SmartHawk

5.4

中危

54 个模型检测该样本为恶意！

重新分析

下载样本

33a76af55237d9ba192ee8496fd6c4adc489593705e81c663a890b39e1c92a8e

e3839c81995dbb83d6add65d76676048.exe

分析耗时

92s

最近分析

文件大小

590.0KB

静态报毒动态报毒 AI SCORE=88 AIDETECTVM AJLB ATTRIBUTE BSCOPE BTNSSI CLASSIC CONFIDENCE DELF GDSDA GENERICKD HIGHCONFIDENCE HLDRJL IGENT IYANY KGW@AAEBLDCI KRYPTIK MALWARE1 MALWARE@#1DDBWVX8TPGY5 R06EC0DIA20 REMCOS RESCOMS SCORE SLGK STATIC AI SUSGEN SUSPICIOUS PE UNSAFE ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	RDN/Generic Downloader.x	20201211	6.0.6.653
Alibaba	TrojanDownloader:Win32/Remcos.0a99c8fb	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201210	21.1.5827.0
Tencent	Win32.Backdoor.Remcos.Ajlb	20201211	1.0.0.1
Kingsoft		20201211	2017.9.26.565
CrowdStrike	win/malicious_confidence_60% (D)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619986840.18325 __exception__	stacktrace: e3839c81995dbb83d6add65d76676048+0x17062 @ 0x417062 e3839c81995dbb83d6add65d76676048+0x16f35 @ 0x416f35 e3839c81995dbb83d6add65d76676048+0x207b7 @ 0x4207b7 e3839c81995dbb83d6add65d76676048+0x210b5 @ 0x4210b5 e3839c81995dbb83d6add65d76676048+0x5b927 @ 0x45b927 e3839c81995dbb83d6add65d76676048+0x5c39c @ 0x45c39c e3839c81995dbb83d6add65d76676048+0x4eb6f @ 0x44eb6f e3839c81995dbb83d6add65d76676048+0x562bc @ 0x4562bc e3839c81995dbb83d6add65d76676048+0x5c7d5 @ 0x45c7d5 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637452 registers.edi: 7143456 registers.eax: 1637452 registers.ebp: 1637532 registers.edx: 0 registers.ebx: 7195628 registers.esi: 4569608 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success	0	0
1619986890.83925 __exception__	stacktrace: registers.esp: 54524980 registers.edi: 33985760 registers.eax: 0 registers.ebp: 0 registers.edx: 0 registers.ebx: 87 registers.esi: 16 registers.ecx: 0 exception.instruction_r: 8b 41 3c 99 03 04 24 13 54 24 04 83 c4 08 89 04 exception.instruction: mov eax, dword ptr [ecx + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2068e78	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619986839.63625 NtAllocateVirtualMemory	process_identifier: 2008 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619986867.15225 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	203.208.41.65
host	203.208.41.98

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619986869.71425 RegSetValueExA	key_handle: 0x000003b0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619986869.71425 RegSetValueExA	key_handle: 0x000003b0 value: 0X°?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619986869.71425 RegSetValueExA	key_handle: 0x000003b0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619986869.71425 RegSetValueExW	key_handle: 0x000003b0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619986869.71425 RegSetValueExA	key_handle: 0x000003c8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619986869.71425 RegSetValueExA	key_handle: 0x000003c8 value: 0X°?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619986869.71425 RegSetValueExA	key_handle: 0x000003c8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619986869.74625 RegSetValueExW	key_handle: 0x000003ac value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.GenericKD.33903911
FireEye	Generic.mg.e3839c81995dbb83
McAfee	RDN/Generic Downloader.x
Cylance	Unsafe
Zillya	Backdoor.Remcos.Win32.2598
Sangfor	Malware
K7AntiVirus	Trojan ( 005675f61 )
Alibaba	TrojanDownloader:Win32/Remcos.0a99c8fb
K7GW	Trojan ( 005675f61 )
Cybereason	malicious.da6136
Arcabit	Trojan.Generic.D2055527
Cyren	W32/Injector.SLGK-9188
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
BitDefender	Trojan.GenericKD.33903911
NANO-Antivirus	Trojan.Win32.Delf.hldrjl
AegisLab	Trojan.Win32.Remcos.m!c
Avast	Win32:Trojan-gen
Tencent	Win32.Backdoor.Remcos.Ajlb
Ad-Aware	Trojan.GenericKD.33903911
Emsisoft	Trojan.GenericKD.33903911 (B)
Comodo	Malware@#1ddbwvx8tpgy5
F-Secure	Trojan.TR/Dldr.Delf.iyany
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R06EC0DIA20
McAfee-GW-Edition	RDN/Generic Downloader.x
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Avira	TR/Dldr.Delf.iyany
Antiy-AVL	Trojan[Backdoor]/Win32.Remcos
Microsoft	Backdoor:Win32/Rescoms.KD
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Trojan.GenericKD.33903911
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Remcos.C4110430
BitDefenderTheta	Gen:NN.ZelphiF.34670.KGW@aaEBlDci
ALYac	Trojan.GenericKD.33903911
MAX	malware (ai score=88)
VBA32	BScope.TrojanDropper.Agent
Zoner	Trojan.Win32.91404
ESET-NOD32	Win32/TrojanDownloader.Delf.CXL
TrendMicro-HouseCall	TROJ_GEN.R06EC0DIA20
Rising	Trojan.Kryptik!1.C6FD (CLASSIC)
Yandex	Trojan.Igent.bTNsSi.23
Ikarus	Trojan.Inject
Fortinet	W32/Delf.BZL!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	172.217.24.14:443
dead_host	66.220.158.32:443
dead_host	172.217.160.78:443
dead_host	172.217.27.142:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x46b140 DeleteCriticalSection

• 0x46b144 LeaveCriticalSection

• 0x46b148 EnterCriticalSection

• 0x46b14c InitializeCriticalSection

• 0x46b150 VirtualFree

• 0x46b154 VirtualAlloc

• 0x46b158 LocalFree

• 0x46b15c LocalAlloc

• 0x46b160 GetVersion

• 0x46b164 GetCurrentThreadId

• 0x46b168 InterlockedDecrement

• 0x46b16c InterlockedIncrement

• 0x46b170 VirtualQuery

• 0x46b174 WideCharToMultiByte

• 0x46b178 MultiByteToWideChar

• 0x46b17c lstrlenA

• 0x46b180 lstrcpynA

• 0x46b184 LoadLibraryExA

• 0x46b188 GetThreadLocale

• 0x46b18c GetStartupInfoA

• 0x46b190 GetProcAddress

• 0x46b194 GetModuleHandleA

• 0x46b198 GetModuleFileNameA

• 0x46b19c GetLocaleInfoA

• 0x46b1a0 GetCommandLineA

• 0x46b1a4 FreeLibrary

• 0x46b1a8 FindFirstFileA

• 0x46b1ac FindClose

• 0x46b1b0 ExitProcess

• 0x46b1b4 ExitThread

• 0x46b1b8 CreateThread

• 0x46b1bc WriteFile

• 0x46b1c0 UnhandledExceptionFilter

• 0x46b1c4 RtlUnwind

• 0x46b1c8 RaiseException

• 0x46b1cc GetStdHandle

Library user32.dll:

• 0x46b1d4 GetKeyboardType

• 0x46b1d8 LoadStringA

• 0x46b1dc MessageBoxA

• 0x46b1e0 CharNextA

Library advapi32.dll:

• 0x46b1e8 RegQueryValueExA

• 0x46b1ec RegOpenKeyExA

• 0x46b1f0 RegCloseKey

Library oleaut32.dll:

• 0x46b1f8 SysFreeString

• 0x46b1fc SysReAllocStringLen

• 0x46b200 SysAllocStringLen

Library kernel32.dll:

• 0x46b208 TlsSetValue

• 0x46b20c TlsGetValue

• 0x46b210 LocalAlloc

• 0x46b214 GetModuleHandleA

Library advapi32.dll:

• 0x46b21c RegQueryValueExA

• 0x46b220 RegOpenKeyExA

• 0x46b224 RegCloseKey

Library kernel32.dll:

• 0x46b22c lstrcpyA

• 0x46b230 WriteFile

• 0x46b234 WaitForSingleObject

• 0x46b238 VirtualQuery

• 0x46b23c VirtualProtect

• 0x46b240 VirtualAlloc

• 0x46b244 Sleep

• 0x46b248 SizeofResource

• 0x46b24c SetThreadLocale

• 0x46b250 SetFilePointer

• 0x46b254 SetEvent

• 0x46b258 SetErrorMode

• 0x46b25c SetEndOfFile

• 0x46b260 ResumeThread

• 0x46b264 ResetEvent

• 0x46b268 ReadFile

• 0x46b26c MulDiv

• 0x46b270 LockResource

• 0x46b274 LoadResource

• 0x46b278 LoadLibraryA

• 0x46b27c LeaveCriticalSection

• 0x46b280 InitializeCriticalSection

• 0x46b284 GlobalUnlock

• 0x46b288 GlobalReAlloc

• 0x46b28c GlobalHandle

• 0x46b290 GlobalLock

• 0x46b294 GlobalFree

• 0x46b298 GlobalFindAtomA

• 0x46b29c GlobalDeleteAtom

• 0x46b2a0 GlobalAlloc

• 0x46b2a4 GlobalAddAtomA

• 0x46b2a8 GetVersionExA

• 0x46b2ac GetVersion

• 0x46b2b0 GetTickCount

• 0x46b2b4 GetThreadLocale

• 0x46b2b8 GetSystemInfo

• 0x46b2bc GetStringTypeExA

• 0x46b2c0 GetStdHandle

• 0x46b2c4 GetProcAddress

• 0x46b2c8 GetModuleHandleA

• 0x46b2cc GetModuleFileNameA

• 0x46b2d0 GetLocaleInfoA

• 0x46b2d4 GetLocalTime

• 0x46b2d8 GetLastError

• 0x46b2dc GetFullPathNameA

• 0x46b2e0 GetExitCodeThread

• 0x46b2e4 GetDiskFreeSpaceA

• 0x46b2e8 GetDateFormatA

• 0x46b2ec GetCurrentThreadId

• 0x46b2f0 GetCurrentProcessId

• 0x46b2f4 GetCPInfo

• 0x46b2f8 GetACP

• 0x46b2fc FreeResource

• 0x46b300 InterlockedIncrement

• 0x46b304 InterlockedExchange

• 0x46b308 InterlockedDecrement

• 0x46b30c FreeLibrary

• 0x46b310 FormatMessageA

• 0x46b314 FindResourceA

• 0x46b318 EnumCalendarInfoA

• 0x46b31c EnterCriticalSection

• 0x46b320 DeleteCriticalSection

• 0x46b324 CreateThread

• 0x46b328 CreateFileA

• 0x46b32c CreateEventA

• 0x46b330 CompareStringA

• 0x46b334 CloseHandle

Library version.dll:

• 0x46b33c VerQueryValueA

• 0x46b340 GetFileVersionInfoSizeA

• 0x46b344 GetFileVersionInfoA

Library gdi32.dll:

• 0x46b34c UnrealizeObject

• 0x46b350 StretchBlt

• 0x46b354 SetWindowOrgEx

• 0x46b358 SetWinMetaFileBits

• 0x46b35c SetViewportOrgEx

• 0x46b360 SetTextColor

• 0x46b364 SetStretchBltMode

• 0x46b368 SetROP2

• 0x46b36c SetPixel

• 0x46b370 SetEnhMetaFileBits

• 0x46b374 SetDIBColorTable

• 0x46b378 SetBrushOrgEx

• 0x46b37c SetBkMode

• 0x46b380 SetBkColor

• 0x46b384 SelectPalette

• 0x46b388 SelectObject

• 0x46b38c SaveDC

• 0x46b390 RestoreDC

• 0x46b394 Rectangle

• 0x46b398 RectVisible

• 0x46b39c RealizePalette

• 0x46b3a0 Polyline

• 0x46b3a4 PlayEnhMetaFile

• 0x46b3a8 PatBlt

• 0x46b3ac MoveToEx

• 0x46b3b0 MaskBlt

• 0x46b3b4 LineTo

• 0x46b3b8 IntersectClipRect

• 0x46b3bc GetWindowOrgEx

• 0x46b3c0 GetWinMetaFileBits

• 0x46b3c4 GetTextMetricsA

• 0x46b3c8 GetTextExtentPointA

• 0x46b3cc GetTextExtentPoint32A

• 0x46b3d0 GetSystemPaletteEntries

• 0x46b3d4 GetStockObject

• 0x46b3d8 GetPixel

• 0x46b3dc GetPaletteEntries

• 0x46b3e0 GetObjectA

• 0x46b3e4 GetEnhMetaFilePaletteEntries

• 0x46b3e8 GetEnhMetaFileHeader

• 0x46b3ec GetEnhMetaFileBits

• 0x46b3f0 GetDeviceCaps

• 0x46b3f4 GetDIBits

• 0x46b3f8 GetDIBColorTable

• 0x46b3fc GetDCOrgEx

• 0x46b400 GetCurrentPositionEx

• 0x46b404 GetClipBox

• 0x46b408 GetBrushOrgEx

• 0x46b40c GetBitmapBits

• 0x46b410 ExcludeClipRect

• 0x46b414 DeleteObject

• 0x46b418 DeleteEnhMetaFile

• 0x46b41c DeleteDC

• 0x46b420 CreateSolidBrush

• 0x46b424 CreatePenIndirect

• 0x46b428 CreatePalette

• 0x46b42c CreateHalftonePalette

• 0x46b430 CreateFontIndirectA

• 0x46b434 CreateDIBitmap

• 0x46b438 CreateDIBSection

• 0x46b43c CreateCompatibleDC

• 0x46b440 CreateCompatibleBitmap

• 0x46b444 CreateBrushIndirect

• 0x46b448 CreateBitmap

• 0x46b44c CopyEnhMetaFileA

• 0x46b450 BitBlt

Library user32.dll:

• 0x46b458 CreateWindowExA

• 0x46b45c WindowFromPoint

• 0x46b460 WinHelpA

• 0x46b464 WaitMessage

• 0x46b468 UpdateWindow

• 0x46b46c UnregisterClassA

• 0x46b470 UnhookWindowsHookEx

• 0x46b474 TranslateMessage

• 0x46b478 TranslateMDISysAccel

• 0x46b47c TrackPopupMenu

• 0x46b480 SystemParametersInfoA

• 0x46b484 ShowWindow

• 0x46b488 ShowScrollBar

• 0x46b48c ShowOwnedPopups

• 0x46b490 ShowCursor

• 0x46b494 SetWindowsHookExA

• 0x46b498 SetWindowTextA

• 0x46b49c SetWindowPos

• 0x46b4a0 SetWindowPlacement

• 0x46b4a4 SetWindowLongA

• 0x46b4a8 SetTimer

• 0x46b4ac SetScrollRange

• 0x46b4b0 SetScrollPos

• 0x46b4b4 SetScrollInfo

• 0x46b4b8 SetRect

• 0x46b4bc SetPropA

• 0x46b4c0 SetParent

• 0x46b4c4 SetMenuItemInfoA

• 0x46b4c8 SetMenu

• 0x46b4cc SetForegroundWindow

• 0x46b4d0 SetFocus

• 0x46b4d4 SetCursor

• 0x46b4d8 SetClassLongA

• 0x46b4dc SetCapture

• 0x46b4e0 SetActiveWindow

• 0x46b4e4 SendMessageA

• 0x46b4e8 ScrollWindow

• 0x46b4ec ScreenToClient

• 0x46b4f0 RemovePropA

• 0x46b4f4 RemoveMenu

• 0x46b4f8 ReleaseDC

• 0x46b4fc ReleaseCapture

• 0x46b500 RegisterWindowMessageA

• 0x46b504 RegisterClipboardFormatA

• 0x46b508 RegisterClassA

• 0x46b50c RedrawWindow

• 0x46b510 PtInRect

• 0x46b514 PostQuitMessage

• 0x46b518 PostMessageA

• 0x46b51c PeekMessageA

• 0x46b520 OffsetRect

• 0x46b524 OemToCharA

• 0x46b528 MsgWaitForMultipleObjects

• 0x46b52c MessageBoxA

• 0x46b530 MapWindowPoints

• 0x46b534 MapVirtualKeyA

• 0x46b538 LoadStringA

• 0x46b53c LoadKeyboardLayoutA

• 0x46b540 LoadIconA

• 0x46b544 LoadCursorA

• 0x46b548 LoadBitmapA

• 0x46b54c KillTimer

• 0x46b550 IsZoomed

• 0x46b554 IsWindowVisible

• 0x46b558 IsWindowEnabled

• 0x46b55c IsWindow

• 0x46b560 IsRectEmpty

• 0x46b564 IsIconic

• 0x46b568 IsDialogMessageA

• 0x46b56c IsChild

• 0x46b570 InvalidateRect

• 0x46b574 IntersectRect

• 0x46b578 InsertMenuItemA

• 0x46b57c InsertMenuA

• 0x46b580 InflateRect

• 0x46b584 GetWindowThreadProcessId

• 0x46b588 GetWindowTextA

• 0x46b58c GetWindowRect

• 0x46b590 GetWindowPlacement

• 0x46b594 GetWindowLongA

• 0x46b598 GetWindowDC

• 0x46b59c GetTopWindow

• 0x46b5a0 GetSystemMetrics

• 0x46b5a4 GetSystemMenu

• 0x46b5a8 GetSysColorBrush

• 0x46b5ac GetSysColor

• 0x46b5b0 GetSubMenu

• 0x46b5b4 GetScrollRange

• 0x46b5b8 GetScrollPos

• 0x46b5bc GetScrollInfo

• 0x46b5c0 GetPropA

• 0x46b5c4 GetParent

• 0x46b5c8 GetWindow

• 0x46b5cc GetMenuStringA

• 0x46b5d0 GetMenuState

• 0x46b5d4 GetMenuItemInfoA

• 0x46b5d8 GetMenuItemID

• 0x46b5dc GetMenuItemCount

• 0x46b5e0 GetMenu

• 0x46b5e4 GetLastActivePopup

• 0x46b5e8 GetKeyboardState

• 0x46b5ec GetKeyboardLayoutList

• 0x46b5f0 GetKeyboardLayout

• 0x46b5f4 GetKeyState

• 0x46b5f8 GetKeyNameTextA

• 0x46b5fc GetIconInfo

• 0x46b600 GetForegroundWindow

• 0x46b604 GetFocus

• 0x46b608 GetDesktopWindow

• 0x46b60c GetDCEx

• 0x46b610 GetDC

• 0x46b614 GetCursorPos

• 0x46b618 GetCursor

• 0x46b61c GetClipboardData

• 0x46b620 GetClientRect

• 0x46b624 GetClassNameA

• 0x46b628 GetClassInfoA

• 0x46b62c GetCapture

• 0x46b630 GetActiveWindow

• 0x46b634 FrameRect

• 0x46b638 FindWindowA

• 0x46b63c FillRect

• 0x46b640 EqualRect

• 0x46b644 EnumWindows

• 0x46b648 EnumThreadWindows

• 0x46b64c EndPaint

• 0x46b650 EnableWindow

• 0x46b654 EnableScrollBar

• 0x46b658 EnableMenuItem

• 0x46b65c DrawTextA

• 0x46b660 DrawMenuBar

• 0x46b664 DrawIconEx

• 0x46b668 DrawIcon

• 0x46b66c DrawFrameControl

• 0x46b670 DrawEdge

• 0x46b674 DispatchMessageA

• 0x46b678 DestroyWindow

• 0x46b67c DestroyMenu

• 0x46b680 DestroyIcon

• 0x46b684 DestroyCursor

• 0x46b688 DeleteMenu

• 0x46b68c DefWindowProcA

• 0x46b690 DefMDIChildProcA

• 0x46b694 DefFrameProcA

• 0x46b698 CreatePopupMenu

• 0x46b69c CreateMenu

• 0x46b6a0 CreateIcon

• 0x46b6a4 ClientToScreen

• 0x46b6a8 CheckMenuItem

• 0x46b6ac CallWindowProcA

• 0x46b6b0 CallNextHookEx

• 0x46b6b4 BeginPaint

• 0x46b6b8 CharNextA

• 0x46b6bc CharLowerBuffA

• 0x46b6c0 CharLowerA

• 0x46b6c4 CharToOemA

• 0x46b6c8 AdjustWindowRectEx

• 0x46b6cc ActivateKeyboardLayout

Library kernel32.dll:

• 0x46b6d4 Sleep

Library oleaut32.dll:

• 0x46b6dc SafeArrayPtrOfIndex

• 0x46b6e0 SafeArrayGetUBound

• 0x46b6e4 SafeArrayGetLBound

• 0x46b6e8 SafeArrayCreate

• 0x46b6ec VariantChangeType

• 0x46b6f0 VariantCopy

• 0x46b6f4 VariantClear

• 0x46b6f8 VariantInit

Library comctl32.dll:

• 0x46b700 ImageList_SetIconSize

• 0x46b704 ImageList_GetIconSize

• 0x46b708 ImageList_Write

• 0x46b70c ImageList_Read

• 0x46b710 ImageList_GetDragImage

• 0x46b714 ImageList_DragShowNolock

• 0x46b718 ImageList_SetDragCursorImage

• 0x46b71c ImageList_DragMove

• 0x46b720 ImageList_DragLeave

• 0x46b724 ImageList_DragEnter

• 0x46b728 ImageList_EndDrag

• 0x46b72c ImageList_BeginDrag

• 0x46b730 ImageList_Remove

• 0x46b734 ImageList_DrawEx

• 0x46b738 ImageList_Draw

• 0x46b73c ImageList_GetBkColor

• 0x46b740 ImageList_SetBkColor

• 0x46b744 ImageList_ReplaceIcon

• 0x46b748 ImageList_Add

• 0x46b74c ImageList_SetImageCount

• 0x46b750 ImageList_GetImageCount

• 0x46b754 ImageList_Destroy

• 0x46b758 ImageList_Create

Library shell32.dll:

• 0x46b760 ShellExecuteA

Library URL.DLL:

• 0x46b768 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com A 172.217.27.142	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
cdn.discordapp.com	A 66.220.158.32	108.160.165.211
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	54178	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60088	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60221	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.