SmartHawk

4.8

中危

52 个模型检测该样本为恶意！

重新分析

下载样本

9dbdec587ca0c7713c3b5bb6e95803937226529b3b4515df219a8860cecfe76d

ca2515407da5152297aef4e50a789d58.exe

分析耗时

98s

最近分析

文件大小

956.0KB

静态报毒动态报毒 7GX@AM6VEDEI AI SCORE=84 BSCOPE CLOUD CONFIDENCE EKLE EMAL FAREIT GDSDA GENERICKD GENERICRXKQ GENKRYPTIK HIGH CONFIDENCE HKJZBL KRYPTIK MALICIOUS MALICIOUS PE NANOCORE QVM05 R337020 RATX REMCOS SIGGEN9 SONBOKLI SUSGEN SXXT THEBFBO TIGGRE TRJGEN UNSAFE WACATAC ZELPHICO ZFYLH 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXKQ-YP!CA2515407DA5	20200603	6.0.6.653
Alibaba	Backdoor:Win32/Injector.1dddded2	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:RATX-gen [Trj]	20200602	18.4.3895.0
Kingsoft		20200603	2013.8.14.323
Tencent	Win32.Backdoor.Remcos.Sxxt	20200603	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619926769.490375 __exception__	stacktrace: 0x22b1722 0x22b1755 0x22b1672 0x226f654 0x22b28cd 0x22b2d92 0x227e2ba gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x775a7bca 0x22af34c 0x22b2fe3 ca2515407da5152297aef4e50a789d58+0x63074 @ 0x463074 0x2260338 registers.esp: 1633948 registers.edi: 0 registers.eax: 1633948 registers.ebp: 1634028 registers.edx: 0 registers.ebx: 1635704 registers.esi: 56704044 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619926727.319375 NtAllocateVirtualMemory	process_identifier: 2208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00610000	success	0	0
1619926733.240375 NtAllocateVirtualMemory	process_identifier: 2208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022d0000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

MicroWorld-eScan	Trojan.GenericKD.33875872
CAT-QuickHeal	Backdoor.Remcos
McAfee	GenericRXKQ-YP!CA2515407DA5
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005671781 )
Alibaba	Backdoor:Win32/Injector.1dddded2
K7GW	Trojan ( 005671781 )
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
BitDefender	Trojan.GenericKD.33875872
NANO-Antivirus	Trojan.Win32.TrjGen.hkjzbl
Paloalto	generic.ml
AegisLab	Trojan.Win32.Remcos.m!c
Rising	Trojan.Kryptik!1.C56D (CLOUD)
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Injector.zfylh
DrWeb	Trojan.Siggen9.47290
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.WACATAC.THEBFBO
McAfee-GW-Edition	BehavesLike.Win32.Fareit.dh
MaxSecure	Trojan.Malware.9833444.susgen
FireEye	Generic.mg.ca2515407da51522
Emsisoft	Trojan.GenericKD.33875872 (B)
SentinelOne	DFI - Malicious PE
Webroot	W32.Trojan.Gen
Avira	TR/Injector.zfylh
Antiy-AVL	Trojan/Win32.Sonbokli
Microsoft	Trojan:Win32/Tiggre!rfn
Arcabit	Trojan.Generic.D204E7A0
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Trojan.GenericKD.33875872
AhnLab-V3	Trojan/Win32.Remcos.R337020
Acronis	suspicious
VBA32	BScope.TrojanDropper.Agent
ALYac	Trojan.GenericKD.33875872
MAX	malware (ai score=84)
Ad-Aware	Trojan.GenericKD.33875872
Malwarebytes	Trojan.MalPack
ESET-NOD32	a variant of Win32/Injector.EMAL
TrendMicro-HouseCall	Trojan.Win32.WACATAC.THEBFBO
Tencent	Win32.Backdoor.Remcos.Sxxt
Ikarus	Trojan.MSIL.NanoCore
Fortinet	W32/GenKryptik.EKLE!tr
BitDefenderTheta	Gen:NN.ZelphiCO.34122.7GX@am6VEdei
AVG	Win32:RATX-gen [Trj]
Panda	Trj/GdSda.A

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	23.225.141.210:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4c3154 DeleteCriticalSection

• 0x4c3158 LeaveCriticalSection

• 0x4c315c EnterCriticalSection

• 0x4c3160 InitializeCriticalSection

• 0x4c3164 VirtualFree

• 0x4c3168 VirtualAlloc

• 0x4c316c LocalFree

• 0x4c3170 LocalAlloc

• 0x4c3174 GetVersion

• 0x4c3178 GetCurrentThreadId

• 0x4c317c InterlockedDecrement

• 0x4c3180 InterlockedIncrement

• 0x4c3184 VirtualQuery

• 0x4c3188 WideCharToMultiByte

• 0x4c318c MultiByteToWideChar

• 0x4c3190 lstrlenA

• 0x4c3194 lstrcpynA

• 0x4c3198 LoadLibraryExA

• 0x4c319c GetThreadLocale

• 0x4c31a0 GetStartupInfoA

• 0x4c31a4 GetProcAddress

• 0x4c31a8 GetModuleHandleA

• 0x4c31ac GetModuleFileNameA

• 0x4c31b0 GetLocaleInfoA

• 0x4c31b4 GetCommandLineA

• 0x4c31b8 FreeLibrary

• 0x4c31bc FindFirstFileA

• 0x4c31c0 FindClose

• 0x4c31c4 ExitProcess

• 0x4c31c8 WriteFile

• 0x4c31cc UnhandledExceptionFilter

• 0x4c31d0 RtlUnwind

• 0x4c31d4 RaiseException

• 0x4c31d8 GetStdHandle

Library user32.dll:

• 0x4c31e0 GetKeyboardType

• 0x4c31e4 LoadStringA

• 0x4c31e8 MessageBoxA

• 0x4c31ec CharNextA

Library advapi32.dll:

• 0x4c31f4 RegQueryValueExA

• 0x4c31f8 RegOpenKeyExA

• 0x4c31fc RegCloseKey

Library oleaut32.dll:

• 0x4c3204 SysFreeString

• 0x4c3208 SysReAllocStringLen

• 0x4c320c SysAllocStringLen

Library kernel32.dll:

• 0x4c3214 TlsSetValue

• 0x4c3218 TlsGetValue

• 0x4c321c LocalAlloc

• 0x4c3220 GetModuleHandleA

Library advapi32.dll:

• 0x4c3228 RegQueryValueExA

• 0x4c322c RegOpenKeyExA

• 0x4c3230 RegCloseKey

Library kernel32.dll:

• 0x4c3238 lstrcpyA

• 0x4c323c WriteFile

• 0x4c3240 WaitForSingleObject

• 0x4c3244 VirtualQuery

• 0x4c3248 VirtualProtect

• 0x4c324c VirtualAlloc

• 0x4c3250 Sleep

• 0x4c3254 SizeofResource

• 0x4c3258 SetThreadLocale

• 0x4c325c SetFilePointer

• 0x4c3260 SetEvent

• 0x4c3264 SetErrorMode

• 0x4c3268 SetEndOfFile

• 0x4c326c ResetEvent

• 0x4c3270 ReadFile

• 0x4c3274 MulDiv

• 0x4c3278 LockResource

• 0x4c327c LoadResource

• 0x4c3280 LoadLibraryA

• 0x4c3284 LeaveCriticalSection

• 0x4c3288 InitializeCriticalSection

• 0x4c328c GlobalUnlock

• 0x4c3290 GlobalReAlloc

• 0x4c3294 GlobalHandle

• 0x4c3298 GlobalLock

• 0x4c329c GlobalFree

• 0x4c32a0 GlobalFindAtomA

• 0x4c32a4 GlobalDeleteAtom

• 0x4c32a8 GlobalAlloc

• 0x4c32ac GlobalAddAtomA

• 0x4c32b0 GetVersionExA

• 0x4c32b4 GetVersion

• 0x4c32b8 GetTickCount

• 0x4c32bc GetThreadLocale

• 0x4c32c0 GetSystemInfo

• 0x4c32c4 GetStringTypeExA

• 0x4c32c8 GetStdHandle

• 0x4c32cc GetProcAddress

• 0x4c32d0 GetModuleHandleA

• 0x4c32d4 GetModuleFileNameA

• 0x4c32d8 GetLocaleInfoA

• 0x4c32dc GetLocalTime

• 0x4c32e0 GetLastError

• 0x4c32e4 GetFullPathNameA

• 0x4c32e8 GetDiskFreeSpaceA

• 0x4c32ec GetDateFormatA

• 0x4c32f0 GetCurrentThreadId

• 0x4c32f4 GetCurrentProcessId

• 0x4c32f8 GetCPInfo

• 0x4c32fc GetACP

• 0x4c3300 FreeResource

• 0x4c3304 InterlockedExchange

• 0x4c3308 FreeLibrary

• 0x4c330c FormatMessageA

• 0x4c3310 FindResourceA

• 0x4c3314 FindFirstFileA

• 0x4c3318 FindClose

• 0x4c331c FileTimeToLocalFileTime

• 0x4c3320 FileTimeToDosDateTime

• 0x4c3324 EnumCalendarInfoA

• 0x4c3328 EnterCriticalSection

• 0x4c332c DeleteCriticalSection

• 0x4c3330 CreateThread

• 0x4c3334 CreateFileA

• 0x4c3338 CreateEventA

• 0x4c333c CompareStringA

• 0x4c3340 CloseHandle

Library version.dll:

• 0x4c3348 VerQueryValueA

• 0x4c334c GetFileVersionInfoSizeA

• 0x4c3350 GetFileVersionInfoA

Library gdi32.dll:

• 0x4c3358 UnrealizeObject

• 0x4c335c StretchBlt

• 0x4c3360 SetWindowOrgEx

• 0x4c3364 SetWindowExtEx

• 0x4c3368 SetWinMetaFileBits

• 0x4c336c SetViewportOrgEx

• 0x4c3370 SetViewportExtEx

• 0x4c3374 SetTextColor

• 0x4c3378 SetStretchBltMode

• 0x4c337c SetROP2

• 0x4c3380 SetPixel

• 0x4c3384 SetMapMode

• 0x4c3388 SetEnhMetaFileBits

• 0x4c338c SetDIBColorTable

• 0x4c3390 SetBrushOrgEx

• 0x4c3394 SetBkMode

• 0x4c3398 SetBkColor

• 0x4c339c SelectPalette

• 0x4c33a0 SelectObject

• 0x4c33a4 SaveDC

• 0x4c33a8 RestoreDC

• 0x4c33ac RectVisible

• 0x4c33b0 RealizePalette

• 0x4c33b4 Polyline

• 0x4c33b8 PolyPolyline

• 0x4c33bc PlayEnhMetaFile

• 0x4c33c0 PatBlt

• 0x4c33c4 MoveToEx

• 0x4c33c8 MaskBlt

• 0x4c33cc LineTo

• 0x4c33d0 IntersectClipRect

• 0x4c33d4 GetWindowOrgEx

• 0x4c33d8 GetWinMetaFileBits

• 0x4c33dc GetTextMetricsA

• 0x4c33e0 GetTextExtentPoint32A

• 0x4c33e4 GetSystemPaletteEntries

• 0x4c33e8 GetStockObject

• 0x4c33ec GetPixel

• 0x4c33f0 GetPaletteEntries

• 0x4c33f4 GetObjectA

• 0x4c33f8 GetEnhMetaFilePaletteEntries

• 0x4c33fc GetEnhMetaFileHeader

• 0x4c3400 GetEnhMetaFileBits

• 0x4c3404 GetDeviceCaps

• 0x4c3408 GetDIBits

• 0x4c340c GetDIBColorTable

• 0x4c3410 GetDCOrgEx

• 0x4c3414 GetCurrentPositionEx

• 0x4c3418 GetClipBox

• 0x4c341c GetBrushOrgEx

• 0x4c3420 GetBitmapBits

• 0x4c3424 ExtTextOutA

• 0x4c3428 ExtCreatePen

• 0x4c342c ExcludeClipRect

• 0x4c3430 DeleteObject

• 0x4c3434 DeleteEnhMetaFile

• 0x4c3438 DeleteDC

• 0x4c343c CreateSolidBrush

• 0x4c3440 CreatePenIndirect

• 0x4c3444 CreatePalette

• 0x4c3448 CreateHalftonePalette

• 0x4c344c CreateFontIndirectA

• 0x4c3450 CreateDIBitmap

• 0x4c3454 CreateDIBSection

• 0x4c3458 CreateCompatibleDC

• 0x4c345c CreateCompatibleBitmap

• 0x4c3460 CreateBrushIndirect

• 0x4c3464 CreateBitmap

• 0x4c3468 CopyEnhMetaFileA

• 0x4c346c BitBlt

Library user32.dll:

• 0x4c3474 CreateWindowExA

• 0x4c3478 WindowFromPoint

• 0x4c347c WinHelpA

• 0x4c3480 WaitMessage

• 0x4c3484 ValidateRect

• 0x4c3488 UpdateWindow

• 0x4c348c UnregisterClassA

• 0x4c3490 UnionRect

• 0x4c3494 UnhookWindowsHookEx

• 0x4c3498 TranslateMessage

• 0x4c349c TranslateMDISysAccel

• 0x4c34a0 TrackPopupMenu

• 0x4c34a4 SystemParametersInfoA

• 0x4c34a8 ShowWindow

• 0x4c34ac ShowScrollBar

• 0x4c34b0 ShowOwnedPopups

• 0x4c34b4 ShowCursor

• 0x4c34b8 SetWindowsHookExA

• 0x4c34bc SetWindowTextA

• 0x4c34c0 SetWindowPos

• 0x4c34c4 SetWindowPlacement

• 0x4c34c8 SetWindowLongA

• 0x4c34cc SetTimer

• 0x4c34d0 SetScrollRange

• 0x4c34d4 SetScrollPos

• 0x4c34d8 SetScrollInfo

• 0x4c34dc SetRect

• 0x4c34e0 SetPropA

• 0x4c34e4 SetParent

• 0x4c34e8 SetMenuItemInfoA

• 0x4c34ec SetMenu

• 0x4c34f0 SetKeyboardState

• 0x4c34f4 SetForegroundWindow

• 0x4c34f8 SetFocus

• 0x4c34fc SetCursor

• 0x4c3500 SetClipboardData

• 0x4c3504 SetClassLongA

• 0x4c3508 SetCapture

• 0x4c350c SetActiveWindow

• 0x4c3510 SendMessageA

• 0x4c3514 ScrollWindowEx

• 0x4c3518 ScrollWindow

• 0x4c351c ScreenToClient

• 0x4c3520 RemovePropA

• 0x4c3524 RemoveMenu

• 0x4c3528 ReleaseDC

• 0x4c352c ReleaseCapture

• 0x4c3530 RegisterWindowMessageA

• 0x4c3534 RegisterClipboardFormatA

• 0x4c3538 RegisterClassA

• 0x4c353c RedrawWindow

• 0x4c3540 PtInRect

• 0x4c3544 PostQuitMessage

• 0x4c3548 PostMessageA

• 0x4c354c PeekMessageA

• 0x4c3550 OpenClipboard

• 0x4c3554 OffsetRect

• 0x4c3558 OemToCharA

• 0x4c355c MessageBoxA

• 0x4c3560 MessageBeep

• 0x4c3564 MapWindowPoints

• 0x4c3568 MapVirtualKeyA

• 0x4c356c LoadStringA

• 0x4c3570 LoadKeyboardLayoutA

• 0x4c3574 LoadIconA

• 0x4c3578 LoadCursorA

• 0x4c357c LoadBitmapA

• 0x4c3580 KillTimer

• 0x4c3584 IsZoomed

• 0x4c3588 IsWindowVisible

• 0x4c358c IsWindowEnabled

• 0x4c3590 IsWindow

• 0x4c3594 IsRectEmpty

• 0x4c3598 IsIconic

• 0x4c359c IsDialogMessageA

• 0x4c35a0 IsChild

• 0x4c35a4 IsCharAlphaNumericA

• 0x4c35a8 IsCharAlphaA

• 0x4c35ac InvalidateRect

• 0x4c35b0 IntersectRect

• 0x4c35b4 InsertMenuItemA

• 0x4c35b8 InsertMenuA

• 0x4c35bc InflateRect

• 0x4c35c0 GetWindowThreadProcessId

• 0x4c35c4 GetWindowTextA

• 0x4c35c8 GetWindowRect

• 0x4c35cc GetWindowPlacement

• 0x4c35d0 GetWindowLongA

• 0x4c35d4 GetWindowDC

• 0x4c35d8 GetTopWindow

• 0x4c35dc GetSystemMetrics

• 0x4c35e0 GetSystemMenu

• 0x4c35e4 GetSysColorBrush

• 0x4c35e8 GetSysColor

• 0x4c35ec GetSubMenu

• 0x4c35f0 GetScrollRange

• 0x4c35f4 GetScrollPos

• 0x4c35f8 GetScrollInfo

• 0x4c35fc GetPropA

• 0x4c3600 GetParent

• 0x4c3604 GetWindow

• 0x4c3608 GetMessageTime

• 0x4c360c GetMenuStringA

• 0x4c3610 GetMenuState

• 0x4c3614 GetMenuItemInfoA

• 0x4c3618 GetMenuItemID

• 0x4c361c GetMenuItemCount

• 0x4c3620 GetMenu

• 0x4c3624 GetLastActivePopup

• 0x4c3628 GetKeyboardState

• 0x4c362c GetKeyboardLayoutList

• 0x4c3630 GetKeyboardLayout

• 0x4c3634 GetKeyState

• 0x4c3638 GetKeyNameTextA

• 0x4c363c GetIconInfo

• 0x4c3640 GetForegroundWindow

• 0x4c3644 GetFocus

• 0x4c3648 GetDoubleClickTime

• 0x4c364c GetDlgItem

• 0x4c3650 GetDesktopWindow

• 0x4c3654 GetDCEx

• 0x4c3658 GetDC

• 0x4c365c GetCursorPos

• 0x4c3660 GetCursor

• 0x4c3664 GetClipboardData

• 0x4c3668 GetClientRect

• 0x4c366c GetClassNameA

• 0x4c3670 GetClassInfoA

• 0x4c3674 GetCaretPos

• 0x4c3678 GetCapture

• 0x4c367c GetActiveWindow

• 0x4c3680 FrameRect

• 0x4c3684 FindWindowA

• 0x4c3688 FillRect

• 0x4c368c EqualRect

• 0x4c3690 EnumWindows

• 0x4c3694 EnumThreadWindows

• 0x4c3698 EnumClipboardFormats

• 0x4c369c EndPaint

• 0x4c36a0 EnableWindow

• 0x4c36a4 EnableScrollBar

• 0x4c36a8 EnableMenuItem

• 0x4c36ac EmptyClipboard

• 0x4c36b0 DrawTextA

• 0x4c36b4 DrawMenuBar

• 0x4c36b8 DrawIconEx

• 0x4c36bc DrawIcon

• 0x4c36c0 DrawFrameControl

• 0x4c36c4 DrawFocusRect

• 0x4c36c8 DrawEdge

• 0x4c36cc DispatchMessageA

• 0x4c36d0 DestroyWindow

• 0x4c36d4 DestroyMenu

• 0x4c36d8 DestroyIcon

• 0x4c36dc DestroyCursor

• 0x4c36e0 DeleteMenu

• 0x4c36e4 DefWindowProcA

• 0x4c36e8 DefMDIChildProcA

• 0x4c36ec DefFrameProcA

• 0x4c36f0 CreatePopupMenu

• 0x4c36f4 CreateMenu

• 0x4c36f8 CreateIcon

• 0x4c36fc CloseClipboard

• 0x4c3700 ClientToScreen

• 0x4c3704 CheckMenuItem

• 0x4c3708 CallWindowProcA

• 0x4c370c CallNextHookEx

• 0x4c3710 BeginPaint

• 0x4c3714 CharNextA

• 0x4c3718 CharLowerBuffA

• 0x4c371c CharLowerA

• 0x4c3720 CharUpperBuffA

• 0x4c3724 CharToOemA

• 0x4c3728 AdjustWindowRectEx

• 0x4c372c ActivateKeyboardLayout

Library kernel32.dll:

• 0x4c3734 Sleep

Library oleaut32.dll:

• 0x4c373c SafeArrayPtrOfIndex

• 0x4c3740 SafeArrayGetUBound

• 0x4c3744 SafeArrayGetLBound

• 0x4c3748 SafeArrayCreate

• 0x4c374c VariantChangeType

• 0x4c3750 VariantCopy

• 0x4c3754 VariantClear

• 0x4c3758 VariantInit

Library comctl32.dll:

• 0x4c3760 ImageList_SetIconSize

• 0x4c3764 ImageList_GetIconSize

• 0x4c3768 ImageList_Write

• 0x4c376c ImageList_Read

• 0x4c3770 ImageList_GetDragImage

• 0x4c3774 ImageList_DragShowNolock

• 0x4c3778 ImageList_SetDragCursorImage

• 0x4c377c ImageList_DragMove

• 0x4c3780 ImageList_DragLeave

• 0x4c3784 ImageList_DragEnter

• 0x4c3788 ImageList_EndDrag

• 0x4c378c ImageList_BeginDrag

• 0x4c3790 ImageList_Remove

• 0x4c3794 ImageList_DrawEx

• 0x4c3798 ImageList_Draw

• 0x4c379c ImageList_GetBkColor

• 0x4c37a0 ImageList_SetBkColor

• 0x4c37a4 ImageList_ReplaceIcon

• 0x4c37a8 ImageList_Add

• 0x4c37ac ImageList_SetImageCount

• 0x4c37b0 ImageList_GetImageCount

• 0x4c37b4 ImageList_Destroy

• 0x4c37b8 ImageList_Create

• 0x4c37bc InitCommonControls

Library comdlg32.dll:

• 0x4c37c4 GetOpenFileNameA

Library kernel32.dll:

• 0x4c37cc MulDiv

Library URL.DLL:

• 0x4c37d4 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	216.58.200.238
drive.google.com	A 23.225.141.210	108.160.163.117
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.