1.4
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.59
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | DDoS:Win32/Magania.471218c7 | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20191022 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20191022 | 2013.8.14.323 |
| McAfee | Artemis!E0E57028F129 | 20191022 | 6.0.6.653 |
| Tencent | None | 20191022 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | |
| section | petite |
动态指标
在 PE 资源中识别到外语
(9 个事件)
| name | RT_ICON | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000a590 | size | 0x000002e8 | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000a578 | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000a220 | size | 0x00000358 | ||||||||||||||||||
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '', 'virtual_address': '0x00001000', 'virtual_size': '0x00009000', 'size_of_data': '0x00005600', 'entropy': 7.711960948968617} | entropy | 7.711960948968617 | description | 发现高熵的节 | |||||||||
| entropy | 0.8628649813834999 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 56 个反病毒引擎识别为恶意
(50 out of 56 个事件)
| ALYac | Trojan.GenericKD.31701564 |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.31701564 |
| AhnLab-V3 | Malware/Win32.Generic.C3036121 |
| Alibaba | DDoS:Win32/Magania.471218c7 |
| Antiy-AVL | Trojan[Backdoor]/Win32.Farfli |
| Arcabit | Trojan.Generic.D1E3BA3C |
| Avast | Win32:Malware-gen |
| Avira | TR/Crypt.XPACK.Gen |
| BitDefender | Trojan.GenericKD.31701564 |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| Comodo | TrojWare.Win32.ServStart.CB@7486ss |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.8f1295 |
| Cylance | Unsafe |
| Cyren | W32/ServStart.H.gen!Eldorado |
| DrWeb | Trojan.DownLoader24.63361 |
| ESET-NOD32 | a variant of Win32/ServStart.OP |
| Emsisoft | Trojan.GenericKD.31701564 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/ServStart.H.gen!Eldorado |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| FireEye | Generic.mg.e0e57028f1295f69 |
| Fortinet | W32/GenKryptik.AWIY!tr |
| GData | Trojan.GenericKD.31701564 |
| Ikarus | Trojan.Vundo |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.dctkc |
| K7AntiVirus | Trojan ( 0053266f1 ) |
| K7GW | Trojan ( 0053266f1 ) |
| Kaspersky | Trojan-GameThief.Win32.Magania.uhbd |
| Lionic | Trojan.Win32.Magania.tpSl |
| MAX | malware (ai score=88) |
| McAfee | Artemis!E0E57028F129 |
| McAfee-GW-Edition | GenericRXGZ-ZM!8DC6AAF3BFF5 |
| MicroWorld-eScan | Trojan.GenericKD.31701564 |
| Microsoft | DDoS:Win32/Nitol.A |
| NANO-Antivirus | Trojan.Win32.Magania.gdsedv |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Win32/Trojan.GameThief.699 |
| Rising | Trojan.ServStart!8.107 (TFE:5:PVGbFy6IOJV) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-BCHT |
| Symantec | ML.Attribute.HighConfidence |
| Trapmine | malicious.high.ml.score |
| TrendMicro | TROJ_GEN.R002C0DJI19 |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DJI19 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2017-05-28 21:59:36
PE Imphash
7bdb3a3ad9a3c676789cc5fe74509fe9
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| 0x00001000 | 0x00009000 | 0x00005600 | 7.711960948968617 | |
| .rsrc | 0x0000a000 | 0x00002000 | 0x00000c00 | 4.548959897127443 |
| petite | 0x0000c000 | 0x000001ab | 0x000001ab | 3.83071027050959 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000a590 | 0x000002e8 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_GROUP_ICON | 0x0000a578 | 0x00000014 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_VERSION | 0x0000a220 | 0x00000358 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
Imports
Library kernel32.dll:
• 0x40c10a ExitProcess
• 0x40c10e GetModuleHandleA
• 0x40c112 GetProcAddress
• 0x40c116 VirtualProtect
• 0x40c11a VirtualAlloc
• 0x40c11e VirtualFree
• 0x40c122 LoadLibraryA
Library MFC42.DLL:
• 0x40c12a None
Library MSVCRT.dll:
• 0x40c132 free
Exports
| Ordinal | Address | Name |
|---|---|---|
| 1 | 0x401c70 | Musalut |
L!This program cannot be run in DOS mode.
MvMvMv6jLvyIvjLv"iLv"iFv"iOv{POvMvviKvpLviIvRichMv
`.rsrc
@petite
h{ZY-L [9Fwr
9BVEu`
f-e^Ul.p*#j
z'djgJ+p
&qvG'b
`rP^$^<ci
l'f,5s
qm>&or\hhe5z
7TJjAJ>/)
1INN4]C
b+K>;3o
y%x2dLB
#@h<<Q!#PSHR@aG/1
xi|`@^2qttH
]$TkzA*2`2]iTO_
7?<U$E
['`Xqo"
BdAQuQ
hcpD(p$&
<[LyDRfB
)fAu4I
LTzsr{
!l k;6;*bRVx
g{^!m]T_oV
^Cu39V
WI OE w2~
:fg#R+$
{%^F~h=O*,-u4Q
nTS8WVR
|uLQ_^_T,i0Z+y^
4$eVEr!"o
Z$`a(f
3oWI]1
Z f'a[
))*\\V"{BK
xF]>ZR*5XY"
8qAz?-wj
&>';@aN
l{B,e)NJ*
Ew:>5>Fb#VD;
vuOpUyR
6k >WM
5Wl?.>uIx~F
o+ZG^I
:U9*p>>xw
'(<1EhU
VAEY<MZ|
t.d1=&(m
;\K3A&
bVI9Ul?8
v3KX;?N'*n,U*
EJRf(ox
0ng:frw
<}8 :khHd<
?xy<)2Ac"9\&V
+ &L'<K$
In8_uf
X7b}J3
2]3.`Df$MiOJ8f_
mhF_>}
Tu,Yg]
BBB@ABBBB
BBBBBBBBBBBBBBBB
BBBBBBBBBBBB
BBBBBBBB!!h^F
,"P)!!(6
@YP_Pa
-B*.j-
V3!JBB5#IDy13,
yqLun}1%Ev
VUYQkA* AdpT;Qu(u
oy9`tm
rI:qt;
exl|$g7
EA@' {)2!
u(oaWj
2L"/&nN>i
2a`iFX
T(Y>fu$pGk"
L)X/$ax $
3|zeyo
.s2$>6
UF$ogk%nBT
r.RpBrS
Etijntr&
,0zqanVBM
2\L,-zi
9eC^)-
i4MmMzTai&iFhzkidn`0:
T<6rZ\L"0
CYC&!.}<QCA
>$2GTm|\
RBQ,.!C.:
rqenkmtqP
_q{b5-@Onm`dd)mcfvla3
1DKRu<?M
JICbZ@
=lZLQD{cM
"<(]&0:JZQ1
y03*wTQ97!0O9
u;2{ 3
5-c|OQN
HY kK<caDHl
jrg=~I
JV9E$b
cT>zoc
&Quf@>D*i+
gb1zpJ
vhl& /*sED41
PXQ/RF ?
Yf"'xU#
sGaz5
P9"#cf
&i&isGmpbF
Qqpqt]V
hDm|LIF[Glc
_T^:TH'YUdW
J:-[_ $
Z:2J/}kK'"
{\Bd ^
.zcjk:
N]|3C%H1
16I98'+
[q`;la2Ul
ah^P4u
c bpdz5#
uLD&t_
i#kb/t
U !vS[7
*|q;G4&X
>F@[u}jv
LhI3JA|D%VN`V
FH7h8G{Bq'
e=kH5B(-S
@416?YsX4
|/e*N{6UZxI
G2,*{Hi
,Y8}zbZ
\?z?w=EHu:
mwHl "&
0(xfy;=
gQd.V%
EICc@|
Z.[@t-v
= <)WK$"5M
W5w,XH~[5X
Wr0mh&'"
^Awf!bXcO
r&^q&Y:uNn+/G
X5@YK?PII,
Of@y+|zV
cg00BF
W\|1i:T@>9'
8ufQW0E4
T]Q5.^PvI?P`'
k5dfAokn
F3za:H 5j'
yINX%4By
<G}>=B
"spaE)c29xA_
M//$|.
2KYFo}
1!57F4
"(M+<w
{Fh=9>
NB2h-WvUF
k)rWxd
Vco8B>
H'5-Uv
`uu;y:L
m<9" PY
?_.r%r
jWj6$T<n
EF: VU
`4Z67~
2)#>~!
3PHhUUKw]B/h
.TPU_q
) nru^A
LxND2"J
r@25JI
[S5]oj
S$hb=K
FhnbTSzI
ouI;Q@NN
?,jfj
^.L(JS
4jk%TiD
312IZbs
Y{x+63D
ZuOA:O$,
/WS1,c2
8F(m\f
J rIqbN9
/20dj}F
}b~Y%yn
Bl4k)s
r _xH5
t}J>^I
:Ka'`A
J;F3RN
lhVpRH,
{49pDr
#Lh=81P
O'!/2ZzK
1y'Tpjf|%
&VDT]mJ~c`
CwNZ5RQg
mDFb 7
fgVs3A
d".CbS{*
86sYQ;]
-@cXzG7
KP.a&-}
>6,JpG%G
`jx57Bs_(O:
:^Z,x*
<G=mI.i
X<#'.m
/0o$+4
<Bi^aA#e>
[<8*p-Z)#
j9T>Y7
S.MS,k
+4AS`.uRPH
Pv]z.s<_xZ+
Z~TBNp
?:el\a6_
R-18~tv"7%%t
y~w*N7@
9)W|DT7
Gb:.c-
cp'$/GH&2$_NOZ
*\N3@l
$.`d=4E
tOW!{q
.1,*K)~"cqwW@
\Vj(_a1
R!8=s+D
`xWo9=N
xU%v*3|*avi
</OSLT
| iS_!'
nAX9UwP3\ZIvhZx
z[!V0_
ysj'IE13t
Vh`\V_
+l%M&C(t
|YD#1Um.
{_R2%C
hQxn1" ],7u)
^_z#:t
-nnad\
w|4F4i2
`EFhsu
@P2+|0.LTv
y03YUf
II8&Ka
_E,||#v}w Ri
1;<ut4
J9:rtG
UBLW"?
t9.wS0
4Wa6IffPca
WBDP $
hQEV}j
5@LfMgr/
!|]hs <%
8nHJi$9
J?=g%UZ"5m"]76
)BPC|4
&6Y^<MH
MN-~)I
=q;!VP[`2Ob
cZ)x{ru9_'q1
DlW'X3W
V#_Ees
'U}*Rt
``;6n\
>Sv_yE"D4s=}^x/j1tq
V4 )O}7G
Jn%`t?~khVy
P"F$:GB/)z<
_,Gkadl~{Z
8c/aad'k{-6;
tyNnZ2neHRT|'B
mDDG4$Xp_
cA?DLN
xvzQNe
\G%SS6"
!07I]R
4zI124G
h%Z"XxC@BW?4Tjks
LD\!YG
\l5o'X
z?)Te+{
vI2Y/l,9=
a>QNF{
i69Mlv
#E/m!D
?qDq1DEM#7
Q9<"7c]I
t$VjS]
mme/"T
JZOpu1
\0lHYu
T7@n$~!O'GmU
Zkaqv'
Tza(lh!DO&
pify1JIE
}{4zICA
%MI\S1
\p7v4t
{|YL\B_DL]
1h@dSAr{jsirr8TYX|82Be
"3@.2<;./
X1N75=sR
/NXyu{oVai`jD
DM#`>g
:}~yF/
UX1!&Y
T/>0@;
7WpXom-n*nc-]KW
Qo4PaO
zCe-Q`9G<`a
R}@j'%8p
41d/%n&
#*\n1*"v3+
qG `=>x
UNH KBN
0: oE<(
;/`vqms
LqX&*Z
V\dF{da&
V48^XXXX]
HrCg@b
Z(JbOG
"+2 +>
T/JcYA
2,bcQq
;PA!6I
!z(\|V]QV
3r>bPr4
jO `v*9|`s
MMROcY,q
)C^VO_/f
Pq-_v+q
2[d'/Z
%]'SaA{T
UGs.@Am
MessageBoxA
wsprintfA
ExitProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
user32.dll
kernel32.dll
MFC42.DLL
MSVCRT.dll
Musalut
MDat.dll
IIr61b8IGwIIr61b8IGwIIr61b8IGwIIr61b8IGwIIr61b8IGwH8ejLY8gJOH8ejLY8gJOH8ejLY8gJOH8ejLY8gJOH8ejLY8gJOOonYaoHtrMOonYaoHtrMOonYaoHtrMOonYaoHtrMOonYaoHtrMs86ZuDxfEVs86ZuDxfEVs86ZuDxfEVs86ZuDxfEVs86ZuDxfEVlePbUjXmcQlePbUjXmcQlePbUjXmcQlePbUjXmcQlePbUjXmcQGI4JVKMKm
GI4JVKMKm
GI4JVKMKm
GI4JVKMKm
GI4JVKMKm
1gzMldzfu41gzMldzfu41gzMldzfu41gzMldzfu41gzMldzfu4ETZRJXSONUETZRJXSONUETZRJXSONUETZRJXSONUETZRJXSONUCMYI9YQV1vCMYI9YQV1vCMYI9YQV1vCMYI9YQV1vCMYI9YQV1vVSrFJJUKP
VSrFJJUKP
VSrFJJUKP
VSrFJJUKP
VSrFJJUKP
O66w7yvjGyO66w7yvjGyO66w7yvjGyO66w7yvjGyO66w7yvjGyirHJSUTJQHirHJSUTJQHirHJSUTJQHirHJSUTJQHirHJSUTJQHtk6f8jXCyotk6f8jXCyotk6f8jXCyotk6f8jXCyotk6f8jXCyoW0vcDV9k5oW0vcDV9k5oW0vcDV9k5oW0vcDV9k5oW0vcDV9k5oUIFvtZ7wVmUIFvtZ7wVmUIFvtZ7wVmUIFvtZ7wVmUIFvtZ7wVmlOTmuchbCwlOTmuchbCwlOTmuchbCwlOTmuchbCwlOTmuchbCwmOW1kMzTvXmOW1kMzTvXmOW1kMzTvXmOW1kMzTvXmOW1kMzTvXSzP4m68IJbSzP4m68IJbSzP4m68IJbSzP4m68IJbSzP4m68IJbRo588cdikTRo588cdikTRo588cdikTRo588cdikTRo588cdikTveWi1yqVC
veWi1yqVC
veWi1yqVC
veWi1yqVC
veWi1yqVC
n7dTFNLZyrn7dTFNLZyrn7dTFNLZyrn7dTFNLZyrn7dTFNLZyrpQ4YqOwXT8pQ4YqOwXT8pQ4YqOwXT8pQ4YqOwXT8pQ4YqOwXT8YiWteCvM9jYiWteCvM9jYiWteCvM9jYiWteCvM9jYiWteCvM9jeyIbeIReIpeyIbeIReIpeyIbeIReIpeyIbeIReIpeyIbeIReIpdXORlYLu8NdXORlYLu8NdXORlYLu8NdXORlYLu8NdXORlYLu8Ne72Wqw9wCNe72Wqw9wCNe72Wqw9wCNe72Wqw9wCNe72Wqw9wCNeaLGfaXiq8eaLGfaXiq8eaLGfaXiq8eaLGfaXiq8eaLGfaXiq8z
UokcfJ88zUokcfJ88
zUokcfJ88
zUokcfJ88
zUokcfJ88
ubZfjLVZbFubZfjLVZbFubZfjLVZbFubZfjLVZbFubZfjLVZbFYLEXLWKa8lYLEXLWKa8lYLEXLWKa8lYLEXLWKa8lYLEXLWKa8l9QkFSr7FFj9QkFSr7FFj9QkFSr7FFj9QkFSr7FFj9QkFSr7FFjs86h0gYt3Ds86h0gYt3Ds86h0gYt3Ds86h0gYt3Ds86h0gYt3D2EzW55vad42EzW55vad42EzW55vad42EzW55vad42EzW55vad4TzOjga2FNMTzOjga2FNMTzOjga2FNMTzOjga2FNMTzOjga2FNMagrwKkZ2wragrwKkZ2wragrwKkZ2wragrwKkZ2wragrwKkZ2wr2PFKoXasPS2PFKoXasPS2PFKoXasPS2PFKoXasPS2PFKoXasPSNJiLMW3XiINJiLMW3XiINJiLMW3XiINJiLMW3XiINJiLMW3XiIWjylmZR5s2WjylmZR5s2WjylmZR5s2WjylmZR5s2WjylmZR5s21
8aYrj48k18aYrj48k
18aYrj48k
18aYrj48k
18aYrj48k
iCW21RNeJoiCW21RNeJoiCW21RNeJoiCW21RNeJoiCW21RNeJojqt3gstSHbjqt3gstSHbjqt3gstSHbjqt3gstSHbjqt3gstSHbNC
QmPHYMXNCQmPHYMX
NCQmPHYMX
NCQmPHYMX
NCQmPHYMX
2oqLnE3YNb2oqLnE3YNb2oqLnE3YNb2oqLnE3YNb2oqLnE3YNbPMYD77O5GcPMYD77O5GcPMYD77O5GcPMYD77O5GcPMYD77O5GcZDaNu0GG9dZDaNu0GG9dZDaNu0GG9dZDaNu0GG9dZDaNu0GG9d8wIH5T9luL8wIH5T9luL8wIH5T9luL8wIH5T9luL8wIH5T9luLMxM8g
MxM8gtjp
MxM8gtjp
MxM8gtjp
MxM8gtjp
CWKrMbw3ixCWKrMbw3ixCWKrMbw3ixCWKrMbw3ixCWKrMbw3ixEWufqK41PuEWufqK41PuEWufqK41PuEWufqK41PuEWufqK41PucV7WDGlloJcV7WDGlloJcV7WDGlloJcV7WDGlloJcV7WDGlloJ55Hn1CDThi55Hn1CDThi55Hn1CDThi55Hn1CDThi55Hn1CDThij4MRZihHylj4MRZihHylj4MRZihHylj4MRZihHylj4MRZihHylrT6QJ5CTM
rT6QJ5CTM
rT6QJ5CTM
rT6QJ5CTM
rT6QJ5CTM
6jXel8T0q6jXel8T
0q6jXel8T
0q6jXel8T
0q6jXel8T
tFOkgKK
MVtFOkgKKMV
tFOkgKKMV
tFOkgKKMV
tFOkgKKMV
hRln7u1Hv9hRln7u1Hv9hRln7u1Hv9hRln7u1Hv9hRln7u1Hv9pPQHz8Vh8spPQHz8Vh8spPQHz8Vh8spPQHz8Vh8spPQHz8Vh8scjJbrnPzZ
cjJbrnPzZ
cjJbrnPzZ
cjJbrnPzZ
cjJbrnPzZ
D6xyiNjbiXD6xyiNjbiXD6xyiNjbiXD6xyiNjbiXD6xyiNjbiXrDJDDLSo
rDJDDLSo
rDJDDLSo
rDJDDLSo
rDJDDLSo
c9UPHFnilOc9UPHFnilOc9UPHFnilOc9UPHFnilOc9UPHFnilOs14gFw8V5rs14gFw8V5rs14gFw8V5rs14gFw8V5rs14gFw8V5r7XmlTEvma37XmlTEvma37XmlTEvma37XmlTEvma37XmlTEvma3UohlxsM3DzUohlxsM3DzUohlxsM3DzUohlxsM3DzUohlxsM3DztfJl6hsa79tfJl6hsa79tfJl6hsa79tfJl6hsa79tfJl6hsa79gFnChHSwXDgFnChHSwXDgFnChHSwXDgFnChHSwXDgFnChHSwXDXp9GrYPiuzXp9GrYPiuzXp9GrYPiuzXp9GrYPiuzXp9GrYPiuzRKKf
9EFmoRKKf9EFmo
RKKf9EFmo
RKKf9EFmo
RKKf9EFmo
L7VERMjMHOL7VERMjMHOL7VERMjMHOL7VERMjMHOL7VERMjMHOEPz8mFbGQsEPz8mFbGQsEPz8mFbGQsEPz8mFbGQsEPz8mFbGQs4XF6mZi8
4XF6mZi8
4XF6mZi8
4XF6mZi8
4XF6mZi8
rDC4Jk7StlrDC4Jk7StlrDC4Jk7StlrDC4Jk7StlrDC4Jk7StlNCun8q8Mg
NCun8q8Mg
NCun8q8Mg
NCun8q8Mg
NCun8q8Mg
QZi5Mmpg9
QZi5Mmpg9
QZi5Mmpg9
QZi5Mmpg9
QZi5Mmpg9
QyjRC73KppQyjRC73KppQyjRC73KppQyjRC73KppQyjRC73KppEc6kgxhyRQEc6kgxhyRQEc6kgxhyRQEc6kgxhyRQEc6kgxhyRQy1fQ4YCRrcy1fQ4YCRrcy1fQ4YCRrcy1fQ4YCRrcy1fQ4YCRrcpHD
II87HPpHDII87HP
pHDII87HP
pHDII87HP
pHDII87HP
Wm1bbNe
q0Wm1bbNeq0
Wm1bbNeq0
Wm1bbNeq0
Wm1bbNeq0
SlfrYgzWjcSlfrYgzWjcSlfrYgzWjcSlfrYgzWjcSlfrYgzWjc4sT7pIoTbt4sT7pIoTbt4sT7pIoTbt4sT7pIoTbt4sT7pIoTbt0mGtInUq1R0mGtInUq1R0mGtInUq1R0mGtInUq1R0mGtInUq1R8pKHvbYFz
8pKHvbYFz
8pKHvbYFz
8pKHvbYFz
8pKHvbYFz
j7GK5qdwuZj7GK5qdwuZj7GK5qdwuZj7GK5qdwuZj7GK5qdwuZq5OIx3bM7Jq5OIx3bM7Jq5OIx3bM7Jq5OIx3bM7Jq5OIx3bM7JcE3VcQ5y9OcE3VcQ5y9OcE3VcQ5y9OcE3VcQ5y9OcE3VcQ5y9OhoJSh7DvndhoJSh7DvndhoJSh7DvndhoJSh7DvndhoJSh7Dvnd58aYHtOX7u58aYHtOX7u58aYHtOX7u58aYHtOX7u58aYHtOX7uNyvTG2nVZfNyvTG2nVZfNyvTG2nVZfNyvTG2nVZfNyvTG2nVZf0frV9My1CI0frV9My1CI0frV9My1CI0frV9My1CI0frV9My1CIHOZrXNyS
HOZrXNyS
HOZrXNyS
HOZrXNyS
HOZrXNyS
VHDGwjPI25VHDGwjPI25VHDGwjPI25VHDGwjPI25VHDGwjPI251rGCyJWix41rGCyJWix41rGCyJWix41rGCyJWix41rGCyJWix4
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 4 0 4 b 0
C o m m e n t s
C o m p a n y N a m e
F i l e D e s c r i p t i o n
4 g f t r 7 h 8 7 j d 9 8 . e x e
F i l e V e r s i o n
1 , 0 , 0 , 1
I n t e r n a l N a m e
4 g f t r 7 h 8 7 j d 9 8 . e x e
L e g a l C o p y r i g h t
( C ) 2 0 1 7
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
4 g f t r 7 h 8 7 j d 9 8 . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
4 g f t r 7 h 8 7 j d 9 8 . e x e
P r o d u c t V e r s i o n
1 , 0 , 0 , 1
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.