| entropy | 7.9980909085395275 | section | {'size_of_data': '0x011aa000', 'virtual_address': '0x0013d000', 'entropy': 7.9980909085395275, 'name': '.setup', 'virtual_size': '0x011a9701'} | description | A section with a high entropy has been found | |||||||||
| entropy | 0.9355781415677451 | description | Overall entropy of this PE file is high | |||||||||||
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1620842847.200374 LookupPrivilegeValueW |
system_name:
privilege_name: SeTakeOwnershipPrivilege |
success | 1 | 0 |
| host | 172.217.24.14 | |||
| Ordinal | Address | Name |
|---|---|---|
| 1 | 0x477280 | _CharLowerW@4 |
| 2 | 0x477160 | _CharUpperW@4 |
| 3 | 0x4776b0 | _CoInitializeEx@8 |
| 4 | 0x4768e0 | _CompareStringW@24 |
| 5 | 0x476e70 | _GetFileAttributesExA@12 |
| 6 | 0x476fb0 | _GetFileAttributesExW@12 |
| 7 | 0x476750 | _GetFileSizeEx@8 |
| 8 | 0x4767f0 | _GetLocaleInfoW@16 |
| 9 | 0x4770f0 | _GetMenuBarInfo@16 |
| 10 | 0x476390 | _GetModuleHandleW@4 |
No hosts contacted.
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| time.windows.com |
A 20.189.79.72
CNAME time.microsoft.akadns.net |
|
| clients2.google.com |
A 216.58.200.46
CNAME clients.l.google.com |
216.58.200.46 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| teredo.ipv6.microsoft.com |
No TCP connections recorded.
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53237 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57756 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57874 | 114.114.114.114 | 53 |
| 192.168.56.101 | 60384 | 114.114.114.114 | 53 |
| 192.168.56.101 | 62318 | 114.114.114.114 | 53 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 123 | 20.189.79.72 time.windows.com | 123 |
| 192.168.56.101 | 49235 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49713 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 50534 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 51378 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 51808 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 51963 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 56804 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 62191 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 63429 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 1900 | 239.255.255.250 | 1900 |
| 192.168.56.101 | 50539 | 239.255.255.250 | 1900 |
| 192.168.56.101 | 50541 | 239.255.255.250 | 3702 |
No HTTP requests performed.
No ICMP traffic performed.
No IRC requests performed.
No Suricata Alerts
No Suricata TLS
No Snort Alerts