SmartHawk

2.4

中危

34 个模型检测该样本为恶意！

重新分析

下载样本

52ef343fba962cc8771062d9d5f51e38379497e309023b21b057e014b207f7d1

d10818e20bc98892bd87c0e6c940dcca.exe

分析耗时

14s

最近分析

文件大小

546.9KB

静态报毒动态报毒 AI SCORE=84 AIDETECTVM CLASSIC CONFIDENCE EMOTET GENCIRC GENERICKDZ HFMY HIGH CONFIDENCE IGENERICPMF KRYPTIK MALWARE2 MALWARE@#KSCD32JHBTI5 R347788 S15425576 SUSGEN UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRV!D10818E20BC9	20201023	6.0.6.653
Alibaba	Trojan:Win32/Emotet.54772642	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast		20201023	18.4.3895.0
Kingsoft		20201023	2013.8.14.323
Tencent	Malware.Win32.Gencirc.10cde802	20201023	1.0.0.1
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0

This executable has a PDB path (1 个事件)

pdb_path

c:\Users\Mr.Anderson\Desktop\2003\12.8.20\ListBoxCH_demo\ListBoxCHDemo\Release\ListBoxCHDemo.pdb

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

Foreign language identified in PE resource (42 个事件)

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_ICON

language

LANG_CHINESE

offset

0x00082f50

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002e8

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00083250

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00008344

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00083250

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00008344

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00083238

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x00000014

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69428
FireEye	Generic.mg.d10818e20bc98892
CAT-QuickHeal	Trojan.IgenericPMF.S15425576
McAfee	Emotet-FRV!D10818E20BC9
Cylance	Unsafe
Alibaba	Trojan:Win32/Emotet.54772642
Arcabit	Trojan.Generic.D10F34
Symantec	Trojan.Emotet
APEX	Malicious
ClamAV	Win.Malware.Emotet-9759299-0
BitDefender	Trojan.GenericKDZ.69428
Paloalto	generic.ml
Rising	Trojan.Kryptik!1.CA5C (CLASSIC)
Ad-Aware	Trojan.GenericKDZ.69428
Comodo	Malware@#kscd32jhbti5
DrWeb	Trojan.Emotet.999
Invincea	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Emotet.hh
Sophos	Mal/Generic-S
Ikarus	Trojan-Banker.Emotet
Jiangmin	Backdoor.Emotet.qt
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
ViRobot	Trojan.Win32.Emotet.602112
GData	Trojan.GenericKDZ.69428
AhnLab-V3	Trojan/Win32.Emotet.R347788
MAX	malware (ai score=84)
ESET-NOD32	a variant of Win32/Kryptik.HFMY
Tencent	Malware.Win32.Gencirc.10cde802
MaxSecure	Trojan.Malware.105954260.susgen
Fortinet	W32/Emotet.E88D!tr
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_80% (W)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-13 05:07:58

Imports

Library KERNEL32.dll:

• 0x45a1e4 GetCommandLineA

• 0x45a1e8 RtlUnwind

• 0x45a1ec TerminateProcess

• 0x45a1f0 ExitThread

• 0x45a1f4 CreateThread

• 0x45a1f8 HeapReAlloc

• 0x45a1fc HeapSize

• 0x45a200 LCMapStringA

• 0x45a204 LCMapStringW

• 0x45a208 HeapDestroy

• 0x45a20c HeapCreate

• 0x45a210 VirtualFree

• 0x45a214 FatalAppExitA

• 0x45a218 IsBadWritePtr

• 0x45a21c GetStdHandle

• 0x45a220 UnhandledExceptionFilter

• 0x45a224 FreeEnvironmentStringsA

• 0x45a228 GetEnvironmentStrings

• 0x45a22c FreeEnvironmentStringsW

• 0x45a230 GetEnvironmentStringsW

• 0x45a234 GetStartupInfoA

• 0x45a238 GetFileType

• 0x45a23c QueryPerformanceCounter

• 0x45a240 GetCurrentProcessId

• 0x45a244 GetSystemTimeAsFileTime

• 0x45a248 SetUnhandledExceptionFilter

• 0x45a24c GetStringTypeA

• 0x45a250 GetStringTypeW

• 0x45a254 GetTimeZoneInformation

• 0x45a258 GetTimeFormatA

• 0x45a25c GetDateFormatA

• 0x45a260 GetUserDefaultLCID

• 0x45a264 EnumSystemLocalesA

• 0x45a268 IsValidLocale

• 0x45a26c IsValidCodePage

• 0x45a270 IsBadReadPtr

• 0x45a274 IsBadCodePtr

• 0x45a278 SetStdHandle

• 0x45a27c SetConsoleCtrlHandler

• 0x45a280 GetLocaleInfoW

• 0x45a284 SetEnvironmentVariableA

• 0x45a288 VirtualQuery

• 0x45a28c GetSystemInfo

• 0x45a290 VirtualAlloc

• 0x45a294 VirtualProtect

• 0x45a298 HeapAlloc

• 0x45a29c HeapFree

• 0x45a2a0 GetDiskFreeSpaceA

• 0x45a2a4 GetTempFileNameA

• 0x45a2a8 LocalLock

• 0x45a2ac LocalUnlock

• 0x45a2b0 GetFileTime

• 0x45a2b4 GetFileAttributesA

• 0x45a2b8 SetFileAttributesA

• 0x45a2bc SetFileTime

• 0x45a2c0 LocalFileTimeToFileTime

• 0x45a2c4 FileTimeToLocalFileTime

• 0x45a2c8 GetTickCount

• 0x45a2cc SetErrorMode

• 0x45a2d0 SystemTimeToFileTime

• 0x45a2d4 FileTimeToSystemTime

• 0x45a2d8 GetShortPathNameA

• 0x45a2dc CreateFileA

• 0x45a2e0 GetFullPathNameA

• 0x45a2e4 GetVolumeInformationA

• 0x45a2e8 FindFirstFileA

• 0x45a2ec FindClose

• 0x45a2f0 GetCurrentProcess

• 0x45a2f4 DuplicateHandle

• 0x45a2f8 GetFileSize

• 0x45a2fc SetEndOfFile

• 0x45a300 UnlockFile

• 0x45a304 LockFile

• 0x45a308 FlushFileBuffers

• 0x45a30c SetFilePointer

• 0x45a310 WriteFile

• 0x45a314 ReadFile

• 0x45a318 DeleteFileA

• 0x45a31c MoveFileA

• 0x45a320 GetCurrentDirectoryA

• 0x45a324 GetPrivateProfileStringA

• 0x45a328 WritePrivateProfileStringA

• 0x45a32c GetPrivateProfileIntA

• 0x45a330 GetOEMCP

• 0x45a334 GetCPInfo

• 0x45a338 InterlockedIncrement

• 0x45a33c GlobalFlags

• 0x45a340 TlsFree

• 0x45a344 LocalReAlloc

• 0x45a348 TlsSetValue

• 0x45a34c TlsAlloc

• 0x45a350 TlsGetValue

• 0x45a354 EnterCriticalSection

• 0x45a358 GlobalHandle

• 0x45a35c GlobalReAlloc

• 0x45a360 LeaveCriticalSection

• 0x45a364 LocalAlloc

• 0x45a368 DeleteCriticalSection

• 0x45a36c InitializeCriticalSection

• 0x45a370 RaiseException

• 0x45a374 CopyFileA

• 0x45a378 GlobalSize

• 0x45a37c FormatMessageA

• 0x45a380 LocalFree

• 0x45a384 InterlockedDecrement

• 0x45a388 CreateEventA

• 0x45a38c SuspendThread

• 0x45a390 SetEvent

• 0x45a394 WaitForSingleObject

• 0x45a398 ResumeThread

• 0x45a39c SetThreadPriority

• 0x45a3a0 CloseHandle

• 0x45a3a4 GlobalFree

• 0x45a3a8 GetCurrentThread

• 0x45a3ac GlobalAlloc

• 0x45a3b0 lstrcmpA

• 0x45a3b4 GetModuleFileNameA

• 0x45a3b8 ConvertDefaultLocale

• 0x45a3bc EnumResourceLanguagesA

• 0x45a3c0 GlobalLock

• 0x45a3c4 GlobalUnlock

• 0x45a3c8 MulDiv

• 0x45a3cc SetLastError

• 0x45a3d0 FreeResource

• 0x45a3d4 GetCurrentThreadId

• 0x45a3d8 GlobalGetAtomNameA

• 0x45a3dc GlobalAddAtomA

• 0x45a3e0 GlobalFindAtomA

• 0x45a3e4 GlobalDeleteAtom

• 0x45a3e8 LoadLibraryA

• 0x45a3ec FreeLibrary

• 0x45a3f0 lstrcatA

• 0x45a3f4 lstrcmpW

• 0x45a3f8 lstrcpynA

• 0x45a3fc GetModuleHandleA

• 0x45a400 GetProcAddress

• 0x45a404 GetVersion

• 0x45a408 CompareStringA

• 0x45a40c lstrcmpiW

• 0x45a410 lstrcmpiA

• 0x45a414 GetLastError

• 0x45a418 GetStringTypeExA

• 0x45a41c lstrlenW

• 0x45a420 MultiByteToWideChar

• 0x45a424 CompareStringW

• 0x45a428 GetEnvironmentVariableA

• 0x45a42c GetStringTypeExW

• 0x45a430 GetEnvironmentVariableW

• 0x45a434 ExitProcess

• 0x45a438 FindResourceA

• 0x45a43c LoadResource

• 0x45a440 LockResource

• 0x45a444 SizeofResource

• 0x45a448 WideCharToMultiByte

• 0x45a44c GetVersionExA

• 0x45a450 GetThreadLocale

• 0x45a454 GetLocaleInfoA

• 0x45a458 GetACP

• 0x45a45c InterlockedExchange

• 0x45a460 lstrlenA

• 0x45a464 SetHandleCount

• 0x45a468 lstrcpyA

• 0x45a46c Sleep

Library USER32.dll:

• 0x45a544 UnionRect

• 0x45a548 PostThreadMessageA

• 0x45a54c SetTimer

• 0x45a550 KillTimer

• 0x45a554 IsClipboardFormatAvailable

• 0x45a558 GetTabbedTextExtentA

• 0x45a55c GetDCEx

• 0x45a560 LockWindowUpdate

• 0x45a564 SetParent

• 0x45a568 MoveWindow

• 0x45a56c SetWindowTextA

• 0x45a570 IsDialogMessageA

• 0x45a574 IsDlgButtonChecked

• 0x45a578 SetDlgItemTextA

• 0x45a57c SetDlgItemInt

• 0x45a580 GetDlgItemTextA

• 0x45a584 GetDlgItemInt

• 0x45a588 CheckRadioButton

• 0x45a58c CheckDlgButton

• 0x45a590 SetMenuItemBitmaps

• 0x45a594 ModifyMenuA

• 0x45a598 GetMenuState

• 0x45a59c EnableMenuItem

• 0x45a5a0 CheckMenuItem

• 0x45a5a4 GetMenuCheckMarkDimensions

• 0x45a5a8 LoadBitmapA

• 0x45a5ac EndPaint

• 0x45a5b0 BeginPaint

• 0x45a5b4 GetWindowDC

• 0x45a5b8 ReleaseDC

• 0x45a5bc GetDC

• 0x45a5c0 ClientToScreen

• 0x45a5c4 GrayStringA

• 0x45a5c8 DrawTextExA

• 0x45a5cc DrawTextA

• 0x45a5d0 TabbedTextOutA

• 0x45a5d4 RegisterWindowMessageA

• 0x45a5d8 WinHelpA

• 0x45a5dc GetCapture

• 0x45a5e0 CreateWindowExA

• 0x45a5e4 SetWindowsHookExA

• 0x45a5e8 CallNextHookEx

• 0x45a5ec GetClassLongA

• 0x45a5f0 GetClassInfoExA

• 0x45a5f4 GetClassNameA

• 0x45a5f8 SetPropA

• 0x45a5fc GetPropA

• 0x45a600 RemovePropA

• 0x45a604 SendDlgItemMessageA

• 0x45a608 GetFocus

• 0x45a60c IsWindow

• 0x45a610 SetFocus

• 0x45a614 IsChild

• 0x45a618 GetWindowTextLengthA

• 0x45a61c GetWindowTextA

• 0x45a620 GetForegroundWindow

• 0x45a624 GetLastActivePopup

• 0x45a628 SetActiveWindow

• 0x45a62c DispatchMessageA

• 0x45a630 BeginDeferWindowPos

• 0x45a634 EndDeferWindowPos

• 0x45a638 GetDlgItem

• 0x45a63c GetTopWindow

• 0x45a640 DestroyWindow

• 0x45a644 SetMenu

• 0x45a648 GetMessageTime

• 0x45a64c GetMessagePos

• 0x45a650 PeekMessageA

• 0x45a654 MapWindowPoints

• 0x45a658 ScrollWindow

• 0x45a65c MessageBoxA

• 0x45a660 MapVirtualKeyA

• 0x45a664 TrackPopupMenu

• 0x45a668 GetKeyState

• 0x45a66c SetScrollRange

• 0x45a670 GetScrollRange

• 0x45a674 SetScrollPos

• 0x45a678 GetScrollPos

• 0x45a67c SetForegroundWindow

• 0x45a680 ShowScrollBar

• 0x45a684 IsWindowVisible

• 0x45a688 UpdateWindow

• 0x45a68c GetMenu

• 0x45a690 PostMessageA

• 0x45a694 GetSubMenu

• 0x45a698 GetMenuItemID

• 0x45a69c GetMenuItemCount

• 0x45a6a0 GetSysColor

• 0x45a6a4 AdjustWindowRectEx

• 0x45a6a8 GetParent

• 0x45a6ac ScreenToClient

• 0x45a6b0 EqualRect

• 0x45a6b4 DeferWindowPos

• 0x45a6b8 GetScrollInfo

• 0x45a6bc SetScrollInfo

• 0x45a6c0 GetClassInfoA

• 0x45a6c4 RegisterClassA

• 0x45a6c8 UnregisterClassA

• 0x45a6cc SetWindowPlacement

• 0x45a6d0 GetDlgCtrlID

• 0x45a6d4 DefWindowProcA

• 0x45a6d8 CallWindowProcA

• 0x45a6dc GetWindowLongA

• 0x45a6e0 TranslateAcceleratorA

• 0x45a6e4 DestroyIcon

• 0x45a6e8 GetDialogBaseUnits

• 0x45a6ec MessageBeep

• 0x45a6f0 GetNextDlgGroupItem

• 0x45a6f4 InvalidateRgn

• 0x45a6f8 CopyAcceleratorTableA

• 0x45a6fc SetRect

• 0x45a700 IsRectEmpty

• 0x45a704 CharNextA

• 0x45a708 WaitMessage

• 0x45a70c GetWindowThreadProcessId

• 0x45a710 ReleaseCapture

• 0x45a714 WindowFromPoint

• 0x45a718 SetWindowLongA

• 0x45a71c SetWindowPos

• 0x45a720 IntersectRect

• 0x45a724 SystemParametersInfoA

• 0x45a728 GetWindowPlacement

• 0x45a72c GetWindowRect

• 0x45a730 PtInRect

• 0x45a734 GetWindow

• 0x45a738 CharUpperA

• 0x45a73c CharLowerW

• 0x45a740 CharLowerA

• 0x45a744 CharUpperW

• 0x45a748 GetClientRect

• 0x45a74c GetSystemMetrics

• 0x45a750 IsIconic

• 0x45a754 GetKeyNameTextA

• 0x45a758 RegisterClipboardFormatA

• 0x45a75c LoadMenuA

• 0x45a760 UnpackDDElParam

• 0x45a764 ReuseDDElParam

• 0x45a768 AppendMenuA

• 0x45a76c GetSystemMenu

• 0x45a770 LoadIconA

• 0x45a774 EnableWindow

• 0x45a778 SendMessageA

• 0x45a77c InvalidateRect

• 0x45a780 FillRect

• 0x45a784 OffsetRect

• 0x45a788 InflateRect

• 0x45a78c CopyRect

• 0x45a790 DrawIcon

• 0x45a794 DrawEdge

• 0x45a798 LoadAcceleratorsA

• 0x45a79c InsertMenuItemA

• 0x45a7a0 CreatePopupMenu

• 0x45a7a4 SetRectEmpty

• 0x45a7a8 TrackPopupMenuEx

• 0x45a7ac BringWindowToTop

• 0x45a7b0 SetCapture

• 0x45a7b4 DeleteMenu

• 0x45a7b8 wsprintfA

• 0x45a7bc LoadCursorA

• 0x45a7c0 GetSysColorBrush

• 0x45a7c4 InsertMenuA

• 0x45a7c8 RemoveMenu

• 0x45a7cc GetMenuStringA

• 0x45a7d0 DestroyMenu

• 0x45a7d4 GetMenuItemInfoA

• 0x45a7d8 ShowOwnedPopups

• 0x45a7dc SetCursor

• 0x45a7e0 GetMessageA

• 0x45a7e4 TranslateMessage

• 0x45a7e8 GetCursorPos

• 0x45a7ec ValidateRect

• 0x45a7f0 GetDesktopWindow

• 0x45a7f4 GetActiveWindow

• 0x45a7f8 CreateDialogIndirectParamA

• 0x45a7fc GetNextDlgTabItem

• 0x45a800 EndDialog

• 0x45a804 SetWindowContextHelpId

• 0x45a808 MapDialogRect

• 0x45a80c PostQuitMessage

• 0x45a810 ScrollWindowEx

• 0x45a814 UnhookWindowsHookEx

• 0x45a818 ShowWindow

• 0x45a81c IsWindowEnabled

Library GDI32.dll:

• 0x45a06c SelectClipPath

• 0x45a070 GetViewportExtEx

• 0x45a074 GetWindowExtEx

• 0x45a078 BitBlt

• 0x45a07c GetPixel

• 0x45a080 StartDocA

• 0x45a084 PtVisible

• 0x45a088 RectVisible

• 0x45a08c TextOutA

• 0x45a090 ExtTextOutA

• 0x45a094 Escape

• 0x45a098 SelectObject

• 0x45a09c SetViewportOrgEx

• 0x45a0a0 OffsetViewportOrgEx

• 0x45a0a4 SetViewportExtEx

• 0x45a0a8 ScaleViewportExtEx

• 0x45a0ac SetWindowOrgEx

• 0x45a0b0 OffsetWindowOrgEx

• 0x45a0b4 SetWindowExtEx

• 0x45a0b8 ScaleWindowExtEx

• 0x45a0bc GetCurrentPositionEx

• 0x45a0c0 ArcTo

• 0x45a0c4 PolyDraw

• 0x45a0c8 PolylineTo

• 0x45a0cc PolyBezierTo

• 0x45a0d0 ExtSelectClipRgn

• 0x45a0d4 DeleteDC

• 0x45a0d8 CreateDIBPatternBrushPt

• 0x45a0dc CreatePatternBrush

• 0x45a0e0 CreateBitmap

• 0x45a0e4 CreateCompatibleDC

• 0x45a0e8 GetStockObject

• 0x45a0ec CreateRectRgn

• 0x45a0f0 PlayMetaFileRecord

• 0x45a0f4 GetObjectType

• 0x45a0f8 EnumMetaFile

• 0x45a0fc PlayMetaFile

• 0x45a100 GetDeviceCaps

• 0x45a104 CreatePen

• 0x45a108 ExtCreatePen

• 0x45a10c CreateSolidBrush

• 0x45a110 CreateHatchBrush

• 0x45a114 CreateFontIndirectA

• 0x45a118 CreateRectRgnIndirect

• 0x45a11c SetRectRgn

• 0x45a120 CombineRgn

• 0x45a124 GetMapMode

• 0x45a128 PatBlt

• 0x45a12c DPtoLP

• 0x45a130 GetTextExtentPoint32A

• 0x45a134 CopyMetaFileA

• 0x45a138 CreateDCA

• 0x45a13c GetBkColor

• 0x45a140 GetTextColor

• 0x45a144 GetRgnBox

• 0x45a148 GetTextMetricsA

• 0x45a14c CreateCompatibleBitmap

• 0x45a150 StretchDIBits

• 0x45a154 GetCharWidthA

• 0x45a158 CreateFontA

• 0x45a15c StartPage

• 0x45a160 EndPage

• 0x45a164 SetAbortProc

• 0x45a168 AbortDoc

• 0x45a16c EndDoc

• 0x45a170 GetClipRgn

• 0x45a174 SelectClipRgn

• 0x45a178 DeleteObject

• 0x45a17c SetColorAdjustment

• 0x45a180 SetArcDirection

• 0x45a184 SetMapperFlags

• 0x45a188 SetTextCharacterExtra

• 0x45a18c SetTextJustification

• 0x45a190 SetTextAlign

• 0x45a194 MoveToEx

• 0x45a198 LineTo

• 0x45a19c OffsetClipRgn

• 0x45a1a0 IntersectClipRect

• 0x45a1a4 ExcludeClipRect

• 0x45a1a8 SetMapMode

• 0x45a1ac SetStretchBltMode

• 0x45a1b0 SetROP2

• 0x45a1b4 SetPolyFillMode

• 0x45a1b8 SetBkMode

• 0x45a1bc RestoreDC

• 0x45a1c0 SaveDC

• 0x45a1c4 GetObjectA

• 0x45a1c8 SetBkColor

• 0x45a1cc SetTextColor

• 0x45a1d0 GetClipBox

• 0x45a1d4 SelectPalette

• 0x45a1d8 Rectangle

• 0x45a1dc GetDCOrgEx

Library comdlg32.dll:

• 0x45a838 PrintDlgA

• 0x45a83c PageSetupDlgA

• 0x45a840 FindTextA

• 0x45a844 ReplaceTextA

• 0x45a848 CommDlgExtendedError

• 0x45a84c GetSaveFileNameA

• 0x45a850 GetFileTitleA

• 0x45a854 GetOpenFileNameA

Library WINSPOOL.DRV:

• 0x45a824 GetJobA

• 0x45a828 OpenPrinterA

• 0x45a82c DocumentPropertiesA

• 0x45a830 ClosePrinter

Library ADVAPI32.dll:

• 0x45a000 SetFileSecurityA

• 0x45a004 RegQueryValueExA

• 0x45a008 RegOpenKeyExA

• 0x45a00c RegDeleteKeyA

• 0x45a010 RegEnumKeyA

• 0x45a014 RegOpenKeyA

• 0x45a018 RegQueryValueA

• 0x45a01c RegSetValueA

• 0x45a020 RegCreateKeyExA

• 0x45a024 RegSetValueExA

• 0x45a028 RegDeleteValueA

• 0x45a02c GetFileSecurityA

• 0x45a030 RegCloseKey

• 0x45a034 RegCreateKeyA

Library SHELL32.dll:

• 0x45a518 SHGetFileInfoA

• 0x45a51c DragFinish

• 0x45a520 DragQueryFileA

• 0x45a524 ExtractIconA

Library COMCTL32.dll:

• 0x45a03c

• 0x45a040 ImageList_Draw

• 0x45a044 ImageList_GetImageInfo

• 0x45a048

• 0x45a04c ImageList_Read

• 0x45a050 ImageList_Write

• 0x45a054

• 0x45a058 ImageList_Destroy

• 0x45a05c ImageList_Create

• 0x45a060 ImageList_LoadImageA

• 0x45a064 ImageList_Merge

Library SHLWAPI.dll:

• 0x45a52c PathRemoveExtensionA

• 0x45a530 PathFindFileNameA

• 0x45a534 PathStripToRootA

• 0x45a538 PathFindExtensionA

• 0x45a53c PathIsUNCA

Library oledlg.dll:

• 0x45a8e4

Library ole32.dll:

• 0x45a85c StgCreateDocfileOnILockBytes

• 0x45a860 StgOpenStorageOnILockBytes

• 0x45a864 CoGetClassObject

• 0x45a868 CoDisconnectObject

• 0x45a86c OleDuplicateData

• 0x45a870 ReleaseStgMedium

• 0x45a874 CoTaskMemAlloc

• 0x45a878 CreateBindCtx

• 0x45a87c CoTreatAsClass

• 0x45a880 CreateILockBytesOnHGlobal

• 0x45a884 ReadClassStg

• 0x45a888 ReadFmtUserTypeStg

• 0x45a88c OleRegGetUserType

• 0x45a890 WriteClassStg

• 0x45a894 WriteFmtUserTypeStg

• 0x45a898 SetConvertStg

• 0x45a89c CoTaskMemFree

• 0x45a8a0 CLSIDFromString

• 0x45a8a4 CLSIDFromProgID

• 0x45a8a8 CoCreateInstance

• 0x45a8ac StringFromGUID2

• 0x45a8b0 OleRun

• 0x45a8b4 OleUninitialize

• 0x45a8b8 CoFreeUnusedLibraries

• 0x45a8bc CreateStreamOnHGlobal

• 0x45a8c0 CoRegisterMessageFilter

• 0x45a8c4 OleFlushClipboard

• 0x45a8c8 OleIsCurrentClipboard

• 0x45a8cc OleSetClipboard

• 0x45a8d0 CoRevokeClassObject

• 0x45a8d4 CoRegisterClassObject

• 0x45a8d8 StringFromCLSID

• 0x45a8dc OleInitialize

Library OLEAUT32.dll:

• 0x45a474 VariantClear

• 0x45a478 VariantInit

• 0x45a47c SysAllocStringLen

• 0x45a480 SysFreeString

• 0x45a484 SysStringLen

• 0x45a488 SysAllocStringByteLen

• 0x45a48c SysStringByteLen

• 0x45a490 OleCreateFontIndirect

• 0x45a494 SystemTimeToVariantTime

• 0x45a498 SafeArrayDestroy

• 0x45a49c SysAllocString

• 0x45a4a0 SafeArrayUnaccessData

• 0x45a4a4 SafeArrayAccessData

• 0x45a4a8 SafeArrayGetUBound

• 0x45a4ac SafeArrayGetLBound

• 0x45a4b0 SafeArrayGetElemsize

• 0x45a4b4 SafeArrayGetDim

• 0x45a4b8 SafeArrayCreate

• 0x45a4bc SafeArrayRedim

• 0x45a4c0 VariantCopy

• 0x45a4c4 SafeArrayAllocData

• 0x45a4c8 SafeArrayAllocDescriptor

• 0x45a4cc SafeArrayCopy

• 0x45a4d0 SafeArrayGetElement

• 0x45a4d4 SafeArrayPtrOfIndex

• 0x45a4d8 SafeArrayPutElement

• 0x45a4dc SafeArrayLock

• 0x45a4e0 SafeArrayUnlock

• 0x45a4e4 SafeArrayDestroyData

• 0x45a4e8 SafeArrayDestroyDescriptor

• 0x45a4ec VariantTimeToSystemTime

• 0x45a4f0 SysReAllocStringLen

• 0x45a4f4 VarDateFromStr

• 0x45a4f8 VarBstrFromDec

• 0x45a4fc VarDecFromStr

• 0x45a500 VarCyFromStr

• 0x45a504 VarBstrFromCy

• 0x45a508 VarBstrFromDate

• 0x45a50c LoadTypeLib

• 0x45a510 VariantChangeType

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.