SmartHawk

8.2

高危

64 个模型检测该样本为恶意！

重新分析

下载样本

6134ae7e654f6cfeff85533d19f99add311329cecc0bd5c5fb3eac0a2ec4bf5e

d64078cdb84d97aae92e167a7b3a4feb.exe

分析耗时

89s

最近分析

文件大小

418.8KB

静态报毒动态报毒 100% AGEN AI SCORE=82 AIDETECTVM AQ1@AIBR3BIJ B6KFZ6TQRXI BSCOPE CLASSIC CONFIDENCE DANGEROUSSIG DROT EDVNU ELDORADO EMOTET EMOTETCRTD FOBVRX FQPI GAMANIA GENASA GENCIRC GENETIC GQYG HACKTOOL HCDF HIGH CONFIDENCE KRAP KRYPTIK LKMC MALICIOUS PE MALWARE1 MAUVAISE QVM20 R + MAL SCORE STATIC AI SUSGEN UNSAFE XE@83S6VI ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Trojan-FQPI!D64078CDB84D	20201202	6.0.6.653
Alibaba	Trojan:Win32/Emotet.158	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Tencent	Malware.Win32.Gencirc.10b7533a	20201202	1.0.0.1
Avast	Win32:DangerousSig [Trj]	20201202	20.10.5736.0
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910855.533879 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

This executable is signed

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

MAD

Allocates read-write-execute memory (usually to unpack itself) (9 个事件)

Time & API	Arguments	Status
1619910846.706241 NtAllocateVirtualMemory	process_identifier: 880 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00320000	success
1619910846.878241 NtAllocateVirtualMemory	process_identifier: 880 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00340000	success
1619910846.878241 NtAllocateVirtualMemory	process_identifier: 880 region_size: 86016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00360000	success
1619910846.893241 NtAllocateVirtualMemory	process_identifier: 880 region_size: 86016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success
1619910847.189879 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00330000	success
1619910847.814879 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00350000	success
1619910847.814879 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 86016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01ca0000	success
1619910847.814879 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 86016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success
1619917620.40125 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004120000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Foreign language identified in PE resource (17 个事件)

name

RT_ICON

language

LANG_CHINESE

offset

0x00067410

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00067410

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00067410

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00067410

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00067410

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00067410

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00067410

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00067bd0

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000514

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00067bd0

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000514

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00067bd0

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000514

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00067bd0

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000514

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00067bd0

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000514

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00067bd0

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000514

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00067bd0

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000514

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00067bd0

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000514

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00067bd0

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000514

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00067878

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000068

Creates a service (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910856.361879 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x00657ad8 display_name: servslide error_control: 0 service_name: servslide filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\servslide.exe" filepath_r: "C:\Windows\SysWOW64\servslide.exe" service_manager_handle: 0x00655d00 desired_access: 18 service_type: 16 password:	success	6650584	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910846.893241 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x00000094 process_identifier: 2288	success	1	0

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910855.923879 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d64078cdb84d97aae92e167a7b3a4feb.exe newfilepath: C:\Windows\SysWOW64\servslide.exe newfilepath_r: C:\Windows\SysWOW64\servslide.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d64078cdb84d97aae92e167a7b3a4feb.exe	success	1	0

Expresses interest in specific running processes (1 个事件)

process

d64078cdb84d97aae92e167a7b3a4feb.exe

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	212.122.71.196
host	58.9.168.7

Installs itself for autorun at Windows startup (1 个事件)

service_name

servslide

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\servslide.exe"

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\servslide.exe:Zone.Identifier

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

212.122.71.196:995

File has been identified by 64 AntiVirus engines on VirusTotal as malicious (50 out of 64 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Agent.DROT
CAT-QuickHeal	Trojan.Mauvaise.SL1
McAfee	Trojan-FQPI!D64078CDB84D
Cylance	Unsafe
Zillya	Trojan.EmotetCRTD.Win32.12446
Sangfor	Malware
K7AntiVirus	Trojan ( 0051665b1 )
Alibaba	Trojan:Win32/Emotet.158
K7GW	Trojan ( 0051665b1 )
Cybereason	malicious.db84d9
Cyren	W32/Emotet.RA.gen!Eldorado
Symantec	Packed.Generic.459
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Emotet-6895511-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Agent.DROT
NANO-Antivirus	Trojan.Win32.Gamania.fobvrx
SUPERAntiSpyware	Trojan.Agent/Gen-Downloader
Rising	Trojan.Kryptik!1.CC69 (CLASSIC)
Ad-Aware	Trojan.Agent.DROT
TACHYON	Trojan/W32.Emotet.428808
Sophos	Mal/Generic-R + Mal/Emotet-Q
Comodo	TrojWare.Win32.Banker.XE@83s6vi
F-Secure	Heuristic.HEUR/AGEN.1114507
DrWeb	Trojan.PWS.Gamania.46715
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.EMOTET.SMA
McAfee-GW-Edition	Trojan-FQPI!D64078CDB84D
FireEye	Generic.mg.d64078cdb84d97aa
Emsisoft	Trojan.Agent.DROT (B)
SentinelOne	Static AI - Malicious PE
GData	Trojan.Agent.DROT
Jiangmin	Trojan.Generic.edvnu
Webroot	W32.Trojan.Emotet
Avira	HEUR/AGEN.1114507
Antiy-AVL	Trojan[Banker]/Win32.Emotet
Gridinsoft	Trojan.Win32.Emotet.vb!s3
Arcabit	Trojan.Agent.DROT
AegisLab	Hacktool.Win32.Krap.lKMc
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:Win32/Emotet.PA!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Emotet.C3100274
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34658.Aq1@aiBR3bij
ALYac	Trojan.Agent.DROT
MAX	malware (ai score=82)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2019-03-15 20:27:36

Imports

Library KERNEL32.dll:

• 0x4080c8 HeapAlloc

• 0x4080cc HeapFree

• 0x4080d0 HeapReAlloc

• 0x4080d4 HeapSize

• 0x4080d8 InitializeCriticalSectionAndSpinCount

• 0x4080dc InterlockedCompareExchange

• 0x4080e0 InterlockedDecrement

• 0x4080e4 InterlockedExchange

• 0x4080e8 InterlockedIncrement

• 0x4080ec IsDebuggerPresent

• 0x4080f0 IsProcessorFeaturePresent

• 0x4080f4 IsValidCodePage

• 0x4080f8 LCMapStringW

• 0x4080fc LeaveCriticalSection

• 0x408100 LoadLibraryExW

• 0x408104 LoadLibraryW

• 0x408108 MapViewOfFile

• 0x40810c MultiByteToWideChar

• 0x408110 OpenEventW

• 0x408114 OutputDebugStringW

• 0x408118 QueryPerformanceCounter

• 0x40811c GetVolumePathNameW

• 0x408120 RtlUnwind

• 0x408124 SetEndOfFile

• 0x408128 SetFilePointer

• 0x40812c SetLastError

• 0x408130 SetUnhandledExceptionFilter

• 0x408134 Sleep

• 0x408138 SystemTimeToTzSpecificLocalTime

• 0x40813c TerminateProcess

• 0x408140 TlsAlloc

• 0x408144 TlsFree

• 0x408148 TlsGetValue

• 0x40814c TlsSetValue

• 0x408150 UnhandledExceptionFilter

• 0x408154 UnmapViewOfFile

• 0x408158 VerSetConditionMask

• 0x40815c VerifyVersionInfoW

• 0x408160 WaitForSingleObject

• 0x408164 WideCharToMultiByte

• 0x408168 WriteFile

• 0x40816c lstrcatW

• 0x408170 lstrlenW

• 0x408174 GetTimeZoneInformation

• 0x408178 GetTickCount

• 0x40817c GetSystemTimeAsFileTime

• 0x408180 GetSystemTime

• 0x408184 GetSystemInfo

• 0x408188 GetSystemDirectoryW

• 0x40818c GetStringTypeW

• 0x408190 GetStdHandle

• 0x408194 GetStartupInfoW

• 0x408198 GetStartupInfoA

• 0x40819c GetProcessHeap

• 0x4081a0 GetProcAddress

• 0x4081a4 GetOEMCP

• 0x4081a8 GetModuleHandleW

• 0x4081ac GetModuleHandleExW

• 0x4081b0 GetModuleFileNameW

• 0x4081b4 GetLastError

• 0x4081b8 GetFileType

• 0x4081bc GetFileSize

• 0x4081c0 GetFileAttributesW

• 0x4081c4 GetEnvironmentStringsW

• 0x4081c8 GetDriveTypeW

• 0x4081cc GetCurrentThreadId

• 0x4081d0 GetCurrentProcessId

• 0x4081d4 GetCurrentProcess

• 0x4081d8 GetConsoleMode

• 0x4081dc GetConsoleCP

• 0x4081e0 GetCommandLineW

• 0x4081e4 GetCPInfo

• 0x4081e8 GetACP

• 0x4081ec FreeLibrary

• 0x4081f0 FreeEnvironmentStringsW

• 0x4081f4 FormatMessageW

• 0x4081f8 FlushFileBuffers

• 0x4081fc ExpandEnvironmentStringsW

• 0x408200 ExitProcess

• 0x408204 EnterCriticalSection

• 0x408208 EncodePointer

• 0x40820c DeleteCriticalSection

• 0x408210 DecodePointer

• 0x408214 CreateProcessW

• 0x408218 CreateMutexW

• 0x40821c CreateFileW

• 0x408220 CreateFileMappingW

• 0x408224 CreateDirectoryW

• 0x408228 CompareStringW

• 0x40822c CloseHandle

• 0x408230 VirtualAllocEx

• 0x408234 ReleaseMutex

• 0x408238 GetModuleHandleA

Library USER32.dll:

• 0x408240 DrawIcon

• 0x408244 DrawIconEx

• 0x408248 DrawStateA

• 0x40824c DrawTextA

• 0x408250 DrawTextW

• 0x408254 EnableMenuItem

• 0x408258 EnableWindow

• 0x40825c EndDeferWindowPos

• 0x408260 EndDialog

• 0x408264 EndPaint

• 0x408268 EnumDisplayMonitors

• 0x40826c EnumWindows

• 0x408270 EqualRect

• 0x408274 ExcludeUpdateRgn

• 0x408278 ExitWindowsEx

• 0x40827c FillRect

• 0x408280 FindWindowA

• 0x408284 FindWindowW

• 0x408288 FrameRect

• 0x40828c GetActiveWindow

• 0x408290 GetAsyncKeyState

• 0x408294 GetCapture

• 0x408298 GetClassInfoA

• 0x40829c GetClassLongA

• 0x4082a0 GetClassNameA

• 0x4082a4 GetClientRect

• 0x4082a8 GetCursorPos

• 0x4082ac GetDC

• 0x4082b0 GetDCEx

• 0x4082b4 GetDesktopWindow

• 0x4082b8 GetDlgCtrlID

• 0x4082bc DrawFrameControl

• 0x4082c0 GetDlgItemTextA

• 0x4082c4 GetDoubleClickTime

• 0x4082c8 GetForegroundWindow

• 0x4082cc GetGUIThreadInfo

• 0x4082d0 GetKeyState

• 0x4082d4 GetLastActivePopup

• 0x4082d8 GetMenu

• 0x4082dc GetMenuCheckMarkDimensions

• 0x4082e0 GetMenuItemCount

• 0x4082e4 GetMenuItemID

• 0x4082e8 GetMenuItemInfoW

• 0x4082ec GetMenuState

• 0x4082f0 GetMenuStringA

• 0x4082f4 GetMessageA

• 0x4082f8 GetMessagePos

• 0x4082fc GetMessageTime

• 0x408300 GetNextDlgGroupItem

• 0x408304 GetNextDlgTabItem

• 0x408308 GetParent

• 0x40830c GetPropA

• 0x408310 GetSubMenu

• 0x408314 GetSysColor

• 0x408318 GetSysColorBrush

• 0x40831c GetSystemMetrics

• 0x408320 GetTopWindow

• 0x408324 GetUpdateRect

• 0x408328 GetWindow

• 0x40832c GetWindowDC

• 0x408330 GetWindowLongA

• 0x408334 GetWindowPlacement

• 0x408338 GetWindowRect

• 0x40833c GetWindowTextA

• 0x408340 GetWindowTextLengthA

• 0x408344 GetWindowTextLengthW

• 0x408348 GetWindowTextW

• 0x40834c GetWindowThreadProcessId

• 0x408350 GrayStringA

• 0x408354 HideCaret

• 0x408358 IMPQueryIMEW

• 0x40835c InflateRect

• 0x408360 IntersectRect

• 0x408364 InvalidateRect

• 0x408368 IsChild

• 0x40836c IsClipboardFormatAvailable

• 0x408370 IsDialogMessageA

• 0x408374 IsIconic

• 0x408378 IsRectEmpty

• 0x40837c IsWindow

• 0x408380 IsWindowEnabled

• 0x408384 IsWindowUnicode

• 0x408388 IsWindowVisible

• 0x40838c KillTimer

• 0x408390 LoadBitmapA

• 0x408394 LoadCursorA

• 0x408398 LoadIconA

• 0x40839c LoadImageA

• 0x4083a0 LoadImageW

• 0x4083a4 LoadStringA

• 0x4083a8 LockWindowUpdate

• 0x4083ac MapDialogRect

• 0x4083b0 MapWindowPoints

• 0x4083b4 MessageBeep

• 0x4083b8 MessageBoxA

• 0x4083bc MessageBoxW

• 0x4083c0 ModifyMenuA

• 0x4083c4 ModifyMenuW

• 0x4083c8 MoveWindow

• 0x4083cc MsgWaitForMultipleObjects

• 0x4083d0 OffsetRect

• 0x4083d4 PeekMessageA

• 0x4083d8 PostMessageA

• 0x4083dc PostQuitMessage

• 0x4083e0 PostThreadMessageA

• 0x4083e4 PtInRect

• 0x4083e8 RegisterClassA

• 0x4083ec RegisterClassW

• 0x4083f0 RegisterClipboardFormatA

• 0x4083f4 RegisterWindowMessageA

• 0x4083f8 ReleaseDC

• 0x4083fc RemoveMenu

• 0x408400 RemovePropA

• 0x408404 ScreenToClient

• 0x408408 SendDlgItemMessageA

• 0x40840c SendMessageA

• 0x408410 SendMessageW

• 0x408414 SetActiveWindow

• 0x408418 SetCapture

• 0x40841c SetClassLongW

• 0x408420 SetClipboardViewer

• 0x408424 SetCursor

• 0x408428 SetCursorPos

• 0x40842c SetDlgItemTextA

• 0x408430 SetDlgItemTextW

• 0x408434 SetFocus

• 0x408438 SetForegroundWindow

• 0x40843c SetMenuItemBitmaps

• 0x408440 SetParent

• 0x408444 SetPropA

• 0x408448 SetRect

• 0x40844c SetRectEmpty

• 0x408450 SetShellWindow

• 0x408454 SetTimer

• 0x408458 SetWindowContextHelpId

• 0x40845c SetWindowLongA

• 0x408460 SetWindowPos

• 0x408464 SetWindowTextA

• 0x408468 SetWindowTextW

• 0x40846c SetWindowsHookExA

• 0x408470 ShowCaret

• 0x408474 ShowWindow

• 0x408478 SystemParametersInfoA

• 0x40847c SystemParametersInfoW

• 0x408480 TabbedTextOutA

• 0x408484 TrackPopupMenu

• 0x408488 TranslateMessage

• 0x40848c UnhookWindowsHookEx

• 0x408490 UnionRect

• 0x408494 UnregisterClassA

• 0x408498 UpdateWindow

• 0x40849c ValidateRect

• 0x4084a0 WinHelpA

• 0x4084a4 WindowFromPoint

• 0x4084a8 wsprintfA

• 0x4084ac wsprintfW

• 0x4084b0 DrawFocusRect

• 0x4084b4 DispatchMessageA

• 0x4084b8 DestroyMenu

• 0x4084bc DestroyIcon

• 0x4084c0 DeleteMenu

• 0x4084c4 DeferWindowPos

• 0x4084c8 DefWindowProcW

• 0x4084cc DefWindowProcA

• 0x4084d0 DefDlgProcA

• 0x4084d4 DdeGetLastError

• 0x4084d8 CreateWindowStationW

• 0x4084dc CreateWindowExW

• 0x4084e0 CreateWindowExA

• 0x4084e4 CreatePopupMenu

• 0x4084e8 CreateDialogParamW

• 0x4084ec CreateDialogParamA

• 0x4084f0 CreateDialogIndirectParamA

• 0x4084f4 CopyRect

• 0x4084f8 CopyImage

• 0x4084fc CopyIcon

• 0x408500 CopyAcceleratorTableA

• 0x408504 ClientToScreen

• 0x408508 ChildWindowFromPointEx

• 0x40850c ChildWindowFromPoint

• 0x408510 CheckMenuRadioItem

• 0x408514 CheckMenuItem

• 0x408518 CharUpperA

• 0x40851c CharNextA

• 0x408520 ChangeClipboardChain

• 0x408524 CascadeChildWindows

• 0x408528 CallWindowProcA

• 0x40852c CallNextHookEx

• 0x408530 BeginPaint

• 0x408534 BeginDeferWindowPos

• 0x408538 AppendMenuW

• 0x40853c AppendMenuA

• 0x408540 AdjustWindowRectEx

• 0x408544 GetFocus

• 0x408548 OpenIcon

• 0x40854c IsMenu

• 0x408550 DestroyWindow

• 0x408554 WindowFromDC

• 0x408558 CloseWindowStation

• 0x40855c GetListBoxInfo

• 0x408560 CloseDesktop

• 0x408564 CloseWindow

• 0x408568 CreateMenu

• 0x40856c IsCharAlphaNumericW

• 0x408570 ReleaseCapture

• 0x408574 GetDlgItem

Library GDI32.dll:

• 0x40800c CreateDCW

• 0x408010 CreateFontIndirectW

• 0x408014 CreatePen

• 0x408018 CreateSolidBrush

• 0x40801c DeleteObject

• 0x408020 EngDeletePalette

• 0x408024 EnumICMProfilesW

• 0x408028 EnumObjects

• 0x40802c GdiConvertBitmapV5

• 0x408030 GdiEntry4

• 0x408034 GdiEntry6

• 0x408038 GdiFixUpHandle

• 0x40803c GdiRealizationInfo

• 0x408040 GdiSetPixelFormat

• 0x408044 GdiStartDocEMF

• 0x408048 GdiSwapBuffers

• 0x40804c GetClipRgn

• 0x408050 GetDeviceCaps

• 0x408054 GetGlyphIndicesW

• 0x408058 GetRegionData

• 0x40805c GetStockObject

• 0x408060 BeginPath

• 0x408064 GetTextCharacterExtra

• 0x408068 GetTextFaceW

• 0x40806c LineTo

• 0x408070 MoveToEx

• 0x408074 PolyPolyline

• 0x408078 PolyTextOutA

• 0x40807c RectVisible

• 0x408080 Rectangle

• 0x408084 ResetDCA

• 0x408088 STROBJ_dwGetCodePage

• 0x40808c SelectObject

• 0x408090 SetAbortProc

• 0x408094 SetBitmapBits

• 0x408098 SetColorSpace

• 0x40809c SetGraphicsMode

• 0x4080a0 SetLayout

• 0x4080a4 SetPixel

• 0x4080a8 StretchDIBits

• 0x4080ac UpdateICMRegKeyW

• 0x4080b0 XLATEOBJ_piVector

• 0x4080b4 bInitSystemAndFontsDirectoriesW

• 0x4080b8 GetObjectType

• 0x4080bc GetTextAlign

• 0x4080c0 CreatePatternBrush

Library ADVAPI32.dll:

• 0x408000 RegQueryValueExA

• 0x408004 RegOpenKeyA

Library ole32.dll:

• 0x40857c OleUninitialize

• 0x408580 OleInitialize

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.