SmartHawk

10.4

0-day

56 个模型检测该样本为恶意！

重新分析

下载样本

3e1db008e023d49ccecd8ecbd91cd54545cb8b19f5fcc53ee9b2a11302ade1a1

bd63440c23d4ecfde5063e27192485c2.exe

分析耗时

116s

最近分析

文件大小

456.0KB

静态报毒动态报毒 5HS2XHZWOLQ AI SCORE=81 AIDETECTVM ATTRIBUTE BANKERX BSCOPE CLASSIC CQ0@AWIA5XNI ELDORADO EMOTET EPAZ GENCIRC GENERICKD GENETIC GENKRYPTIK HAPZV HFGP HIGH CONFIDENCE HIGHCONFIDENCE HPMPIZ KRYPTIK MALWARE2 MALWARE@#PHXG0U6SSWV2 R + TROJ R346459 SCORE SUSGEN THIAABO UNSAFE WACATAC XPACK ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Emotet.309efb2d	20190527	0.3.0.5
CrowdStrike		20190702	1.0
Avast	Win32:BankerX-gen [Trj]	20201210	21.1.5827.0
Baidu		20190318	1.0.0.2
McAfee	Emotet-FRH!BD63440C23D4	20201211	6.0.6.653
Tencent	Malware.Win32.Gencirc.10cde542	20201211	1.0.0.1

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619884599.224875 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619884590.599875 CryptGenKey	crypto_handle: 0x006dc010 algorithm_identifier: 0x0000660e () provider_handle: 0x00633a38 flags: 1 key: fÅséØY_\wÂKÒ >	success	1
1619884599.411875 CryptExportKey	crypto_handle: 0x006dc010 crypto_export_handle: 0x006dbf90 buffer: f¤vh:¨!#Ð²àÂÎ:Æ!Gg,qÅÓTñ@æ=n¿sÌÇ7Q_aþ,~oÛpÐQÁO³(ÖÖ*ã¶¾¦¤éÀÈqñÖGûÝüð7û3[:!K blob_type: 1 flags: 64	success	1
1619884631.458875 CryptExportKey	crypto_handle: 0x006dc010 crypto_export_handle: 0x006dbf90 buffer: f¤ß P{æ «0Í@D¥%ËI"¸m u}0¡§}NtBÁMÂûãÃSÙrô#6ý.ýe¨5X(QÊüA*zíA@»f=;nGnÈýâæ¤¦ blob_type: 1 flags: 64	success	1
1619884655.114875 CryptExportKey	crypto_handle: 0x006dc010 crypto_export_handle: 0x006dbf90 buffer: f¤vFE¸NYLðjÌÐMüIÏ&íÉô OY³P¾!c«ðrå6]úv>YïËà¹zµÀ·}3©©4å8¯Ç3ß{èÃc¸5þ± Ã1`Á blob_type: 1 flags: 64	success	1

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:1344586700&cup2hreq=468a284ec4aac7ee243b61d851db24c773525aab53d895fb065bd459ae829e46

Performs some HTTP requests (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:1344586700&cup2hreq=468a284ec4aac7ee243b61d851db24c773525aab53d895fb065bd459ae829e46

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:1344586700&cup2hreq=468a284ec4aac7ee243b61d851db24c773525aab53d895fb065bd459ae829e46

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619884585.7395 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00500000	success
1619884638.318 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004070000	success
1619884590.239875 NtAllocateVirtualMemory	process_identifier: 2944 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003e0000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 个事件)

Time & API	Arguments	Status	Return
1619884631.458875 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x000003a8 process_identifier: 3212	success	1
1619884631.458875 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x000003a8 process_identifier: 3244	success	1
1619884631.458875 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000003a8 process_identifier: 3312	success	1
1619884631.458875 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000003a8 process_identifier: 3368	success	1
1619884655.114875 Process32NextW	process_name: inject-x64.exe snapshot_handle: 0x000003a8 process_identifier: 3580	success	1

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619884586.4895 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bd63440c23d4ecfde5063e27192485c2.exe newfilepath: C:\Windows\SysWOW64\shsetup\dpnsvr.exe newfilepath_r: C:\Windows\SysWOW64\shsetup\dpnsvr.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bd63440c23d4ecfde5063e27192485c2.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619884605.083875 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

dpnsvr.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619884600.677875 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (4 个事件)

host	172.217.24.14
host	212.51.142.238
host	47.146.117.214
host	62.108.54.22

Installs itself for autorun at Windows startup (1 个事件)

service_name

dpnsvr

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\shsetup\dpnsvr.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619884589.4425 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x024b9618 display_name: dpnsvr error_control: 0 service_name: dpnsvr filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\shsetup\dpnsvr.exe" filepath_r: "C:\Windows\SysWOW64\shsetup\dpnsvr.exe" service_manager_handle: 0x024b9078 desired_access: 2 service_type: 16 password:	success	38508056	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619884607.661875 RegSetValueExA	key_handle: 0x000003a8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619884607.661875 RegSetValueExA	key_handle: 0x000003a8 value: ÐÍ-ùª>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619884607.661875 RegSetValueExA	key_handle: 0x000003a8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619884607.661875 RegSetValueExW	key_handle: 0x000003a8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619884607.661875 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619884607.661875 RegSetValueExA	key_handle: 0x000003c0 value: ÐÍ-ùª>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619884607.661875 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619884607.677875 RegSetValueExW	key_handle: 0x000003a4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\shsetup\dpnsvr.exe:Zone.Identifier

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.Emotet.995
MicroWorld-eScan	Trojan.GenericKD.34266379
FireEye	Generic.mg.bd63440c23d4ecfd
ALYac	Trojan.GenericKD.34266379
Cylance	Unsafe
Zillya	Backdoor.Emotet.Win32.849
Sangfor	Malware
K7AntiVirus	Trojan ( 0056ba551 )
Alibaba	Trojan:Win32/Emotet.309efb2d
K7GW	Trojan ( 0056ba551 )
Arcabit	Trojan.Generic.D20ADD0B
BitDefenderTheta	Gen:NN.ZexaF.34670.Cq0@aWIA5Xni
Cyren	W32/Emotet.AOL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HFGP
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
ClamAV	Win.Packed.Emotet-9527878-0
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.pef
BitDefender	Trojan.GenericKD.34266379
NANO-Antivirus	Trojan.Win32.Emotet.hpmpiz
Paloalto	generic.ml
AegisLab	Trojan.Win32.Generic.4!c
Rising	Trojan.Kryptik!1.C82B (CLASSIC)
Ad-Aware	Trojan.GenericKD.34266379
Sophos	Mal/Generic-R + Troj/Emotet-CKL
Comodo	Malware@#phxg0u6sswv2
F-Secure	Trojan.TR/Crypt.XPACK.hapzv
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.WACATAC.THIAABO
McAfee-GW-Edition	BehavesLike.Win32.Emotet.gh
Emsisoft	Trojan.Emotet (A)
Jiangmin	Backdoor.Emotet.pe
Avira	TR/Crypt.XPACK.hapzv
Antiy-AVL	Trojan[Backdoor]/Win32.Emotet
Gridinsoft	Trojan.Win32.Emotet.oa
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.pef
GData	Trojan.GenericKD.34266379
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Emotet.R346459
McAfee	Emotet-FRH!BD63440C23D4
MAX	malware (ai score=81)
VBA32	BScope.Trojan.Emotet
Malwarebytes	Trojan.MalPack.TRE
TrendMicro-HouseCall	Trojan.Win32.WACATAC.THIAABO
Tencent	Malware.Win32.Gencirc.10cde542
Yandex	Trojan.Kryptik!5Hs2XhZWOLQ

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (6 个事件)

dead_host	172.217.27.142:443
dead_host	172.217.24.14:443
dead_host	62.108.54.22:8080
dead_host	212.51.142.238:8080
dead_host	172.217.160.78:443
dead_host	47.146.117.214:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-30 16:22:39

Imports

Library KERNEL32.dll:

• 0x44d1a0 HeapCreate

• 0x44d1a4 VirtualFree

• 0x44d1a8 IsBadWritePtr

• 0x44d1ac GetStdHandle

• 0x44d1b0 UnhandledExceptionFilter

• 0x44d1b4 FreeEnvironmentStringsA

• 0x44d1b8 GetEnvironmentStrings

• 0x44d1bc FreeEnvironmentStringsW

• 0x44d1c0 GetEnvironmentStringsW

• 0x44d1c4 SetHandleCount

• 0x44d1c8 GetFileType

• 0x44d1cc QueryPerformanceCounter

• 0x44d1d0 GetCurrentProcessId

• 0x44d1d4 GetSystemTimeAsFileTime

• 0x44d1d8 HeapDestroy

• 0x44d1dc LCMapStringW

• 0x44d1e0 GetTimeZoneInformation

• 0x44d1e4 IsBadReadPtr

• 0x44d1e8 IsBadCodePtr

• 0x44d1ec GetUserDefaultLCID

• 0x44d1f0 EnumSystemLocalesA

• 0x44d1f4 IsValidLocale

• 0x44d1f8 IsValidCodePage

• 0x44d1fc SetStdHandle

• 0x44d200 GetLocaleInfoW

• 0x44d204 SetEnvironmentVariableA

• 0x44d208 GetStringTypeW

• 0x44d20c GetStringTypeA

• 0x44d210 SetUnhandledExceptionFilter

• 0x44d214 HeapSize

• 0x44d218 TerminateProcess

• 0x44d21c HeapReAlloc

• 0x44d220 GetCommandLineA

• 0x44d224 GetStartupInfoA

• 0x44d228 VirtualQuery

• 0x44d22c GetSystemInfo

• 0x44d230 VirtualAlloc

• 0x44d234 VirtualProtect

• 0x44d238 HeapFree

• 0x44d23c HeapAlloc

• 0x44d240 RtlUnwind

• 0x44d244 GetTickCount

• 0x44d248 SetErrorMode

• 0x44d24c LocalFileTimeToFileTime

• 0x44d250 FileTimeToLocalFileTime

• 0x44d254 GetShortPathNameA

• 0x44d258 CreateFileA

• 0x44d25c GetVolumeInformationA

• 0x44d260 FindFirstFileA

• 0x44d264 FindClose

• 0x44d268 DuplicateHandle

• 0x44d26c GetFileSize

• 0x44d270 SetEndOfFile

• 0x44d274 UnlockFile

• 0x44d278 LockFile

• 0x44d27c FlushFileBuffers

• 0x44d280 SetFilePointer

• 0x44d284 WriteFile

• 0x44d288 ReadFile

• 0x44d28c DeleteFileA

• 0x44d290 MoveFileA

• 0x44d294 GetCurrentDirectoryA

• 0x44d298 RaiseException

• 0x44d29c GetOEMCP

• 0x44d2a0 GetCPInfo

• 0x44d2a4 InterlockedIncrement

• 0x44d2a8 GlobalFlags

• 0x44d2ac InterlockedDecrement

• 0x44d2b0 TlsFree

• 0x44d2b4 DeleteCriticalSection

• 0x44d2b8 LocalReAlloc

• 0x44d2bc TlsSetValue

• 0x44d2c0 TlsAlloc

• 0x44d2c4 InitializeCriticalSection

• 0x44d2c8 TlsGetValue

• 0x44d2cc EnterCriticalSection

• 0x44d2d0 GlobalHandle

• 0x44d2d4 GlobalReAlloc

• 0x44d2d8 LeaveCriticalSection

• 0x44d2dc LocalAlloc

• 0x44d2e0 SystemTimeToFileTime

• 0x44d2e4 FileTimeToSystemTime

• 0x44d2e8 GetDiskFreeSpaceA

• 0x44d2ec GetFullPathNameA

• 0x44d2f0 GetTempFileNameA

• 0x44d2f4 GetFileTime

• 0x44d2f8 SetFileTime

• 0x44d2fc GetFileAttributesA

• 0x44d300 GetPrivateProfileStringA

• 0x44d304 WritePrivateProfileStringA

• 0x44d308 GetPrivateProfileIntA

• 0x44d30c CloseHandle

• 0x44d310 GetCurrentThread

• 0x44d314 GetModuleFileNameA

• 0x44d318 ConvertDefaultLocale

• 0x44d31c EnumResourceLanguagesA

• 0x44d320 lstrcpyA

• 0x44d324 lstrcmpA

• 0x44d328 SetLastError

• 0x44d32c GlobalFree

• 0x44d330 MulDiv

• 0x44d334 GlobalAlloc

• 0x44d338 GlobalLock

• 0x44d33c GlobalUnlock

• 0x44d340 FormatMessageA

• 0x44d344 LocalFree

• 0x44d348 FreeResource

• 0x44d34c GetCurrentThreadId

• 0x44d350 GlobalGetAtomNameA

• 0x44d354 GlobalAddAtomA

• 0x44d358 GlobalFindAtomA

• 0x44d35c GlobalDeleteAtom

• 0x44d360 LoadLibraryA

• 0x44d364 FreeLibrary

• 0x44d368 lstrcatA

• 0x44d36c lstrcmpW

• 0x44d370 lstrcpynA

• 0x44d374 GetModuleHandleA

• 0x44d378 GetStringTypeExA

• 0x44d37c CompareStringW

• 0x44d380 CompareStringA

• 0x44d384 lstrlenA

• 0x44d388 GetVersion

• 0x44d38c GetLastError

• 0x44d390 MultiByteToWideChar

• 0x44d394 lstrcmpiA

• 0x44d398 LoadLibraryExW

• 0x44d39c ExitProcess

• 0x44d3a0 LoadLibraryExA

• 0x44d3a4 GetProcAddress

• 0x44d3a8 GetCurrentProcess

• 0x44d3ac WideCharToMultiByte

• 0x44d3b0 FindResourceA

• 0x44d3b4 LoadResource

• 0x44d3b8 LockResource

• 0x44d3bc SizeofResource

• 0x44d3c0 GetVersionExA

• 0x44d3c4 GetThreadLocale

• 0x44d3c8 GetLocaleInfoA

• 0x44d3cc GetACP

• 0x44d3d0 LCMapStringA

• 0x44d3d4 InterlockedExchange

Library USER32.dll:

• 0x44d438 IsZoomed

• 0x44d43c GetCursorPos

• 0x44d440 WindowFromPoint

• 0x44d444 KillTimer

• 0x44d448 SetTimer

• 0x44d44c ClientToScreen

• 0x44d450 SetRect

• 0x44d454 wsprintfA

• 0x44d458 LoadMenuA

• 0x44d45c DestroyMenu

• 0x44d460 GetActiveWindow

• 0x44d464 UnpackDDElParam

• 0x44d468 ReuseDDElParam

• 0x44d46c ReleaseCapture

• 0x44d470 LoadAcceleratorsA

• 0x44d474 InvalidateRect

• 0x44d478 InsertMenuItemA

• 0x44d47c CreatePopupMenu

• 0x44d480 SetRectEmpty

• 0x44d484 BringWindowToTop

• 0x44d488 SetMenu

• 0x44d48c GetDesktopWindow

• 0x44d490 TranslateAcceleratorA

• 0x44d494 GetMenuStringA

• 0x44d498 AppendMenuA

• 0x44d49c InsertMenuA

• 0x44d4a0 RemoveMenu

• 0x44d4a4 SetMenuItemBitmaps

• 0x44d4a8 ModifyMenuA

• 0x44d4ac GetMenuState

• 0x44d4b0 EnableMenuItem

• 0x44d4b4 CheckMenuItem

• 0x44d4b8 GetMenuCheckMarkDimensions

• 0x44d4bc LoadBitmapA

• 0x44d4c0 IsWindowEnabled

• 0x44d4c4 ShowWindow

• 0x44d4c8 MoveWindow

• 0x44d4cc SetWindowTextA

• 0x44d4d0 IsDialogMessageA

• 0x44d4d4 SetDlgItemTextA

• 0x44d4d8 RegisterWindowMessageA

• 0x44d4dc WinHelpA

• 0x44d4e0 GetCapture

• 0x44d4e4 CreateWindowExA

• 0x44d4e8 SetWindowsHookExA

• 0x44d4ec CallNextHookEx

• 0x44d4f0 GetClassLongA

• 0x44d4f4 GetClassInfoExA

• 0x44d4f8 GetClassNameA

• 0x44d4fc SetPropA

• 0x44d500 GetPropA

• 0x44d504 RemovePropA

• 0x44d508 SendDlgItemMessageA

• 0x44d50c GetFocus

• 0x44d510 SetFocus

• 0x44d514 IsChild

• 0x44d518 GetWindowTextLengthA

• 0x44d51c GetLastActivePopup

• 0x44d520 SetActiveWindow

• 0x44d524 DispatchMessageA

• 0x44d528 BeginDeferWindowPos

• 0x44d52c MessageBeep

• 0x44d530 GetDlgItem

• 0x44d534 GetTopWindow

• 0x44d538 DestroyWindow

• 0x44d53c UnhookWindowsHookEx

• 0x44d540 GetMessageTime

• 0x44d544 LoadIconA

• 0x44d548 PeekMessageA

• 0x44d54c MapWindowPoints

• 0x44d550 ScrollWindow

• 0x44d554 MessageBoxA

• 0x44d558 TrackPopupMenu

• 0x44d55c GetKeyState

• 0x44d560 SetScrollRange

• 0x44d564 GetScrollRange

• 0x44d568 SetScrollPos

• 0x44d56c GetScrollPos

• 0x44d570 SetForegroundWindow

• 0x44d574 ShowScrollBar

• 0x44d578 IsWindowVisible

• 0x44d57c GetClientRect

• 0x44d580 GetMenu

• 0x44d584 PostMessageA

• 0x44d588 GetSubMenu

• 0x44d58c GetMenuItemID

• 0x44d590 GetMenuItemCount

• 0x44d594 GetSysColor

• 0x44d598 AdjustWindowRectEx

• 0x44d59c ScreenToClient

• 0x44d5a0 EqualRect

• 0x44d5a4 DeferWindowPos

• 0x44d5a8 GetScrollInfo

• 0x44d5ac SetScrollInfo

• 0x44d5b0 GetClassInfoA

• 0x44d5b4 RegisterClassA

• 0x44d5b8 UnregisterClassA

• 0x44d5bc GetDlgCtrlID

• 0x44d5c0 DefWindowProcA

• 0x44d5c4 GetNextDlgGroupItem

• 0x44d5c8 InvalidateRgn

• 0x44d5cc CopyAcceleratorTableA

• 0x44d5d0 SetWindowContextHelpId

• 0x44d5d4 DestroyIcon

• 0x44d5d8 DeleteMenu

• 0x44d5dc LockWindowUpdate

• 0x44d5e0 GetDCEx

• 0x44d5e4 CharNextA

• 0x44d5e8 GetSysColorBrush

• 0x44d5ec EndPaint

• 0x44d5f0 CallWindowProcA

• 0x44d5f4 GetWindowLongA

• 0x44d5f8 SetWindowLongA

• 0x44d5fc SetWindowPos

• 0x44d600 OffsetRect

• 0x44d604 IntersectRect

• 0x44d608 SystemParametersInfoA

• 0x44d60c GetWindowPlacement

• 0x44d610 GetWindowRect

• 0x44d614 CopyRect

• 0x44d618 PtInRect

• 0x44d61c GetWindow

• 0x44d620 CharUpperA

• 0x44d624 RegisterClipboardFormatA

• 0x44d628 GetTabbedTextExtentA

• 0x44d62c LoadCursorA

• 0x44d630 SetCursor

• 0x44d634 GetSystemMetrics

• 0x44d638 GetForegroundWindow

• 0x44d63c GetWindowTextA

• 0x44d640 IsWindow

• 0x44d644 GetParent

• 0x44d648 IsIconic

• 0x44d64c SendMessageA

• 0x44d650 UpdateWindow

• 0x44d654 GetSystemMenu

• 0x44d658 EnableWindow

• 0x44d65c PostThreadMessageA

• 0x44d660 CreateMenu

• 0x44d664 SetParent

• 0x44d668 GetMessagePos

• 0x44d66c BeginPaint

• 0x44d670 GetWindowDC

• 0x44d674 GrayStringA

• 0x44d678 DrawTextExA

• 0x44d67c DrawTextA

• 0x44d680 TabbedTextOutA

• 0x44d684 GetMenuItemInfoA

• 0x44d688 InflateRect

• 0x44d68c SetCapture

• 0x44d690 SetWindowRgn

• 0x44d694 DrawIcon

• 0x44d698 FindWindowA

• 0x44d69c FillRect

• 0x44d6a0 DestroyCursor

• 0x44d6a4 ReleaseDC

• 0x44d6a8 MapDialogRect

• 0x44d6ac GetMessageA

• 0x44d6b0 TranslateMessage

• 0x44d6b4 ValidateRect

• 0x44d6b8 ShowOwnedPopups

• 0x44d6bc PostQuitMessage

• 0x44d6c0 CreateDialogIndirectParamA

• 0x44d6c4 GetNextDlgTabItem

• 0x44d6c8 EndDialog

• 0x44d6cc UnionRect

• 0x44d6d0 IsRectEmpty

• 0x44d6d4 EndDeferWindowPos

• 0x44d6d8 GetDC

Library GDI32.dll:

• 0x44d054 SetAbortProc

• 0x44d058 AbortDoc

• 0x44d05c EndDoc

• 0x44d060 CreateEllipticRgn

• 0x44d064 LPtoDP

• 0x44d068 Ellipse

• 0x44d06c CreateFontIndirectA

• 0x44d070 BitBlt

• 0x44d074 ExtTextOutA

• 0x44d078 SaveDC

• 0x44d07c RestoreDC

• 0x44d080 SetBkMode

• 0x44d084 SetPolyFillMode

• 0x44d088 SetROP2

• 0x44d08c SetStretchBltMode

• 0x44d090 SetMapMode

• 0x44d094 ExcludeClipRect

• 0x44d098 IntersectClipRect

• 0x44d09c LineTo

• 0x44d0a0 MoveToEx

• 0x44d0a4 SetTextAlign

• 0x44d0a8 SelectClipRgn

• 0x44d0ac CreateRectRgn

• 0x44d0b0 GetViewportExtEx

• 0x44d0b4 GetWindowExtEx

• 0x44d0b8 GetPixel

• 0x44d0bc PtVisible

• 0x44d0c0 RectVisible

• 0x44d0c4 TextOutA

• 0x44d0c8 Escape

• 0x44d0cc SetViewportOrgEx

• 0x44d0d0 EndPage

• 0x44d0d4 SetViewportExtEx

• 0x44d0d8 ScaleViewportExtEx

• 0x44d0dc SetWindowOrgEx

• 0x44d0e0 SetWindowExtEx

• 0x44d0e4 ScaleWindowExtEx

• 0x44d0e8 GetCurrentPositionEx

• 0x44d0ec ExtSelectClipRgn

• 0x44d0f0 CreatePatternBrush

• 0x44d0f4 CreateSolidBrush

• 0x44d0f8 GetTextColor

• 0x44d0fc CreateRectRgnIndirect

• 0x44d100 SetRectRgn

• 0x44d104 CombineRgn

• 0x44d108 GetMapMode

• 0x44d10c GetRgnBox

• 0x44d110 GetNearestColor

• 0x44d114 GetBkMode

• 0x44d118 GetPolyFillMode

• 0x44d11c GetROP2

• 0x44d120 GetStretchBltMode

• 0x44d124 GetTextAlign

• 0x44d128 GetTextFaceA

• 0x44d12c GetWindowOrgEx

• 0x44d130 StartPage

• 0x44d134 StartDocA

• 0x44d138 GetStockObject

• 0x44d13c PatBlt

• 0x44d140 Rectangle

• 0x44d144 DPtoLP

• 0x44d148 GetViewportOrgEx

• 0x44d14c CreatePen

• 0x44d150 CreateFontA

• 0x44d154 GetCharWidthA

• 0x44d158 DeleteObject

• 0x44d15c StretchDIBits

• 0x44d160 DeleteDC

• 0x44d164 GetTextExtentPoint32A

• 0x44d168 GetTextMetricsA

• 0x44d16c SelectObject

• 0x44d170 GetBkColor

• 0x44d174 CreateCompatibleDC

• 0x44d178 CreateCompatibleBitmap

• 0x44d17c CreateDCA

• 0x44d180 GetDeviceCaps

• 0x44d184 CreateBitmap

• 0x44d188 GetObjectA

• 0x44d18c SetBkColor

• 0x44d190 SetTextColor

• 0x44d194 OffsetViewportOrgEx

• 0x44d198 GetClipBox

Library comdlg32.dll:

• 0x44d6f4 GetFileTitleA

• 0x44d6f8 PrintDlgA

• 0x44d6fc GetSaveFileNameA

• 0x44d700 CommDlgExtendedError

• 0x44d704 GetOpenFileNameA

Library WINSPOOL.DRV:

• 0x44d6e0 OpenPrinterA

• 0x44d6e4 DocumentPropertiesA

• 0x44d6e8 ClosePrinter

• 0x44d6ec GetJobA

Library ADVAPI32.dll:

• 0x44d000 GetFileSecurityA

• 0x44d004 RegCloseKey

• 0x44d008 RegSetValueA

• 0x44d00c RegOpenKeyA

• 0x44d010 RegQueryValueExA

• 0x44d014 RegOpenKeyExA

• 0x44d018 RegDeleteKeyA

• 0x44d01c RegEnumKeyA

• 0x44d020 RegQueryValueA

• 0x44d024 RegCreateKeyExA

• 0x44d028 RegSetValueExA

• 0x44d02c RegCreateKeyA

• 0x44d030 CryptAcquireContextA

• 0x44d034 SetFileSecurityA

• 0x44d038 RegDeleteValueA

Library SHELL32.dll:

• 0x44d410 DragQueryFileA

• 0x44d414 ExtractIconA

• 0x44d418 SHGetFileInfoA

• 0x44d41c DragFinish

Library COMCTL32.dll:

• 0x44d040

• 0x44d044 ImageList_Draw

• 0x44d048 ImageList_GetImageInfo

• 0x44d04c ImageList_Destroy

Library SHLWAPI.dll:

• 0x44d424 PathFindFileNameA

• 0x44d428 PathStripToRootA

• 0x44d42c PathFindExtensionA

• 0x44d430 PathIsUNCA

Library oledlg.dll:

• 0x44d75c

Library ole32.dll:

• 0x44d70c CoRevokeClassObject

• 0x44d710 OleIsCurrentClipboard

• 0x44d714 OleFlushClipboard

• 0x44d718 CoRegisterMessageFilter

• 0x44d71c OleTranslateAccelerator

• 0x44d720 CreateILockBytesOnHGlobal

• 0x44d724 StgCreateDocfileOnILockBytes

• 0x44d728 StgOpenStorageOnILockBytes

• 0x44d72c CoGetClassObject

• 0x44d730 CoTaskMemAlloc

• 0x44d734 CoTaskMemFree

• 0x44d738 CLSIDFromString

• 0x44d73c CLSIDFromProgID

• 0x44d740 OleInitialize

• 0x44d744 CoFreeUnusedLibraries

• 0x44d748 OleUninitialize

• 0x44d74c OleDestroyMenuDescriptor

• 0x44d750 OleCreateMenuDescriptor

• 0x44d754 IsAccelerator

Library OLEAUT32.dll:

• 0x44d3dc VariantClear

• 0x44d3e0 VariantInit

• 0x44d3e4 SysAllocStringLen

• 0x44d3e8 SysFreeString

• 0x44d3ec SysAllocString

• 0x44d3f0 SysStringLen

• 0x44d3f4 SysAllocStringByteLen

• 0x44d3f8 VariantCopy

• 0x44d3fc SafeArrayDestroy

• 0x44d400 SystemTimeToVariantTime

• 0x44d404 OleCreateFontIndirect

• 0x44d408 VariantChangeType

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142 A 172.217.160.78	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.41.98	203.208.41.34
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49192	203.208.41.98 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	54991	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	54260	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56743	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57236	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.