SmartHawk

6.8

高危

55 个模型检测该样本为恶意！

重新分析

下载样本

c303fb93eba5623184f5bfb8fefbea2458e25ead795e6d5c5d5e78e921c6490e

c4dc14e8754c36300ae98fa8b4369a40.exe

分析耗时

42s

最近分析

文件大小

876.5KB

静态报毒动态报毒 100% 2GX@ASCG6VFI AI SCORE=83 BTGZIH CLOUD CONFIDENCE DELF DELPHILESS ELUS FAREIT FORMBOOK HJZMHP IGENT KRYPTIK MALICIOUS PE MALWARE@#2PVIG9UHIC5GQ MODERATE SCORE SIGGEN9 SIMDA SUSGEN THEOIBO TSCOPE UNSAFE WACATAC WAHT X2059 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FSK!C4DC14E8754C	20200519	6.0.6.653
Alibaba	Trojan:Win32/Kryptik.3478e569	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20200519	18.4.3895.0
Tencent		20200519	1.0.0.1
Kingsoft		20200519	2013.8.14.323

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619943911.09675 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34602816 registers.edi: 0 registers.eax: 0 registers.ebp: 34602888 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 1950559753 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 56 e9 25 46 f7 exception.symbol: c4dc14e8754c36300ae98fa8b4369a40+0x8f276 exception.instruction: div eax exception.module: c4dc14e8754c36300ae98fa8b4369a40.exe exception.exception_code: 0xc0000094 exception.offset: 586358 exception.address: 0x48f276	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (4 个事件)

Time & API	Arguments	Status
1619943910.98775 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619943911.09675 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01fb0000	success
1619943911.12775 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02110000	success
1619943911.707125 NtAllocateVirtualMemory	process_identifier: 2852 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x007c0000	success

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.5026998517206955

section

{'size_of_data': '0x0000b000', 'virtual_address': '0x00090000', 'entropy': 7.5026998517206955, 'name': 'DATA', 'virtual_size': '0x0000afec'}

description

A section with a high entropy has been found

entropy

7.345570460071091

section

{'size_of_data': '0x00033200', 'virtual_address': '0x000ad000', 'entropy': 7.345570460071091, 'name': '.rsrc', 'virtual_size': '0x000331e8'}

description

A section with a high entropy has been found

entropy

0.284

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (2 个事件)

host	113.108.239.196
host	172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1320 called NtSetContextThread to modify thread in remote process 2852
1619943911.17475 NtSetContextThread	thread_handle: 0x000000f0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4306480 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2852	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1320 resumed a thread in remote process 2852
1619943911.23775 NtResumeThread	thread_handle: 0x000000f0 suspend_count: 1 process_identifier: 2852	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619943911.17475 CreateProcessInternalW	thread_identifier: 1752 thread_handle: 0x000000f0 process_identifier: 2852 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c4dc14e8754c36300ae98fa8b4369a40.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000f4 inherit_handles: 0	success	1
1619943911.17475 NtUnmapViewOfSection	process_identifier: 2852 region_size: 4096 process_handle: 0x000000f4 base_address: 0x00400000	success	0
1619943911.17475 NtMapViewOfSection	section_handle: 0x000000fc process_identifier: 2852 commit_size: 172032 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000f4 allocation_type: 0 () section_offset: 0 view_size: 172032 base_address: 0x00400000	success	0
1619943911.17475 NtGetContextThread	thread_handle: 0x000000f0	success	0
1619943911.17475 NtSetContextThread	thread_handle: 0x000000f0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4306480 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2852	success	0
1619943911.23775 NtResumeThread	thread_handle: 0x000000f0 suspend_count: 1 process_identifier: 2852	success	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

MicroWorld-eScan	Trojan.Delf.FareIt.Gen.6
FireEye	Generic.mg.c4dc14e8754c3630
McAfee	Fareit-FSK!C4DC14E8754C
Cylance	Unsafe
Zillya	Dropper.Agent.Win32.426876
Sangfor	Malware
K7AntiVirus	Trojan ( 005662f61 )
Alibaba	Trojan:Win32/Kryptik.3478e569
K7GW	Trojan ( 005662f61 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Delf.FareIt.Gen.6
Invincea	heuristic
F-Prot	W32/Fareit.DLK
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.Delf.FareIt.Gen.6
NANO-Antivirus	Trojan.Win32.Dwn.hjzmhp
AegisLab	Trojan.Multi.Generic.4!c
Ad-Aware	Trojan.Delf.FareIt.Gen.6
Emsisoft	Trojan.Delf.FareIt.Gen.6 (B)
Comodo	Malware@#2pvig9uhic5gq
DrWeb	Trojan.Siggen9.44728
VIPRE	Trojan.Win32.Simda.ba (v)
TrendMicro	TrojanSpy.Win32.FORMBOOK.THEOIBO
McAfee-GW-Edition	BehavesLike.Win32.Fareit.cc
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
Paloalto	generic.ml
Cyren	W32/Trojan.WAHT-8657
Jiangmin	Trojan.Kryptik.aqk
eGambit	Unsafe.AI_Score_99%
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	PWS:Win32/Fareit.AR!MTB
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.Delf.FareIt.Gen.6
AhnLab-V3	Suspicious/Win.Delphiless.X2059
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZelphiF.34110.2GX@aSCG6Vfi
ALYac	Trojan.Delf.FareIt.Gen.6
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
ESET-NOD32	a variant of Win32/Injector.ELUS
TrendMicro-HouseCall	TrojanSpy.Win32.FORMBOOK.THEOIBO
Rising	Trojan.Injector!8.C4 (CLOUD)
Yandex	Trojan.Igent.bTGzIH.50
SentinelOne	DFI - Malicious PE
MaxSecure	Trojan.Malware.73736783.susgen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x49c154 DeleteCriticalSection

• 0x49c158 LeaveCriticalSection

• 0x49c15c EnterCriticalSection

• 0x49c160 InitializeCriticalSection

• 0x49c164 VirtualFree

• 0x49c168 VirtualAlloc

• 0x49c16c LocalFree

• 0x49c170 LocalAlloc

• 0x49c174 GetVersion

• 0x49c178 GetCurrentThreadId

• 0x49c17c InterlockedDecrement

• 0x49c180 InterlockedIncrement

• 0x49c184 VirtualQuery

• 0x49c188 WideCharToMultiByte

• 0x49c18c MultiByteToWideChar

• 0x49c190 lstrlenA

• 0x49c194 lstrcpynA

• 0x49c198 LoadLibraryExA

• 0x49c19c GetThreadLocale

• 0x49c1a0 GetStartupInfoA

• 0x49c1a4 GetProcAddress

• 0x49c1a8 GetModuleHandleA

• 0x49c1ac GetModuleFileNameA

• 0x49c1b0 GetLocaleInfoA

• 0x49c1b4 GetCommandLineA

• 0x49c1b8 FreeLibrary

• 0x49c1bc FindFirstFileA

• 0x49c1c0 FindClose

• 0x49c1c4 ExitProcess

• 0x49c1c8 WriteFile

• 0x49c1cc UnhandledExceptionFilter

• 0x49c1d0 RtlUnwind

• 0x49c1d4 RaiseException

• 0x49c1d8 GetStdHandle

Library user32.dll:

• 0x49c1e0 GetKeyboardType

• 0x49c1e4 LoadStringA

• 0x49c1e8 MessageBoxA

• 0x49c1ec CharNextA

Library advapi32.dll:

• 0x49c1f4 RegQueryValueExA

• 0x49c1f8 RegOpenKeyExA

• 0x49c1fc RegCloseKey

Library oleaut32.dll:

• 0x49c204 SysFreeString

• 0x49c208 SysReAllocStringLen

• 0x49c20c SysAllocStringLen

Library kernel32.dll:

• 0x49c214 TlsSetValue

• 0x49c218 TlsGetValue

• 0x49c21c LocalAlloc

• 0x49c220 GetModuleHandleA

Library advapi32.dll:

• 0x49c228 RegQueryValueExA

• 0x49c22c RegOpenKeyExA

• 0x49c230 RegCloseKey

Library kernel32.dll:

• 0x49c238 lstrcpyA

• 0x49c23c WriteFile

• 0x49c240 WinExec

• 0x49c244 WaitForSingleObjectEx

• 0x49c248 WaitForSingleObject

• 0x49c24c VirtualQuery

• 0x49c250 VirtualAlloc

• 0x49c254 Sleep

• 0x49c258 SizeofResource

• 0x49c25c SetThreadLocale

• 0x49c260 SetFilePointer

• 0x49c264 SetEvent

• 0x49c268 SetErrorMode

• 0x49c26c SetEndOfFile

• 0x49c270 SearchPathA

• 0x49c274 ResetEvent

• 0x49c278 ReleaseMutex

• 0x49c27c ReadFile

• 0x49c280 OpenFileMappingA

• 0x49c284 MultiByteToWideChar

• 0x49c288 MulDiv

• 0x49c28c LockResource

• 0x49c290 LoadResource

• 0x49c294 LoadLibraryA

• 0x49c298 LeaveCriticalSection

• 0x49c29c IsDBCSLeadByte

• 0x49c2a0 InitializeCriticalSection

• 0x49c2a4 GlobalUnlock

• 0x49c2a8 GlobalReAlloc

• 0x49c2ac GlobalMemoryStatus

• 0x49c2b0 GlobalHandle

• 0x49c2b4 GlobalLock

• 0x49c2b8 GlobalFree

• 0x49c2bc GlobalFindAtomA

• 0x49c2c0 GlobalDeleteAtom

• 0x49c2c4 GlobalAlloc

• 0x49c2c8 GlobalAddAtomA

• 0x49c2cc GetVersionExA

• 0x49c2d0 GetVersion

• 0x49c2d4 GetTickCount

• 0x49c2d8 GetThreadLocale

• 0x49c2dc GetTempPathA

• 0x49c2e0 GetSystemTimeAsFileTime

• 0x49c2e4 GetSystemTime

• 0x49c2e8 GetSystemInfo

• 0x49c2ec GetStringTypeExA

• 0x49c2f0 GetStdHandle

• 0x49c2f4 GetProcAddress

• 0x49c2f8 GetModuleHandleA

• 0x49c2fc GetModuleFileNameA

• 0x49c300 GetLocaleInfoA

• 0x49c304 GetLocalTime

• 0x49c308 GetLastError

• 0x49c30c GetFullPathNameA

• 0x49c310 GetFileSize

• 0x49c314 GetDiskFreeSpaceA

• 0x49c318 GetDateFormatA

• 0x49c31c GetCurrentThreadId

• 0x49c320 GetCurrentProcessId

• 0x49c324 GetCurrentDirectoryA

• 0x49c328 GetCPInfo

• 0x49c32c GetACP

• 0x49c330 FreeResource

• 0x49c334 InterlockedIncrement

• 0x49c338 InterlockedExchange

• 0x49c33c InterlockedDecrement

• 0x49c340 FreeLibrary

• 0x49c344 FormatMessageA

• 0x49c348 FindResourceA

• 0x49c34c FindFirstFileA

• 0x49c350 FindClose

• 0x49c354 FileTimeToSystemTime

• 0x49c358 FatalAppExitA

• 0x49c35c ExitThread

• 0x49c360 ExitProcess

• 0x49c364 EnumCalendarInfoA

• 0x49c368 EnterCriticalSection

• 0x49c36c DeleteCriticalSection

• 0x49c370 CreateThread

• 0x49c374 CreateMutexA

• 0x49c378 CreateFileA

• 0x49c37c CreateEventA

• 0x49c380 CompareStringA

• 0x49c384 CloseHandle

Library version.dll:

• 0x49c38c VerQueryValueA

• 0x49c390 GetFileVersionInfoSizeA

• 0x49c394 GetFileVersionInfoA

Library gdi32.dll:

• 0x49c39c UnrealizeObject

• 0x49c3a0 StretchBlt

• 0x49c3a4 SetWindowOrgEx

• 0x49c3a8 SetViewportOrgEx

• 0x49c3ac SetTextColor

• 0x49c3b0 SetStretchBltMode

• 0x49c3b4 SetROP2

• 0x49c3b8 SetPixel

• 0x49c3bc SetDIBColorTable

• 0x49c3c0 SetBrushOrgEx

• 0x49c3c4 SetBkMode

• 0x49c3c8 SetBkColor

• 0x49c3cc SetArcDirection

• 0x49c3d0 SelectPalette

• 0x49c3d4 SelectObject

• 0x49c3d8 SaveDC

• 0x49c3dc RestoreDC

• 0x49c3e0 RectVisible

• 0x49c3e4 RealizePalette

• 0x49c3e8 PatBlt

• 0x49c3ec MoveToEx

• 0x49c3f0 MaskBlt

• 0x49c3f4 LineTo

• 0x49c3f8 IntersectClipRect

• 0x49c3fc GetWindowOrgEx

• 0x49c400 GetTextMetricsA

• 0x49c404 GetTextExtentPoint32A

• 0x49c408 GetSystemPaletteEntries

• 0x49c40c GetStockObject

• 0x49c410 GetPixel

• 0x49c414 GetPaletteEntries

• 0x49c418 GetObjectA

• 0x49c41c GetDeviceCaps

• 0x49c420 GetDIBits

• 0x49c424 GetDIBColorTable

• 0x49c428 GetDCOrgEx

• 0x49c42c GetCurrentPositionEx

• 0x49c430 GetClipBox

• 0x49c434 GetBrushOrgEx

• 0x49c438 GetBitmapBits

• 0x49c43c ExcludeClipRect

• 0x49c440 DeleteObject

• 0x49c444 DeleteDC

• 0x49c448 CreateSolidBrush

• 0x49c44c CreatePenIndirect

• 0x49c450 CreatePalette

• 0x49c454 CreateHalftonePalette

• 0x49c458 CreateFontIndirectA

• 0x49c45c CreateDIBitmap

• 0x49c460 CreateDIBSection

• 0x49c464 CreateCompatibleDC

• 0x49c468 CreateCompatibleBitmap

• 0x49c46c CreateBrushIndirect

• 0x49c470 CreateBitmap

• 0x49c474 BitBlt

Library user32.dll:

• 0x49c47c CreateWindowExA

• 0x49c480 WindowFromPoint

• 0x49c484 WinHelpA

• 0x49c488 WaitMessage

• 0x49c48c UpdateWindow

• 0x49c490 UnregisterClassA

• 0x49c494 UnhookWindowsHookEx

• 0x49c498 TranslateMessage

• 0x49c49c TranslateMDISysAccel

• 0x49c4a0 TrackPopupMenu

• 0x49c4a4 SystemParametersInfoA

• 0x49c4a8 ShowWindow

• 0x49c4ac ShowScrollBar

• 0x49c4b0 ShowOwnedPopups

• 0x49c4b4 ShowCursor

• 0x49c4b8 SetWindowsHookExA

• 0x49c4bc SetWindowPos

• 0x49c4c0 SetWindowPlacement

• 0x49c4c4 SetWindowLongA

• 0x49c4c8 SetTimer

• 0x49c4cc SetScrollRange

• 0x49c4d0 SetScrollPos

• 0x49c4d4 SetScrollInfo

• 0x49c4d8 SetRect

• 0x49c4dc SetPropA

• 0x49c4e0 SetParent

• 0x49c4e4 SetMenuItemInfoA

• 0x49c4e8 SetMenu

• 0x49c4ec SetForegroundWindow

• 0x49c4f0 SetFocus

• 0x49c4f4 SetCursor

• 0x49c4f8 SetClassLongA

• 0x49c4fc SetCapture

• 0x49c500 SetActiveWindow

• 0x49c504 SendMessageA

• 0x49c508 ScrollWindow

• 0x49c50c ScreenToClient

• 0x49c510 RemovePropA

• 0x49c514 RemoveMenu

• 0x49c518 ReleaseDC

• 0x49c51c ReleaseCapture

• 0x49c520 RegisterWindowMessageA

• 0x49c524 RegisterClipboardFormatA

• 0x49c528 RegisterClassA

• 0x49c52c RedrawWindow

• 0x49c530 PtInRect

• 0x49c534 PostQuitMessage

• 0x49c538 PostMessageA

• 0x49c53c PeekMessageA

• 0x49c540 OffsetRect

• 0x49c544 OemToCharBuffA

• 0x49c548 OemToCharA

• 0x49c54c MessageBoxA

• 0x49c550 MapWindowPoints

• 0x49c554 MapVirtualKeyA

• 0x49c558 LoadStringA

• 0x49c55c LoadKeyboardLayoutA

• 0x49c560 LoadIconA

• 0x49c564 LoadCursorA

• 0x49c568 LoadBitmapA

• 0x49c56c KillTimer

• 0x49c570 IsZoomed

• 0x49c574 IsWindowVisible

• 0x49c578 IsWindowEnabled

• 0x49c57c IsWindow

• 0x49c580 IsRectEmpty

• 0x49c584 IsIconic

• 0x49c588 IsDialogMessageA

• 0x49c58c IsChild

• 0x49c590 InvalidateRect

• 0x49c594 IntersectRect

• 0x49c598 InsertMenuItemA

• 0x49c59c InsertMenuA

• 0x49c5a0 InflateRect

• 0x49c5a4 GetWindowThreadProcessId

• 0x49c5a8 GetWindowTextA

• 0x49c5ac GetWindowRect

• 0x49c5b0 GetWindowPlacement

• 0x49c5b4 GetWindowLongA

• 0x49c5b8 GetWindowDC

• 0x49c5bc GetTopWindow

• 0x49c5c0 GetSystemMetrics

• 0x49c5c4 GetSystemMenu

• 0x49c5c8 GetSysColorBrush

• 0x49c5cc GetSysColor

• 0x49c5d0 GetSubMenu

• 0x49c5d4 GetScrollRange

• 0x49c5d8 GetScrollPos

• 0x49c5dc GetScrollInfo

• 0x49c5e0 GetPropA

• 0x49c5e4 GetParent

• 0x49c5e8 GetWindow

• 0x49c5ec GetMenuStringA

• 0x49c5f0 GetMenuState

• 0x49c5f4 GetMenuItemInfoA

• 0x49c5f8 GetMenuItemID

• 0x49c5fc GetMenuItemCount

• 0x49c600 GetMenu

• 0x49c604 GetLastActivePopup

• 0x49c608 GetKeyboardState

• 0x49c60c GetKeyboardLayoutList

• 0x49c610 GetKeyboardLayout

• 0x49c614 GetKeyState

• 0x49c618 GetKeyNameTextA

• 0x49c61c GetIconInfo

• 0x49c620 GetForegroundWindow

• 0x49c624 GetFocus

• 0x49c628 GetDesktopWindow

• 0x49c62c GetDCEx

• 0x49c630 GetDC

• 0x49c634 GetCursorPos

• 0x49c638 GetCursor

• 0x49c63c GetClientRect

• 0x49c640 GetClassNameA

• 0x49c644 GetClassInfoA

• 0x49c648 GetCapture

• 0x49c64c GetActiveWindow

• 0x49c650 FrameRect

• 0x49c654 FindWindowA

• 0x49c658 FillRect

• 0x49c65c EqualRect

• 0x49c660 EnumWindows

• 0x49c664 EnumThreadWindows

• 0x49c668 EndPaint

• 0x49c66c EnableWindow

• 0x49c670 EnableScrollBar

• 0x49c674 EnableMenuItem

• 0x49c678 DrawTextA

• 0x49c67c DrawMenuBar

• 0x49c680 DrawIconEx

• 0x49c684 DrawIcon

• 0x49c688 DrawFrameControl

• 0x49c68c DrawEdge

• 0x49c690 DispatchMessageA

• 0x49c694 DestroyWindow

• 0x49c698 DestroyMenu

• 0x49c69c DestroyIcon

• 0x49c6a0 DestroyCursor

• 0x49c6a4 DeleteMenu

• 0x49c6a8 DefWindowProcA

• 0x49c6ac DefMDIChildProcA

• 0x49c6b0 DefFrameProcA

• 0x49c6b4 CreatePopupMenu

• 0x49c6b8 CreateMenu

• 0x49c6bc CreateIcon

• 0x49c6c0 ClientToScreen

• 0x49c6c4 CheckMenuItem

• 0x49c6c8 CallWindowProcA

• 0x49c6cc CallNextHookEx

• 0x49c6d0 BeginPaint

• 0x49c6d4 CharNextA

• 0x49c6d8 CharLowerA

• 0x49c6dc CharUpperBuffA

• 0x49c6e0 CharToOemBuffA

• 0x49c6e4 CharToOemA

• 0x49c6e8 AdjustWindowRectEx

• 0x49c6ec ActivateKeyboardLayout

Library kernel32.dll:

• 0x49c6f4 Sleep

Library oleaut32.dll:

• 0x49c6fc SafeArrayPtrOfIndex

• 0x49c700 SafeArrayPutElement

• 0x49c704 SafeArrayGetElement

• 0x49c708 SafeArrayUnaccessData

• 0x49c70c SafeArrayAccessData

• 0x49c710 SafeArrayGetUBound

• 0x49c714 SafeArrayGetLBound

• 0x49c718 SafeArrayCreate

• 0x49c71c VariantChangeType

• 0x49c720 VariantCopyInd

• 0x49c724 VariantCopy

• 0x49c728 VariantClear

• 0x49c72c VariantInit

Library ole32.dll:

• 0x49c734 CoCreateInstance

• 0x49c738 CoUninitialize

• 0x49c73c CoInitialize

Library oleaut32.dll:

• 0x49c744 GetErrorInfo

• 0x49c748 SysFreeString

Library comctl32.dll:

• 0x49c750 ImageList_SetIconSize

• 0x49c754 ImageList_GetIconSize

• 0x49c758 ImageList_Write

• 0x49c75c ImageList_Read

• 0x49c760 ImageList_GetDragImage

• 0x49c764 ImageList_DragShowNolock

• 0x49c768 ImageList_SetDragCursorImage

• 0x49c76c ImageList_DragMove

• 0x49c770 ImageList_DragLeave

• 0x49c774 ImageList_DragEnter

• 0x49c778 ImageList_EndDrag

• 0x49c77c ImageList_BeginDrag

• 0x49c780 ImageList_Remove

• 0x49c784 ImageList_DrawEx

• 0x49c788 ImageList_Draw

• 0x49c78c ImageList_GetBkColor

• 0x49c790 ImageList_SetBkColor

• 0x49c794 ImageList_ReplaceIcon

• 0x49c798 ImageList_Add

• 0x49c79c ImageList_GetImageCount

• 0x49c7a0 ImageList_Destroy

• 0x49c7a4 ImageList_Create

Library user32.dll:

• 0x49c7ac DdeCmpStringHandles

• 0x49c7b0 DdeFreeStringHandle

• 0x49c7b4 DdeQueryStringA

• 0x49c7b8 DdeCreateStringHandleA

• 0x49c7bc DdeGetLastError

• 0x49c7c0 DdeFreeDataHandle

• 0x49c7c4 DdeUnaccessData

• 0x49c7c8 DdeAccessData

• 0x49c7cc DdeCreateDataHandle

• 0x49c7d0 DdeClientTransaction

• 0x49c7d4 DdeNameService

• 0x49c7d8 DdePostAdvise

• 0x49c7dc DdeSetUserHandle

• 0x49c7e0 DdeQueryConvInfo

• 0x49c7e4 DdeDisconnect

• 0x49c7e8 DdeConnect

• 0x49c7ec DdeUninitialize

• 0x49c7f0 DdeInitializeA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	55371	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.