ReadFile

• 0x4a929c MultiByteToWideChar

• 0x4a92a0 MulDiv

• 0x4a92a4 LockResource

• 0x4a92a8 LoadResource

• 0x4a92ac LoadLibraryA

• 0x4a92b0 LeaveCriticalSection

• 0x4a92b4 InitializeCriticalSection

• 0x4a92b8 GlobalUnlock

• 0x4a92bc GlobalReAlloc

• 0x4a92c0 GlobalHandle

• 0x4a92c4 GlobalLock

• 0x4a92c8 GlobalFree

• 0x4a92cc GlobalFindAtomA

• 0x4a92d0 GlobalDeleteAtom

• 0x4a92d4 GlobalAlloc

• 0x4a92d8 GlobalAddAtomA

• 0x4a92dc GetVersionExA

• 0x4a92e0 GetVersion

• 0x4a92e4 GetTickCount

• 0x4a92e8 GetThreadLocale

• 0x4a92ec GetSystemInfo

• 0x4a92f0 GetStringTypeExA

• 0x4a92f4 GetStdHandle

• 0x4a92f8 GetProcAddress

• 0x4a92fc GetModuleHandleA

• 0x4a9300 GetModuleFileNameA

• 0x4a9304 GetLocaleInfoA

• 0x4a9308 GetLocalTime

• 0x4a930c GetLastError

• 0x4a9310 GetFullPathNameA

• 0x4a9314 GetDiskFreeSpaceA

• 0x4a9318 GetDateFormatA

• 0x4a931c GetCurrentThreadId

• 0x4a9320 GetCurrentProcessId

• 0x4a9324 GetCPInfo

• 0x4a9328 GetACP

• 0x4a932c FreeResource

• 0x4a9330 InterlockedExchange

• 0x4a9334 FreeLibrary

• 0x4a9338 FormatMessageA

• 0x4a933c FindResourceA

• 0x4a9340 EnumCalendarInfoA

• 0x4a9344 EnterCriticalSection

• 0x4a9348 DeleteCriticalSection

• 0x4a934c CreateThread

• 0x4a9350 CreateFileA

• 0x4a9354 CreateEventA

• 0x4a9358 CompareStringA

• 0x4a935c CloseHandle

Library version.dll:

• 0x4a9364 VerQueryValueA

• 0x4a9368 GetFileVersionInfoSizeA

• 0x4a936c GetFileVersionInfoA

Library gdi32.dll:

• 0x4a9374 UnrealizeObject

• 0x4a9378 StretchBlt

• 0x4a937c SetWindowOrgEx

• 0x4a9380 SetWindowExtEx

• 0x4a9384 SetWinMetaFileBits

• 0x4a9388 SetViewportOrgEx

• 0x4a938c SetViewportExtEx

• 0x4a9390 SetTextColor

• 0x4a9394 SetStretchBltMode

• 0x4a9398 SetROP2

• 0x4a939c SetPixel

• 0x4a93a0 SetMapMode

• 0x4a93a4 SetEnhMetaFileBits

• 0x4a93a8 SetDIBColorTable

• 0x4a93ac SetBrushOrgEx

• 0x4a93b0 SetBkMode

• 0x4a93b4 SetBkColor

• 0x4a93b8 SelectPalette

• 0x4a93bc SelectObject

• 0x4a93c0 SelectClipRgn

• 0x4a93c4 SaveDC

• 0x4a93c8 RestoreDC

• 0x4a93cc Rectangle

• 0x4a93d0 RectVisible

• 0x4a93d4 RealizePalette

• 0x4a93d8 Polyline

• 0x4a93dc PolyPolyline

• 0x4a93e0 PlayEnhMetaFile

• 0x4a93e4 PatBlt

• 0x4a93e8 MoveToEx

• 0x4a93ec MaskBlt

• 0x4a93f0 LineTo

• 0x4a93f4 IntersectClipRect

• 0x4a93f8 GetWindowOrgEx

• 0x4a93fc GetWinMetaFileBits

• 0x4a9400 GetTextMetricsA

• 0x4a9404 GetTextExtentPointA

• 0x4a9408 GetTextExtentPoint32A

• 0x4a940c GetSystemPaletteEntries

• 0x4a9410 GetStockObject

• 0x4a9414 GetPixel

• 0x4a9418 GetPaletteEntries

• 0x4a941c GetObjectA

• 0x4a9420 GetNearestColor

• 0x4a9424 GetEnhMetaFilePaletteEntries

• 0x4a9428 GetEnhMetaFileHeader

• 0x4a942c GetEnhMetaFileBits

• 0x4a9430 GetDeviceCaps

• 0x4a9434 GetDIBits

• 0x4a9438 GetDIBColorTable

• 0x4a943c GetDCOrgEx

• 0x4a9440 GetCurrentPositionEx

• 0x4a9444 GetClipBox

• 0x4a9448 GetBrushOrgEx

• 0x4a944c GetBitmapBits

• 0x4a9450 ExtTextOutA

• 0x4a9454 ExtCreatePen

• 0x4a9458 ExcludeClipRect

• 0x4a945c DeleteObject

• 0x4a9460 DeleteEnhMetaFile

• 0x4a9464 DeleteDC

• 0x4a9468 CreateSolidBrush

• 0x4a946c CreatePenIndirect

• 0x4a9470 CreatePalette

• 0x4a9474 CreateHalftonePalette

• 0x4a9478 CreateFontIndirectA

• 0x4a947c CreateDIBitmap

• 0x4a9480 CreateDIBSection

• 0x4a9484 CreateCompatibleDC

• 0x4a9488 CreateCompatibleBitmap

• 0x4a948c CreateBrushIndirect

• 0x4a9490 CreateBitmap

• 0x4a9494 CopyEnhMetaFileA

• 0x4a9498 BitBlt

Library user32.dll:

• 0x4a94a0 CreateWindowExA

• 0x4a94a4 WindowFromPoint

• 0x4a94a8 WinHelpA

• 0x4a94ac WaitMessage

• 0x4a94b0 ValidateRect

• 0x4a94b4 UpdateWindow

• 0x4a94b8 UnregisterClassA

• 0x4a94bc UnionRect

• 0x4a94c0 UnhookWindowsHookEx

• 0x4a94c4 TranslateMessage

• 0x4a94c8 TranslateMDISysAccel

• 0x4a94cc TrackPopupMenu

• 0x4a94d0 SystemParametersInfoA

• 0x4a94d4 ShowWindow

• 0x4a94d8 ShowScrollBar

• 0x4a94dc ShowOwnedPopups

• 0x4a94e0 ShowCursor

• 0x4a94e4 SetWindowsHookExA

• 0x4a94e8 SetWindowTextA

• 0x4a94ec SetWindowPos

• 0x4a94f0 SetWindowPlacement

• 0x4a94f4 SetWindowLongA

• 0x4a94f8 SetTimer

• 0x4a94fc SetScrollRange

• 0x4a9500 SetScrollPos

• 0x4a9504 SetScrollInfo

• 0x4a9508 SetRect

• 0x4a950c SetPropA

• 0x4a9510 SetParent

• 0x4a9514 SetMenuItemInfoA

• 0x4a9518 SetMenu

• 0x4a951c SetKeyboardState

• 0x4a9520 SetForegroundWindow

• 0x4a9524 SetFocus

• 0x4a9528 SetCursor

• 0x4a952c SetClipboardData

• 0x4a9530 SetClassLongA

• 0x4a9534 SetCapture

• 0x4a9538 SetActiveWindow

• 0x4a953c SendMessageA

• 0x4a9540 ScrollWindowEx

• 0x4a9544 ScrollWindow

• 0x4a9548 ScreenToClient

• 0x4a954c RemovePropA

• 0x4a9550 RemoveMenu

• 0x4a9554 ReleaseDC

• 0x4a9558 ReleaseCapture

• 0x4a955c RegisterWindowMessageA

• 0x4a9560 RegisterClipboardFormatA

• 0x4a9564 RegisterClassA

• 0x4a9568 RedrawWindow

• 0x4a956c PtInRect

• 0x4a9570 PostQuitMessage

• 0x4a9574 PostMessageA

• 0x4a9578 PeekMessageA

• 0x4a957c OpenClipboard

• 0x4a9580 OffsetRect

• 0x4a9584 OemToCharA

• 0x4a9588 MessageBoxA

• 0x4a958c MessageBeep

• 0x4a9590 MapWindowPoints

• 0x4a9594 MapVirtualKeyA

• 0x4a9598 LoadStringA

• 0x4a959c LoadKeyboardLayoutA

• 0x4a95a0 LoadIconA

• 0x4a95a4 LoadCursorA

• 0x4a95a8 LoadBitmapA

• 0x4a95ac KillTimer

• 0x4a95b0 IsZoomed

• 0x4a95b4 IsWindowVisible

• 0x4a95b8 IsWindowEnabled

• 0x4a95bc IsWindow

• 0x4a95c0 IsRectEmpty

• 0x4a95c4 IsIconic

• 0x4a95c8 IsDialogMessageA

• 0x4a95cc IsChild

• 0x4a95d0 IsCharAlphaNumericA

• 0x4a95d4 IsCharAlphaA

• 0x4a95d8 InvalidateRect

• 0x4a95dc IntersectRect

• 0x4a95e0 InsertMenuItemA

• 0x4a95e4 InsertMenuA

• 0x4a95e8 InflateRect

• 0x4a95ec GetWindowThreadProcessId

• 0x4a95f0 GetWindowTextA

• 0x4a95f4 GetWindowRect

• 0x4a95f8 GetWindowPlacement

• 0x4a95fc GetWindowLongA

• 0x4a9600 GetWindowDC

• 0x4a9604 GetTopWindow

• 0x4a9608 GetSystemMetrics

• 0x4a960c GetSystemMenu

• 0x4a9610 GetSysColorBrush

• 0x4a9614 GetSysColor

• 0x4a9618 GetSubMenu

• 0x4a961c GetScrollRange

• 0x4a9620 GetScrollPos

• 0x4a9624 GetScrollInfo

• 0x4a9628 GetPropA

• 0x4a962c GetParent

• 0x4a9630 GetWindow

• 0x4a9634 GetMessageTime

• 0x4a9638 GetMenuStringA

• 0x4a963c GetMenuState

• 0x4a9640 GetMenuItemInfoA

• 0x4a9644 GetMenuItemID

• 0x4a9648 GetMenuItemCount

• 0x4a964c GetMenu

• 0x4a9650 GetLastActivePopup

• 0x4a9654 GetKeyboardState

• 0x4a9658 GetKeyboardLayoutList

• 0x4a965c GetKeyboardLayout

• 0x4a9660 GetKeyState

• 0x4a9664 GetKeyNameTextA

• 0x4a9668 GetIconInfo

• 0x4a966c GetForegroundWindow

• 0x4a9670 GetFocus

• 0x4a9674 GetDoubleClickTime

• 0x4a9678 GetDlgItem

• 0x4a967c GetDesktopWindow

• 0x4a9680 GetDCEx

• 0x4a9684 GetDC

• 0x4a9688 GetCursorPos

• 0x4a968c GetCursor

• 0x4a9690 GetClipboardData

• 0x4a9694 GetClientRect

• 0x4a9698 GetClassNameA

• 0x4a969c GetClassInfoA

• 0x4a96a0 GetCaretPos

• 0x4a96a4 GetCapture

• 0x4a96a8 GetActiveWindow

• 0x4a96ac FrameRect

• 0x4a96b0 FindWindowA

• 0x4a96b4 FillRect

• 0x4a96b8 EqualRect

• 0x4a96bc EnumWindows

• 0x4a96c0 EnumThreadWindows

• 0x4a96c4 EnumClipboardFormats

• 0x4a96c8 EndPaint

• 0x4a96cc EnableWindow

• 0x4a96d0 EnableScrollBar

• 0x4a96d4 EnableMenuItem

• 0x4a96d8 EmptyClipboard

• 0x4a96dc DrawTextA

• 0x4a96e0 DrawMenuBar

• 0x4a96e4 DrawIconEx

• 0x4a96e8 DrawIcon

• 0x4a96ec DrawFrameControl

• 0x4a96f0 DrawFocusRect

• 0x4a96f4 DrawEdge

• 0x4a96f8 DispatchMessageA

• 0x4a96fc DestroyWindow

• 0x4a9700 DestroyMenu

• 0x4a9704 DestroyIcon

• 0x4a9708 DestroyCursor

• 0x4a970c DeleteMenu

• 0x4a9710 DefWindowProcA

• 0x4a9714 DefMDIChildProcA

• 0x4a9718 DefFrameProcA

• 0x4a971c CreatePopupMenu

• 0x4a9720 CreateMenu

• 0x4a9724 CreateIcon

• 0x4a9728 CloseClipboard

• 0x4a972c ClientToScreen

• 0x4a9730 CheckMenuItem

• 0x4a9734 CallWindowProcA

• 0x4a9738 CallNextHookEx

• 0x4a973c BeginPaint

• 0x4a9740 CharNextA

• 0x4a9744 CharLowerBuffA

• 0x4a9748 CharLowerA

• 0x4a974c CharUpperBuffA

• 0x4a9750 CharToOemA

• 0x4a9754 AdjustWindowRectEx

• 0x4a9758 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4a9760 Sleep

Library oleaut32.dll:

• 0x4a9768 SafeArrayPtrOfIndex

• 0x4a976c SafeArrayPutElement

• 0x4a9770 SafeArrayGetElement

• 0x4a9774 SafeArrayUnaccessData

• 0x4a9778 SafeArrayAccessData

• 0x4a977c SafeArrayGetUBound

• 0x4a9780 SafeArrayGetLBound

• 0x4a9784 SafeArrayCreate

• 0x4a9788 VariantChangeType

• 0x4a978c VariantCopyInd

• 0x4a9790 VariantCopy

• 0x4a9794 VariantClear

• 0x4a9798 VariantInit

Library ole32.dll:

• 0x4a97a0 CoUninitialize

• 0x4a97a4 CoInitialize

Library oleaut32.dll:

• 0x4a97ac GetErrorInfo

• 0x4a97b0 SysFreeString

Library comctl32.dll:

• 0x4a97b8 ImageList_SetIconSize

• 0x4a97bc ImageList_GetIconSize

• 0x4a97c0 ImageList_Write

• 0x4a97c4 ImageList_Read

• 0x4a97c8 ImageList_GetDragImage

• 0x4a97cc ImageList_DragShowNolock

• 0x4a97d0 ImageList_SetDragCursorImage

• 0x4a97d4 ImageList_DragMove

• 0x4a97d8 ImageList_DragLeave

• 0x4a97dc ImageList_DragEnter

• 0x4a97e0 ImageList_EndDrag

• 0x4a97e4 ImageList_BeginDrag

• 0x4a97e8 ImageList_Remove

• 0x4a97ec ImageList_DrawEx

• 0x4a97f0 ImageList_Replace

• 0x4a97f4 ImageList_Draw

• 0x4a97f8 ImageList_GetBkColor

• 0x4a97fc ImageList_SetBkColor

• 0x4a9800 ImageList_ReplaceIcon

• 0x4a9804 ImageList_Add

• 0x4a9808 ImageList_SetImageCount

• 0x4a980c ImageList_GetImageCount

• 0x4a9810 ImageList_Destroy

• 0x4a9814 ImageList_Create

Library comdlg32.dll:

• 0x4a981c GetSaveFileNameA

• 0x4a9820 GetOpenFileNameA

Library kernel32.dll:

• 0x4a9828 MulDiv

Library URL.DLL:

• 0x4a9830 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
drive.google.com	A 202.160.130.66	162.125.32.5
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.