5.2
中危
60 个模型检测该样本为恶意！
重新分析
更多

5ca3d1fa70d2f1598340abcf182391c0463fac5a53160d648bb6afd9ac98718c

d7c399d874578279ac4c024b5a785f00.exe

分析耗时

74s

最近分析

文件大小

600.0KB
静态报毒 动态报毒 100% AI SCORE=81 AIDETECTGBM BSYMEM CLASSIC CONFIDENCE CRYPTINJECT DOWNLOADER34 EMOTET ENDK EVJT EVJU FSTA GDSDA GENKRYPTIK GVWYZ2YZSFU HIGH CONFIDENCE HSZGLT HWMAWW4A KRYPTIK LM0@AMMCRMMO MALICIOUS PE MALWARE@#15CG7LNQONY05 R349200 SAVE SCORE SMTHF STATIC AI SUSGEN TRICKBOT TSCOPE UNSAFE XIDG YDDOO ZEVBAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Bsymem.3b8ba163 20190527 0.3.0.5
Avast Win32:Malware-gen 20210223 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20210223 2017.9.26.565
McAfee Trickbot-FSTA!D7C399D87457 20210223 6.0.6.653
Tencent 20210223 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619967795.657626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619967796.782626
__exception__
stacktrace: 
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
hook_in_monitor+0x45 lde-0x133 @ 0x756142ea
New_ntdll_LdrGetProcedureAddress+0x43 New_ntdll_LdrLoadDll-0x156 @ 0x7562f7f3
GetProcAddress+0x60 GetModuleHandleA-0x80 kernelbase+0x4190 @ 0x7fefdc54190
SvchostPushServiceGlobals+0x471 WinHttpQueryOption-0x1a7b winhttp+0x1eb99 @ 0x7fef9efeb99
SvchostPushServiceGlobals+0x4fb WinHttpQueryOption-0x19f1 winhttp+0x1ec23 @ 0x7fef9efec23
WinHttpConnect+0x1ab WinHttpGetDefaultProxyConfiguration-0x1615 winhttp+0x13fe7 @ 0x7fef9ef3fe7

registers.r14: 36297812
registers.r9: 1970001920
registers.rcx: 0
registers.rsi: 1402432
registers.r10: 0
registers.rbx: 0
registers.rdi: 0
registers.r11: 0
registers.r8: 5
registers.rdx: 2
registers.rbp: 0
registers.r15: 589824
registers.r12: 1213120
registers.rsp: 2485072
registers.rax: 1
registers.r13: 443
exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c
exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a
exception.instruction: mov rax, qword ptr [rcx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 105050
exception.address: 0x77b69a5a
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (22 个事件)
Time & API Arguments Status Return Repeated
1619948416.401822
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02660000
success 0 0
1619948419.041822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948419.823822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948420.541822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948421.448822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948422.229822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948423.026822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948423.854822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948424.604822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948425.385822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948426.166822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948426.948822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948427.744822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02660000
success 0 0
1619948427.744822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00448000
success 0 0
1619948427.760822
NtAllocateVirtualMemory
process_identifier: 472
region_size: 188416
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x026f0000
success 0 0
1619948427.760822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 184320
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x026f1000
success 0 0
1619948427.807822
NtAllocateVirtualMemory
process_identifier: 472
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02720000
success 0 0
1619948427.807822
NtAllocateVirtualMemory
process_identifier: 472
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x10000000
success 0 0
1619948427.807822
NtAllocateVirtualMemory
process_identifier: 472
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x10001000
success 0 0
1619948427.869822
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02730000
success 0 0
1619948427.869822
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02740000
success 0 0
1619948427.869822
NtAllocateVirtualMemory
process_identifier: 472
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x028c0000
success 0 0
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1619948415.979822
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x003d0000
success 0 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 个事件)
Time & API Arguments Status Return Repeated
1619967776.797626
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619967779.735626
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619967787.626626
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 110.93.15.98
host 172.217.24.14
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectGBM.malware.02
Elastic malicious (high confidence)
DrWeb Trojan.DownLoader34.28557
MicroWorld-eScan Trojan.Agent.EVJT
FireEye Generic.mg.d7c399d874578279
ALYac Trojan.Agent.EVJT
Cylance Unsafe
Zillya Trojan.Bsymem.Win32.1436
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0056d4581 )
Alibaba Trojan:Win32/Bsymem.3b8ba163
K7GW Trojan ( 0056d4581 )
Cybereason malicious.874578
Arcabit Trojan.Agent.EVJT
BitDefenderTheta Gen:NN.ZevbaF.34574.Lm0@ammcRmmO
Cyren W32/Trojan.XIDG-1629
Symantec Trojan Horse
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan.Win32.Bsymem.vho
BitDefender Trojan.Agent.EVJT
NANO-Antivirus Trojan.Win32.Bsymem.hszglt
Paloalto generic.ml
AegisLab Trojan.Win32.Bsymem.4!c
Rising Trojan.Kryptik!1.CB33 (CLASSIC)
Ad-Aware Trojan.Agent.EVJT
TACHYON Trojan/W32.VB-Bsymem.614400
Emsisoft Trojan.Agent (A)
Comodo Malware@#15cg7lnqony05
F-Secure Trojan.TR/Injector.yddoo
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.EMOTET.SMTHF.hp
McAfee-GW-Edition BehavesLike.Win32.Emotet.jh
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Bsymem.aex
eGambit Generic.Malware
Avira TR/Injector.yddoo
Antiy-AVL Trojan/Win32.Injector
Gridinsoft Trojan.Win32.TrickBot.oa
Microsoft Trojan:Win32/Trickbot.VI!MSR
ViRobot Trojan.Win32.Agent.614400.AI
ZoneAlarm HEUR:Trojan.Win32.Bsymem.vho
GData Trojan.Agent.EVJT
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.CryptInject.R349200
McAfee Trickbot-FSTA!D7C399D87457
MAX malware (ai score=81)
VBA32 TScope.Trojan.VB
Malwarebytes Trojan.TrickBot
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 192.168.56.101:49181
dead_host 110.93.15.98:449
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-24 16:54:48

Imports

Library oleaut32.dll:
• 0x401000 SysAllocStringLen
• 0x401008 SysStringLen
Library user32.dll:
• 0x401010 LoadStringW
Library kernel32.dll:
• 0x401018 GetProcAddress
• 0x40101c VirtualAlloc
• 0x401020 VirtualProtect
• 0x401024 RtlMoveMemory
• 0x401028 WideCharToMultiByte
• 0x40102c GetModuleHandleW
Library MSVBVM60.DLL:
• 0x401038 __vbaVarSub
• 0x40103c __vbaStrI2
• 0x401040 _CIcos
• 0x401044 _adj_fptan
• 0x401048 __vbaStrI4
• 0x40104c __vbaVarMove
• 0x401050 __vbaVarVargNofree
• 0x401054 __vbaFreeVar
• 0x401058 __vbaAryMove
• 0x40105c __vbaLenBstr
• 0x401060 __vbaStrVarMove
• 0x401064 __vbaFreeVarList
• 0x401068 _adj_fdiv_m64
• 0x40106c
• 0x401070 EVENT_SINK_Invoke
• 0x401074 __vbaRaiseEvent
• 0x401078 __vbaFreeObjList
• 0x40107c
• 0x401080 __vbaStrErrVarCopy
• 0x401084 _adj_fprem1
• 0x40108c
• 0x401090
• 0x401094 __vbaStrCat
• 0x401098 __vbaSetSystemError
• 0x4010a0 __vbaLenVar
• 0x4010a4 _adj_fdiv_m32
• 0x4010a8 __vbaAryVar
• 0x4010ac Zombie_GetTypeInfo
• 0x4010b0 __vbaAryDestruct
• 0x4010b8 __vbaExitProc
• 0x4010bc __vbaOnError
• 0x4010c0
• 0x4010c4 __vbaObjSet
• 0x4010c8 _adj_fdiv_m16i
• 0x4010cc __vbaObjSetAddref
• 0x4010d0 _adj_fdivr_m16i
• 0x4010d4
• 0x4010d8 __vbaVarIndexLoad
• 0x4010dc __vbaBoolVarNull
• 0x4010e0 __vbaRefVarAry
• 0x4010e4 _CIsin
• 0x4010e8
• 0x4010ec
• 0x4010f0 __vbaErase
• 0x4010f4 __vbaChkstk
• 0x4010f8 __vbaFileClose
• 0x4010fc EVENT_SINK_AddRef
• 0x401100
• 0x401108 __vbaStrCmp
• 0x40110c __vbaVarTstEq
• 0x401110 __vbaAryConstruct2
• 0x401114 __vbaGet4
• 0x401118 __vbaObjVar
• 0x40111c __vbaI2I4
• 0x401120
• 0x401124 DllFunctionCall
• 0x401128 __vbaVarLateMemSt
• 0x40112c __vbaCastObjVar
• 0x401130 __vbaRedimPreserve
• 0x401134 _adj_fpatan
• 0x401138 __vbaLateIdCallLd
• 0x401140 __vbaStrR8
• 0x401144 __vbaRedim
• 0x401148 EVENT_SINK_Release
• 0x40114c __vbaNew
• 0x401150 __vbaUI1I2
• 0x401154 _CIsqrt
• 0x401158 __vbaObjIs
• 0x401160 __vbaUI1I4
• 0x401164 __vbaExceptHandler
• 0x401168
• 0x40116c
• 0x401170 __vbaStrToUnicode
• 0x401174
• 0x401178 _adj_fprem
• 0x40117c _adj_fdivr_m64
• 0x401180 __vbaI2Str
• 0x401184
• 0x401188 __vbaFPException
• 0x40118c
• 0x401190 __vbaUbound
• 0x401194 __vbaStrVarVal
• 0x401198 __vbaVarCat
• 0x40119c
• 0x4011a0
• 0x4011a4 _CIlog
• 0x4011a8 __vbaErrorOverflow
• 0x4011ac __vbaFileOpen
• 0x4011b0 __vbaR8Str
• 0x4011b8 __vbaNew2
• 0x4011bc __vbaInStr
• 0x4011c0 __vbaVar2Vec
• 0x4011c4
• 0x4011c8
• 0x4011cc _adj_fdiv_m32i
• 0x4011d0 _adj_fdivr_m32i
• 0x4011d4 __vbaVarSetObj
• 0x4011d8 __vbaStrCopy
• 0x4011dc __vbaI4Str
• 0x4011e0 __vbaFreeStrList
• 0x4011e4 _adj_fdivr_m32
• 0x4011e8 _adj_fdiv_r
• 0x4011ec
• 0x4011f0
• 0x4011f4 __vbaVarTstNe
• 0x4011f8
• 0x4011fc __vbaVarSetVar
• 0x401200 __vbaI4Var
• 0x401204
• 0x401208 __vbaVarAdd
• 0x40120c
• 0x401210 __vbaLateMemCall
• 0x401214 __vbaAryLock
• 0x401218 __vbaFreeVarg
• 0x40121c
• 0x401220 __vbaVarDup
• 0x401224 __vbaStrToAnsi
• 0x401228
• 0x40122c __vbaUnkVar
• 0x401234
• 0x401238 __vbaFpI4
• 0x401240 _CIatan
• 0x401244 __vbaCastObj
• 0x401248 __vbaStrMove
• 0x40124c __vbaAryCopy
• 0x401250
• 0x401254
• 0x401258 _allmul
• 0x40125c __vbaLateIdSt
• 0x401260 __vbaLenVarB
• 0x401264 _CItan
• 0x401268
• 0x40126c __vbaAryUnlock
• 0x401270
• 0x401274 _CIexp
• 0x401278 __vbaFreeStr
• 0x40127c __vbaFreeObj
• 0x401280 __vbaI4ErrVar
• 0x401284

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.