1.2
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.70
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Heim | 20191016 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191016 | 2013.8.14.323 |
| McAfee | Packed-FE!C6545AE7949C | 20191016 | 6.0.6.653 |
| Tencent | None | 20191016 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | .ndata |
| section | .adata |
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(3 个事件)
| section | {'name': '.rdata', 'virtual_address': '0x00008000', 'virtual_size': '0x00002ba8', 'size_of_data': '0x00002c00', 'entropy': 7.036424129302671} | entropy | 7.036424129302671 | description | 发现高熵的节 | |||||||||
| section | {'name': '.ndata', 'virtual_address': '0x0000d000', 'virtual_size': '0x000007e1', 'size_of_data': '0x00000800', 'entropy': 7.540630785891322} | entropy | 7.540630785891322 | description | 发现高熵的节 | |||||||||
| entropy | 0.2549019607843137 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 46 个反病毒引擎识别为恶意
(46 个事件)
| ALYac | Gen:Variant.Ulise.71643 |
| APEX | Malicious |
| AVG | Win32:Heim |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.71643 |
| AhnLab-V3 | Malware/Win32.Generic.C754143 |
| Antiy-AVL | Trojan[Banker]/Win32.Tinba |
| Arcabit | Trojan.Ulise.D117DB |
| Avast | Win32:Heim |
| Avira | TR/Crypt.ZPACK.Gen4 |
| BitDefender | Gen:Variant.Ulise.71643 |
| Comodo | TrojWare.Win32.TrojanDownloader.Dofoil.CYAD@7cy223 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.7949c9 |
| Cylance | Unsafe |
| Cyren | W32/Fuerboos.AG.gen!Eldorado |
| DrWeb | Trojan.PWS.Tinba |
| ESET-NOD32 | a variant of Win32/Kryptik.CYCW |
| Emsisoft | Gen:Variant.Ulise.71643 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Fuerboos.AG.gen!Eldorado |
| F-Secure | Trojan.TR/Crypt.ZPACK.Gen4 |
| FireEye | Generic.mg.c6545ae7949c9dcb |
| Fortinet | W32/Kryptik.DFAR!tr |
| GData | Gen:Variant.Ulise.71643 |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.dztvr |
| K7AntiVirus | Trojan ( 00517f131 ) |
| K7GW | Trojan ( 00517f131 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=80) |
| Malwarebytes | Trojan.Tinba |
| McAfee | Packed-FE!C6545AE7949C |
| McAfee-GW-Edition | BehavesLike.Win32.Virut.qh |
| MicroWorld-eScan | Gen:Variant.Ulise.71643 |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM20.1.9697.Malware.Gen |
| Rising | Downloader.Dofoil!8.322 (TFE:1:DUdtdFy1X2U) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Tinba-AD |
| Symantec | ML.Attribute.HighConfidence |
| VBA32 | TrojanPSW.Tinba |
| Yandex | Trojan.PWS.Tinba! |
| Zillya | Trojan.Tinba.Win32.1101 |
| ZoneAlarm | HEUR:Trojan.Win32.Generic |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2015-01-30 22:07:32
PE Imphash
6290f6a612e56ab4efbb3682e24c3f41
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00006250 | 0x00006400 | 6.267313171397885 |
| .rdata | 0x00008000 | 0x00002ba8 | 0x00002c00 | 7.036424129302671 |
| .data | 0x0000b000 | 0x000007a4 | 0x00000400 | 3.5787528392908383 |
| .edata | 0x0000c000 | 0x00000605 | 0x00000800 | 6.052896055811544 |
| .ndata | 0x0000d000 | 0x000007e1 | 0x00000800 | 7.540630785891322 |
| .adata | 0x0000e000 | 0x000001b2 | 0x00000200 | 6.5555840564548635 |
| .rsrc | 0x0000f000 | 0x00003000 | 0x00002600 | 3.3807352524913656 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_STRING | 0x00010e10 | 0x00000290 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00010e10 | 0x00000290 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00010e10 | 0x00000290 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00010e10 | 0x00000290 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00010e10 | 0x00000290 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00010e10 | 0x00000290 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00010e10 | 0x00000290 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00010e10 | 0x00000290 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00010e10 | 0x00000290 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00010e10 | 0x00000290 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x000110b0 | 0x000003a4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.dll:
• 0x408000 SetProcessAffinityMask
• 0x408004 GetTickCount
• 0x408008 FreeConsole
• 0x40800c TlsAlloc
• 0x408010 CancelDeviceWakeupRequest
• 0x408014 GetConsoleTitleW
• 0x408018 SetCurrentDirectoryW
• 0x40801c GetEnvironmentStrings
• 0x408020 CreateNamedPipeA
• 0x408024 OpenWaitableTimerW
• 0x408028 CreateMailslotW
• 0x40802c FindNextVolumeA
• 0x408030 GetLocaleInfoW
• 0x408034 GetFullPathNameW
• 0x408038 FoldStringA
• 0x40803c SetProcessAffinityMask
• 0x408040 GetNumberFormatA
• 0x408044 GlobalFindAtomW
• 0x408048 AreFileApisANSI
• 0x40804c HeapAlloc
• 0x408050 LeaveCriticalSection
• 0x408054 GetSystemInfo
• 0x408058 GetProfileSectionA
• 0x40805c RegisterWaitForSingleObjectEx
• 0x408060 GetCommTimeouts
• 0x408064 FindFirstVolumeA
• 0x408068 CreateDirectoryExW
• 0x40806c WritePrivateProfileSectionA
• 0x408070 WriteConsoleOutputAttribute
• 0x408074 DisconnectNamedPipe
• 0x408078 SetConsoleOutputCP
• 0x40807c SetCalendarInfoA
• 0x408080 ReadConsoleOutputW
• 0x408084 CopyFileA
• 0x408088 SetConsoleScreenBufferSize
• 0x40808c OpenEventA
• 0x408090 WaitCommEvent
• 0x408094 SetThreadPriority
• 0x408098 AssignProcessToJobObject
• 0x40809c GetComputerNameW
• 0x4080a0 GetNamedPipeInfo
Library ole32.dll:
• 0x408228 CreateStreamOnHGlobal
• 0x40822c CoRegisterPSClsid
• 0x408230 HMENU_UserSize
• 0x408234 CoCopyProxy
• 0x408238 OleTranslateAccelerator
• 0x40823c OleRun
• 0x408240 CreateILockBytesOnHGlobal
• 0x408244 StgIsStorageILockBytes
Library msvcrt.dll:
• 0x4081a8 fputc
• 0x4081ac _wtoi
• 0x4081b0 atol
• 0x4081b4 isdigit
• 0x4081b8 _wexecle
• 0x4081bc memcpy
• 0x4081c0 _lrotr
• 0x4081c4 bsearch
• 0x4081c8 wcsncmp
• 0x4081cc _wgetenv
• 0x4081d0 fputws
• 0x4081d4 _wspawnlp
• 0x4081d8 ungetwc
• 0x4081dc _wexecv
• 0x4081e0 _tempnam
• 0x4081e4 fwrite
• 0x4081e8 isprint
• 0x4081ec free
• 0x4081f0 _wspawnve
• 0x4081f4 wcscoll
• 0x4081f8 _wspawnlpe
• 0x4081fc wcsspn
• 0x408200 _wexeclpe
• 0x408204 fflush
• 0x408208 strtok
• 0x40820c _fgetwchar
• 0x408210 _wgetdcwd
• 0x408214 wcscmp
• 0x408218 _vsnwprintf
• 0x40821c _wremove
• 0x408220 _flsbuf
Library WINMM.dll:
• 0x4080a8 midiOutMessage
• 0x4080ac midiInGetDevCapsW
• 0x4080b0 midiInStart
• 0x4080b4 midiStreamPause
• 0x4080b8 mciGetErrorStringW
• 0x4080bc mmioSetBuffer
• 0x4080c0 waveOutClose
• 0x4080c4 PlaySoundA
• 0x4080c8 mixerGetDevCapsW
• 0x4080cc midiOutGetErrorTextW
• 0x4080d0 waveOutGetErrorTextA
• 0x4080d4 mmioDescend
• 0x4080d8 mciGetDeviceIDFromElementIDA
• 0x4080dc waveInAddBuffer
• 0x4080e0 mciGetYieldProc
• 0x4080e4 joyGetThreshold
• 0x4080e8 waveInUnprepareHeader
• 0x4080ec mixerGetLineInfoA
• 0x4080f0 auxGetNumDevs
• 0x4080f4 joySetCapture
• 0x4080f8 midiStreamProperty
• 0x4080fc waveOutGetErrorTextW
• 0x408100 mixerGetNumDevs
• 0x408104 waveInStart
• 0x408108 midiStreamClose
• 0x40810c midiInClose
• 0x408110 joyGetPosEx
• 0x408114 waveOutGetID
• 0x408118 waveOutPrepareHeader
• 0x40811c waveInGetPosition
• 0x408120 midiStreamStop
• 0x408124 auxOutMessage
• 0x408128 mciGetDeviceIDA
• 0x40812c mixerGetDevCapsA
• 0x408130 midiInGetErrorTextA
Library mscms.dll:
• 0x408138 CreateMultiProfileTransform
• 0x40813c ConvertIndexToColorName
• 0x408140 GetCMMInfo
• 0x408144 DisassociateColorProfileFromDeviceW
• 0x408148 SelectCMM
• 0x40814c DisassociateColorProfileFromDeviceA
• 0x408150 OpenColorProfileW
• 0x408154 CreateProfileFromLogColorSpaceW
• 0x408158 GetColorDirectoryW
• 0x40815c CreateProfileFromLogColorSpaceA
• 0x408160 RegisterCMMA
• 0x408164 AssociateColorProfileWithDeviceA
• 0x408168 OpenColorProfileA
• 0x40816c GetColorProfileElement
• 0x408170 InstallColorProfileW
• 0x408174 GetPS2ColorRenderingDictionary
• 0x408178 GetStandardColorSpaceProfileW
• 0x40817c SetColorProfileElementReference
• 0x408180 GetColorProfileFromHandle
• 0x408184 GetStandardColorSpaceProfileA
• 0x408188 UninstallColorProfileW
• 0x40818c GetCountColorProfileElements
• 0x408190 SetColorProfileHeader
• 0x408194 CloseColorProfile
• 0x408198 GetColorProfileHeader
• 0x40819c TranslateBitmapBits
• 0x4081a0 SetColorProfileElementSize
L!This program cannot be run in DOS mode.
`.rdata
@.data
.edata
.ndata
.adata
]fffff.
USWVLE
EM1MEEE
uf+M)EfME9tIEMU
Ufuff!fu
uuu)Uf}f]f
f]ff)fM
fMEL^_[]ffffff.
USWV,E
fE?fUE
,^_[]f.
USWVXE
MEE7EZ
f]EfEj,E
Ef]MUu}EM
UUfME%
X^_[]f
USWV|E
TfEaME
EEfE=$E
EEfE4fEO>fE$E
MME9E]U|x~"EfEWVfMff1fM
EfMf9fM=t
EfMfwvU
EfMEfMf
f)fEMfE7)0EfMfW\Uu
Ufuff!fu)
ME|^_[]
MM9Eu,
4mf+U@0mfU(EM
Z@0EEEEfMf)fMU
UE,]fffff.
^_[]f.
USWVLE
EM1MfEf
EfEmEMI
UE;J4u(E
L^_[]fffff.
E@0MEA
]fffff.
]fffff.
fE:EUE
}E]fE!ME
fUfQsfufUff1fuMEM
]fuff)Mf}CEfMfUf
f~fMfUu
fEn2EMU
MEEEMfUff&fUu
fUff!fUu
USWV,Ea
fERJEEE
f+E]fEE1
fUff)fuE
Mfuff!fu,^_[]
|$XD$_D$k
D$4D$dD$`
D$0D$`D$t
D$,D$tD$L
D$(fD$rfD$Fq
L$xT$@
|$$fD$"\$!t$
fL$Fff!fL$FD$,D$TfD$D`
D$TL$@
TL$LT$Tt$l
ff|$Df
gf|$DD$LD$Lf$
$L$$9u)
L$|L$l
L$l+D$LD$l
\$xt$_|$L(T$_f|$Df
f|$DL$PO
fD$FC8Q
$WT$F$
D$lL$LT$L1
D$LD$|e^_[]
Et5MEUV
EfUff1fU
EfMfrUfM
UUfMff
USWVPE
]EE;EE
]MUu}u
u9uqEfMfXfM
@<Uu94
M!fUfs
Ufuff)f}*EEE
Ufuff1fuU])
UMf}f!f}
&U*MMfEmt)
P^_[]fff.
+UUflfO
flf+^f^
'fL}ff)
)+EL9E
^fMff!f^
EfMff)
UfufDfu(? fMff!fME
LfUff1fufF*fufU
*O@fufwUfu?(
hfUfb*fU1hEE
^_[]fff.
USWV0fEZE
uME9A<U~
ESfE#EM9
Uu]f}f)0]fUfUff1fU
ufEffE
0^_[]ffff.
USWV@E
M;EsSEM
E@^_[]fUSWV<
fEEfEN
$fffM|p
|f+UfU
Pf}ff1f}
E$9|t-
}f]fMftf]M)
E|fEM9t8
|+ppE)M
>!f>Uff1f>M
EEE+|EfE
MMtplhdWE}
E*MMEE
E@4M+A4E
EEUB E@$
EdP,f+}Ehp0Ef}
Uff}!ff}9
USWV\E
uEqE6M
u]+E{]vTE
`$`fET|E
f>f[jf>
f>f%Of.M
Tfn+HUH
6ff1fuE
X}f+Uf]
f.ffffff!f.ff1f]
fnff!SfnSMwE@
()(EMfNfn
HUff!fN
fffff.
UM+XXEfufc7fu
*MMfEx
uf0wfU
,46 !+EE$9tuE
f1fEEEM
] ]ElD
fuff!fu
UbEvU!
P;XfMf
xM!MsEh)
8d@0(d@$pE`d@4\d@8XTPTH
dI(\dE
I4xt<dI8
fuff!fu
TdI4MdU
Eff5!f
Effdfw0T
Ef)pf9
LM@UDMHMPM
J,`d00)
ILXdIPdITMdID0M
dIHU41UM
,eX]`m]USWV0
,BZD$t
M"fD$BHD$LlBZ
D$4+D$|a
)D$?D$PD$da
L$0\$,|$(T$$t$
L$HfD$@JH$
u%D$@L$HT$(
\$o0\$oL$HD$?f
f+L$B$
T$ T$\ft$@f$
ff)fL$@
L$?T$t\$o
L$t0\$?)
L$\D$tD$$9sy$
L$\fT$@ff
fT$@D$H
fT$Bf;
T$\t$0
T$\\$of|$Bf
f|$B \$oO$
fT$BD$
fT$Be^_[]f.
`ffff!ff9
Ef!fUM
UM1ME8f
f+Uu)fU88
UVErM9t
'IQb0Pi]RbQOzA@K]xFUX= KzM"MX9BI}GA<Kg M'F6@G\
^vVi|[GYg[>
<qrg2C
9%J>*>:hwU\VQwm
oeT/'ezd:3A
K2mr2+%9ADNUJ
%V)&VZ\
OL*y{n
-7THUdg}:hh
Y`1HDZ}`SQA
tiX*a2
'~xyN|
r60N/rm>v5
LPbldlG
7i?TAf
,m_js"5
)MTd /RaJk40qlFDNz]
Y0QE/1
,DcAmorzRup-
<Na*np>-G|r#
O:Pf50t>NmJvr
?:qF?P^
R{gfk=haS#5
UB1ft|
Xkzr1uH@5VwH9IWEdOPo>;P=L
bUI4H_#h
p*Sd>Xz1 DdK%hj
!ms9@VN
]{J5ctS]I5
%|-KUUX
Yxz0Gh
_Q/%ans
!1lt3ncf8@#oF0GW(
6yDR^OJ.
tem|i9
`@]{I\7<
]8uAf^c/
tHjnf]V)
|2f}t8;
:U7b@Lq7
_'G4soM]pch
A~P8vB
vyq}DM`S
-66ez6k_Lo}
x[3igKPNt9BlI
DFNRfi
w|0g<vKRq~
L^vkVF
7>l1 .e3kak
F\WQk64\
CYenH]uY50>4Ke
(yYwfb
{Y#u_e
xEerY_3
leHfVe0L
Y~]5Ce?:
en"P-qSYB
weKkxO
Y&8fGe<:
xexM)}Y!q,WXe
JYePc8&(e
/e{Z6e[YL
aepHYz
ep}YK}ue
'}eBeY
enZ%};3Y
kYUlme:pY
Yj}e;XYR
6%e&~YO~
eObX~YNV=iel|Y,
fhI;~x
sHH|I%fs)xIu~xsus/RPI
s.IqG}s>iuRID
s=lsIGHhs{CI
RGux~jF^wsdeZ:PgIYKeo}XEg;
H|j kFs2Dw[N
tG*7g@i]v
@Lw9z-/_
AmwwVKh:9s-
Sl[~`9b?z.ye=hH
z0x!c}b
H#a8af&' p=,/
!In(_R1SFu2I
r)@z[19
'?vjSaK]6Qb("i
WLhcRRux{KS
>tV}ZX^
Ng>UpES|E2
:VM_`}
dG[lP`
"tyvF1SqY0VP
5urt]Z`M>
yfFyo=
f'zcf
7$bN`fo
vMOZtD
_8F9jK78
aJ2m>?0
@h4q$A2rq
|y_hNeU~
?Tcf5ygrj
<go{Gu
Vz8.r,=sZ*xYZO
w[<yn
QJP9xS
`Et*hJ4g
duSpQ8haJ:D9Spm
Gm2kq>u
`v8vcKX2i%
fS;(<I
*X#l:Mm|b
QI>|kfAhNZ
vyAQZ[
K_,JT5Q5sR
zC|hSMn"h
SwvDRz^YNy
&"8 h\
<ugYhzwYoN}tK`!..iaU
i&PQKy_~SRvyn`B6cNL<|yTx\T@FSljRHGh
=0mPGjSExH==lhG
jurI_uV7_
StvcQ&
.u8td_3oFJzeM_ewlh^|meeMz|
^zzMP5[)%_IoStSSkjyuwiZto
KL'fZ^i
$[0%oXZ'Y4
+:dU6CvoQDX3
,y*RxM3NcJZ8
6WF8U.
G}Hy-JLA
aoq|>'Pv
lpwQ]^
`xwamSJzp]U
q\ `rwPh
6F/rjP
A=Kb}Ea7
d~Z*~p
^g\$js@cY]#tzuo^
D~qhNnh
sNS4KEBLgy^TJ
S-UGAzXq
!XY(~iSc{M{cRli
qjK$&2f%`wcK
m&*s+LyZ
X}KSQ'XI Q;VASa_{
0F|Tqqy
>5sU8VY
#:roN#h
hd[dvA\
yCOY2_<
?7;wD|
Lgw]`Rx]@tP:S'QHg
[1WdWqsnMLh4]TxCon`:m
UNT]X$R1HD[
|?|(!J
V,9OyW6ls"#
DKBt.(
HePcKE)Tl
u9jYf>HxYOOc]G=
5poqm{\
DQaq'zi
CdI{T]<_bM*t8
Ih)"Gs3[L
(Q:k}Bd
jC\fCN\Ty?nA}aj#
BpUM,3
9eU;=3
>h&82@
QYi~GW9h
A/69R5;
>O.j]|_rj
3#}mW_K;%
t~}\j@z0
Sa`}r`"l
'Zi]GD!
X>WM9 >_]SEX
l:[d}T3v
HYlO_wTgWP'
OF``(`Z
agERE4
9ly&;k6n
71G[EgIWetf`0Y
D|5iu:n
fd,KoO^fs
X5t&{^g
:`_vX}v
sV]huH_c$C
t83;ZR
U-dhIe
.\-'7qAz
Bcf/8Z}U\Vt4xOV~
_+jIR%b
(5R^o+zU7
Q0B\pD5\LF%
P>xD5vj+
ySOLxF
^b98]ao{qK@q}WKh`AZ9CYh}.^mps^
SM`9hYJN-
m?RWL}m`8H
*D9|(uL
]_utlE
rmhWTbw:
S'@FqHa:
[o)+wAw
;H!l' p
j|l[<D~
Wp|6vd
@z)YDQsh
,.~AJqm
,EW}Ow:|p?fxnC
HThvG[q
dYe:H1+U<
E|A_qS
fc6K/BI/:.If&z*
uqRUpf
Q"be_CS
<PSvDQ~
[Wl{$\qt
b*wrn=<-
t zMV,
e(;.z_>cMHIuY~KFo^XsEe;:fP
7juc'N
ND5pN{B\yo6I&
c>y';X
RPnn)W(lcY(i_qp:m
fThJ:l
1 '^:r[
_Q+5dkXBPe{_w_
,whrK@@G
[%h9XXcyW
SetProcessAffinityMask
GetTickCount
FreeConsole
TlsAlloc
CancelDeviceWakeupRequest
GetConsoleTitleW
SetCurrentDirectoryW
GetEnvironmentStrings
CreateNamedPipeA
OpenWaitableTimerW
CreateMailslotW
FindNextVolumeA
GetLocaleInfoW
GetFullPathNameW
FoldStringA
SetProcessAffinityMask
GetNumberFormatA
GlobalFindAtomW
AreFileApisANSI
HeapAlloc
LeaveCriticalSection
GetSystemInfo
GetProfileSectionA
RegisterWaitForSingleObjectEx
GetCommTimeouts
FindFirstVolumeA
CreateDirectoryExW
WritePrivateProfileSectionA
WriteConsoleOutputAttribute
DisconnectNamedPipe
SetConsoleOutputCP
SetCalendarInfoA
ReadConsoleOutputW
CopyFileA
SetConsoleScreenBufferSize
OpenEventA
WaitCommEvent
SetThreadPriority
AssignProcessToJobObject
GetComputerNameW
GetNamedPipeInfo
KERNEL32.dll
StgIsStorageILockBytes
CreateILockBytesOnHGlobal
OleRun
OleTranslateAccelerator
CoCopyProxy
HMENU_UserSize
CoRegisterPSClsid
CreateStreamOnHGlobal
ole32.dll
_wremove
_vsnwprintf
wcscmp
_wgetdcwd
_fgetwchar
strtok
fflush
_wexeclpe
wcsspn
_wspawnlpe
wcscoll
_wspawnve
isprint
fwrite
_tempnam
_wexecv
ungetwc
_wspawnlp
fputws
_wgetenv
wcsncmp
_flsbuf
bsearch
_lrotr
memcpy
_wexecle
isdigit
msvcrt.dll
mixerGetNumDevs
waveOutGetErrorTextW
midiStreamProperty
joySetCapture
auxGetNumDevs
mixerGetLineInfoA
waveInUnprepareHeader
joyGetThreshold
mciGetYieldProc
waveInAddBuffer
mciGetDeviceIDFromElementIDA
waveOutGetErrorTextA
midiOutGetErrorTextW
mixerGetDevCapsW
PlaySoundA
waveOutClose
mmioSetBuffer
mciGetErrorStringW
midiStreamPause
midiInStart
midiInGetDevCapsW
midiOutMessage
mmioDescend
waveInStart
midiStreamClose
midiInClose
joyGetPosEx
midiStreamStop
midiInGetErrorTextA
mixerGetDevCapsA
mciGetDeviceIDA
auxOutMessage
waveInGetPosition
waveOutPrepareHeader
waveOutGetID
WINMM.dll
CreateMultiProfileTransform
ConvertIndexToColorName
GetCMMInfo
DisassociateColorProfileFromDeviceW
SelectCMM
DisassociateColorProfileFromDeviceA
OpenColorProfileW
CreateProfileFromLogColorSpaceW
GetColorDirectoryW
CreateProfileFromLogColorSpaceA
RegisterCMMA
AssociateColorProfileWithDeviceA
OpenColorProfileA
GetColorProfileElement
InstallColorProfileW
SetColorProfileElementSize
GetPS2ColorRenderingDictionary
GetStandardColorSpaceProfileW
SetColorProfileElementReference
GetColorProfileFromHandle
GetStandardColorSpaceProfileA
UninstallColorProfileW
GetCountColorProfileElements
SetColorProfileHeader
CloseColorProfile
GetColorProfileHeader
TranslateBitmapBits
mscms.dll
~IC-[lp!
v;;v(BJ
n}vhofyHr
68&7([
e+RxM!k{gQ
y_%QfLRG
e+Ri>KkaB
b dj":t~
[wIMk}On
L~NFo^\sEe:9fP
HIuY~KF^XsEe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KF^XsSHf
Ro_:fPMHIuKF_Ys{fPMHIuY~+F~_ctF;nfPMHIuY~KFonXsEu;:fPMHIu~KVo^XuEe<:fPMHIu^~KFo^XsE;:fRMHZ~MFo^XEe;JfPMHJuY~KFo^XsUe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KFo^XsEe;:fP{~KFoXsEu;:fMHIwY~KFo^XsEe;:fPmHIY~KFo^XsEe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KFo^XsEe;:fPMHIuY~KFo^
oK\^sE;:
PHHEE{}os-g;:fO4E'
&"`@Ee;\
OAKFon
<zQ$5IuY$
FsEe&b
8{Mg:fPHuYUkcy]h]
'[3d:9w
5/HtX=
!@ThQU]*e0(^
'nISIth!
r^f"}p
T8jJ&XQ
b1|!!*-
6#XU3*
Iq%zB3_
o8_k[UOhAb
9>|W|'
}1Y^?r{
y2UP*9cO
IZ]EZg
{ut^ayp
%"LL F
-|HHDN_n
JoDV|>dYB
3|DcCD
}~NHk-I
[lK.T_rw9+aZb
TB9FO:
5NZ@<z
nH@!Bp=&O
0]O.v\F^_%
nufb%tbe
E'W}9QXgO1?.^"`
DL9h6y
ZRW{ZK%A [Hz
I]G2wHi
MyAdN{
Ifh,In
=AVA#xK
oZ+F}
W,Gmy\Jr
o/Q:!Qb$)
W:RX]f
5^uscgm"J-C
5R>#}d+
d3Z9pdg
\YV`zb?
zP`,~'C+:
ael9nOF!
e^"kM^9
(s|sHQj-4gE
[3:^By
4^B=nkK
]wDZrX
dv~JQk
VWgF*#
UP8(]HzA
WLPxshR5h8^^3grST
aOdWGmv
e>0Q/<Z
Ra=7$pyj/w
TUUeMdi
K`t4nUmdr?
Qst<*J
L#pN8*Vd4q
bgcYAVs9SW
^cRSRF0
Pp)qV^
H%AgsJ>InS
UrpvI6ilKd
lI!fKF#wKtT0A
=zgMUk;~nvu
H o s t N a m e
C o n n e c t i o n N a m e
N e t w o r k A d a p t e r
P h y s i c a l A d d r e s s
T r a n s p o r t N a m e
G E T M A C [ / S s y s t e m [ / U u s e r n a m e [ / P [ p a s s w o r d ] ] ] ] [ / F O f o r m a t ] [ / N H ] [ / V ]
D e s c r i p t i o n :
B T h i s t o o l e n a b l e s a n a d m i n i s t r a t o r t o d i s p l a y t h e M A C a d d r e s s
& f o r n e t w o r k a d a p t e r s o n a s y s t e m .
P a r a m e t e r L i s t :
I / S s y s t e m S p e c i f i e s t h e r e m o t e s y s t e m t o c o n n e c t t o .
? / U [ d o m a i n \ ] u s e r S p e c i f i e s t h e u s e r c o n t e x t u n d e r
@ w h i c h t h e c o m m a n d s h o u l d e x e c u t e .
B / P [ p a s s w o r d ] S p e c i f i e s t h e p a s s w o r d f o r t h e g i v e n
J u s e r c o n t e x t . P r o m p t s f o r i n p u t i f o m i t t e d .
F / F O f o r m a t S p e c i f i e s t h e f o r m a t i n w h i c h t h e o u t p u t
1 i s t o b e d i s p l a y e d .
D V a l i d v a l u e s : " T A B L E " , " L I S T " , " C S V " .
G / N H S p e c i f i e s t h a t t h e " C o l u m n H e a d e r " s h o u l d
= n o t b e d i s p l a y e d i n t h e o u t p u t .
D V a l i d o n l y f o r T A B L E a n d C S V f o r m a t s .
J / V S p e c i f i e s t h a t v e r b o s e o u t p u t i s d i s p l a y e d .
: / ? D i s p l a y s t h i s h e l p m e s s a g e .
E x a m p l e s :
G E T M A C / ?
G E T M A C / F O c s v
G E T M A C / S s y s t e m / N H / V
G E T M A C / S s y s t e m / U u s e r
< G E T M A C / S s y s t e m / U d o m a i n \ u s e r / P p a s s w o r d / F O l i s t / V
> G E T M A C / S s y s t e m / U d o m a i n \ u s e r / P p a s s w o r d / F O t a b l e / N H
N / A b E R R O R : I n v a l i d s y n t a x . / U c a n b e s p e c i f i e d o n l y w h e n / S i s s p e c i f i e d .
T y p e " G E T M A C / ? " f o r u s a g e .
b E R R O R : I n v a l i d s y n t a x . / P c a n b e s p e c i f i e d o n l y w h e n / U i s s p e c i f i e d .
T y p e " G E T M A C / ? " f o r u s a g e .
E R R O R :
C S V | T A B L E | L I S T
2 E R R O R : I n v a l i d s y n t a x . U s e r n a m e c a n n o t b e e m p t y .
i E R R O R : I n v a l i d s y n t a x . / N H o p t i o n i s a l l o w e d o n l y f o r T A B L E a n d C S V f o r m a t s .
T y p e " G E T M A C / ? " f o r u s a g e .
D i s c o n n e c t e d
C o n n e c t i n g . . .
D i s c o n n e c t i n g
H a r d w a r e n o t p r e s e n t
H a r d w a r e d i s a b l e d
H a r d w a r e m a l f u n c t i o n
M e d i a d i s c o n n e c t e d
A u t h e n t i c a t i o n
A u t h e n t i c a t i o n s u c c e e d e d
A u t h e n t i c a t i o n f a i l e d C E R R O R : C o u l d n o t r e t r i e v e i n f o r m a t i o n d u e t o W M I v e r s i o n m i s m a t c h .
D i s a b l e d ! I N F O : N o n e t w o r k a d a p t e r s f o u n d .
@ W A R N I N G : U s e r c r e d e n t i a l s c a n n o t b e u s e d f o r l o c a l c o n n e c t i o n s .
W A R N I N G : / E R R O R : T h e m a c h i n e f a i l e d t o r e s p o n d p r o p e r l y .
1 E R R O R : T h e m a c h i n e w a s n o t f o u n d o n t h e n e t w o r k .
2 E R R O R : M a c h i n e n a m e w a s n o t a v a l i d m a c h i n e n a m e .
C E R R O R : W o r k s t a t i o n s e r v i c e s a r e n o t r u n n i n g o n t h e t a r g e t m a c h i n e .
4 E R R O R : I n v a l i d s y n t a x . S y s t e m n a m e c a n n o t b e e m p t y .
T y p e " G E T M A C / ? " f o r u s a g e .
: " I N F O : N o n e t w o r k p r o t o c o l s f o u n d .
E R R O R :
W A R N I N G :
S U C C E S S :
T y p e t h e p a s s w o r d f o r % s : 2 P a s s i n g t h e u s e r c r e d e n t i a l f o r l o c a l c o n n e c t i o n .
7 T h e t a r g e t s y s t e m m u s t b e r u n n i n g W i n d o w s X P o r a b o v e .
9 T h e r e m o t e s y s t e m m u s t b e r u n n i n g W i n d o w s 2 0 0 0 o r a b o v e .
> I n v a l i d s y n t a x . ' % s ' v a l u e i s n o t a l l o w e d f o r ' % s ' o p t i o n .
9 I n v a l i d s y n t a x . S p e c i f y v a l i d n u m e r i c v a l u e f o r ' % s ' .
A I n v a l i d s y n t a x . S p e c i f i y v a l i d f l o a t i n g p o i n t v a l u e f o r ' % s ' .
5 I n v a l i d s y n t a x . M a n d a t o r y o p t i o n ' % s ' i s m i s s i n g .
F I n v a l i d s y n t a x . ' % s ' o p t i o n i s n o t a l l o w e d m o r e t h a n ' % d ' t i m e ( s ) .
# I n v a l i d a r g u m e n t / o p t i o n - ' % s ' .
0 I n v a l i d s y n t a x . D e f a u l t a r g u m e n t i s m i s s i n g .
F L e n g t h o f t h e c o m m a n d l i n e a r g u m e n t s h o u l d n o t e x c e e d 2 5 5 c h a r a c t e r s .
I I n v a l i d s y n t a x . D e f a u l t o p t i o n i s n o t a l l o w e d m o r e t h a n ' % d ' t i m e ( s ) .
, I n v a l i d s y n t a x . V a l u e e x p e c t e d f o r ' % s ' .
B I n v a l i d s y n t a x . ' % s ' v a l u e i s n o t a l l o w e d a s d e f a u l t a r g u m e n t .
T y p e " % s / ? " f o r u s a g e . * V a l u e f o r ' % s ' o p t i o n c a n n o t b e e m p t y .
- V a l u e f o r d e f a u l t o p t i o n c a n n o t b e e m p t y .
< I n v a l i d s y n t a x . S p e c i f y v a l i d n u m e r i c v a l u e f o r d e f a u l t .
D I n v a l i d s y n t a x . S p e c i f i y v a l i d f l o a t i n g p o i n t v a l u e f o r d e f a u l t .
> V a l u e f o r d e f a u l t o p t i o n c a n n o t b e m o r e t h a n % d c h a r a c t e r ( s ) .
? I n v a l i d s y n t a x . V a l u e c a n n o t b e s p e c i f i e d w i t h ' % s ' o p t i o n .
; V a l u e f o r ' % s ' o p t i o n c a n n o t b e m o r e t h a n % d c h a r a c t e r ( s ) .
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 B 0
C o m p a n y N a m e
M i c r o s o f t C o r p o r a t i o n
F i l e D e s c r i p t i o n
D i s p l a y s N I C M A C i n f o r m a t i o n
F i l e V e r s i o n
5 . 2 . 3 7 9 0 . 1 8 3 0 ( s r v 0 3 _ s p 1 _ r t m . 0 5 0 3 2 4 - 1 4 4 7 )
I n t e r n a l N a m e
G e t M a c . e x e
L e g a l C o p y r i g h t
M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d .
O r i g i n a l F i l e n a m e
G e t M a c . e x e
P r o d u c t N a m e
M i c r o s o f t
W i n d o w s
O p e r a t i n g S y s t e m
P r o d u c t V e r s i o n
5 . 2 . 3 7 9 0 . 1 8 3 0
V a r F i l e I n f o
T r a n s l a t i o n
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.