10.6
0-day
60 个模型检测该样本为恶意！
重新分析
更多

761e94e205b3928ebc9330f5ba1c779e098e0a4e83ec3f7eea1a4ad1f480e675

c228e15ec3356c8d12f3eb69a4110b67.exe

分析耗时

141s

最近分析

文件大小

1.9MB
静态报毒 动态报毒 100% AI SCORE=86 BHOQF BSCOPE CLOUD CONFIDENCE DARKKOMET DE@74B38H DELF DOWNLOADER22 FAZBWQ GENCIRC GENERICKD GENERICRXCB GENETIC HACKTOOL HIGH HIGH CONFIDENCE HQXY MALICIOUS PE NAPWHICH NOCIVO OAZM OPTIX QHTQQ SCORE SUSGEN SYNAPTICS UNSAFE VMPROTBAD X1799 ZOREX 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXCB-VC!C228E15EC335 20200215 6.0.6.653
Alibaba 20190527 0.3.0.5
Avast Win32:Trojan-gen 20200215 18.4.3895.0
Tencent Malware.Win32.Gencirc.10b8ace3 20200215 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200215 2013.8.14.323
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1621003187.788396
IsDebuggerPresent
failed 0 0
Uses Windows APIs to generate a cryptographic key (20 个事件)
Time & API Arguments Status Return Repeated
1621003212.631396
CryptExportKey
crypto_handle: 0x000000001adb8720
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003229.897396
CryptExportKey
crypto_handle: 0x000000001adcbd40
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003229.928396
CryptExportKey
crypto_handle: 0x000000001adcbd40
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003229.975396
CryptExportKey
crypto_handle: 0x000000001adcbd40
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003231.835396
CryptExportKey
crypto_handle: 0x000000001adcbd40
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003231.881396
CryptExportKey
crypto_handle: 0x000000001adcbd40
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003231.928396
CryptExportKey
crypto_handle: 0x000000001adcbd40
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003232.678396
CryptExportKey
crypto_handle: 0x000000001adcbd40
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003248.335396
CryptExportKey
crypto_handle: 0x000000001ade2f60
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003248.350396
CryptExportKey
crypto_handle: 0x000000001ade2f60
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003248.397396
CryptExportKey
crypto_handle: 0x000000001ade2fd0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003248.475396
CryptExportKey
crypto_handle: 0x000000001ade2fd0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003248.538396
CryptExportKey
crypto_handle: 0x000000001ade2fd0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003248.694396
CryptExportKey
crypto_handle: 0x000000001ade2fd0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003248.710396
CryptExportKey
crypto_handle: 0x000000001ade2fd0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003248.803396
CryptExportKey
crypto_handle: 0x000000001ade2fd0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003248.835396
CryptExportKey
crypto_handle: 0x000000001ade30b0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003248.835396
CryptExportKey
crypto_handle: 0x000000001ade30b0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003254.303396
CryptExportKey
crypto_handle: 0x000000001ade30b0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1621003254.319396
CryptExportKey
crypto_handle: 0x000000001ade30b0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1621003611.76925
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (4 个事件)
Time & API Arguments Status Return Repeated
1621003642.066875
__exception__
stacktrace: 
synaptics+0x1dc41 @ 0x41dc41
synaptics+0x1db79 @ 0x41db79
synaptics+0x1cbc2 @ 0x41cbc2
synaptics+0x763b8 @ 0x4763b8
synaptics+0x7648f @ 0x47648f
synaptics+0x9a2a5 @ 0x49a2a5
synaptics+0x9a59a @ 0x49a59a
synaptics+0x9a6b1 @ 0x49a6b1
synaptics+0x52fdf @ 0x452fdf
synaptics+0x5a6c8 @ 0x45a6c8
synaptics+0x9abc5 @ 0x49abc5
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637400
registers.edi: 31981567
registers.eax: 1637400
registers.ebp: 1637480
registers.edx: 0
registers.ebx: 31928392
registers.esi: 31932424
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1621003654.675875
__exception__
stacktrace: 
synaptics+0x81a9b @ 0x481a9b
synaptics+0x81c7b @ 0x481c7b
synaptics+0x845fd @ 0x4845fd
synaptics+0x959fc @ 0x4959fc
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 59309572
registers.edi: 125
registers.eax: 59309572
registers.ebp: 59309652
registers.edx: 0
registers.ebx: 31932928
registers.esi: 125
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1621003661.441875
__exception__
stacktrace: 
synaptics+0x7bda4 @ 0x47bda4
synaptics+0x7bcf2 @ 0x47bcf2
synaptics+0x7bcb3 @ 0x47bcb3
synaptics+0x845fd @ 0x4845fd
synaptics+0x95a83 @ 0x495a83
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 59307384
registers.edi: 59307572
registers.eax: 59307384
registers.ebp: 59307464
registers.edx: 0
registers.ebx: 4703484
registers.esi: 11004
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1621003673.550875
__exception__
stacktrace: 
synaptics+0x81a9b @ 0x481a9b
synaptics+0x81c7b @ 0x481c7b
synaptics+0x845fd @ 0x4845fd
synaptics+0x95b0a @ 0x495b0a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 59305236
registers.edi: 125
registers.eax: 59305236
registers.ebp: 59305316
registers.edx: 0
registers.ebx: 31932928
registers.esi: 125
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
行为判定
动态指标
Connects to a Dynamic DNS Domain (1 个事件)
domain xred.mooo.com
Performs some HTTP requests (1 个事件)
request GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Allocates read-write-execute memory (usually to unpack itself) (50 out of 140 个事件)
Time & API Arguments Status Return Repeated
1621003598.286
NtAllocateVirtualMemory
process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1621003184.366396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 2490368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x0000000000780000
success 0 0
1621003184.366396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000000960000
success 0 0
1621003186.819396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1bc1000
success 0 0
1621003187.553396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3e000
success 0 0
1621003187.553396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3e000
success 0 0
1621003187.850396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3f000
success 0 0
1621003187.850396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3f000
success 0 0
1621003187.850396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3f000
success 0 0
1621003187.850396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3f000
success 0 0
1621003187.850396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3f000
success 0 0
1621003187.866396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3f000
success 0 0
1621003187.881396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3f000
success 0 0
1621003187.881396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3f000
success 0 0
1621003187.897396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e40000
success 0 0
1621003187.897396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e40000
success 0 0
1621003187.913396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e40000
success 0 0
1621003187.913396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e40000
success 0 0
1621003187.928396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e40000
success 0 0
1621003187.928396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e41000
success 0 0
1621003187.928396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e41000
success 0 0
1621003187.928396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e41000
success 0 0
1621003187.928396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e41000
success 0 0
1621003187.944396
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef1e3e000
success 0 0
1621003189.600396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00032000
success 0 0
1621003189.835396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x000007fffff10000
success 0 0
1621003189.835396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007fffff10000
success 0 0
1621003189.835396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007fffff10000
success 0 0
1621003189.835396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x000007fffff00000
success 0 0
1621003189.835396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007fffff00000
success 0 0
1621003189.850396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000ea000
success 0 0
1621003189.897396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00022000
success 0 0
1621003190.553396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00033000
success 0 0
1621003190.710396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000fa000
success 0 0
1621003190.725396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00122000
success 0 0
1621003190.741396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000fd000
success 0 0
1621003191.085396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff0003c000
success 0 0
1621003193.460396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00170000
success 0 0
1621003196.616396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000eb000
success 0 0
1621003205.710396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00034000
success 0 0
1621003210.913396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000e2000
success 0 0
1621003211.147396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff0004f000
success 0 0
1621003211.147396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00084000
success 0 0
1621003211.147396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00053000
success 0 0
1621003211.163396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00035000
success 0 0
1621003212.475396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff001b0000
success 0 0
1621003214.616396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00036000
success 0 0
1621003216.475396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00023000
success 0 0
1621003223.741396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00037000
success 0 0
1621003224.881396
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000e3000
success 0 0
Foreign language identified in PE resource (12 个事件)
name RT_ICON language LANG_TURKISH offset 0x000b39f8 filetype dBase IV DBT of @.DBF, block length 8192, next free block index 40 sublanguage SUBLANG_DEFAULT size 0x000010a8
name RT_ICON language LANG_TURKISH offset 0x000b39f8 filetype dBase IV DBT of @.DBF, block length 8192, next free block index 40 sublanguage SUBLANG_DEFAULT size 0x000010a8
name RT_RCDATA language LANG_TURKISH offset 0x001ee1b8 filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT size 0x000047d3
name RT_RCDATA language LANG_TURKISH offset 0x001ee1b8 filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT size 0x000047d3
name RT_RCDATA language LANG_TURKISH offset 0x001ee1b8 filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT size 0x000047d3
name RT_RCDATA language LANG_TURKISH offset 0x001ee1b8 filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT size 0x000047d3
name RT_RCDATA language LANG_TURKISH offset 0x001ee1b8 filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT size 0x000047d3
name RT_RCDATA language LANG_TURKISH offset 0x001ee1b8 filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT size 0x000047d3
name RT_RCDATA language LANG_TURKISH offset 0x001ee1b8 filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT size 0x000047d3
name RT_RCDATA language LANG_TURKISH offset 0x001ee1b8 filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT size 0x000047d3
name RT_GROUP_ICON language LANG_TURKISH offset 0x001f2a18 filetype data sublanguage SUBLANG_DEFAULT size 0x00000014
name RT_VERSION language LANG_TURKISH offset 0x001f2a2c filetype data sublanguage SUBLANG_DEFAULT size 0x00000304
Creates executable files on the filesystem (6 个事件)
file C:\Users\Public\Music\CefView.exe
file C:\Users\Public\Music\S.exe
file C:\Users\Public\Music\CefView.lnk
file C:\Users\Public\Music\7z.exe
file C:\Users\Public\Music\libcef.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\._cache_c228e15ec3356c8d12f3eb69a4110b67.exe
Creates a shortcut to an executable file (1 个事件)
file C:\Users\Public\Music\CefView.lnk
Drops a binary and executes it (1 个事件)
file C:\Users\Public\Music\S.exe
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1621003612.42525
ShellExecuteExW
parameters:
filepath: C:\Users\Public\Music\CefView.exe
filepath_r: C:\Users\Public\Music\CefView.exe
show_type: 0
success 1 0
1621003613.26925
ShellExecuteExW
parameters:
filepath: C:\Users\Public\Music\S.exe
filepath_r: C:\Users\Public\Music\S.exe
show_type: 0
success 1 0
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1621003613.02
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 651264
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x10001000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1621003655.300875
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.861731635629077 section {'size_of_data': '0x00142e00', 'virtual_address': '0x000b0000', 'entropy': 7.861731635629077, 'name': '.rsrc', 'virtual_size': '0x00142d30'} description A section with a high entropy has been found
entropy 0.6547528517110266 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1621003613.145
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 122.51.38.68
host 172.217.24.14
Installs itself for autorun at Windows startup (1 个事件)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver reg_value C:\ProgramData\Synaptics\Synaptics.exe
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1621003657.910875
RegSetValueExA
key_handle: 0x000003d8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1621003657.910875
RegSetValueExA
key_handle: 0x000003d8
value: ar¬ÕH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1621003657.910875
RegSetValueExA
key_handle: 0x000003d8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1621003657.910875
RegSetValueExW
key_handle: 0x000003d8
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1621003657.925875
RegSetValueExA
key_handle: 0x000003f0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1621003657.925875
RegSetValueExA
key_handle: 0x000003f0
value: ar¬ÕH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1621003657.925875
RegSetValueExA
key_handle: 0x000003f0
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1621003658.019875
RegSetValueExW
key_handle: 0x000003d4
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1621003658.878875
RegSetValueExA
key_handle: 0x00000454
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1621003658.894875
RegSetValueExA
key_handle: 0x00000454
value:  <­ÕH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1621003658.894875
RegSetValueExA
key_handle: 0x00000454
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1621003658.894875
RegSetValueExW
key_handle: 0x00000454
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1621003658.894875
RegSetValueExA
key_handle: 0x00000458
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1621003658.894875
RegSetValueExA
key_handle: 0x00000458
value:  <­ÕH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1621003658.894875
RegSetValueExA
key_handle: 0x00000458
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
DrWeb Trojan.DownLoader22.9658
MicroWorld-eScan Dropped:Trojan.GenericKD.33223042
FireEye Generic.mg.c228e15ec3356c8d
CAT-QuickHeal Sus.Nocivo.E0011
McAfee GenericRXCB-VC!C228E15EC335
Cylance Unsafe
VIPRE BehavesLike.Win32.Malware.eah (mx-v)
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
K7GW Riskware ( 0040eff71 )
Cybereason malicious.ec3356
Arcabit HEUR.VBA.Trojan.d
TrendMicro Virus.Win32.NAPWHICH.B
BitDefenderTheta AI:Packer.F5AF03D517
F-Prot W32/Zorex.A
TrendMicro-HouseCall Virus.Win32.NAPWHICH.B
Avast Win32:Trojan-gen
ClamAV Win.Malware.Delf-6899401-0
Kaspersky Backdoor.Win32.DarkKomet.hqxy
BitDefender Dropped:Trojan.GenericKD.33223042
NANO-Antivirus Trojan.Win32.DarkKomet.fazbwq
Paloalto generic.ml
Tencent Malware.Win32.Gencirc.10b8ace3
Ad-Aware Dropped:Trojan.GenericKD.33223042
Emsisoft Dropped:Trojan.GenericKD.33223042 (B)
Comodo Virus.Win32.Agent.DE@74b38h
F-Secure Trojan:W97M/MaliciousMacro.GEN
Zillya Trojan.Delf.Win32.76144
Invincea heuristic
McAfee-GW-Edition BehavesLike.Win32.Dropper.tc
Trapmine malicious.high.ml.score
Sophos Mal/VMProtBad-A
Ikarus Virus.Win32.Delf
Cyren W32/Backdoor.OAZM-5661
Jiangmin Trojan.Generic.bhoqf
Webroot W32.Malware.gen
Avira TR/Injector.qhtqq
Antiy-AVL HackTool[VirTool]/Win32.Obfuscator
Microsoft Worm:Win32/AutoRun.XXY!bit
Endgame malicious (high confidence)
ZoneAlarm Backdoor.Win32.DarkKomet.hqxy
GData Dropped:Trojan.GenericKD.33223042
AhnLab-V3 Win32/Zorex.X1799
Acronis suspicious
VBA32 BScope.Backdoor.DarkKomet
ALYac Dropped:Trojan.GenericKD.33223042
MAX malware (ai score=86)
Malwarebytes Trojan.Agent
APEX Malicious
ESET-NOD32 Win32/Delf.NBX
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)
dead_host 172.217.24.14:443
dead_host 216.58.200.238:443
dead_host 122.51.38.68:7777
dead_host 77.4.7.92:1199
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4a01dc VirtualFree
• 0x4a01e0 VirtualAlloc
• 0x4a01e4 LocalFree
• 0x4a01e8 LocalAlloc
• 0x4a01ec GetTickCount
• 0x4a01f4 GetVersion
• 0x4a01f8 GetCurrentThreadId
• 0x4a0204 VirtualQuery
• 0x4a0208 WideCharToMultiByte
• 0x4a0210 MultiByteToWideChar
• 0x4a0214 lstrlenA
• 0x4a0218 lstrcpynA
• 0x4a021c LoadLibraryExA
• 0x4a0220 GetThreadLocale
• 0x4a0224 GetStartupInfoA
• 0x4a0228 GetProcAddress
• 0x4a022c GetModuleHandleA
• 0x4a0230 GetModuleFileNameA
• 0x4a0234 GetLocaleInfoA
• 0x4a0238 GetLastError
• 0x4a0240 GetCommandLineA
• 0x4a0244 FreeLibrary
• 0x4a0248 FindFirstFileA
• 0x4a024c FindClose
• 0x4a0250 ExitProcess
• 0x4a0254 ExitThread
• 0x4a0258 CreateThread
• 0x4a025c WriteFile
• 0x4a0264 SetFilePointer
• 0x4a0268 SetEndOfFile
• 0x4a026c RtlUnwind
• 0x4a0270 ReadFile
• 0x4a0274 RaiseException
• 0x4a0278 GetStdHandle
• 0x4a027c GetFileSize
• 0x4a0280 GetFileType
• 0x4a0284 CreateFileA
• 0x4a0288 CloseHandle
Library user32.dll:
• 0x4a0290 GetKeyboardType
• 0x4a0294 LoadStringA
• 0x4a0298 MessageBoxA
• 0x4a029c CharNextA
Library advapi32.dll:
• 0x4a02a4 RegQueryValueExA
• 0x4a02a8 RegOpenKeyExA
• 0x4a02ac RegCloseKey
Library oleaut32.dll:
• 0x4a02b4 SysFreeString
• 0x4a02b8 SysReAllocStringLen
• 0x4a02bc SysAllocStringLen
Library kernel32.dll:
• 0x4a02c4 TlsSetValue
• 0x4a02c8 TlsGetValue
• 0x4a02cc LocalAlloc
• 0x4a02d0 GetModuleHandleA
Library advapi32.dll:
• 0x4a02d8 RegSetValueExA
• 0x4a02dc RegQueryValueExA
• 0x4a02e0 RegOpenKeyExA
• 0x4a02e8 RegFlushKey
• 0x4a02ec RegDeleteValueA
• 0x4a02f0 RegCreateKeyExA
• 0x4a02f4 RegCloseKey
• 0x4a02f8 OpenProcessToken
• 0x4a0300 GetUserNameA
Library kernel32.dll:
• 0x4a030c lstrcpyA
• 0x4a0314 WriteFile
• 0x4a0318 WaitForSingleObject
• 0x4a0320 VirtualQuery
• 0x4a0324 VirtualAlloc
• 0x4a0328 UpdateResourceA
• 0x4a032c UnmapViewOfFile
• 0x4a0330 TerminateProcess
• 0x4a0334 Sleep
• 0x4a0338 SizeofResource
• 0x4a033c SetThreadLocale
• 0x4a0340 SetFilePointer
• 0x4a0344 SetFileAttributesA
• 0x4a0348 SetEvent
• 0x4a034c SetErrorMode
• 0x4a0350 SetEndOfFile
• 0x4a0354 ResumeThread
• 0x4a0358 ResetEvent
• 0x4a035c RemoveDirectoryA
• 0x4a0360 ReadFile
• 0x4a0364 OpenProcess
• 0x4a0368 OpenMutexA
• 0x4a036c MultiByteToWideChar
• 0x4a0370 MulDiv
• 0x4a0374 MoveFileA
• 0x4a0378 MapViewOfFile
• 0x4a037c LockResource
• 0x4a0380 LoadResource
• 0x4a0384 LoadLibraryA
• 0x4a0390 GlobalUnlock
• 0x4a0394 GlobalReAlloc
• 0x4a0398 GlobalHandle
• 0x4a039c GlobalLock
• 0x4a03a0 GlobalFree
• 0x4a03a4 GlobalFindAtomA
• 0x4a03a8 GlobalDeleteAtom
• 0x4a03ac GlobalAlloc
• 0x4a03b0 GlobalAddAtomA
• 0x4a03b4 GetVersionExA
• 0x4a03b8 GetVersion
• 0x4a03c0 GetTickCount
• 0x4a03c4 GetThreadLocale
• 0x4a03c8 GetTempPathA
• 0x4a03cc GetTempFileNameA
• 0x4a03d0 GetSystemInfo
• 0x4a03d4 GetSystemDirectoryA
• 0x4a03d8 GetStringTypeExA
• 0x4a03dc GetStdHandle
• 0x4a03e0 GetProcAddress
• 0x4a03e8 GetModuleHandleA
• 0x4a03ec GetModuleFileNameA
• 0x4a03f0 GetLogicalDrives
• 0x4a03f4 GetLocaleInfoA
• 0x4a03f8 GetLocalTime
• 0x4a03fc GetLastError
• 0x4a0400 GetFullPathNameA
• 0x4a0404 GetFileSize
• 0x4a0408 GetFileAttributesA
• 0x4a040c GetExitCodeThread
• 0x4a0410 GetDriveTypeA
• 0x4a0414 GetDiskFreeSpaceA
• 0x4a0418 GetDateFormatA
• 0x4a041c GetCurrentThreadId
• 0x4a0420 GetCurrentProcessId
• 0x4a0424 GetCurrentProcess
• 0x4a0428 GetComputerNameA
• 0x4a042c GetCPInfo
• 0x4a0430 GetACP
• 0x4a0434 FreeResource
• 0x4a043c InterlockedExchange
• 0x4a0444 FreeLibrary
• 0x4a0448 FormatMessageA
• 0x4a044c FindResourceA
• 0x4a0450 FindNextFileA
• 0x4a0454 FindFirstFileA
• 0x4a0458 FindClose
• 0x4a0464 EnumCalendarInfoA
• 0x4a046c EndUpdateResourceA
• 0x4a0470 DeleteFileA
• 0x4a0478 CreateThread
• 0x4a047c CreateProcessA
• 0x4a0480 CreatePipe
• 0x4a0484 CreateMutexA
• 0x4a0488 CreateFileMappingA
• 0x4a048c CreateFileA
• 0x4a0490 CreateEventA
• 0x4a0494 CreateDirectoryA
• 0x4a0498 CopyFileA
• 0x4a049c CompareStringA
• 0x4a04a0 CloseHandle
Library version.dll:
• 0x4a04ac VerQueryValueA
• 0x4a04b4 GetFileVersionInfoA
Library gdi32.dll:
• 0x4a04bc UnrealizeObject
• 0x4a04c0 StretchBlt
• 0x4a04c4 SetWindowOrgEx
• 0x4a04c8 SetWinMetaFileBits
• 0x4a04cc SetViewportOrgEx
• 0x4a04d0 SetTextColor
• 0x4a04d4 SetStretchBltMode
• 0x4a04d8 SetROP2
• 0x4a04dc SetPixel
• 0x4a04e0 SetEnhMetaFileBits
• 0x4a04e4 SetDIBColorTable
• 0x4a04e8 SetBrushOrgEx
• 0x4a04ec SetBkMode
• 0x4a04f0 SetBkColor
• 0x4a04f4 SelectPalette
• 0x4a04f8 SelectObject
• 0x4a04fc SaveDC
• 0x4a0500 RestoreDC
• 0x4a0504 RectVisible
• 0x4a0508 RealizePalette
• 0x4a050c PlayEnhMetaFile
• 0x4a0510 PatBlt
• 0x4a0514 MoveToEx
• 0x4a0518 MaskBlt
• 0x4a051c LineTo
• 0x4a0520 IntersectClipRect
• 0x4a0524 GetWindowOrgEx
• 0x4a0528 GetWinMetaFileBits
• 0x4a052c GetTextMetricsA
• 0x4a0538 GetStockObject
• 0x4a053c GetPixel
• 0x4a0540 GetPaletteEntries
• 0x4a0544 GetObjectA
• 0x4a0550 GetEnhMetaFileBits
• 0x4a0554 GetDeviceCaps
• 0x4a0558 GetDIBits
• 0x4a055c GetDIBColorTable
• 0x4a0560 GetDCOrgEx
• 0x4a0568 GetClipBox
• 0x4a056c GetBrushOrgEx
• 0x4a0570 GetBitmapBits
• 0x4a0574 GdiFlush
• 0x4a0578 ExcludeClipRect
• 0x4a057c DeleteObject
• 0x4a0580 DeleteEnhMetaFile
• 0x4a0584 DeleteDC
• 0x4a0588 CreateSolidBrush
• 0x4a058c CreatePenIndirect
• 0x4a0590 CreatePalette
• 0x4a0598 CreateFontIndirectA
• 0x4a059c CreateDIBitmap
• 0x4a05a0 CreateDIBSection
• 0x4a05a4 CreateCompatibleDC
• 0x4a05ac CreateBrushIndirect
• 0x4a05b0 CreateBitmap
• 0x4a05b4 CopyEnhMetaFileA
• 0x4a05b8 BitBlt
Library user32.dll:
• 0x4a05c0 CreateWindowExA
• 0x4a05c4 WindowFromPoint
• 0x4a05c8 WinHelpA
• 0x4a05cc WaitMessage
• 0x4a05d0 UpdateWindow
• 0x4a05d4 UnregisterClassA
• 0x4a05d8 UnhookWindowsHookEx
• 0x4a05dc TranslateMessage
• 0x4a05e4 TrackPopupMenu
• 0x4a05e8 ToAsciiEx
• 0x4a05f0 ShowWindow
• 0x4a05f4 ShowScrollBar
• 0x4a05f8 ShowOwnedPopups
• 0x4a05fc ShowCursor
• 0x4a0600 SetWindowsHookExA
• 0x4a0604 SetWindowTextA
• 0x4a0608 SetWindowPos
• 0x4a060c SetWindowPlacement
• 0x4a0610 SetWindowLongA
• 0x4a0614 SetTimer
• 0x4a0618 SetScrollRange
• 0x4a061c SetScrollPos
• 0x4a0620 SetScrollInfo
• 0x4a0624 SetRect
• 0x4a0628 SetPropA
• 0x4a062c SetParent
• 0x4a0630 SetMenuItemInfoA
• 0x4a0634 SetMenu
• 0x4a0638 SetForegroundWindow
• 0x4a063c SetFocus
• 0x4a0640 SetCursor
• 0x4a0644 SetClassLongA
• 0x4a0648 SetCapture
• 0x4a064c SetActiveWindow
• 0x4a0650 SendMessageA
• 0x4a0654 ScrollWindow
• 0x4a0658 ScreenToClient
• 0x4a065c RemovePropA
• 0x4a0660 RemoveMenu
• 0x4a0664 ReleaseDC
• 0x4a0668 ReleaseCapture
• 0x4a0674 RegisterClassA
• 0x4a0678 RedrawWindow
• 0x4a067c PtInRect
• 0x4a0680 PostQuitMessage
• 0x4a0684 PostMessageA
• 0x4a0688 PeekMessageA
• 0x4a068c OffsetRect
• 0x4a0690 OemToCharA
• 0x4a0698 MessageBoxA
• 0x4a069c MapWindowPoints
• 0x4a06a0 MapVirtualKeyExA
• 0x4a06a4 MapVirtualKeyA
• 0x4a06a8 LoadStringA
• 0x4a06ac LoadKeyboardLayoutA
• 0x4a06b0 LoadIconA
• 0x4a06b4 LoadCursorA
• 0x4a06b8 LoadBitmapA
• 0x4a06bc KillTimer
• 0x4a06c0 IsZoomed
• 0x4a06c4 IsWindowVisible
• 0x4a06c8 IsWindowEnabled
• 0x4a06cc IsWindow
• 0x4a06d0 IsRectEmpty
• 0x4a06d4 IsIconic
• 0x4a06d8 IsDialogMessageA
• 0x4a06dc IsChild
• 0x4a06e0 InvalidateRect
• 0x4a06e4 IntersectRect
• 0x4a06e8 InsertMenuItemA
• 0x4a06ec InsertMenuA
• 0x4a06f0 InflateRect
• 0x4a06fc GetWindowTextA
• 0x4a0700 GetWindowRect
• 0x4a0704 GetWindowPlacement
• 0x4a0708 GetWindowLongA
• 0x4a070c GetWindowDC
• 0x4a0710 GetTopWindow
• 0x4a0714 GetSystemMetrics
• 0x4a0718 GetSystemMenu
• 0x4a071c GetSysColorBrush
• 0x4a0720 GetSysColor
• 0x4a0724 GetSubMenu
• 0x4a0728 GetScrollRange
• 0x4a072c GetScrollPos
• 0x4a0730 GetScrollInfo
• 0x4a0734 GetPropA
• 0x4a0738 GetParent
• 0x4a073c GetWindow
• 0x4a0740 GetMenuStringA
• 0x4a0744 GetMenuState
• 0x4a0748 GetMenuItemInfoA
• 0x4a074c GetMenuItemID
• 0x4a0750 GetMenuItemCount
• 0x4a0754 GetMenu
• 0x4a0758 GetLastActivePopup
• 0x4a075c GetKeyboardState
• 0x4a0764 GetKeyboardLayout
• 0x4a0768 GetKeyState
• 0x4a076c GetKeyNameTextA
• 0x4a0770 GetIconInfo
• 0x4a0774 GetForegroundWindow
• 0x4a0778 GetFocus
• 0x4a077c GetDesktopWindow
• 0x4a0780 GetDCEx
• 0x4a0784 GetDC
• 0x4a0788 GetCursorPos
• 0x4a078c GetCursor
• 0x4a0790 GetClipboardData
• 0x4a0794 GetClientRect
• 0x4a0798 GetClassNameA
• 0x4a079c GetClassInfoA
• 0x4a07a0 GetCapture
• 0x4a07a4 GetActiveWindow
• 0x4a07a8 FrameRect
• 0x4a07ac FindWindowA
• 0x4a07b0 FillRect
• 0x4a07b4 EqualRect
• 0x4a07b8 EnumWindows
• 0x4a07bc EnumThreadWindows
• 0x4a07c0 EndPaint
• 0x4a07c4 EnableWindow
• 0x4a07c8 EnableScrollBar
• 0x4a07cc EnableMenuItem
• 0x4a07d0 DrawTextA
• 0x4a07d4 DrawMenuBar
• 0x4a07d8 DrawIconEx
• 0x4a07dc DrawIcon
• 0x4a07e0 DrawFrameControl
• 0x4a07e4 DrawEdge
• 0x4a07e8 DispatchMessageA
• 0x4a07ec DestroyWindow
• 0x4a07f0 DestroyMenu
• 0x4a07f4 DestroyIcon
• 0x4a07f8 DestroyCursor
• 0x4a07fc DeleteMenu
• 0x4a0800 DefWindowProcA
• 0x4a0804 DefMDIChildProcA
• 0x4a0808 DefFrameProcA
• 0x4a080c CreatePopupMenu
• 0x4a0810 CreateMenu
• 0x4a0814 CreateIcon
• 0x4a0818 ClientToScreen
• 0x4a081c CheckMenuItem
• 0x4a0820 CallWindowProcA
• 0x4a0824 CallNextHookEx
• 0x4a0828 BeginPaint
• 0x4a082c CharNextA
• 0x4a0830 CharLowerBuffA
• 0x4a0834 CharLowerA
• 0x4a0838 CharUpperBuffA
• 0x4a083c CharToOemA
• 0x4a0840 AdjustWindowRectEx
Library ole32.dll:
• 0x4a084c CLSIDFromString
Library kernel32.dll:
• 0x4a0854 Sleep
Library oleaut32.dll:
• 0x4a085c SafeArrayPtrOfIndex
• 0x4a0860 SafeArrayGetUBound
• 0x4a0864 SafeArrayGetLBound
• 0x4a0868 SafeArrayCreate
• 0x4a086c VariantChangeType
• 0x4a0870 VariantCopyInd
• 0x4a0874 VariantCopy
• 0x4a0878 VariantClear
• 0x4a087c VariantInit
Library ole32.dll:
• 0x4a0884 CLSIDFromProgID
• 0x4a0888 CoCreateInstance
• 0x4a088c CoUninitialize
• 0x4a0890 CoInitialize
Library oleaut32.dll:
• 0x4a0898 GetErrorInfo
• 0x4a089c SysFreeString
Library comctl32.dll:
• 0x4a08ac ImageList_Write
• 0x4a08b0 ImageList_Read
• 0x4a08c0 ImageList_DragMove
• 0x4a08c4 ImageList_DragLeave
• 0x4a08c8 ImageList_DragEnter
• 0x4a08cc ImageList_EndDrag
• 0x4a08d0 ImageList_BeginDrag
• 0x4a08d4 ImageList_Remove
• 0x4a08d8 ImageList_DrawEx
• 0x4a08dc ImageList_Draw
• 0x4a08ec ImageList_Add
• 0x4a08f4 ImageList_Destroy
• 0x4a08f8 ImageList_Create
Library shell32.dll:
• 0x4a0900 ShellExecuteExA
• 0x4a0904 ExtractIconExW
Library wininet.dll:
• 0x4a0910 InternetReadFile
• 0x4a0914 InternetOpenUrlA
• 0x4a0918 InternetOpenA
• 0x4a091c InternetCloseHandle
Library shell32.dll:
• 0x4a092c SHGetMalloc
• 0x4a0930 SHGetDesktopFolder
Library advapi32.dll:
• 0x4a0938 OpenSCManagerA
• 0x4a093c CloseServiceHandle

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49194 69.42.215.252 freedns.afraid.org 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 54178 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 63497 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60215 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 
GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
User-Agent: MyApp
Host: freedns.afraid.org
Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.