SmartHawk

11.4

0-day

51 个模型检测该样本为恶意！

重新分析

下载样本

4726eed001138aea3c2d50ba075fd7f4b7bed0dd5df92321e6d43a9d9557809a

cccca0905235efd701cd8d0c5c5c0bc9.exe

分析耗时

88s

最近分析

文件大小

587.0KB

静态报毒动态报毒 AI SCORE=88 AIDETECTVM AUTOG CKGENERIC CLOUD CONFIDENCE DELF DELPHILESS EMOY EMRP FAREIT GENERICKD GENETIC HIGH CONFIDENCE HODBUF HPLOKI KGW@AI2NKFFI KRYPTIK LOKIBOT MALWARE1 MALWARE@#2JT1SXYKM2VWU OPQPG PUTTY SCORE SMBD SUSPICIOUS PE TSCOPE TSPY VTSQ X2091 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Kryptik.156e7050	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Tencent		20200818	1.0.0.1
Baidu		20190318	1.0.0.2
Kingsoft		20200818	2013.8.14.323
McAfee	Fareit-FVZ!CCCCA0905235	20200818	6.0.6.653

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619926023.749625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619926025.155625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619926025.249625 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619926019.718625 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619926018.641125 NtAllocateVirtualMemory	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619926018.953125 NtProtectVirtualMemory	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0045c000	success
1619926018.953125 NtAllocateVirtualMemory	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00740000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619926025.233625 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\cccca0905235efd701cd8d0c5c5c0bc9.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\cccca0905235efd701cd8d0c5c5c0bc9.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.214987752839771

section

{'size_of_data': '0x00024200', 'virtual_address': '0x00075000', 'entropy': 7.214987752839771, 'name': '.rsrc', 'virtual_size': '0x0002408c'}

description

A section with a high entropy has been found

entropy

0.24658703071672355

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619926024.952625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 called NtSetContextThread to modify thread in remote process 2476
1619926018.984125 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2476	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 resumed a thread in remote process 2476
1619926019.094125 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2476	success	0	0

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619926018.984125 CreateProcessInternalW	thread_identifier: 1632 thread_handle: 0x000000fc process_identifier: 2476 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\cccca0905235efd701cd8d0c5c5c0bc9.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619926018.984125 NtUnmapViewOfSection	process_identifier: 2476 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619926018.984125 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 2476 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619926018.984125 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619926018.984125 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2476	success	0
1619926019.094125 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2476	success	0
1619926021.733625 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2476	success	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43521731
FireEye	Generic.mg.cccca0905235efd7
CAT-QuickHeal	Trojan.CKGENERIC
ALYac	Trojan.GenericKD.43521731
Malwarebytes	Trojan.MalPack.DLF
Zillya	Trojan.Injector.Win32.751075
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Kryptik.156e7050
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Generic.D29816C3
TrendMicro	TSPY_HPLOKI.SMBD
BitDefenderTheta	Gen:NN.ZelphiF.34152.KGW@ai2nKffi
Cyren	W32/Injector.VTSQ-0325
Symantec	Infostealer.Lokibot!43
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.GenericKD.43521731
NANO-Antivirus	Trojan.Win32.Kryptik.hodbuf
ViRobot	Trojan.Win32.Z.Injector.601088.BP
Ad-Aware	Trojan.GenericKD.43521731
Comodo	Malware@#2jt1sxykm2vwu
F-Secure	Trojan.TR/Injector.opqpg
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
Sophos	Troj/AutoG-IQ
Ikarus	Trojan.Inject
Webroot	W32.Injector.Gen
Avira	TR/Injector.opqpg
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	PWS:Win32/Fareit.AQ!MTB
AegisLab	Trojan.Win32.Kryptik.4!c
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.GenericKD.43521731
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2091
Acronis	suspicious
McAfee	Fareit-FVZ!CCCCA0905235
MAX	malware (ai score=88)
VBA32	TScope.Trojan.Delf
ESET-NOD32	a variant of Win32/Injector.EMRP
TrendMicro-HouseCall	TSPY_HPLOKI.SMBD
Rising	Trojan.Lokibot!8.F1B5 (CLOUD)
SentinelOne	DFI - Suspicious PE
Fortinet	W32/Injector.EMOY!tr
Panda	Trj/Genetic.gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x469154 DeleteCriticalSection

• 0x469158 LeaveCriticalSection

• 0x46915c EnterCriticalSection

• 0x469160 InitializeCriticalSection

• 0x469164 VirtualFree

• 0x469168 VirtualAlloc

• 0x46916c LocalFree

• 0x469170 LocalAlloc

• 0x469174 GetVersion

• 0x469178 GetCurrentThreadId

• 0x46917c InterlockedDecrement

• 0x469180 InterlockedIncrement

• 0x469184 VirtualQuery

• 0x469188 WideCharToMultiByte

• 0x46918c MultiByteToWideChar

• 0x469190 lstrlenA

• 0x469194 lstrcpynA

• 0x469198 LoadLibraryExA

• 0x46919c GetThreadLocale

• 0x4691a0 GetStartupInfoA

• 0x4691a4 GetProcAddress

• 0x4691a8 GetModuleHandleA

• 0x4691ac GetModuleFileNameA

• 0x4691b0 GetLocaleInfoA

• 0x4691b4 GetCommandLineA

• 0x4691b8 FreeLibrary

• 0x4691bc FindFirstFileA

• 0x4691c0 FindClose

• 0x4691c4 ExitProcess

• 0x4691c8 WriteFile

• 0x4691cc UnhandledExceptionFilter

• 0x4691d0 RtlUnwind

• 0x4691d4 RaiseException

• 0x4691d8 GetStdHandle

Library user32.dll:

• 0x4691e0 GetKeyboardType

• 0x4691e4 LoadStringA

• 0x4691e8 MessageBoxA

• 0x4691ec CharNextA

Library advapi32.dll:

• 0x4691f4 RegQueryValueExA

• 0x4691f8 RegOpenKeyExA

• 0x4691fc RegCloseKey

Library oleaut32.dll:

• 0x469204 SysFreeString

• 0x469208 SysReAllocStringLen

• 0x46920c SysAllocStringLen

Library kernel32.dll:

• 0x469214 TlsSetValue

• 0x469218 TlsGetValue

• 0x46921c LocalAlloc

• 0x469220 GetModuleHandleA

Library advapi32.dll:

• 0x469228 RegQueryValueExA

• 0x46922c RegOpenKeyExA

• 0x469230 RegCloseKey

Library kernel32.dll:

• 0x469238 lstrcpyA

• 0x46923c WriteFile

• 0x469240 WaitForSingleObject

• 0x469244 VirtualQuery

• 0x469248 VirtualProtect

• 0x46924c VirtualAlloc

• 0x469250 Sleep

• 0x469254 SizeofResource

• 0x469258 SetThreadLocale

• 0x46925c SetFilePointer

• 0x469260 SetEvent

• 0x469264 SetErrorMode

• 0x469268 SetEndOfFile

• 0x46926c ResetEvent

• 0x469270 ReadFile

• 0x469274 MultiByteToWideChar

• 0x469278 MulDiv

• 0x46927c LockResource

• 0x469280 LoadResource

• 0x469284 LoadLibraryA

• 0x469288 LeaveCriticalSection

• 0x46928c InitializeCriticalSection

• 0x469290 GlobalUnlock

• 0x469294 GlobalSize

• 0x469298 GlobalReAlloc

• 0x46929c GlobalHandle

• 0x4692a0 GlobalLock

• 0x4692a4 GlobalFree

• 0x4692a8 GlobalFindAtomA

• 0x4692ac GlobalDeleteAtom

• 0x4692b0 GlobalAlloc

• 0x4692b4 GlobalAddAtomA

• 0x4692b8 GetVersionExA

• 0x4692bc GetVersion

• 0x4692c0 GetUserDefaultLCID

• 0x4692c4 GetTickCount

• 0x4692c8 GetThreadLocale

• 0x4692cc GetSystemInfo

• 0x4692d0 GetStringTypeExA

• 0x4692d4 GetStdHandle

• 0x4692d8 GetProcAddress

• 0x4692dc GetModuleHandleA

• 0x4692e0 GetModuleFileNameA

• 0x4692e4 GetLocaleInfoA

• 0x4692e8 GetLocalTime

• 0x4692ec GetLastError

• 0x4692f0 GetFullPathNameA

• 0x4692f4 GetDiskFreeSpaceA

• 0x4692f8 GetDateFormatA

• 0x4692fc GetCurrentThreadId

• 0x469300 GetCurrentProcessId

• 0x469304 GetComputerNameA

• 0x469308 GetCPInfo

• 0x46930c GetACP

• 0x469310 FreeResource

• 0x469314 InterlockedExchange

• 0x469318 FreeLibrary

• 0x46931c FormatMessageA

• 0x469320 FindResourceA

• 0x469324 EnumCalendarInfoA

• 0x469328 EnterCriticalSection

• 0x46932c DeleteCriticalSection

• 0x469330 CreateThread

• 0x469334 CreateFileA

• 0x469338 CreateEventA

• 0x46933c CompareStringA

• 0x469340 CloseHandle

Library version.dll:

• 0x469348 VerQueryValueA

• 0x46934c GetFileVersionInfoSizeA

• 0x469350 GetFileVersionInfoA

Library gdi32.dll:

• 0x469358 UnrealizeObject

• 0x46935c StretchBlt

• 0x469360 SetWindowOrgEx

• 0x469364 SetWinMetaFileBits

• 0x469368 SetViewportOrgEx

• 0x46936c SetTextColor

• 0x469370 SetStretchBltMode

• 0x469374 SetROP2

• 0x469378 SetPixel

• 0x46937c SetMapMode

• 0x469380 SetEnhMetaFileBits

• 0x469384 SetDIBColorTable

• 0x469388 SetBrushOrgEx

• 0x46938c SetBkMode

• 0x469390 SetBkColor

• 0x469394 SelectPalette

• 0x469398 SelectObject

• 0x46939c SaveDC

• 0x4693a0 RestoreDC

• 0x4693a4 RectVisible

• 0x4693a8 RealizePalette

• 0x4693ac PlayEnhMetaFile

• 0x4693b0 PatBlt

• 0x4693b4 MoveToEx

• 0x4693b8 MaskBlt

• 0x4693bc LineTo

• 0x4693c0 LPtoDP

• 0x4693c4 IntersectClipRect

• 0x4693c8 GetWindowOrgEx

• 0x4693cc GetWinMetaFileBits

• 0x4693d0 GetTextMetricsA

• 0x4693d4 GetTextExtentPoint32A

• 0x4693d8 GetSystemPaletteEntries

• 0x4693dc GetStockObject

• 0x4693e0 GetPixel

• 0x4693e4 GetPaletteEntries

• 0x4693e8 GetObjectA

• 0x4693ec GetEnhMetaFilePaletteEntries

• 0x4693f0 GetEnhMetaFileHeader

• 0x4693f4 GetEnhMetaFileDescriptionA

• 0x4693f8 GetEnhMetaFileBits

• 0x4693fc GetDeviceCaps

• 0x469400 GetDIBits

• 0x469404 GetDIBColorTable

• 0x469408 GetDCOrgEx

• 0x46940c GetCurrentPositionEx

• 0x469410 GetClipBox

• 0x469414 GetBrushOrgEx

• 0x469418 GetBitmapBits

• 0x46941c ExtTextOutA

• 0x469420 ExcludeClipRect

• 0x469424 DeleteObject

• 0x469428 DeleteEnhMetaFile

• 0x46942c DeleteDC

• 0x469430 CreateSolidBrush

• 0x469434 CreatePenIndirect

• 0x469438 CreatePalette

• 0x46943c CreateHalftonePalette

• 0x469440 CreateFontIndirectA

• 0x469444 CreateEnhMetaFileA

• 0x469448 CreateDIBitmap

• 0x46944c CreateDIBSection

• 0x469450 CreateCompatibleDC

• 0x469454 CreateCompatibleBitmap

• 0x469458 CreateBrushIndirect

• 0x46945c CreateBitmap

• 0x469460 CopyEnhMetaFileA

• 0x469464 CloseEnhMetaFile

• 0x469468 BitBlt

Library user32.dll:

• 0x469470 CreateWindowExA

• 0x469474 WindowFromPoint

• 0x469478 WinHelpA

• 0x46947c WaitMessage

• 0x469480 UpdateWindow

• 0x469484 UnregisterClassA

• 0x469488 UnhookWindowsHookEx

• 0x46948c TranslateMessage

• 0x469490 TranslateMDISysAccel

• 0x469494 TrackPopupMenu

• 0x469498 SystemParametersInfoA

• 0x46949c ShowWindow

• 0x4694a0 ShowScrollBar

• 0x4694a4 ShowOwnedPopups

• 0x4694a8 ShowCursor

• 0x4694ac SetWindowsHookExA

• 0x4694b0 SetWindowPos

• 0x4694b4 SetWindowPlacement

• 0x4694b8 SetWindowLongA

• 0x4694bc SetTimer

• 0x4694c0 SetScrollRange

• 0x4694c4 SetScrollPos

• 0x4694c8 SetScrollInfo

• 0x4694cc SetRect

• 0x4694d0 SetPropA

• 0x4694d4 SetParent

• 0x4694d8 SetMenuItemInfoA

• 0x4694dc SetMenu

• 0x4694e0 SetForegroundWindow

• 0x4694e4 SetFocus

• 0x4694e8 SetCursor

• 0x4694ec SetClassLongA

• 0x4694f0 SetCapture

• 0x4694f4 SetActiveWindow

• 0x4694f8 SendMessageA

• 0x4694fc ScrollWindow

• 0x469500 ScreenToClient

• 0x469504 RemovePropA

• 0x469508 RemoveMenu

• 0x46950c ReleaseDC

• 0x469510 ReleaseCapture

• 0x469514 RegisterWindowMessageA

• 0x469518 RegisterClipboardFormatA

• 0x46951c RegisterClassA

• 0x469520 RedrawWindow

• 0x469524 PtInRect

• 0x469528 PostQuitMessage

• 0x46952c PostMessageA

• 0x469530 PeekMessageA

• 0x469534 OffsetRect

• 0x469538 OemToCharA

• 0x46953c MessageBoxA

• 0x469540 MapWindowPoints

• 0x469544 MapVirtualKeyA

• 0x469548 LoadStringA

• 0x46954c LoadKeyboardLayoutA

• 0x469550 LoadIconA

• 0x469554 LoadCursorA

• 0x469558 LoadBitmapA

• 0x46955c KillTimer

• 0x469560 IsZoomed

• 0x469564 IsWindowVisible

• 0x469568 IsWindowEnabled

• 0x46956c IsWindow

• 0x469570 IsRectEmpty

• 0x469574 IsIconic

• 0x469578 IsDialogMessageA

• 0x46957c IsChild

• 0x469580 InvalidateRect

• 0x469584 IntersectRect

• 0x469588 InsertMenuItemA

• 0x46958c InsertMenuA

• 0x469590 InflateRect

• 0x469594 GetWindowThreadProcessId

• 0x469598 GetWindowTextA

• 0x46959c GetWindowRect

• 0x4695a0 GetWindowPlacement

• 0x4695a4 GetWindowLongA

• 0x4695a8 GetWindowDC

• 0x4695ac GetTopWindow

• 0x4695b0 GetSystemMetrics

• 0x4695b4 GetSystemMenu

• 0x4695b8 GetSysColorBrush

• 0x4695bc GetSysColor

• 0x4695c0 GetSubMenu

• 0x4695c4 GetScrollRange

• 0x4695c8 GetScrollPos

• 0x4695cc GetScrollInfo

• 0x4695d0 GetPropA

• 0x4695d4 GetParent

• 0x4695d8 GetWindow

• 0x4695dc GetMessageTime

• 0x4695e0 GetMenuStringA

• 0x4695e4 GetMenuState

• 0x4695e8 GetMenuItemInfoA

• 0x4695ec GetMenuItemID

• 0x4695f0 GetMenuItemCount

• 0x4695f4 GetMenu

• 0x4695f8 GetLastActivePopup

• 0x4695fc GetKeyboardState

• 0x469600 GetKeyboardLayoutList

• 0x469604 GetKeyboardLayout

• 0x469608 GetKeyState

• 0x46960c GetKeyNameTextA

• 0x469610 GetIconInfo

• 0x469614 GetForegroundWindow

• 0x469618 GetFocus

• 0x46961c GetDlgItem

• 0x469620 GetDesktopWindow

• 0x469624 GetDCEx

• 0x469628 GetDC

• 0x46962c GetCursorPos

• 0x469630 GetCursor

• 0x469634 GetClipboardData

• 0x469638 GetClientRect

• 0x46963c GetClassNameA

• 0x469640 GetClassInfoA

• 0x469644 GetCapture

• 0x469648 GetActiveWindow

• 0x46964c FrameRect

• 0x469650 FindWindowA

• 0x469654 FillRect

• 0x469658 EqualRect

• 0x46965c EnumWindows

• 0x469660 EnumThreadWindows

• 0x469664 EndPaint

• 0x469668 EnableWindow

• 0x46966c EnableScrollBar

• 0x469670 EnableMenuItem

• 0x469674 DrawTextA

• 0x469678 DrawMenuBar

• 0x46967c DrawIconEx

• 0x469680 DrawIcon

• 0x469684 DrawFrameControl

• 0x469688 DrawEdge

• 0x46968c DispatchMessageA

• 0x469690 DestroyWindow

• 0x469694 DestroyMenu

• 0x469698 DestroyIcon

• 0x46969c DestroyCursor

• 0x4696a0 DeleteMenu

• 0x4696a4 DefWindowProcA

• 0x4696a8 DefMDIChildProcA

• 0x4696ac DefFrameProcA

• 0x4696b0 CreatePopupMenu

• 0x4696b4 CreateMenu

• 0x4696b8 CreateIcon

• 0x4696bc ClientToScreen

• 0x4696c0 CheckMenuItem

• 0x4696c4 CallWindowProcA

• 0x4696c8 CallNextHookEx

• 0x4696cc BeginPaint

• 0x4696d0 CharNextA

• 0x4696d4 CharLowerBuffA

• 0x4696d8 CharLowerA

• 0x4696dc CharToOemA

• 0x4696e0 AdjustWindowRectEx

• 0x4696e4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4696ec Sleep

Library oleaut32.dll:

• 0x4696f4 SafeArrayPtrOfIndex

• 0x4696f8 SafeArrayGetUBound

• 0x4696fc SafeArrayGetLBound

• 0x469700 SafeArrayCreate

• 0x469704 VariantChangeType

• 0x469708 VariantCopy

• 0x46970c VariantClear

• 0x469710 VariantInit

Library ole32.dll:

• 0x469718 CreateStreamOnHGlobal

• 0x46971c IsAccelerator

• 0x469720 OleDraw

• 0x469724 OleSetMenuDescriptor

• 0x469728 CoTaskMemFree

• 0x46972c ProgIDFromCLSID

• 0x469730 StringFromCLSID

• 0x469734 CoCreateInstance

• 0x469738 CoGetClassObject

• 0x46973c CoUninitialize

• 0x469740 CoInitialize

• 0x469744 IsEqualGUID

Library oleaut32.dll:

• 0x46974c GetErrorInfo

• 0x469750 GetActiveObject

• 0x469754 SysFreeString

Library comctl32.dll:

• 0x46975c ImageList_SetIconSize

• 0x469760 ImageList_GetIconSize

• 0x469764 ImageList_Write

• 0x469768 ImageList_Read

• 0x46976c ImageList_GetDragImage

• 0x469770 ImageList_DragShowNolock

• 0x469774 ImageList_SetDragCursorImage

• 0x469778 ImageList_DragMove

• 0x46977c ImageList_DragLeave

• 0x469780 ImageList_DragEnter

• 0x469784 ImageList_EndDrag

• 0x469788 ImageList_BeginDrag

• 0x46978c ImageList_Remove

• 0x469790 ImageList_DrawEx

• 0x469794 ImageList_Draw

• 0x469798 ImageList_GetBkColor

• 0x46979c ImageList_SetBkColor

• 0x4697a0 ImageList_ReplaceIcon

• 0x4697a4 ImageList_Add

• 0x4697a8 ImageList_GetImageCount

• 0x4697ac ImageList_Destroy

• 0x4697b0 ImageList_Create

Library comdlg32.dll:

• 0x4697b8 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
boeschboddenspies.com
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.