SmartHawk

4.4

中危

66 个模型检测该样本为恶意！

重新分析

下载样本

76891d123ffcc4b341faf147aa9a9eb740a7109164c80548da1755e101c39491

e139adc760802c47db9d4efbc9523b06.exe

分析耗时

83s

最近分析

文件大小

658.5KB

静态报毒动态报毒 100% ACEG AI SCORE=85 CLASSIC COMET CONFIDENCE DARKCOMET DARKKOMET DARKKOMETJ DGNEPN FWDO FYNLOS FYNLOSK FYNLOSKI GRAYBIRD HIGH CONFIDENCE HUIGEZIT MALICIOUS PE MODERATE PK0@AWO3UWES PONTOEB R33420 SCORE TNET TORDEV UNSAFE USERSTARTUP XAB@4OF2BC 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Generic BackDoor.xa	20191113	6.0.6.653
Alibaba	Backdoor:Win32/Fynloski.9f55a372	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu	Win32.Backdoor.Agent.l	20190318	1.0.0.2
Avast	MSIL:GenMalicious-CHX [Trj]	20191118	18.4.3895.0
Kingsoft	Win32.Hack.HuigeziT.cz	20191118	2013.8.14.323
Tencent	Backdoor.Win32.DarkKomet.zem	20191118	1.0.0.1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620827278.22875 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.itext

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620827278.72875 __exception__	stacktrace: e139adc760802c47db9d4efbc9523b06+0x9772 @ 0x409772 e139adc760802c47db9d4efbc9523b06+0x8fef1 @ 0x48fef1 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637628 registers.edi: 0 registers.eax: 1637628 registers.ebp: 1637708 registers.edx: 0 registers.ebx: 4229120 registers.esi: 1637784 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620827277.91675 NtAllocateVirtualMemory	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008f0000	success	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (10 个事件)

Time & API	Arguments	Status	Return
1620827278.30675 LookupPrivilegeValueW	system_name: privilege_name: SeSecurityPrivilege	success	1
1620827278.32275 LookupPrivilegeValueW	system_name: privilege_name: SeTakeOwnershipPrivilege	success	1
1620827278.32275 LookupPrivilegeValueW	system_name: privilege_name: SeLoadDriverPrivilege	success	1
1620827278.40075 LookupPrivilegeValueW	system_name: privilege_name: SeBackupPrivilege	success	1
1620827278.40075 LookupPrivilegeValueW	system_name: privilege_name: SeRestorePrivilege	success	1
1620827278.40075 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620827278.41675 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620827278.46375 LookupPrivilegeValueW	system_name: privilege_name: SeRemoteShutdownPrivilege	success	1
1620827278.47875 LookupPrivilegeValueW	system_name: privilege_name: SeManageVolumePrivilege	success	1
1620827278.51075 LookupPrivilegeValueW	system_name: privilege_name: SeCreateGlobalPrivilege	success	1

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Installs itself for autorun at Windows startup (2 个事件)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate				reg_value	C:\Users\ADMINI~1.OSK\AppData\Local\Temp\MSDCSC\msdcsc.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit				reg_value	C:\Windows\system32\userinit.exe,C:\Users\ADMINI~1.OSK\AppData\Local\Temp\MSDCSC\msdcsc.exe

Creates known Fynloski/DarkComet files, registry keys and/or mutexes (2 个事件)

regkey	HKEY_CURRENT_USER\Software\DC3_FEXEC
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\MSDCSC\msdcsc.exe

File has been identified by 66 AntiVirus engines on VirusTotal as malicious (50 out of 66 个事件)

Bkav	W32.DarkKometJ.Trojan
MicroWorld-eScan	Gen:Trojan.UserStartup.PK0@aWo3UWeS
CAT-QuickHeal	Backdoor.Fynloski.A9
McAfee	Generic BackDoor.xa
Cylance	Unsafe
VIPRE	Backdoor.Win32.Fynloski.A (v)
AegisLab	Trojan.Win32.DarkKomet.tneT
K7AntiVirus	Trojan ( 004bc4d11 )
Alibaba	Backdoor:Win32/Fynloski.9f55a372
K7GW	Trojan ( 004bc4d11 )
CrowdStrike	win/malicious_confidence_100% (W)
Invincea	heuristic
Baidu	Win32.Backdoor.Agent.l
F-Prot	W32/Fynloski.BA
Symantec	SMG.Heur!gen
ESET-NOD32	Win32/Fynloski.AM
APEX	Malicious
Avast	MSIL:GenMalicious-CHX [Trj]
ClamAV	Win.Trojan.DarkKomet-1
Kaspersky	Backdoor.Win32.DarkKomet.aceg
BitDefender	Gen:Trojan.UserStartup.PK0@aWo3UWeS
NANO-Antivirus	Trojan.Win32.Tordev.dgnepn
Rising	Backdoor.Pontoeb!1.6637 (CLASSIC)
Endgame	malicious (high confidence)
Emsisoft	Trojan.Fynloski (A)
Comodo	Backdoor.Win32.Agent.XAB@4of2bc
F-Secure	Backdoor.BDS/Backdoor.Gen
DrWeb	BackDoor.Tordev.9
Zillya	Backdoor.DarkKomet.Win32.30209
TrendMicro	BKDR_FYNLOS.SMM
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.jh
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.e139adc760802c47
Sophos	Troj/Fynlosk-AK
Ikarus	Backdoor.Win32.DarkKomet
Cyren	W32/Fynloski.FWDO-2352
Jiangmin	Backdoor/DarkKomet.lue
Webroot	W32.Trojan.Gen
Avira	BDS/Backdoor.Gen
MAX	malware (ai score=85)
Antiy-AVL	Trojan[Backdoor]/Win32.DarkKomet
Kingsoft	Win32.Hack.HuigeziT.cz
Microsoft	Backdoor:Win32/Fynloski.A
Arcabit	Trojan.UserStartup.EA80ED
SUPERAntiSpyware	Backdoor.Fynloski
ZoneAlarm	Backdoor.Win32.DarkKomet.aceg
GData	Gen:Trojan.UserStartup.PK0@aWo3UWeS
AhnLab-V3	Backdoor/Win32.Graybird.R33420
Acronis	suspicious
VBA32	Backdoor.Tordev

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2012-06-08 19:12:27

Imports

Library oleaut32.dll:

• 0x49dca4 SysFreeString

• 0x49dca8 SysReAllocStringLen

• 0x49dcac SysAllocStringLen

Library advapi32.dll:

• 0x49dcb4 RegQueryValueExA

• 0x49dcb8 RegOpenKeyExA

• 0x49dcbc RegCloseKey

Library user32.dll:

• 0x49dcc4 GetKeyboardType

• 0x49dcc8 DestroyWindow

• 0x49dccc LoadStringA

• 0x49dcd0 MessageBoxA

• 0x49dcd4 CharNextA

Library kernel32.dll:

• 0x49dcdc GetACP

• 0x49dce0 Sleep

• 0x49dce4 VirtualFree

• 0x49dce8 VirtualAlloc

• 0x49dcec GetTickCount

• 0x49dcf0 QueryPerformanceCounter

• 0x49dcf4 GetCurrentThreadId

• 0x49dcf8 InterlockedDecrement

• 0x49dcfc InterlockedIncrement

• 0x49dd00 VirtualQuery

• 0x49dd04 WideCharToMultiByte

• 0x49dd08 MultiByteToWideChar

• 0x49dd0c lstrlenA

• 0x49dd10 lstrcpynA

• 0x49dd14 LoadLibraryExA

• 0x49dd18 GetThreadLocale

• 0x49dd1c GetStartupInfoA

• 0x49dd20 GetProcAddress

• 0x49dd24 GetModuleHandleA

• 0x49dd28 GetModuleFileNameA

• 0x49dd2c GetLocaleInfoA

• 0x49dd30 GetLastError

• 0x49dd34 GetCommandLineA

• 0x49dd38 FreeLibrary

• 0x49dd3c FindFirstFileA

• 0x49dd40 FindClose

• 0x49dd44 ExitProcess

• 0x49dd48 ExitThread

• 0x49dd4c CreateThread

• 0x49dd50 CompareStringA

• 0x49dd54 WriteFile

• 0x49dd58 UnhandledExceptionFilter

• 0x49dd5c SetFilePointer

• 0x49dd60 SetEndOfFile

• 0x49dd64 RtlUnwind

• 0x49dd68 ReadFile

• 0x49dd6c RaiseException

• 0x49dd70 GetStdHandle

• 0x49dd74 GetFileSize

• 0x49dd78 GetFileType

• 0x49dd7c CreateFileA

• 0x49dd80 CloseHandle

Library kernel32.dll:

• 0x49dd88 TlsSetValue

• 0x49dd8c TlsGetValue

• 0x49dd90 LocalAlloc

• 0x49dd94 GetModuleHandleA

Library user32.dll:

• 0x49dd9c CreateWindowExA

• 0x49dda0 mouse_event

• 0x49dda4 keybd_event

• 0x49dda8 WindowFromPoint

• 0x49ddac WaitMessage

• 0x49ddb0 VkKeyScanA

• 0x49ddb4 UpdateWindow

• 0x49ddb8 UnregisterClassA

• 0x49ddbc UnhookWindowsHookEx

• 0x49ddc0 TranslateMessage

• 0x49ddc4 TranslateMDISysAccel

• 0x49ddc8 TrackPopupMenu

• 0x49ddcc ToAscii

• 0x49ddd0 SystemParametersInfoA

• 0x49ddd4 ShowWindow

• 0x49ddd8 ShowScrollBar

• 0x49dddc ShowOwnedPopups

• 0x49dde0 SetWindowsHookExA

• 0x49dde4 SetWindowTextA

• 0x49dde8 SetWindowPos

• 0x49ddec SetWindowPlacement

• 0x49ddf0 SetWindowLongW

• 0x49ddf4 SetWindowLongA

• 0x49ddf8 SetTimer

• 0x49ddfc SetScrollRange

• 0x49de00 SetScrollPos

• 0x49de04 SetScrollInfo

• 0x49de08 SetRect

• 0x49de0c SetPropA

• 0x49de10 SetParent

• 0x49de14 SetMenuItemInfoA

• 0x49de18 SetMenu

• 0x49de1c SetForegroundWindow

• 0x49de20 SetFocus

• 0x49de24 SetCursorPos

• 0x49de28 SetCursor

• 0x49de2c SetClipboardData

• 0x49de30 SetClassLongA

• 0x49de34 SetCapture

• 0x49de38 SetActiveWindow

• 0x49de3c SendMessageW

• 0x49de40 SendMessageA

• 0x49de44 ScrollWindow

• 0x49de48 ScreenToClient

• 0x49de4c RemovePropA

• 0x49de50 RemoveMenu

• 0x49de54 ReleaseDC

• 0x49de58 ReleaseCapture

• 0x49de5c RegisterWindowMessageA

• 0x49de60 RegisterClipboardFormatA

• 0x49de64 RegisterClassA

• 0x49de68 RedrawWindow

• 0x49de6c PtInRect

• 0x49de70 PostQuitMessage

• 0x49de74 PostMessageA

• 0x49de78 PeekMessageW

• 0x49de7c PeekMessageA

• 0x49de80 OpenClipboard

• 0x49de84 OffsetRect

• 0x49de88 OemToCharA

• 0x49de8c MsgWaitForMultipleObjectsEx

• 0x49de90 MsgWaitForMultipleObjects

• 0x49de94 MessageBoxA

• 0x49de98 MapWindowPoints

• 0x49de9c MapVirtualKeyA

• 0x49dea0 LockWorkStation

• 0x49dea4 LoadStringA

• 0x49dea8 LoadKeyboardLayoutA

• 0x49deac LoadIconA

• 0x49deb0 LoadCursorA

• 0x49deb4 LoadBitmapA

• 0x49deb8 KillTimer

• 0x49debc IsZoomed

• 0x49dec0 IsWindowVisible

• 0x49dec4 IsWindowUnicode

• 0x49dec8 IsWindowEnabled

• 0x49decc IsWindow

• 0x49ded0 IsRectEmpty

• 0x49ded4 IsIconic

• 0x49ded8 IsDialogMessageW

• 0x49dedc IsDialogMessageA

• 0x49dee0 IsClipboardFormatAvailable

• 0x49dee4 IsChild

• 0x49dee8 InvalidateRect

• 0x49deec IntersectRect

• 0x49def0 InsertMenuItemA

• 0x49def4 InsertMenuA

• 0x49def8 InflateRect

• 0x49defc GetWindowThreadProcessId

• 0x49df00 GetWindowTextLengthA

• 0x49df04 GetWindowTextA

• 0x49df08 GetWindowRect

• 0x49df0c GetWindowPlacement

• 0x49df10 GetWindowLongW

• 0x49df14 GetWindowLongA

• 0x49df18 GetWindowDC

• 0x49df1c GetTopWindow

• 0x49df20 GetSystemMetrics

• 0x49df24 GetSystemMenu

• 0x49df28 GetSysColorBrush

• 0x49df2c GetSysColor

• 0x49df30 GetSubMenu

• 0x49df34 GetScrollRange

• 0x49df38 GetScrollPos

• 0x49df3c GetScrollInfo

• 0x49df40 GetPropA

• 0x49df44 GetParent

• 0x49df48 GetWindow

• 0x49df4c GetMessagePos

• 0x49df50 GetMessageA

• 0x49df54 GetMenuStringA

• 0x49df58 GetMenuState

• 0x49df5c GetMenuItemInfoA

• 0x49df60 GetMenuItemID

• 0x49df64 GetMenuItemCount

• 0x49df68 GetMenu

• 0x49df6c GetLastInputInfo

• 0x49df70 GetLastActivePopup

• 0x49df74 GetKeyboardState

• 0x49df78 GetKeyboardLayoutNameA

• 0x49df7c GetKeyboardLayoutList

• 0x49df80 GetKeyboardLayout

• 0x49df84 GetKeyState

• 0x49df88 GetKeyNameTextA

• 0x49df8c GetIconInfo

• 0x49df90 GetForegroundWindow

• 0x49df94 GetFocus

• 0x49df98 GetDesktopWindow

• 0x49df9c GetDCEx

• 0x49dfa0 GetDC

• 0x49dfa4 GetCursorPos

• 0x49dfa8 GetCursor

• 0x49dfac GetClipboardData

• 0x49dfb0 GetClientRect

• 0x49dfb4 GetClassNameA

• 0x49dfb8 GetClassLongA

• 0x49dfbc GetClassInfoA

• 0x49dfc0 GetCapture

• 0x49dfc4 GetActiveWindow

• 0x49dfc8 FrameRect

• 0x49dfcc FindWindowExA

• 0x49dfd0 FindWindowA

• 0x49dfd4 FillRect

• 0x49dfd8 ExitWindowsEx

• 0x49dfdc EqualRect

• 0x49dfe0 EnumWindows

• 0x49dfe4 EnumThreadWindows

• 0x49dfe8 EnumDisplayDevicesA

• 0x49dfec EnumClipboardFormats

• 0x49dff0 EnumChildWindows

• 0x49dff4 EndPaint

• 0x49dff8 EnableWindow

• 0x49dffc EnableScrollBar

• 0x49e000 EnableMenuItem

• 0x49e004 EmptyClipboard

• 0x49e008 DrawTextA

• 0x49e00c DrawMenuBar

• 0x49e010 DrawIconEx

• 0x49e014 DrawIcon

• 0x49e018 DrawFrameControl

• 0x49e01c DrawEdge

• 0x49e020 DispatchMessageW

• 0x49e024 DispatchMessageA

• 0x49e028 DestroyWindow

• 0x49e02c DestroyMenu

• 0x49e030 DestroyIcon

• 0x49e034 DestroyCursor

• 0x49e038 DeleteMenu

• 0x49e03c DefWindowProcA

• 0x49e040 DefMDIChildProcA

• 0x49e044 DefFrameProcA

• 0x49e048 CreatePopupMenu

• 0x49e04c CreateMenu

• 0x49e050 CreateIcon

• 0x49e054 CloseClipboard

• 0x49e058 ClientToScreen

• 0x49e05c CheckMenuItem

• 0x49e060 CallWindowProcA

• 0x49e064 CallNextHookEx

• 0x49e068 BeginPaint

• 0x49e06c CharNextA

• 0x49e070 CharLowerBuffA

• 0x49e074 CharLowerA

• 0x49e078 CharUpperBuffA

• 0x49e07c CharToOemA

• 0x49e080 AdjustWindowRectEx

• 0x49e084 ActivateKeyboardLayout

Library gdi32.dll:

• 0x49e08c UnrealizeObject

• 0x49e090 StretchBlt

• 0x49e094 SetWindowOrgEx

• 0x49e098 SetWinMetaFileBits

• 0x49e09c SetViewportOrgEx

• 0x49e0a0 SetTextColor

• 0x49e0a4 SetStretchBltMode

• 0x49e0a8 SetROP2

• 0x49e0ac SetPixel

• 0x49e0b0 SetEnhMetaFileBits

• 0x49e0b4 SetDIBColorTable

• 0x49e0b8 SetBrushOrgEx

• 0x49e0bc SetBkMode

• 0x49e0c0 SetBkColor

• 0x49e0c4 SelectPalette

• 0x49e0c8 SelectObject

• 0x49e0cc SaveDC

• 0x49e0d0 RestoreDC

• 0x49e0d4 RectVisible

• 0x49e0d8 RealizePalette

• 0x49e0dc PlayEnhMetaFile

• 0x49e0e0 PatBlt

• 0x49e0e4 MoveToEx

• 0x49e0e8 MaskBlt

• 0x49e0ec LineTo

• 0x49e0f0 IntersectClipRect

• 0x49e0f4 GetWindowOrgEx

• 0x49e0f8 GetWinMetaFileBits

• 0x49e0fc GetTextMetricsA

• 0x49e100 GetTextExtentPoint32A

• 0x49e104 GetSystemPaletteEntries

• 0x49e108 GetStockObject

• 0x49e10c GetRgnBox

• 0x49e110 GetPixel

• 0x49e114 GetPaletteEntries

• 0x49e118 GetObjectA

• 0x49e11c GetEnhMetaFilePaletteEntries

• 0x49e120 GetEnhMetaFileHeader

• 0x49e124 GetEnhMetaFileBits

• 0x49e128 GetDeviceCaps

• 0x49e12c GetDIBits

• 0x49e130 GetDIBColorTable

• 0x49e134 GetDCOrgEx

• 0x49e138 GetCurrentPositionEx

• 0x49e13c GetClipBox

• 0x49e140 GetBrushOrgEx

• 0x49e144 GetBitmapBits

• 0x49e148 GdiFlush

• 0x49e14c ExtTextOutA

• 0x49e150 ExcludeClipRect

• 0x49e154 DeleteObject

• 0x49e158 DeleteEnhMetaFile

• 0x49e15c DeleteDC

• 0x49e160 CreateSolidBrush

• 0x49e164 CreatePenIndirect

• 0x49e168 CreatePalette

• 0x49e16c CreateHalftonePalette

• 0x49e170 CreateFontIndirectA

• 0x49e174 CreateDIBitmap

• 0x49e178 CreateDIBSection

• 0x49e17c CreateDCA

• 0x49e180 CreateCompatibleDC

• 0x49e184 CreateCompatibleBitmap

• 0x49e188 CreateBrushIndirect

• 0x49e18c CreateBitmap

• 0x49e190 CopyEnhMetaFileA

• 0x49e194 BitBlt

Library version.dll:

• 0x49e19c VerQueryValueA

• 0x49e1a0 GetFileVersionInfoSizeA

• 0x49e1a4 GetFileVersionInfoA

Library kernel32.dll:

• 0x49e1ac lstrcpyA

• 0x49e1b0 WriteProcessMemory

• 0x49e1b4 WriteFile

• 0x49e1b8 WinExec

• 0x49e1bc WaitForSingleObject

• 0x49e1c0 WaitForMultipleObjectsEx

• 0x49e1c4 VirtualQuery

• 0x49e1c8 VirtualProtectEx

• 0x49e1cc VirtualProtect

• 0x49e1d0 VirtualFreeEx

• 0x49e1d4 VirtualFree

• 0x49e1d8 VirtualAllocEx

• 0x49e1dc VirtualAlloc

• 0x49e1e0 VerLanguageNameA

• 0x49e1e4 UnmapViewOfFile

• 0x49e1e8 TerminateProcess

• 0x49e1ec Sleep

• 0x49e1f0 SizeofResource

• 0x49e1f4 SetThreadPriority

• 0x49e1f8 SetThreadLocale

• 0x49e1fc SetThreadContext

• 0x49e200 SetLastError

• 0x49e204 SetFileTime

• 0x49e208 SetFilePointer

• 0x49e20c SetFileAttributesA

• 0x49e210 SetEvent

• 0x49e214 SetErrorMode

• 0x49e218 SetEndOfFile

• 0x49e21c ResumeThread

• 0x49e220 ResetEvent

• 0x49e224 ReadProcessMemory

• 0x49e228 ReadFile

• 0x49e22c PeekNamedPipe

• 0x49e230 OpenProcess

• 0x49e234 MultiByteToWideChar

• 0x49e238 MulDiv

• 0x49e23c MoveFileA

• 0x49e240 MapViewOfFile

• 0x49e244 LockResource

• 0x49e248 LocalFileTimeToFileTime

• 0x49e24c LocalAlloc

• 0x49e250 LoadResource

• 0x49e254 LoadLibraryA

• 0x49e258 LeaveCriticalSection

• 0x49e25c IsBadReadPtr

• 0x49e260 InitializeCriticalSection

• 0x49e264 HeapFree

• 0x49e268 HeapAlloc

• 0x49e26c GlobalUnlock

• 0x49e270 GlobalMemoryStatus

• 0x49e274 GlobalLock

• 0x49e278 GlobalFree

• 0x49e27c GlobalFindAtomA

• 0x49e280 GlobalDeleteAtom

• 0x49e284 GlobalAlloc

• 0x49e288 GlobalAddAtomA

• 0x49e28c GetWindowsDirectoryA

• 0x49e290 GetVolumeInformationA

• 0x49e294 GetVersionExA

• 0x49e298 GetVersion

• 0x49e29c GetUserDefaultLangID

• 0x49e2a0 GetTickCount

• 0x49e2a4 GetThreadLocale

• 0x49e2a8 GetThreadContext

• 0x49e2ac GetTempPathA

• 0x49e2b0 GetSystemPowerStatus

• 0x49e2b4 GetSystemDirectoryA

• 0x49e2b8 GetStdHandle

• 0x49e2bc GetProcessHeap

• 0x49e2c0 GetProcAddress

• 0x49e2c4 GetModuleHandleA

• 0x49e2c8 GetModuleFileNameA

• 0x49e2cc GetLocaleInfoA

• 0x49e2d0 GetLocalTime

• 0x49e2d4 GetLastError

• 0x49e2d8 GetFullPathNameA

• 0x49e2dc GetFileTime

• 0x49e2e0 GetFileSize

• 0x49e2e4 GetFileAttributesA

• 0x49e2e8 GetExitCodeThread

• 0x49e2ec GetExitCodeProcess

• 0x49e2f0 GetEnvironmentVariableA

• 0x49e2f4 GetDriveTypeA

• 0x49e2f8 GetDiskFreeSpaceA

• 0x49e2fc GetDateFormatA

• 0x49e300 GetCurrentThreadId

• 0x49e304 GetCurrentThread

• 0x49e308 GetCurrentProcessId

• 0x49e30c GetCurrentProcess

• 0x49e310 GetComputerNameA

• 0x49e314 GetCPInfo

• 0x49e318 FreeResource

• 0x49e31c InterlockedIncrement

• 0x49e320 InterlockedExchange

• 0x49e324 InterlockedDecrement

• 0x49e328 FreeLibrary

• 0x49e32c FormatMessageA

• 0x49e330 FindResourceA

• 0x49e334 FindNextFileA

• 0x49e338 FindFirstFileA

• 0x49e33c FindClose

• 0x49e340 FileTimeToSystemTime

• 0x49e344 FileTimeToLocalFileTime

• 0x49e348 FileTimeToDosDateTime

• 0x49e34c ExitThread

• 0x49e350 ExitProcess

• 0x49e354 EnumResourceNamesA

• 0x49e358 EnumCalendarInfoA

• 0x49e35c EnterCriticalSection

• 0x49e360 DosDateTimeToFileTime

• 0x49e364 DeleteFileA

• 0x49e368 DeleteCriticalSection

• 0x49e36c CreateThread

• 0x49e370 CreateRemoteThread

• 0x49e374 CreateProcessA

• 0x49e378 CreatePipe

• 0x49e37c CreateMutexA

• 0x49e380 CreateFileMappingA

• 0x49e384 CreateFileA

• 0x49e388 CreateEventA

• 0x49e38c CreateDirectoryA

• 0x49e390 CopyFileA

• 0x49e394 CompareStringA

• 0x49e398 CloseHandle

• 0x49e39c Beep

Library advapi32.dll:

• 0x49e3a4 RegSetValueExA

• 0x49e3a8 RegQueryValueExA

• 0x49e3ac RegQueryInfoKeyA

• 0x49e3b0 RegOpenKeyExA

• 0x49e3b4 RegOpenKeyA

• 0x49e3b8 RegFlushKey

• 0x49e3bc RegEnumValueA

• 0x49e3c0 RegEnumKeyExA

• 0x49e3c4 RegDeleteValueA

• 0x49e3c8 RegDeleteKeyA

• 0x49e3cc RegCreateKeyExA

• 0x49e3d0 RegCreateKeyA

• 0x49e3d4 RegCloseKey

• 0x49e3d8 OpenThreadToken

• 0x49e3dc OpenProcessToken

• 0x49e3e0 LookupPrivilegeValueA

• 0x49e3e4 LookupPrivilegeNameA

• 0x49e3e8 LookupPrivilegeDisplayNameA

• 0x49e3ec LookupAccountSidA

• 0x49e3f0 IsValidSid

• 0x49e3f4 GetUserNameA

• 0x49e3f8 GetTokenInformation

• 0x49e3fc GetSidSubAuthorityCount

• 0x49e400 GetSidSubAuthority

• 0x49e404 GetSidIdentifierAuthority

• 0x49e408 GetCurrentHwProfileA

• 0x49e40c AdjustTokenPrivileges

Library oleaut32.dll:

• 0x49e414 GetErrorInfo

• 0x49e418 GetActiveObject

• 0x49e41c SysFreeString

Library ole32.dll:

• 0x49e424 CoTaskMemFree

• 0x49e428 CLSIDFromProgID

• 0x49e42c ProgIDFromCLSID

• 0x49e430 StringFromCLSID

• 0x49e434 CoCreateInstance

• 0x49e438 CoUninitialize

• 0x49e43c CoInitialize

• 0x49e440 IsEqualGUID

Library kernel32.dll:

• 0x49e448 Sleep

Library ole32.dll:

• 0x49e450 CoTaskMemFree

• 0x49e454 StringFromCLSID

Library oleaut32.dll:

• 0x49e45c SafeArrayPtrOfIndex

• 0x49e460 SafeArrayGetUBound

• 0x49e464 SafeArrayGetLBound

• 0x49e468 SafeArrayCreate

• 0x49e46c VariantChangeType

• 0x49e470 VariantCopy

• 0x49e474 VariantClear

• 0x49e478 VariantInit

Library netapi32.dll:

• 0x49e480 Netbios

Library shell32.dll:

• 0x49e488 ShellExecuteExA

• 0x49e48c ShellExecuteA

• 0x49e490 SHGetFileInfoA

• 0x49e494 SHFileOperationA

• 0x49e498 DragQueryFileA

Library gdiplus.dll:

• 0x49e4a0 GdipGetImageEncoders

• 0x49e4a4 GdipGetImageEncodersSize

• 0x49e4a8 GdipDrawImageRectI

• 0x49e4ac GdipSetInterpolationMode

• 0x49e4b0 GdipDeleteGraphics

• 0x49e4b4 GdipCreateBitmapFromHBITMAP

• 0x49e4b8 GdipCreateBitmapFromScan0

• 0x49e4bc GdipGetImagePixelFormat

• 0x49e4c0 GdipGetImageGraphicsContext

• 0x49e4c4 GdipSaveImageToStream

• 0x49e4c8 GdipDisposeImage

• 0x49e4cc GdiplusShutdown

• 0x49e4d0 GdiplusStartup

• 0x49e4d4 GdipFree

• 0x49e4d8 GdipAlloc

Library winmm.dll:

• 0x49e4e0 waveInUnprepareHeader

• 0x49e4e4 waveInStart

• 0x49e4e8 waveInReset

• 0x49e4ec waveInPrepareHeader

• 0x49e4f0 waveInOpen

• 0x49e4f4 waveInClose

• 0x49e4f8 waveInAddBuffer

• 0x49e4fc PlaySoundA

• 0x49e500 mciSendStringA

Library URLMON.DLL:

• 0x49e508 URLDownloadToFileA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	50005	239.255.255.250	3702
192.168.56.101	51966	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.