SmartHawk

10.4

0-day

59 个模型检测该样本为恶意！

重新分析

下载样本

d006fe0a27ea2f03237104eea8ecd58ee0a34968af2b6804b3970bf26412c0f2

c9eebe45bc14ae83dd5c2d670bccb3fa.exe

分析耗时

76s

最近分析

文件大小

847.0KB

静态报毒动态报毒 0GW@ASWTCVAI AI SCORE=80 AIDETECTVM ALI2000015 CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMWL EMZL FAREIT FORMBOOK GENETIC HIGH CONFIDENCE HQKFJH LOKIBOT MALWARE2 MALWARE@#27AYYPQF6EDB NBFIX NZOEW7K SCORE SIGGEN2 STATIC AI SUSPICIOUS PE TCCK THIAHBO TSCOPE UNSAFE UPAN X2094 ZELPHIF ZUSY 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FPQ!C9EEBE45BC14	20201211	6.0.6.653
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20201210	21.1.5827.0
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Kingsoft		20201211	2017.9.26.565
Tencent	Win32.Trojan.Crypt.Tcck	20201211	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619930391.065375 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a c9eebe45bc14ae83dd5c2d670bccb3fa+0x543f8 @ 0x4543f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74104b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74105d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 180 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe8614ad	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619930391.065375
__exception__

stacktrace:

RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
c9eebe45bc14ae83dd5c2d670bccb3fa+0x543f8 @ 0x4543f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74104b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74105d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 180
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe8614ad

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (28 个事件)

Time & API	Arguments	Status
1619930372.44025 NtAllocateVirtualMemory	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619930373.42525 NtProtectVirtualMemory	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 81920 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00475000	success
1619930373.44025 NtAllocateVirtualMemory	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00500000	success
1619930379.425375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619930380.081375 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01ee0000	success
1619930380.081375 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f80000	success
1619930380.081375 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00560000	success
1619930380.081375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 286720 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00562000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02042000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02042000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02042000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02042000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02042000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02042000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02042000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02042000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02042000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02042000	success
1619930390.972375 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LDR T's and C's June 2020.vbs

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619930373.44025 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x000000f4 process_identifier: 1108	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.508792060702092

section

{'size_of_data': '0x0003e400', 'virtual_address': '0x0009c000', 'entropy': 7.508792060702092, 'name': '.rsrc', 'virtual_size': '0x0003e288'}

description

A section with a high entropy has been found

entropy

0.29432624113475175

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619930379.17525 NtAllocateVirtualMemory	process_identifier: 1816 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000fc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000b0000	success	0	0

Installs itself for autorun at Windows startup (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LDR T's and C's June 2020.vbs

Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3056 created a thread in remote process 1816
1619930379.17525 NtQueueApcThread	thread_handle: 0x000000f8 process_identifier: 1816 function_address: 0x000b05c0 parameter: 0x000c0000	success	0	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619930379.17525 WriteProcessMemory	process_identifier: 1816 buffer: Q¹0d@@@$$YÃVWR¾§ÆgNèYøv· ¿Zwf;Ït ¿Ntf;ÏuÂèÀtÎÁáþÁïÏ¾:Ï3ñBHué_Æ^ÃUìQQMSVWÉt;¸MZf9u1A<Át*8PEu"@xeüÁxX$p @ùÙñEøÀu 3À_^[ÉÃMEüÑèOÿÿÿ;Et ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh@ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿuSÿVSÿV3À9}üÀ_[ÉÃÉtèÀt3ÉfÃUììVðäüÿÿP3ÀPPjPÿVlÀj\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUüäüÿÿèÖUèÎUðèÆÿuìþÿÿÿuPÿVxÄäüÿÿPÿVìþÿÿPèÂ@PìþÿÿPäüÿÿPèîþÿÿÄ^ÉÃUìì,j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEúÔýÿÿè¬UÜè÷EÿPÆEÿèPEÿPÔýÿÿPè?þÿÿÄÉÃUìQeüVðEüPÿuèþYYÀt}ütÿuüPÿuèþÿÿÄÀt3À@ë3À^ÉÃUììSVðÏøýÿÿè'Èè(þÿÿ3ÛSøýÿÿPÿVWÿV8]uWÿuÆè~ÿÿÿYYØë }u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]uWÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿøÿ"h"¿WèÌüÿÿØYYÛjh0hjÿÓðöñh¼Û«½W~`^@èüÿÿhÒ¼WF$èüÿÿh\|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh)·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWFèüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WFèÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~ WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ãWFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32ÿÓøÿt"hÀåz°W~dè,ûÿÿhêêºWFlèûÿÿÄFpEøPÇEøuserfÇEü32ÆEþÿV øÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF\|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷îSè¤ýÿÿØ;ßuWÿDéÕEüPëj2ÿSPÿuüWWÿSLÀuïjdÿSPFEøE9>tYÿ¶¶QP¾Ãè¾üÿÿ}3ÿÄ9>t1jDE¤WPèjEèWPèüÄEèPE¤PWWj WWWWÿuÿS$9¾(tlP,PÿuÃè½úÿÿÄ9¾tëj2ÿSPÿuüWWÿSLÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂUììSW3ÿWWjWjhÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh0PWÿV@Eø;ÇtWMüQÿuô}üPSÿVEüMSÿVEø_[ÉÃ·ffÒtVð+ñÁ·ffÒuñ^ÃUìQQEEüEüEEøEü;EøtEüMEü@EüëçEÉÃf8Vðt Æf>u÷+ò· fÂfÉuñ^ÃD$@Éuù+D$HÃÉu3ÀÃf9Át Àf8u÷+ÁÑøÃÉt èÚÿÿÿÀtDAþë fù\t è·fÉuï3ÀÃ process_handle: 0x000000fc base_address: 0x000b0000	success	1	0
1619930379.17525 WriteProcessMemory	process_identifier: 1816 buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c9eebe45bc14ae83dd5c2d670bccb3fa.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c9eebe45bc14ae83dd5c2d670bccb3fa.exe" LDR T's and C's June 2020Set ImtmVeBn = crEateObjeCt("WsCrIpt.shelL") iMTMVeBn.rUN """%ls""", 0, False process_handle: 0x000000fc base_address: 0x000c0000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3056 called NtSetContextThread to modify thread in remote process 1320
1619930379.20625 NtSetContextThread	thread_handle: 0x00000104 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4864720 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1320	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3056 resumed a thread in remote process 1320
1619930379.26825 NtResumeThread	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 1320	success	0	0

Executed a process and injected code into it, probably while unpacking (11 个事件)

Time & API	Arguments	Status	Return
1619930379.17525 CreateProcessInternalW	thread_identifier: 1376 thread_handle: 0x000000f8 process_identifier: 1816 current_directory: filepath: C:\Windows\System32\notepad.exe track: 1 command_line: filepath_r: C:\Windows\system32\notepad.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x000000fc inherit_handles: 0	success	1
1619930379.17525 NtAllocateVirtualMemory	process_identifier: 1816 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000fc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000b0000	success	0
1619930379.17525 NtAllocateVirtualMemory	process_identifier: 1816 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000000fc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000c0000	success	0
1619930379.17525 WriteProcessMemory	process_identifier: 1816 buffer: Q¹0d@@@$$YÃVWR¾§ÆgNèYøv· ¿Zwf;Ït ¿Ntf;ÏuÂèÀtÎÁáþÁïÏ¾:Ï3ñBHué_Æ^ÃUìQQMSVWÉt;¸MZf9u1A<Át*8PEu"@xeüÁxX$p @ùÙñEøÀu 3À_^[ÉÃMEüÑèOÿÿÿ;Et ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh@ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿuSÿVSÿV3À9}üÀ_[ÉÃÉtèÀt3ÉfÃUììVðäüÿÿP3ÀPPjPÿVlÀj\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUüäüÿÿèÖUèÎUðèÆÿuìþÿÿÿuPÿVxÄäüÿÿPÿVìþÿÿPèÂ@PìþÿÿPäüÿÿPèîþÿÿÄ^ÉÃUìì,j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEúÔýÿÿè¬UÜè÷EÿPÆEÿèPEÿPÔýÿÿPè?þÿÿÄÉÃUìQeüVðEüPÿuèþYYÀt}ütÿuüPÿuèþÿÿÄÀt3À@ë3À^ÉÃUììSVðÏøýÿÿè'Èè(þÿÿ3ÛSøýÿÿPÿVWÿV8]uWÿuÆè~ÿÿÿYYØë }u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]uWÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿøÿ"h"¿WèÌüÿÿØYYÛjh0hjÿÓðöñh¼Û«½W~`^@èüÿÿhÒ¼WF$èüÿÿh\|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh)·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWFèüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WFèÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~ WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ãWFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32ÿÓøÿt"hÀåz°W~dè,ûÿÿhêêºWFlèûÿÿÄFpEøPÇEøuserfÇEü32ÆEþÿV øÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF\|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷îSè¤ýÿÿØ;ßuWÿDéÕEüPëj2ÿSPÿuüWWÿSLÀuïjdÿSPFEøE9>tYÿ¶¶QP¾Ãè¾üÿÿ}3ÿÄ9>t1jDE¤WPèjEèWPèüÄEèPE¤PWWj WWWWÿuÿS$9¾(tlP,PÿuÃè½úÿÿÄ9¾tëj2ÿSPÿuüWWÿSLÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂUììSW3ÿWWjWjhÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh0PWÿV@Eø;ÇtWMüQÿuô}üPSÿVEüMSÿVEø_[ÉÃ·ffÒtVð+ñÁ·ffÒuñ^ÃUìQQEEüEüEEøEü;EøtEüMEü@EüëçEÉÃf8Vðt Æf>u÷+ò· fÂfÉuñ^ÃD$@Éuù+D$HÃÉu3ÀÃf9Át Àf8u÷+ÁÑøÃÉt èÚÿÿÿÀtDAþë fù\t è·fÉuï3ÀÃ process_handle: 0x000000fc base_address: 0x000b0000	success	1
1619930379.17525 WriteProcessMemory	process_identifier: 1816 buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c9eebe45bc14ae83dd5c2d670bccb3fa.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c9eebe45bc14ae83dd5c2d670bccb3fa.exe" LDR T's and C's June 2020Set ImtmVeBn = crEateObjeCt("WsCrIpt.shelL") iMTMVeBn.rUN """%ls""", 0, False process_handle: 0x000000fc base_address: 0x000c0000	success	1
1619930379.19025 CreateProcessInternalW	thread_identifier: 1880 thread_handle: 0x00000104 process_identifier: 1320 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c9eebe45bc14ae83dd5c2d670bccb3fa.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619930379.19025 NtUnmapViewOfSection	process_identifier: 1320 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619930379.19025 NtMapViewOfSection	section_handle: 0x0000010c process_identifier: 1320 commit_size: 675840 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 675840 base_address: 0x00400000	success	0
1619930379.20625 NtGetContextThread	thread_handle: 0x00000104	success	0
1619930379.20625 NtSetContextThread	thread_handle: 0x00000104 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4864720 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1320	success	0
1619930379.26825 NtResumeThread	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 1320	success	0

File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.310651
FireEye	Generic.mg.c9eebe45bc14ae83
McAfee	Fareit-FPQ!C9EEBE45BC14
Cylance	Unsafe
Zillya	Trojan.Agent.Win32.1362051
Sangfor	Malware
K7AntiVirus	Trojan ( 0056cd161 )
BitDefender	Gen:Variant.Zusy.310651
K7GW	Trojan ( 0056cd161 )
Cybereason	malicious.3e76fc
Cyren	W32/Trojan.UPAN-4710
Symantec	Infostealer.Lokibot!43
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.Win32.Crypt.gen
Alibaba	Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus	Trojan.Win32.Crypt.hqkfjh
AegisLab	Trojan.Win32.Crypt.4!c
Rising	Trojan.Injector!1.C99D (CLASSIC)
Ad-Aware	Gen:Variant.Zusy.310651
Sophos	Mal/Generic-S
Comodo	Malware@#27ayypqf6edb
F-Secure	Trojan.TR/Injector.nbfix
DrWeb	Trojan.PWS.Siggen2.53083
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.FORMBOOK.THIAHBO
McAfee-GW-Edition	BehavesLike.Win32.Fareit.ch
Emsisoft	Gen:Variant.Zusy.310651 (B)
Ikarus	Trojan.Inject
Jiangmin	Trojan.Crypt.dvd
Avira	TR/Injector.nbfix
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Win32.Injector
Microsoft	Trojan:Win32/FormBook.GD!MTB
Gridinsoft	Trojan.Win32.Packed.oa
Arcabit	Trojan.Zusy.D4BD7B
ZoneAlarm	HEUR:Trojan.Win32.Crypt.gen
GData	Gen:Variant.Zusy.310651
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2094
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZelphiF.34670.0GW@aSwtcvai
ALYac	Gen:Variant.Zusy.310651
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/Genetic.gen
Zoner	Trojan.Win32.97444
ESET-NOD32	a variant of Win32/Injector.EMWL

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x48d12c DeleteCriticalSection

• 0x48d130 LeaveCriticalSection

• 0x48d134 EnterCriticalSection

• 0x48d138 InitializeCriticalSection

• 0x48d13c VirtualFree

• 0x48d140 VirtualAlloc

• 0x48d144 LocalFree

• 0x48d148 LocalAlloc

• 0x48d14c GetTickCount

• 0x48d150 QueryPerformanceCounter

• 0x48d154 GetVersion

• 0x48d158 GetCurrentThreadId

• 0x48d15c InterlockedDecrement

• 0x48d160 InterlockedIncrement

• 0x48d164 VirtualQuery

• 0x48d168 WideCharToMultiByte

• 0x48d16c MultiByteToWideChar

• 0x48d170 lstrlenA

• 0x48d174 lstrcpynA

• 0x48d178 LoadLibraryExA

• 0x48d17c GetThreadLocale

• 0x48d180 GetStartupInfoA

• 0x48d184 GetProcAddress

• 0x48d188 GetModuleHandleA

• 0x48d18c GetModuleFileNameA

• 0x48d190 GetLocaleInfoA

• 0x48d194 GetCommandLineA

• 0x48d198 FreeLibrary

• 0x48d19c FindFirstFileA

• 0x48d1a0 FindClose

• 0x48d1a4 ExitProcess

• 0x48d1a8 ExitThread

• 0x48d1ac CreateThread

• 0x48d1b0 WriteFile

• 0x48d1b4 UnhandledExceptionFilter

• 0x48d1b8 RtlUnwind

• 0x48d1bc RaiseException

• 0x48d1c0 GetStdHandle

Library user32.dll:

• 0x48d1c8 GetKeyboardType

• 0x48d1cc LoadStringA

• 0x48d1d0 MessageBoxA

• 0x48d1d4 CharNextA

Library advapi32.dll:

• 0x48d1dc RegQueryValueExA

• 0x48d1e0 RegOpenKeyExA

• 0x48d1e4 RegCloseKey

Library oleaut32.dll:

• 0x48d1ec SysFreeString

• 0x48d1f0 SysReAllocStringLen

• 0x48d1f4 SysAllocStringLen

Library kernel32.dll:

• 0x48d1fc TlsSetValue

• 0x48d200 TlsGetValue

• 0x48d204 LocalAlloc

• 0x48d208 GetModuleHandleA

Library advapi32.dll:

• 0x48d210 RegQueryValueExA

• 0x48d214 RegQueryInfoKeyA

• 0x48d218 RegOpenKeyExA

• 0x48d21c RegFlushKey

• 0x48d220 RegEnumKeyExA

• 0x48d224 RegCloseKey

Library kernel32.dll:

• 0x48d22c lstrcpyA

• 0x48d230 WriteFile

• 0x48d234 WaitForSingleObject

• 0x48d238 VirtualQuery

• 0x48d23c VirtualProtect

• 0x48d240 VirtualAlloc

• 0x48d244 SuspendThread

• 0x48d248 Sleep

• 0x48d24c SizeofResource

• 0x48d250 SetThreadPriority

• 0x48d254 SetThreadLocale

• 0x48d258 SetFilePointer

• 0x48d25c SetEvent

• 0x48d260 SetErrorMode

• 0x48d264 SetEndOfFile

• 0x48d268 ResumeThread

• 0x48d26c ResetEvent

• 0x48d270 ReadFile

• 0x48d274 MulDiv

• 0x48d278 LockResource

• 0x48d27c LoadResource

• 0x48d280 LoadLibraryA

• 0x48d284 LeaveCriticalSection

• 0x48d288 InitializeCriticalSection

• 0x48d28c GlobalUnlock

• 0x48d290 GlobalReAlloc

• 0x48d294 GlobalHandle

• 0x48d298 GlobalLock

• 0x48d29c GlobalFree

• 0x48d2a0 GlobalFindAtomA

• 0x48d2a4 GlobalDeleteAtom

• 0x48d2a8 GlobalAlloc

• 0x48d2ac GlobalAddAtomA

• 0x48d2b0 GetVersionExA

• 0x48d2b4 GetVersion

• 0x48d2b8 GetTimeZoneInformation

• 0x48d2bc GetTickCount

• 0x48d2c0 GetThreadLocale

• 0x48d2c4 GetTempPathA

• 0x48d2c8 GetSystemTimeAsFileTime

• 0x48d2cc GetSystemInfo

• 0x48d2d0 GetStringTypeExA

• 0x48d2d4 GetStdHandle

• 0x48d2d8 GetProcAddress

• 0x48d2dc GetModuleHandleA

• 0x48d2e0 GetModuleFileNameA

• 0x48d2e4 GetLocaleInfoA

• 0x48d2e8 GetLocalTime

• 0x48d2ec GetLastError

• 0x48d2f0 GetFullPathNameA

• 0x48d2f4 GetFileSize

• 0x48d2f8 GetExitCodeThread

• 0x48d2fc GetDiskFreeSpaceA

• 0x48d300 GetDateFormatA

• 0x48d304 GetCurrentThreadId

• 0x48d308 GetCurrentProcessId

• 0x48d30c GetCPInfo

• 0x48d310 GetACP

• 0x48d314 FreeResource

• 0x48d318 InterlockedIncrement

• 0x48d31c InterlockedExchange

• 0x48d320 InterlockedDecrement

• 0x48d324 FreeLibrary

• 0x48d328 FormatMessageA

• 0x48d32c FindResourceA

• 0x48d330 FindFirstFileA

• 0x48d334 FindClose

• 0x48d338 FileTimeToSystemTime

• 0x48d33c FileTimeToLocalFileTime

• 0x48d340 FileTimeToDosDateTime

• 0x48d344 EnumCalendarInfoA

• 0x48d348 EnterCriticalSection

• 0x48d34c DeleteCriticalSection

• 0x48d350 CreateThread

• 0x48d354 CreateFileA

• 0x48d358 CreateEventA

• 0x48d35c CompareStringA

• 0x48d360 CloseHandle

Library version.dll:

• 0x48d368 VerQueryValueA

• 0x48d36c GetFileVersionInfoSizeA

• 0x48d370 GetFileVersionInfoA

Library gdi32.dll:

• 0x48d378 UnrealizeObject

• 0x48d37c StretchBlt

• 0x48d380 SetWindowOrgEx

• 0x48d384 SetViewportOrgEx

• 0x48d388 SetTextColor

• 0x48d38c SetStretchBltMode

• 0x48d390 SetROP2

• 0x48d394 SetPixel

• 0x48d398 SetDIBColorTable

• 0x48d39c SetBrushOrgEx

• 0x48d3a0 SetBkMode

• 0x48d3a4 SetBkColor

• 0x48d3a8 SelectPalette

• 0x48d3ac SelectObject

• 0x48d3b0 SaveDC

• 0x48d3b4 RestoreDC

• 0x48d3b8 Rectangle

• 0x48d3bc RectVisible

• 0x48d3c0 RealizePalette

• 0x48d3c4 PatBlt

• 0x48d3c8 MoveToEx

• 0x48d3cc MaskBlt

• 0x48d3d0 LineTo

• 0x48d3d4 IntersectClipRect

• 0x48d3d8 GetWindowOrgEx

• 0x48d3dc GetTextMetricsA

• 0x48d3e0 GetTextExtentPoint32A

• 0x48d3e4 GetSystemPaletteEntries

• 0x48d3e8 GetStockObject

• 0x48d3ec GetPixel

• 0x48d3f0 GetPaletteEntries

• 0x48d3f4 GetObjectA

• 0x48d3f8 GetDeviceCaps

• 0x48d3fc GetDIBits

• 0x48d400 GetDIBColorTable

• 0x48d404 GetDCOrgEx

• 0x48d408 GetCurrentPositionEx

• 0x48d40c GetClipBox

• 0x48d410 GetBrushOrgEx

• 0x48d414 GetBitmapBits

• 0x48d418 ExcludeClipRect

• 0x48d41c DeleteObject

• 0x48d420 DeleteDC

• 0x48d424 CreateSolidBrush

• 0x48d428 CreatePenIndirect

• 0x48d42c CreatePen

• 0x48d430 CreatePalette

• 0x48d434 CreateHalftonePalette

• 0x48d438 CreateFontIndirectA

• 0x48d43c CreateDIBitmap

• 0x48d440 CreateDIBSection

• 0x48d444 CreateCompatibleDC

• 0x48d448 CreateCompatibleBitmap

• 0x48d44c CreateBrushIndirect

• 0x48d450 CreateBitmap

• 0x48d454 BitBlt

Library user32.dll:

• 0x48d45c CreateWindowExA

• 0x48d460 WindowFromPoint

• 0x48d464 WinHelpA

• 0x48d468 WaitMessage

• 0x48d46c ValidateRect

• 0x48d470 UpdateWindow

• 0x48d474 UnregisterClassA

• 0x48d478 UnhookWindowsHookEx

• 0x48d47c TranslateMessage

• 0x48d480 TranslateMDISysAccel

• 0x48d484 TrackPopupMenu

• 0x48d488 SystemParametersInfoA

• 0x48d48c ShowWindow

• 0x48d490 ShowScrollBar

• 0x48d494 ShowOwnedPopups

• 0x48d498 ShowCursor

• 0x48d49c SetWindowsHookExA

• 0x48d4a0 SetWindowTextA

• 0x48d4a4 SetWindowPos

• 0x48d4a8 SetWindowPlacement

• 0x48d4ac SetWindowLongA

• 0x48d4b0 SetTimer

• 0x48d4b4 SetScrollRange

• 0x48d4b8 SetScrollPos

• 0x48d4bc SetScrollInfo

• 0x48d4c0 SetRect

• 0x48d4c4 SetPropA

• 0x48d4c8 SetParent

• 0x48d4cc SetMenuItemInfoA

• 0x48d4d0 SetMenu

• 0x48d4d4 SetForegroundWindow

• 0x48d4d8 SetFocus

• 0x48d4dc SetCursor

• 0x48d4e0 SetClassLongA

• 0x48d4e4 SetCapture

• 0x48d4e8 SetActiveWindow

• 0x48d4ec SendMessageA

• 0x48d4f0 ScrollWindow

• 0x48d4f4 ScreenToClient

• 0x48d4f8 RemovePropA

• 0x48d4fc RemoveMenu

• 0x48d500 ReleaseDC

• 0x48d504 ReleaseCapture

• 0x48d508 RegisterWindowMessageA

• 0x48d50c RegisterClipboardFormatA

• 0x48d510 RegisterClassA

• 0x48d514 RedrawWindow

• 0x48d518 PtInRect

• 0x48d51c PostQuitMessage

• 0x48d520 PostMessageA

• 0x48d524 PeekMessageA

• 0x48d528 OffsetRect

• 0x48d52c OemToCharA

• 0x48d530 MsgWaitForMultipleObjects

• 0x48d534 MessageBoxA

• 0x48d538 MessageBeep

• 0x48d53c MapWindowPoints

• 0x48d540 MapVirtualKeyA

• 0x48d544 LoadStringA

• 0x48d548 LoadKeyboardLayoutA

• 0x48d54c LoadIconA

• 0x48d550 LoadCursorA

• 0x48d554 LoadBitmapA

• 0x48d558 KillTimer

• 0x48d55c IsZoomed

• 0x48d560 IsWindowVisible

• 0x48d564 IsWindowEnabled

• 0x48d568 IsWindow

• 0x48d56c IsRectEmpty

• 0x48d570 IsIconic

• 0x48d574 IsDialogMessageA

• 0x48d578 IsChild

• 0x48d57c InvalidateRect

• 0x48d580 IntersectRect

• 0x48d584 InsertMenuItemA

• 0x48d588 InsertMenuA

• 0x48d58c InflateRect

• 0x48d590 GetWindowThreadProcessId

• 0x48d594 GetWindowTextA

• 0x48d598 GetWindowRect

• 0x48d59c GetWindowPlacement

• 0x48d5a0 GetWindowLongA

• 0x48d5a4 GetWindowDC

• 0x48d5a8 GetTopWindow

• 0x48d5ac GetSystemMetrics

• 0x48d5b0 GetSystemMenu

• 0x48d5b4 GetSysColorBrush

• 0x48d5b8 GetSysColor

• 0x48d5bc GetSubMenu

• 0x48d5c0 GetScrollRange

• 0x48d5c4 GetScrollPos

• 0x48d5c8 GetScrollInfo

• 0x48d5cc GetPropA

• 0x48d5d0 GetParent

• 0x48d5d4 GetWindow

• 0x48d5d8 GetMessageTime

• 0x48d5dc GetMenuStringA

• 0x48d5e0 GetMenuState

• 0x48d5e4 GetMenuItemInfoA

• 0x48d5e8 GetMenuItemID

• 0x48d5ec GetMenuItemCount

• 0x48d5f0 GetMenu

• 0x48d5f4 GetLastActivePopup

• 0x48d5f8 GetKeyboardState

• 0x48d5fc GetKeyboardLayoutList

• 0x48d600 GetKeyboardLayout

• 0x48d604 GetKeyState

• 0x48d608 GetKeyNameTextA

• 0x48d60c GetIconInfo

• 0x48d610 GetForegroundWindow

• 0x48d614 GetFocus

• 0x48d618 GetDlgItem

• 0x48d61c GetDesktopWindow

• 0x48d620 GetDCEx

• 0x48d624 GetDC

• 0x48d628 GetCursorPos

• 0x48d62c GetCursor

• 0x48d630 GetClientRect

• 0x48d634 GetClassNameA

• 0x48d638 GetClassInfoA

• 0x48d63c GetCapture

• 0x48d640 GetActiveWindow

• 0x48d644 FrameRect

• 0x48d648 FindWindowA

• 0x48d64c FillRect

• 0x48d650 EqualRect

• 0x48d654 EnumWindows

• 0x48d658 EnumThreadWindows

• 0x48d65c EndPaint

• 0x48d660 EnableWindow

• 0x48d664 EnableScrollBar

• 0x48d668 EnableMenuItem

• 0x48d66c DrawTextA

• 0x48d670 DrawMenuBar

• 0x48d674 DrawIconEx

• 0x48d678 DrawIcon

• 0x48d67c DrawFrameControl

• 0x48d680 DrawFocusRect

• 0x48d684 DrawEdge

• 0x48d688 DispatchMessageA

• 0x48d68c DestroyWindow

• 0x48d690 DestroyMenu

• 0x48d694 DestroyIcon

• 0x48d698 DestroyCursor

• 0x48d69c DeleteMenu

• 0x48d6a0 DefWindowProcA

• 0x48d6a4 DefMDIChildProcA

• 0x48d6a8 DefFrameProcA

• 0x48d6ac CreatePopupMenu

• 0x48d6b0 CreateMenu

• 0x48d6b4 CreateIcon

• 0x48d6b8 ClientToScreen

• 0x48d6bc CheckMenuItem

• 0x48d6c0 CallWindowProcA

• 0x48d6c4 CallNextHookEx

• 0x48d6c8 BeginPaint

• 0x48d6cc CharNextA

• 0x48d6d0 CharLowerBuffA

• 0x48d6d4 CharLowerA

• 0x48d6d8 CharUpperBuffA

• 0x48d6dc CharToOemA

• 0x48d6e0 AdjustWindowRectEx

• 0x48d6e4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x48d6ec Sleep

Library oleaut32.dll:

• 0x48d6f4 SafeArrayPtrOfIndex

• 0x48d6f8 SafeArrayGetUBound

• 0x48d6fc SafeArrayGetLBound

• 0x48d700 SafeArrayCreate

• 0x48d704 VariantChangeType

• 0x48d708 VariantCopy

• 0x48d70c VariantClear

• 0x48d710 VariantInit

Library comctl32.dll:

• 0x48d718 ImageList_SetIconSize

• 0x48d71c ImageList_GetIconSize

• 0x48d720 ImageList_Write

• 0x48d724 ImageList_Read

• 0x48d728 ImageList_GetDragImage

• 0x48d72c ImageList_DragShowNolock

• 0x48d730 ImageList_SetDragCursorImage

• 0x48d734 ImageList_DragMove

• 0x48d738 ImageList_DragLeave

• 0x48d73c ImageList_DragEnter

• 0x48d740 ImageList_EndDrag

• 0x48d744 ImageList_BeginDrag

• 0x48d748 ImageList_Remove

• 0x48d74c ImageList_DrawEx

• 0x48d750 ImageList_Replace

• 0x48d754 ImageList_Draw

• 0x48d758 ImageList_GetBkColor

• 0x48d75c ImageList_SetBkColor

• 0x48d760 ImageList_ReplaceIcon

• 0x48d764 ImageList_Add

• 0x48d768 ImageList_GetImageCount

• 0x48d76c ImageList_Destroy

• 0x48d770 ImageList_Create

• 0x48d774 InitCommonControls

Library comdlg32.dll:

• 0x48d77c GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com		127.0.0.1
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.