SmartHawk

5.0

中危

53 个模型检测该样本为恶意！

重新分析

下载样本

4d811c7feeb2f6a7d3e131ab7db681470f801264f4c74592a6885d68a91e01ab

eaf7282c1981864704e66a96864a00bd.exe

分析耗时

89s

最近分析

文件大小

899.0KB

静态报毒动态报毒 100% AGEN AI SCORE=89 AIDETECTVM AOTB CLASSIC CONFIDENCE DELF DOWNLOADER33 ELDORADO FORMBOOK GENERICRXKK GJSR0FUC8CG GRAFTOR GRAYWARE HIGH CONFIDENCE KRYPTIK MALWARE2 MALWARE@#3UTXSEOZRMYTL R066C0PHK20 REMCOS REMCOSCRYPT SCORE TROJANX TSCOPE UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXKK-PF!EAF7282C1981	20201231	6.0.6.653
Alibaba	TrojanDownloader:Win32/Remcos.44a0b109	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Tencent	Win32.Backdoor.Remcos.Aotb	20201231	1.0.0.1
Kingsoft		20201231	2017.9.26.565

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951418.375375 __exception__	stacktrace: eaf7282c1981864704e66a96864a00bd+0xa1e13 @ 0x4a1e13 eaf7282c1981864704e66a96864a00bd+0x25f76 @ 0x425f76 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x775a7bca eaf7282c1981864704e66a96864a00bd+0x63efc @ 0x463efc eaf7282c1981864704e66a96864a00bd+0xb5ec3 @ 0x4b5ec3 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637200 registers.edi: 1637244 registers.eax: 1429200984 registers.ebp: 1637792 registers.edx: 0 registers.ebx: 31203720 registers.esi: 31235816 registers.ecx: 0 exception.instruction_r: 8b 40 50 50 8b 44 24 10 8b 40 34 50 e8 82 50 f6 exception.symbol: eaf7282c1981864704e66a96864a00bd+0xa20ed exception.instruction: mov eax, dword ptr [eax + 0x50] exception.module: eaf7282c1981864704e66a96864a00bd.exe exception.exception_code: 0xc0000005 exception.offset: 663789 exception.address: 0x4a20ed	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619951418.375375
__exception__

stacktrace:

eaf7282c1981864704e66a96864a00bd+0xa1e13 @ 0x4a1e13
eaf7282c1981864704e66a96864a00bd+0x25f76 @ 0x425f76
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4
DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x775a7bca
eaf7282c1981864704e66a96864a00bd+0x63efc @ 0x463efc
eaf7282c1981864704e66a96864a00bd+0xb5ec3 @ 0x4b5ec3
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637200
registers.edi: 1637244
registers.eax: 1429200984
registers.ebp: 1637792
registers.edx: 0
registers.ebx: 31203720
registers.esi: 31235816
registers.ecx: 0
exception.instruction_r: 8b 40 50 50 8b 44 24 10 8b 40 34 50 e8 82 50 f6
exception.symbol: eaf7282c1981864704e66a96864a00bd+0xa20ed
exception.instruction: mov eax, dword ptr [eax + 0x50]
exception.module: eaf7282c1981864704e66a96864a00bd.exe
exception.exception_code: 0xc0000005
exception.offset: 663789
exception.address: 0x4a20ed

success

Performs some HTTP requests (1 个事件)

request

GET https://is.gd/hsajisne

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951408.125375 NtAllocateVirtualMemory	process_identifier: 2120 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005d0000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

7.169707300709615

section

{'size_of_data': '0x0001ac00', 'virtual_address': '0x000cb000', 'entropy': 7.169707300709615, 'name': '.rsrc', 'virtual_size': '0x0001abb0'}

description

A section with a high entropy has been found

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Graftor.733447
FireEye	Gen:Variant.Graftor.733447
McAfee	GenericRXKK-PF!EAF7282C1981
Cylance	Unsafe
SUPERAntiSpyware	Trojan.Agent/Gen-Injector
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanDownloader:Win32/Remcos.44a0b109
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Graftor.DB3107
Cyren	W32/Kryptik.BKC.gen!Eldorado
Symantec	Trojan Horse
TrendMicro-HouseCall	TROJ_GEN.R066C0PHK20
Paloalto	generic.ml
ClamAV	Win.Dropper.Formbook-8041921-0
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
BitDefender	Gen:Variant.Graftor.733447
ViRobot	Trojan.Win32.Z.Remcos.920576
Tencent	Win32.Backdoor.Remcos.Aotb
Ad-Aware	Gen:Variant.Graftor.733447
Emsisoft	Gen:Variant.Graftor.733447 (B)
Comodo	Malware@#3utxseozrmytl
DrWeb	Trojan.DownLoader33.29877
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R066C0PHK20
McAfee-GW-Edition	GenericRXKK-PF!EAF7282C1981
Sophos	Mal/Generic-S
APEX	Malicious
Jiangmin	Backdoor.Remcos.bgu
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1104988
MAX	malware (ai score=89)
Antiy-AVL	GrayWare/Win32.Generic
Microsoft	Trojan:Win32/RemcosCrypt.ACH!MTB
AegisLab	Trojan.Win32.Remcos.m!c
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Gen:Variant.Graftor.733447
Cynet	Malicious (score: 85)
AhnLab-V3	Malware/Win32.Generic.C4078130
VBA32	TScope.Trojan.Delf
ALYac	Backdoor.Remcos.A
Malwarebytes	Trojan.Injector
ESET-NOD32	a variant of Win32/TrojanDownloader.Delf.CWR
Rising	Trojan.Kryptik!1.C56D (CLASSIC)
Yandex	Trojan.DL.Delf!gjSr0fUC8cg
Fortinet	W32/Delf.CWU!tr
AVG	Win32:TrojanX-gen [Trj]

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4ba168 DeleteCriticalSection

• 0x4ba16c LeaveCriticalSection

• 0x4ba170 EnterCriticalSection

• 0x4ba174 InitializeCriticalSection

• 0x4ba178 VirtualFree

• 0x4ba17c VirtualAlloc

• 0x4ba180 LocalFree

• 0x4ba184 LocalAlloc

• 0x4ba188 GetVersion

• 0x4ba18c GetCurrentThreadId

• 0x4ba190 InterlockedDecrement

• 0x4ba194 InterlockedIncrement

• 0x4ba198 VirtualQuery

• 0x4ba19c WideCharToMultiByte

• 0x4ba1a0 MultiByteToWideChar

• 0x4ba1a4 lstrlenA

• 0x4ba1a8 lstrcpynA

• 0x4ba1ac LoadLibraryExA

• 0x4ba1b0 GetThreadLocale

• 0x4ba1b4 GetStartupInfoA

• 0x4ba1b8 GetProcAddress

• 0x4ba1bc GetModuleHandleA

• 0x4ba1c0 GetModuleFileNameA

• 0x4ba1c4 GetLocaleInfoA

• 0x4ba1c8 GetLastError

• 0x4ba1cc GetCommandLineA

• 0x4ba1d0 FreeLibrary

• 0x4ba1d4 FindFirstFileA

• 0x4ba1d8 FindClose

• 0x4ba1dc ExitProcess

• 0x4ba1e0 WriteFile

• 0x4ba1e4 UnhandledExceptionFilter

• 0x4ba1e8 SetFilePointer

• 0x4ba1ec SetEndOfFile

• 0x4ba1f0 RtlUnwind

• 0x4ba1f4 ReadFile

• 0x4ba1f8 RaiseException

• 0x4ba1fc GetStdHandle

• 0x4ba200 GetFileSize

• 0x4ba204 GetFileType

• 0x4ba208 CreateFileA

• 0x4ba20c CloseHandle

Library user32.dll:

• 0x4ba214 GetKeyboardType

• 0x4ba218 LoadStringA

• 0x4ba21c MessageBoxA

• 0x4ba220 CharNextA

Library advapi32.dll:

• 0x4ba228 RegQueryValueExA

• 0x4ba22c RegOpenKeyExA

• 0x4ba230 RegCloseKey

Library oleaut32.dll:

• 0x4ba238 SysFreeString

• 0x4ba23c SysReAllocStringLen

• 0x4ba240 SysAllocStringLen

Library kernel32.dll:

• 0x4ba248 TlsSetValue

• 0x4ba24c TlsGetValue

• 0x4ba250 LocalAlloc

• 0x4ba254 GetModuleHandleA

Library advapi32.dll:

• 0x4ba25c RegQueryValueExA

• 0x4ba260 RegOpenKeyExA

• 0x4ba264 RegCloseKey

Library kernel32.dll:

• 0x4ba26c lstrcpyA

• 0x4ba270 WriteFile

• 0x4ba274 WaitForSingleObject

• 0x4ba278 VirtualQuery

• 0x4ba27c VirtualProtect

• 0x4ba280 VirtualAlloc

• 0x4ba284 Sleep

• 0x4ba288 SizeofResource

• 0x4ba28c SetThreadLocale

• 0x4ba290 SetFilePointer

• 0x4ba294 SetEvent

• 0x4ba298 SetErrorMode

• 0x4ba29c SetEndOfFile

• 0x4ba2a0 ResetEvent

• 0x4ba2a4 ReadFile

• 0x4ba2a8 MultiByteToWideChar

• 0x4ba2ac MulDiv

• 0x4ba2b0 LockResource

• 0x4ba2b4 LoadResource

• 0x4ba2b8 LoadLibraryA

• 0x4ba2bc LeaveCriticalSection

• 0x4ba2c0 InitializeCriticalSection

• 0x4ba2c4 GlobalUnlock

• 0x4ba2c8 GlobalReAlloc

• 0x4ba2cc GlobalHandle

• 0x4ba2d0 GlobalLock

• 0x4ba2d4 GlobalFree

• 0x4ba2d8 GlobalFindAtomA

• 0x4ba2dc GlobalDeleteAtom

• 0x4ba2e0 GlobalAlloc

• 0x4ba2e4 GlobalAddAtomA

• 0x4ba2e8 GetVersionExA

• 0x4ba2ec GetVersion

• 0x4ba2f0 GetTickCount

• 0x4ba2f4 GetThreadLocale

• 0x4ba2f8 GetSystemInfo

• 0x4ba2fc GetStringTypeExA

• 0x4ba300 GetStdHandle

• 0x4ba304 GetProcAddress

• 0x4ba308 GetModuleHandleA

• 0x4ba30c GetModuleFileNameA

• 0x4ba310 GetLocaleInfoA

• 0x4ba314 GetLocalTime

• 0x4ba318 GetLastError

• 0x4ba31c GetFullPathNameA

• 0x4ba320 GetDiskFreeSpaceA

• 0x4ba324 GetDateFormatA

• 0x4ba328 GetCurrentThreadId

• 0x4ba32c GetCurrentProcessId

• 0x4ba330 GetCPInfo

• 0x4ba334 GetACP

• 0x4ba338 FreeResource

• 0x4ba33c InterlockedExchange

• 0x4ba340 FreeLibrary

• 0x4ba344 FormatMessageA

• 0x4ba348 FindResourceA

• 0x4ba34c FindFirstFileA

• 0x4ba350 FindClose

• 0x4ba354 FileTimeToLocalFileTime

• 0x4ba358 FileTimeToDosDateTime

• 0x4ba35c EnumCalendarInfoA

• 0x4ba360 EnterCriticalSection

• 0x4ba364 DeleteCriticalSection

• 0x4ba368 CreateThread

• 0x4ba36c CreateFileA

• 0x4ba370 CreateEventA

• 0x4ba374 CompareStringA

• 0x4ba378 CloseHandle

Library version.dll:

• 0x4ba380 VerQueryValueA

• 0x4ba384 GetFileVersionInfoSizeA

• 0x4ba388 GetFileVersionInfoA

Library gdi32.dll:

• 0x4ba390 UnrealizeObject

• 0x4ba394 StretchBlt

• 0x4ba398 SetWindowOrgEx

• 0x4ba39c SetWindowExtEx

• 0x4ba3a0 SetWinMetaFileBits

• 0x4ba3a4 SetViewportOrgEx

• 0x4ba3a8 SetViewportExtEx

• 0x4ba3ac SetTextColor

• 0x4ba3b0 SetStretchBltMode

• 0x4ba3b4 SetROP2

• 0x4ba3b8 SetPixel

• 0x4ba3bc SetMapMode

• 0x4ba3c0 SetEnhMetaFileBits

• 0x4ba3c4 SetDIBColorTable

• 0x4ba3c8 SetBrushOrgEx

• 0x4ba3cc SetBkMode

• 0x4ba3d0 SetBkColor

• 0x4ba3d4 SelectPalette

• 0x4ba3d8 SelectObject

• 0x4ba3dc SelectClipRgn

• 0x4ba3e0 SaveDC

• 0x4ba3e4 RestoreDC

• 0x4ba3e8 Rectangle

• 0x4ba3ec RectVisible

• 0x4ba3f0 RealizePalette

• 0x4ba3f4 Polyline

• 0x4ba3f8 PolyPolyline

• 0x4ba3fc PlayEnhMetaFile

• 0x4ba400 PatBlt

• 0x4ba404 MoveToEx

• 0x4ba408 MaskBlt

• 0x4ba40c LineTo

• 0x4ba410 IntersectClipRect

• 0x4ba414 GetWindowOrgEx

• 0x4ba418 GetWinMetaFileBits

• 0x4ba41c GetTextMetricsA

• 0x4ba420 GetTextExtentPointA

• 0x4ba424 GetTextExtentPoint32A

• 0x4ba428 GetSystemPaletteEntries

• 0x4ba42c GetStockObject

• 0x4ba430 GetRgnBox

• 0x4ba434 GetPixel

• 0x4ba438 GetPaletteEntries

• 0x4ba43c GetObjectA

• 0x4ba440 GetNearestColor

• 0x4ba444 GetEnhMetaFilePaletteEntries

• 0x4ba448 GetEnhMetaFileHeader

• 0x4ba44c GetEnhMetaFileBits

• 0x4ba450 GetDeviceCaps

• 0x4ba454 GetDIBits

• 0x4ba458 GetDIBColorTable

• 0x4ba45c GetDCOrgEx

• 0x4ba460 GetCurrentPositionEx

• 0x4ba464 GetClipBox

• 0x4ba468 GetBrushOrgEx

• 0x4ba46c GetBitmapBits

• 0x4ba470 GdiFlush

• 0x4ba474 ExtTextOutA

• 0x4ba478 ExtCreatePen

• 0x4ba47c ExcludeClipRect

• 0x4ba480 DeleteObject

• 0x4ba484 DeleteEnhMetaFile

• 0x4ba488 DeleteDC

• 0x4ba48c CreateSolidBrush

• 0x4ba490 CreateRectRgn

• 0x4ba494 CreatePenIndirect

• 0x4ba498 CreatePalette

• 0x4ba49c CreateHalftonePalette

• 0x4ba4a0 CreateFontIndirectA

• 0x4ba4a4 CreateDIBitmap

• 0x4ba4a8 CreateDIBSection

• 0x4ba4ac CreateCompatibleDC

• 0x4ba4b0 CreateCompatibleBitmap

• 0x4ba4b4 CreateBrushIndirect

• 0x4ba4b8 CreateBitmap

• 0x4ba4bc CopyEnhMetaFileA

• 0x4ba4c0 CombineRgn

• 0x4ba4c4 BitBlt

Library user32.dll:

• 0x4ba4cc CreateWindowExA

• 0x4ba4d0 WindowFromPoint

• 0x4ba4d4 WinHelpA

• 0x4ba4d8 WaitMessage

• 0x4ba4dc ValidateRect

• 0x4ba4e0 UpdateWindow

• 0x4ba4e4 UnregisterClassA

• 0x4ba4e8 UnionRect

• 0x4ba4ec UnhookWindowsHookEx

• 0x4ba4f0 TranslateMessage

• 0x4ba4f4 TranslateMDISysAccel

• 0x4ba4f8 TrackPopupMenu

• 0x4ba4fc SystemParametersInfoA

• 0x4ba500 ShowWindow

• 0x4ba504 ShowScrollBar

• 0x4ba508 ShowOwnedPopups

• 0x4ba50c ShowCursor

• 0x4ba510 SetWindowsHookExA

• 0x4ba514 SetWindowTextA

• 0x4ba518 SetWindowPos

• 0x4ba51c SetWindowPlacement

• 0x4ba520 SetWindowLongA

• 0x4ba524 SetTimer

• 0x4ba528 SetScrollRange

• 0x4ba52c SetScrollPos

• 0x4ba530 SetScrollInfo

• 0x4ba534 SetRect

• 0x4ba538 SetPropA

• 0x4ba53c SetParent

• 0x4ba540 SetMenuItemInfoA

• 0x4ba544 SetMenu

• 0x4ba548 SetKeyboardState

• 0x4ba54c SetForegroundWindow

• 0x4ba550 SetFocus

• 0x4ba554 SetCursor

• 0x4ba558 SetClipboardData

• 0x4ba55c SetClassLongA

• 0x4ba560 SetCapture

• 0x4ba564 SetActiveWindow

• 0x4ba568 SendMessageA

• 0x4ba56c ScrollWindowEx

• 0x4ba570 ScrollWindow

• 0x4ba574 ScreenToClient

• 0x4ba578 RemovePropA

• 0x4ba57c RemoveMenu

• 0x4ba580 ReleaseDC

• 0x4ba584 ReleaseCapture

• 0x4ba588 RegisterWindowMessageA

• 0x4ba58c RegisterClipboardFormatA

• 0x4ba590 RegisterClassA

• 0x4ba594 RedrawWindow

• 0x4ba598 PtInRect

• 0x4ba59c PostQuitMessage

• 0x4ba5a0 PostMessageA

• 0x4ba5a4 PeekMessageA

• 0x4ba5a8 OpenClipboard

• 0x4ba5ac OffsetRect

• 0x4ba5b0 OemToCharA

• 0x4ba5b4 MessageBoxA

• 0x4ba5b8 MessageBeep

• 0x4ba5bc MapWindowPoints

• 0x4ba5c0 MapVirtualKeyA

• 0x4ba5c4 LoadStringA

• 0x4ba5c8 LoadKeyboardLayoutA

• 0x4ba5cc LoadIconA

• 0x4ba5d0 LoadCursorA

• 0x4ba5d4 LoadBitmapA

• 0x4ba5d8 KillTimer

• 0x4ba5dc IsZoomed

• 0x4ba5e0 IsWindowVisible

• 0x4ba5e4 IsWindowEnabled

• 0x4ba5e8 IsWindow

• 0x4ba5ec IsRectEmpty

• 0x4ba5f0 IsIconic

• 0x4ba5f4 IsDialogMessageA

• 0x4ba5f8 IsChild

• 0x4ba5fc IsCharAlphaNumericA

• 0x4ba600 IsCharAlphaA

• 0x4ba604 InvalidateRect

• 0x4ba608 IntersectRect

• 0x4ba60c InsertMenuItemA

• 0x4ba610 InsertMenuA

• 0x4ba614 InflateRect

• 0x4ba618 GetWindowThreadProcessId

• 0x4ba61c GetWindowTextA

• 0x4ba620 GetWindowRect

• 0x4ba624 GetWindowPlacement

• 0x4ba628 GetWindowLongA

• 0x4ba62c GetWindowDC

• 0x4ba630 GetTopWindow

• 0x4ba634 GetSystemMetrics

• 0x4ba638 GetSystemMenu

• 0x4ba63c GetSysColorBrush

• 0x4ba640 GetSysColor

• 0x4ba644 GetSubMenu

• 0x4ba648 GetScrollRange

• 0x4ba64c GetScrollPos

• 0x4ba650 GetScrollInfo

• 0x4ba654 GetPropA

• 0x4ba658 GetParent

• 0x4ba65c GetWindow

• 0x4ba660 GetMessageTime

• 0x4ba664 GetMenuStringA

• 0x4ba668 GetMenuState

• 0x4ba66c GetMenuItemInfoA

• 0x4ba670 GetMenuItemID

• 0x4ba674 GetMenuItemCount

• 0x4ba678 GetMenu

• 0x4ba67c GetLastActivePopup

• 0x4ba680 GetKeyboardState

• 0x4ba684 GetKeyboardLayoutList

• 0x4ba688 GetKeyboardLayout

• 0x4ba68c GetKeyState

• 0x4ba690 GetKeyNameTextA

• 0x4ba694 GetIconInfo

• 0x4ba698 GetForegroundWindow

• 0x4ba69c GetFocus

• 0x4ba6a0 GetDoubleClickTime

• 0x4ba6a4 GetDesktopWindow

• 0x4ba6a8 GetDCEx

• 0x4ba6ac GetDC

• 0x4ba6b0 GetCursorPos

• 0x4ba6b4 GetCursor

• 0x4ba6b8 GetClipboardData

• 0x4ba6bc GetClientRect

• 0x4ba6c0 GetClassNameA

• 0x4ba6c4 GetClassInfoA

• 0x4ba6c8 GetCaretPos

• 0x4ba6cc GetCapture

• 0x4ba6d0 GetActiveWindow

• 0x4ba6d4 FrameRect

• 0x4ba6d8 FindWindowA

• 0x4ba6dc FillRect

• 0x4ba6e0 EqualRect

• 0x4ba6e4 EnumWindows

• 0x4ba6e8 EnumThreadWindows

• 0x4ba6ec EnumClipboardFormats

• 0x4ba6f0 EndPaint

• 0x4ba6f4 EnableWindow

• 0x4ba6f8 EnableScrollBar

• 0x4ba6fc EnableMenuItem

• 0x4ba700 EmptyClipboard

• 0x4ba704 DrawTextA

• 0x4ba708 DrawMenuBar

• 0x4ba70c DrawIconEx

• 0x4ba710 DrawIcon

• 0x4ba714 DrawFrameControl

• 0x4ba718 DrawFocusRect

• 0x4ba71c DrawEdge

• 0x4ba720 DispatchMessageA

• 0x4ba724 DestroyWindow

• 0x4ba728 DestroyMenu

• 0x4ba72c DestroyIcon

• 0x4ba730 DestroyCursor

• 0x4ba734 DeleteMenu

• 0x4ba738 DefWindowProcA

• 0x4ba73c DefMDIChildProcA

• 0x4ba740 DefFrameProcA

• 0x4ba744 CreatePopupMenu

• 0x4ba748 CreateMenu

• 0x4ba74c CreateIcon

• 0x4ba750 CloseClipboard

• 0x4ba754 ClientToScreen

• 0x4ba758 CheckMenuItem

• 0x4ba75c CallWindowProcA

• 0x4ba760 CallNextHookEx

• 0x4ba764 BeginPaint

• 0x4ba768 CharNextA

• 0x4ba76c CharLowerBuffA

• 0x4ba770 CharLowerA

• 0x4ba774 CharUpperBuffA

• 0x4ba778 CharToOemA

• 0x4ba77c AdjustWindowRectEx

• 0x4ba780 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4ba788 Sleep

Library oleaut32.dll:

• 0x4ba790 SafeArrayPtrOfIndex

• 0x4ba794 SafeArrayPutElement

• 0x4ba798 SafeArrayGetElement

• 0x4ba79c SafeArrayUnaccessData

• 0x4ba7a0 SafeArrayAccessData

• 0x4ba7a4 SafeArrayGetUBound

• 0x4ba7a8 SafeArrayGetLBound

• 0x4ba7ac SafeArrayCreate

• 0x4ba7b0 VariantChangeType

• 0x4ba7b4 VariantCopyInd

• 0x4ba7b8 VariantCopy

• 0x4ba7bc VariantClear

• 0x4ba7c0 VariantInit

Library ole32.dll:

• 0x4ba7c8 CLSIDFromProgID

• 0x4ba7cc CoCreateInstance

• 0x4ba7d0 CoUninitialize

• 0x4ba7d4 CoInitialize

Library oleaut32.dll:

• 0x4ba7dc GetErrorInfo

• 0x4ba7e0 SysFreeString

Library comctl32.dll:

• 0x4ba7e8 ImageList_SetIconSize

• 0x4ba7ec ImageList_GetIconSize

• 0x4ba7f0 ImageList_Write

• 0x4ba7f4 ImageList_Read

• 0x4ba7f8 ImageList_GetDragImage

• 0x4ba7fc ImageList_DragShowNolock

• 0x4ba800 ImageList_SetDragCursorImage

• 0x4ba804 ImageList_DragMove

• 0x4ba808 ImageList_DragLeave

• 0x4ba80c ImageList_DragEnter

• 0x4ba810 ImageList_EndDrag

• 0x4ba814 ImageList_BeginDrag

• 0x4ba818 ImageList_Remove

• 0x4ba81c ImageList_DrawEx

• 0x4ba820 ImageList_Replace

• 0x4ba824 ImageList_Draw

• 0x4ba828 ImageList_GetBkColor

• 0x4ba82c ImageList_SetBkColor

• 0x4ba830 ImageList_ReplaceIcon

• 0x4ba834 ImageList_Add

• 0x4ba838 ImageList_SetImageCount

• 0x4ba83c ImageList_GetImageCount

• 0x4ba840 ImageList_Destroy

• 0x4ba844 ImageList_Create

• 0x4ba848 InitCommonControls

Library wininet.dll:

• 0x4ba850 InternetGetConnectedState

Library kernel32.dll:

• 0x4ba858 MulDiv

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
is.gd	A 104.25.233.53 A 172.67.83.132 A 104.25.234.53	172.67.83.132
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49176	104.25.233.53 is.gd	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.