SmartHawk

6.2

高危

55 个模型检测该样本为恶意！

重新分析

下载样本

32f5356b0823e3258636016b4fe66c3494cb5884e19d58a31643fc00d6128445

df213fc225741ad8e074ef84c00d8898.exe

分析耗时

78s

最近分析

文件大小

308.1KB

静态报毒动态报毒 AI SCORE=82 ATTRIBUTE BKSNP CONFIDENCE DOWNLOADER34 ELDORADO EMOTET GENERICKDZ GENETIC HCEJ HGIASOGA HIGH CONFIDENCE HIGHCONFIDENCE HSEJQL KRYPTIK MALWARE@#SSK02L0Q65E3 PHORPIEXUPO R + TROJ R348891 SCORE SUSGEN TIOIBELM UNSAFE VY4TLVLX5U8 WACATAC 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRV!DF213FC22574	20210223	6.0.6.653
Baidu		20190318	1.0.0.2
Alibaba	Trojan:Win32/Emotet.2836822f	20190527	0.3.0.5
Kingsoft		20210225	2017.9.26.565
Avast	Win32:Trojan-gen	20210223	21.1.5827.0
CrowdStrike	win/malicious_confidence_60% (W)	20210203	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619963120.87825 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (6 个事件)

Time & API	Arguments	Status	Return
1619963111.78425 CryptGenKey	crypto_handle: 0x005c4e40 algorithm_identifier: 0x0000660e () provider_handle: 0x005c4128 flags: 1 key: fÈ1 ÙÀÁ°cá9	success	1
1619963120.89425 CryptExportKey	crypto_handle: 0x005c4e40 crypto_export_handle: 0x005c4e00 buffer: f¤0ú½wÒ( Z$âà£<*_ F&¸%$/³°,-v&õ^ÄQÍæÂ<¯Ø¬\Õv)vÉ5uÉ½_ZVç ÝÒ¬-5Z©IÞ`ÒúÙ@µ-»7¨x¹¡(¥¹ùMj blob_type: 1 flags: 64	success	1
1619963155.47225 CryptExportKey	crypto_handle: 0x005c4e40 crypto_export_handle: 0x005c4e00 buffer: f¤øÇJïN9H¬£¸î"oõ¨ÂbíéæøX»<n R¼qêO\àkAàUT§0Ï9Æ^ùK-SZÌùIÂTÞî?LÉéQ&é3¾vïCl,\ blob_type: 1 flags: 64	success	1
1619963160.30025 CryptExportKey	crypto_handle: 0x005c4e40 crypto_export_handle: 0x005c4e00 buffer: f¤WoØò2¹AR¾yä&à·ÕkõÇ7{fÎ®ÕÚjá pØbi3KóíÇ6'Ío×7¤`À:4ôj¿µñN-¢ÜðÃ¾êõ¿â.ü¯\|y blob_type: 1 flags: 64	success	1
1619963165.70625 CryptExportKey	crypto_handle: 0x005c4e40 crypto_export_handle: 0x005c4e00 buffer: f¤«³o±=-s&ùæH÷eiPèZÂWBi2ùyÇclè#,#ýoj}#6'è_"ß O7gÖ»nkDÕÿvgãÀPê¹K?uõÊYSµ` blob_type: 1 flags: 64	success	1
1619963169.69125 CryptExportKey	crypto_handle: 0x005c4e40 crypto_export_handle: 0x005c4e00 buffer: f¤ö4bU£.j¿ïd¢ðáðBË;#ºWb{rüI xðòÊ^·7Ê¥¯©IG6YB¤R6oäF¯;l\|gÌ0%röÑ`¸¸$þÙµó¥½ÎQU blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619963111.20625 NtAllocateVirtualMemory	process_identifier: 3056 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003f0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619963121.40925 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

df213fc225741ad8e074ef84c00d8898.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619963121.05025 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (6 个事件)

host	172.217.24.14
host	173.94.215.84
host	178.128.14.92
host	181.126.54.234
host	60.125.114.64
host	85.25.207.108

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619963124.00325 RegSetValueExA	key_handle: 0x000003bc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619963124.00325 RegSetValueExA	key_handle: 0x000003bc value: 0þpç)?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619963124.00325 RegSetValueExA	key_handle: 0x000003bc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619963124.00325 RegSetValueExW	key_handle: 0x000003bc value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619963124.00325 RegSetValueExA	key_handle: 0x000003d4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619963124.00325 RegSetValueExA	key_handle: 0x000003d4 value: 0þpç)?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619963124.00325 RegSetValueExA	key_handle: 0x000003d4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619963124.01925 RegSetValueExW	key_handle: 0x000003b8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Bkav	W32.PhorpiexUPO.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69604
FireEye	Trojan.GenericKDZ.69604
McAfee	Emotet-FRV!DF213FC22574
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Emotet.PED
K7AntiVirus	Trojan ( 005600f21 )
BitDefender	Trojan.GenericKDZ.69604
K7GW	Trojan ( 005600f21 )
Cybereason	malicious.225741
Cyren	W32/Emotet.AQT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Emotet.CD
APEX	Malicious
ClamAV	Win.Packed.Generickdz-9481059-0
Kaspersky	HEUR:Backdoor.Win32.Emotet.vho
Alibaba	Trojan:Win32/Emotet.2836822f
NANO-Antivirus	Trojan.Win32.Emotet.hsejql
ViRobot	Trojan.Win32.Emotet.315392.B
Ad-Aware	Trojan.GenericKDZ.69604
TACHYON	Trojan/W32.Agent.315486.D
Emsisoft	Trojan.Emotet (A)
Comodo	Malware@#ssk02l0q65e3
F-Secure	Trojan.TR/AD.Emotet.bksnp
DrWeb	Trojan.DownLoader34.26342
Zillya	Trojan.Emotet.Win32.24751
TrendMicro	TrojanSpy.Win32.EMOTET.TIOIBELM
McAfee-GW-Edition	BehavesLike.Win32.Emotet.fh
Sophos	Mal/Generic-R + Troj/Emotet-CLN
Ikarus	Trojan-Banker.Emotet
Jiangmin	Backdoor.Emotet.sa
Avira	TR/AD.Emotet.bksnp
Antiy-AVL	Trojan/Win32.Emotet
Gridinsoft	Ransom.Win32.Wacatac.oa
Arcabit	Trojan.Generic.D10FE4
AhnLab-V3	Trojan/Win32.Emotet.R348891
ZoneAlarm	HEUR:Backdoor.Win32.Emotet.vho
GData	Trojan.GenericKDZ.69604
Cynet	Malicious (score: 90)
VBA32	Trojan.Wacatac
ALYac	Trojan.Agent.Emotet
MAX	malware (ai score=82)
Malwarebytes	Trojan.Emotet
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.TIOIBELM
Yandex	Trojan.Emotet!vy4TLVLx5u8
eGambit	Generic.Malware
Fortinet	W32/Kryptik.HCEJ!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (7 个事件)

dead_host	60.125.114.64:443
dead_host	173.94.215.84:80
dead_host	85.25.207.108:8080
dead_host	178.128.14.92:8080
dead_host	192.168.56.101:49175
dead_host	192.168.56.101:49174
dead_host	192.168.56.101:49176

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-21 02:03:49

Imports

Library KERNEL32.dll:

• 0x42e158 CreateEventA

• 0x42e15c lstrlenA

• 0x42e160 LoadResource

• 0x42e164 FindResourceA

• 0x42e168 LockResource

• 0x42e16c GlobalFree

• 0x42e170 GlobalUnlock

• 0x42e174 lstrcpyA

• 0x42e178 GlobalFindAtomA

• 0x42e17c GlobalAddAtomA

• 0x42e180 GlobalGetAtomNameA

• 0x42e184 lstrcatA

• 0x42e188 FreeLibrary

• 0x42e18c MulDiv

• 0x42e190 lstrcpynA

• 0x42e194 LocalFree

• 0x42e198 FormatMessageA

• 0x42e19c LocalAlloc

• 0x42e1a0 GlobalHandle

• 0x42e1a4 GlobalReAlloc

• 0x42e1a8 LocalReAlloc

• 0x42e1ac GlobalFlags

• 0x42e1b0 GetPrivateProfileIntA

• 0x42e1b4 GetPrivateProfileStringA

• 0x42e1b8 WritePrivateProfileStringA

• 0x42e1bc GetCurrentDirectoryA

• 0x42e1c0 GetProcessVersion

• 0x42e1c4 SizeofResource

• 0x42e1c8 SetErrorMode

• 0x42e1cc SuspendThread

• 0x42e1d0 CreateFileA

• 0x42e1d4 LockFile

• 0x42e1d8 UnlockFile

• 0x42e1dc SetEndOfFile

• 0x42e1e0 MoveFileA

• 0x42e1e4 DeleteFileA

• 0x42e1e8 FindClose

• 0x42e1ec FindFirstFileA

• 0x42e1f0 GetVolumeInformationA

• 0x42e1f4 GetFullPathNameA

• 0x42e1f8 GetStringTypeExA

• 0x42e1fc GetThreadLocale

• 0x42e200 GetShortPathNameA

• 0x42e204 GetFileAttributesA

• 0x42e208 GetFileSize

• 0x42e20c GetFileTime

• 0x42e210 LocalFileTimeToFileTime

• 0x42e214 SystemTimeToFileTime

• 0x42e218 SetFileTime

• 0x42e21c SetFileAttributesA

• 0x42e220 FileTimeToSystemTime

• 0x42e224 FileTimeToLocalFileTime

• 0x42e228 SetThreadPriority

• 0x42e22c ResumeThread

• 0x42e230 SetEvent

• 0x42e234 WaitForSingleObject

• 0x42e238 GetLocalTime

• 0x42e23c GetSystemTime

• 0x42e240 ExitThread

• 0x42e244 CreateThread

• 0x42e248 GetProfileStringA

• 0x42e24c GlobalLock

• 0x42e250 GlobalAlloc

• 0x42e254 GlobalDeleteAtom

• 0x42e258 lstrcmpA

• 0x42e25c lstrcmpiA

• 0x42e260 SetEnvironmentVariableA

• 0x42e264 CompareStringW

• 0x42e268 CompareStringA

• 0x42e26c GetLocaleInfoW

• 0x42e270 GetTimeZoneInformation

• 0x42e274 SetConsoleCtrlHandler

• 0x42e278 GetStringTypeW

• 0x42e27c GetStringTypeA

• 0x42e280 ReadFile

• 0x42e284 SetStdHandle

• 0x42e288 LoadLibraryA

• 0x42e28c GetProcAddress

• 0x42e290 GetOEMCP

• 0x42e294 GetACP

• 0x42e298 IsBadCodePtr

• 0x42e29c IsBadReadPtr

• 0x42e2a0 GetVersionExA

• 0x42e2a4 GetUserDefaultLCID

• 0x42e2a8 EnumSystemLocalesA

• 0x42e2ac GetLocaleInfoA

• 0x42e2b0 IsValidCodePage

• 0x42e2b4 IsValidLocale

• 0x42e2b8 GetCPInfo

• 0x42e2bc CloseHandle

• 0x42e2c0 FlushFileBuffers

• 0x42e2c4 SetFilePointer

• 0x42e2c8 SetUnhandledExceptionFilter

• 0x42e2cc WriteFile

• 0x42e2d0 GetFileType

• 0x42e2d4 GetStdHandle

• 0x42e2d8 SetHandleCount

• 0x42e2dc GetEnvironmentStringsW

• 0x42e2e0 GetEnvironmentStrings

• 0x42e2e4 FreeEnvironmentStringsW

• 0x42e2e8 FreeEnvironmentStringsA

• 0x42e2ec GetModuleFileNameA

• 0x42e2f0 UnhandledExceptionFilter

• 0x42e2f4 IsBadWritePtr

• 0x42e2f8 VirtualAlloc

• 0x42e2fc VirtualFree

• 0x42e300 HeapCreate

• 0x42e304 HeapDestroy

• 0x42e308 ExitProcess

• 0x42e30c LCMapStringW

• 0x42e310 LCMapStringA

• 0x42e314 WideCharToMultiByte

• 0x42e318 GetCurrentThread

• 0x42e31c GetLastError

• 0x42e320 TlsGetValue

• 0x42e324 SetLastError

• 0x42e328 TlsFree

• 0x42e32c TlsAlloc

• 0x42e330 TlsSetValue

• 0x42e334 GetCurrentThreadId

• 0x42e338 HeapSize

• 0x42e33c HeapReAlloc

• 0x42e340 GetCurrentProcess

• 0x42e344 TerminateProcess

• 0x42e348 FatalAppExitA

• 0x42e34c RaiseException

• 0x42e350 HeapFree

• 0x42e354 GetVersion

• 0x42e358 GetCommandLineA

• 0x42e35c GetStartupInfoA

• 0x42e360 GetModuleHandleA

• 0x42e364 HeapAlloc

• 0x42e368 RtlUnwind

• 0x42e36c MultiByteToWideChar

• 0x42e370 InterlockedIncrement

• 0x42e374 InterlockedDecrement

• 0x42e378 LeaveCriticalSection

• 0x42e37c DeleteCriticalSection

• 0x42e380 InterlockedExchange

• 0x42e384 InitializeCriticalSection

• 0x42e388 Sleep

• 0x42e38c EnterCriticalSection

• 0x42e390 DuplicateHandle

Library USER32.dll:

• 0x42e3a4 EndDeferWindowPos

• 0x42e3a8 CopyRect

• 0x42e3ac BeginDeferWindowPos

• 0x42e3b0 DeferWindowPos

• 0x42e3b4 EqualRect

• 0x42e3b8 ScreenToClient

• 0x42e3bc AdjustWindowRectEx

• 0x42e3c0 SetFocus

• 0x42e3c4 GetSysColor

• 0x42e3c8 MapWindowPoints

• 0x42e3cc SendDlgItemMessageA

• 0x42e3d0 UpdateWindow

• 0x42e3d4 CheckDlgButton

• 0x42e3d8 CheckRadioButton

• 0x42e3dc GetDlgItemInt

• 0x42e3e0 GetDlgItemTextA

• 0x42e3e4 SetDlgItemInt

• 0x42e3e8 SetDlgItemTextA

• 0x42e3ec IsDlgButtonChecked

• 0x42e3f0 ScrollWindowEx

• 0x42e3f4 IsDialogMessageA

• 0x42e3f8 SetWindowTextA

• 0x42e3fc MoveWindow

• 0x42e400 wvsprintfA

• 0x42e404 LoadStringA

• 0x42e408 DestroyMenu

• 0x42e40c ClientToScreen

• 0x42e410 GetDC

• 0x42e414 ReleaseDC

• 0x42e418 GetWindowDC

• 0x42e41c BeginPaint

• 0x42e420 EndPaint

• 0x42e424 TabbedTextOutA

• 0x42e428 DrawTextA

• 0x42e42c GrayStringA

• 0x42e430 GetClassNameA

• 0x42e434 PtInRect

• 0x42e438 GetDesktopWindow

• 0x42e43c InsertMenuA

• 0x42e440 DeleteMenu

• 0x42e444 GetMenuStringA

• 0x42e448 LoadCursorA

• 0x42e44c GetSysColorBrush

• 0x42e450 GetDialogBaseUnits

• 0x42e454 CharUpperA

• 0x42e458 UnregisterClassA

• 0x42e45c ShowScrollBar

• 0x42e460 GetScrollRange

• 0x42e464 SetScrollRange

• 0x42e468 GetScrollPos

• 0x42e46c SetScrollPos

• 0x42e470 GetTopWindow

• 0x42e474 IsChild

• 0x42e478 GetCapture

• 0x42e47c WinHelpA

• 0x42e480 wsprintfA

• 0x42e484 GetClassInfoA

• 0x42e488 RegisterClassA

• 0x42e48c GetMenu

• 0x42e490 GetMenuItemCount

• 0x42e494 GetSubMenu

• 0x42e498 GetMenuItemID

• 0x42e49c TrackPopupMenu

• 0x42e4a0 SetWindowPlacement

• 0x42e4a4 GetWindowTextLengthA

• 0x42e4a8 ScrollWindow

• 0x42e4ac GetDlgCtrlID

• 0x42e4b0 DefWindowProcA

• 0x42e4b4 CreateWindowExA

• 0x42e4b8 GetClassLongA

• 0x42e4bc SetPropA

• 0x42e4c0 UnhookWindowsHookEx

• 0x42e4c4 GetPropA

• 0x42e4c8 CallWindowProcA

• 0x42e4cc RemovePropA

• 0x42e4d0 GetMessageTime

• 0x42e4d4 GetMessagePos

• 0x42e4d8 GetForegroundWindow

• 0x42e4dc SetForegroundWindow

• 0x42e4e0 GetWindow

• 0x42e4e4 SetWindowPos

• 0x42e4e8 RegisterWindowMessageA

• 0x42e4ec OffsetRect

• 0x42e4f0 IntersectRect

• 0x42e4f4 SystemParametersInfoA

• 0x42e4f8 GetWindowPlacement

• 0x42e4fc EndDialog

• 0x42e500 SetActiveWindow

• 0x42e504 IsWindow

• 0x42e508 CreateDialogIndirectParamA

• 0x42e50c DestroyWindow

• 0x42e510 GetDlgItem

• 0x42e514 OemToCharA

• 0x42e518 CharToOemA

• 0x42e51c GetMenuCheckMarkDimensions

• 0x42e520 LoadBitmapA

• 0x42e524 GetMenuState

• 0x42e528 ModifyMenuA

• 0x42e52c SetMenuItemBitmaps

• 0x42e530 CheckMenuItem

• 0x42e534 EnableMenuItem

• 0x42e538 GetFocus

• 0x42e53c GetNextDlgTabItem

• 0x42e540 GetMessageA

• 0x42e544 TranslateMessage

• 0x42e548 DispatchMessageA

• 0x42e54c GetActiveWindow

• 0x42e550 GetKeyState

• 0x42e554 CallNextHookEx

• 0x42e558 ValidateRect

• 0x42e55c IsWindowVisible

• 0x42e560 PeekMessageA

• 0x42e564 GetCursorPos

• 0x42e568 SetWindowsHookExA

• 0x42e56c GetParent

• 0x42e570 GetLastActivePopup

• 0x42e574 LoadIconA

• 0x42e578 ShowWindow

• 0x42e57c SendMessageA

• 0x42e580 AppendMenuA

• 0x42e584 HideCaret

• 0x42e588 ShowCaret

• 0x42e58c ExcludeUpdateRgn

• 0x42e590 DrawFocusRect

• 0x42e594 IsWindowEnabled

• 0x42e598 GetWindowLongA

• 0x42e59c MessageBoxA

• 0x42e5a0 SetCursor

• 0x42e5a4 ShowOwnedPopups

• 0x42e5a8 PostMessageA

• 0x42e5ac PostQuitMessage

• 0x42e5b0 EnableWindow

• 0x42e5b4 InvalidateRect

• 0x42e5b8 GetScrollInfo

• 0x42e5bc GetWindowTextA

• 0x42e5c0 SetScrollInfo

• 0x42e5c4 IsRectEmpty

• 0x42e5c8 GetWindowRect

• 0x42e5cc IsIconic

• 0x42e5d0 GetSystemMetrics

• 0x42e5d4 GetClientRect

• 0x42e5d8 DrawIcon

• 0x42e5dc GetSystemMenu

• 0x42e5e0 IsWindowUnicode

• 0x42e5e4 CharNextA

• 0x42e5e8 InflateRect

• 0x42e5ec DefDlgProcA

• 0x42e5f0 SetWindowLongA

Library GDI32.dll:

• 0x42e02c GetStockObject

• 0x42e030 SelectPalette

• 0x42e034 SetBkMode

• 0x42e038 SetPolyFillMode

• 0x42e03c SetROP2

• 0x42e040 SetStretchBltMode

• 0x42e044 SetMapMode

• 0x42e048 SetViewportOrgEx

• 0x42e04c OffsetViewportOrgEx

• 0x42e050 SetViewportExtEx

• 0x42e054 ScaleViewportExtEx

• 0x42e058 SetWindowOrgEx

• 0x42e05c OffsetWindowOrgEx

• 0x42e060 SetWindowExtEx

• 0x42e064 ScaleWindowExtEx

• 0x42e068 SelectClipRgn

• 0x42e06c ExcludeClipRect

• 0x42e070 IntersectClipRect

• 0x42e074 OffsetClipRgn

• 0x42e078 MoveToEx

• 0x42e07c LineTo

• 0x42e080 SetTextAlign

• 0x42e084 SetTextJustification

• 0x42e088 SetTextCharacterExtra

• 0x42e08c SetMapperFlags

• 0x42e090 GetCurrentPositionEx

• 0x42e094 ArcTo

• 0x42e098 SetArcDirection

• 0x42e09c PolyDraw

• 0x42e0a0 SelectObject

• 0x42e0a4 SetColorAdjustment

• 0x42e0a8 PolyBezierTo

• 0x42e0ac DeleteObject

• 0x42e0b0 GetClipRgn

• 0x42e0b4 CreateRectRgn

• 0x42e0b8 SelectClipPath

• 0x42e0bc ExtSelectClipRgn

• 0x42e0c0 PlayMetaFileRecord

• 0x42e0c4 GetObjectType

• 0x42e0c8 EnumMetaFile

• 0x42e0cc PlayMetaFile

• 0x42e0d0 GetDeviceCaps

• 0x42e0d4 GetViewportExtEx

• 0x42e0d8 GetWindowExtEx

• 0x42e0dc CreatePen

• 0x42e0e0 ExtCreatePen

• 0x42e0e4 CreateSolidBrush

• 0x42e0e8 CreateHatchBrush

• 0x42e0ec CreatePatternBrush

• 0x42e0f0 CreateDIBPatternBrushPt

• 0x42e0f4 PtVisible

• 0x42e0f8 RectVisible

• 0x42e0fc TextOutA

• 0x42e100 ExtTextOutA

• 0x42e104 Escape

• 0x42e108 GetTextExtentPoint32A

• 0x42e10c GetTextMetricsA

• 0x42e110 CreateFontIndirectA

• 0x42e114 RestoreDC

• 0x42e118 SaveDC

• 0x42e11c StartDocA

• 0x42e120 DeleteDC

• 0x42e124 GetObjectA

• 0x42e128 SetBkColor

• 0x42e12c SetTextColor

• 0x42e130 GetClipBox

• 0x42e134 GetDCOrgEx

• 0x42e138 PolylineTo

• 0x42e13c CreateDIBitmap

• 0x42e140 PatBlt

• 0x42e144 GetTextExtentPointA

• 0x42e148 BitBlt

• 0x42e14c CreateCompatibleDC

• 0x42e150 CreateBitmap

Library comdlg32.dll:

• 0x42e608 GetOpenFileNameA

• 0x42e60c GetSaveFileNameA

• 0x42e610 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42e5f8 OpenPrinterA

• 0x42e5fc DocumentPropertiesA

• 0x42e600 ClosePrinter

Library ADVAPI32.dll:

• 0x42e000 RegSetValueExA

• 0x42e004 RegOpenKeyA

• 0x42e008 RegDeleteKeyA

• 0x42e00c RegDeleteValueA

• 0x42e010 RegCloseKey

• 0x42e014 RegQueryValueExA

• 0x42e018 RegOpenKeyExA

• 0x42e01c RegCreateKeyExA

Library SHELL32.dll:

• 0x42e398 DragAcceptFiles

• 0x42e39c SHGetFileInfoA

Library COMCTL32.dll:

• 0x42e024

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.