SmartHawk

5.6

高危

51 个模型检测该样本为恶意！

重新分析

下载样本

b9689def990ba4d8db5f260e373c7ccd442ce09b468af9d97a906cfda1863826

fd5dc47d616775710e952cfe25e23933.exe

分析耗时

79s

最近分析

文件大小

284.0KB

静态报毒动态报毒 5HLPDRVPFC AFFP AI SCORE=99 AIDETECTVM BRUCBGY CLASSIC EMOTET GENCIRC GENERICKD GENERIK HEEO HIGH CONFIDENCE HOUVNR ICEDID JJCD KRYPTIK MALWARE2 MALWAREX NONAME@0 PHOTODLDER S + TROJ SCORE SUSGEN TRIKBOT UNSAFE ZENPAK 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	RDN/Generic.dx	20200908	6.0.6.653
Alibaba	Backdoor:Win32/IcedId.6a9ee34e	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft		20200909	2013.8.14.323
Tencent	Malware.Win32.Gencirc.11986642	20200909	1.0.0.1
CrowdStrike		20190702	1.0

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 个事件)

request

GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Resolves a suspicious Top Level Domain (TLD) (1 个事件)

domain

loadcanti.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620822461.228374 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00520000	success	0	0

Foreign language identified in PE resource (4 个事件)

name

RT_ICON

language

LANG_CHINESE

offset

0x00044918

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000128

name

RT_ICON

language

LANG_CHINESE

offset

0x00044918

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000128

name

RT_RCDATA

language

LANG_CHINESE

offset

0x00044a68

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00002f44

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00044a40

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000022

Creates hidden or system file (8 个事件)

Time & API	Arguments	Status	Return
1620822461.369374 NtCreateFile	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	failed	3221225525
1620822461.369374 NtCreateFile	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	failed	3221225525
1620822461.369374 NtCreateFile	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	failed	3221225525
1620822461.369374 NtCreateFile	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500 desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500 create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	failed	3221225525
1620822461.447374 NtCreateFile	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	failed	3221225525
1620822461.447374 NtCreateFile	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	failed	3221225525
1620822461.447374 NtCreateFile	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	failed	3221225525
1620822461.447374 NtCreateFile	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500 desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500 create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	failed	3221225525

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620822464.947374 GetAdaptersAddresses	flags: 15 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Generates some ICMP traffic

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.33992125
FireEye	Trojan.GenericKD.33992125
McAfee	RDN/Generic.dx
Cylance	Unsafe
Zillya	Trojan.Zenpak.Win32.2168
Sangfor	Malware
K7AntiVirus	Trojan ( 005691711 )
Alibaba	Backdoor:Win32/IcedId.6a9ee34e
K7GW	Trojan ( 005691711 )
Arcabit	Trojan.Generic.D206ADBD
Invincea	Mal/Generic-S + Troj/Trikbot-FZ
Cyren	W32/Trojan.JJCD-0272
Symantec	Trojan.Emotet
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Zenpak.affp
BitDefender	Trojan.GenericKD.33992125
NANO-Antivirus	Trojan.Win32.Zenpak.houvnr
Rising	Trojan.Kryptik!1.C805 (CLASSIC)
Ad-Aware	Trojan.GenericKD.33992125
Sophos	Troj/Trikbot-FZ
Comodo	fls.noname@0
F-Secure	Trojan.TR/AD.PhotoDlder.DQ
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.ICEDID.AD
Emsisoft	Trojan.GenericKD.33992125 (B)
Ikarus	Trojan.Inject
Jiangmin	Trojan.Zenpak.cas
Avira	TR/AD.PhotoDlder.DQ
Antiy-AVL	Trojan/Win32.Zenpak
Microsoft	Trojan:Win32/IcedId.DAS!MTB
ZoneAlarm	Trojan.Win32.Zenpak.affp
GData	Trojan.GenericKD.33992125
Cynet	Malicious (score: 85)
AhnLab-V3	Malware/Win32.Generic.C4154563
ALYac	Trojan.IcedID.gen
MAX	malware (ai score=99)
VBA32	Trojan.Zenpak
Malwarebytes	Trojan.IcedID
ESET-NOD32	a variant of Win32/Kryptik.HEEO
TrendMicro-HouseCall	Trojan.Win32.ICEDID.AD
Tencent	Malware.Win32.Gencirc.11986642
Yandex	Trojan.Kryptik!/5HLPDRVPFc
MaxSecure	Trojan.Malware.102093144.susgen
Fortinet	W32/Generik.BRUCBGY!tr
Webroot	W32.Trojan.Gen
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/CI.A

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-08 17:56:37

Imports

Library KERNEL32.dll:

• 0x4330d8 GetACP

• 0x4330dc GetTimeZoneInformation

• 0x4330e0 UnhandledExceptionFilter

• 0x4330e4 FreeEnvironmentStringsA

• 0x4330e8 FreeEnvironmentStringsW

• 0x4330ec GetEnvironmentStrings

• 0x4330f0 GetEnvironmentStringsW

• 0x4330f4 SetHandleCount

• 0x4330f8 GetStdHandle

• 0x4330fc GetFileType

• 0x433100 HeapDestroy

• 0x433104 HeapCreate

• 0x433108 VirtualFree

• 0x43310c VirtualAlloc

• 0x433110 IsBadWritePtr

• 0x433114 SetUnhandledExceptionFilter

• 0x433118 HeapSize

• 0x43311c LCMapStringW

• 0x433120 GetStringTypeA

• 0x433124 GetStringTypeW

• 0x433128 IsBadCodePtr

• 0x43312c SetStdHandle

• 0x433130 CompareStringA

• 0x433134 CompareStringW

• 0x433138 SetEnvironmentVariableA

• 0x43313c HeapReAlloc

• 0x433140 GetProfileStringA

• 0x433144 TerminateProcess

• 0x433148 RaiseException

• 0x43314c IsBadReadPtr

• 0x433150 HeapAlloc

• 0x433154 HeapFree

• 0x433158 ExitProcess

• 0x43315c GetCommandLineA

• 0x433160 GetStartupInfoA

• 0x433164 RtlUnwind

• 0x433168 FormatMessageA

• 0x43316c GetFileTime

• 0x433170 GetFileSize

• 0x433174 GetFileAttributesA

• 0x433178 FileTimeToLocalFileTime

• 0x43317c FileTimeToSystemTime

• 0x433180 GetFullPathNameA

• 0x433184 GetVolumeInformationA

• 0x433188 FindFirstFileA

• 0x43318c FindClose

• 0x433190 SetEndOfFile

• 0x433194 UnlockFile

• 0x433198 LockFile

• 0x43319c FlushFileBuffers

• 0x4331a0 SetFilePointer

• 0x4331a4 WriteFile

• 0x4331a8 ReadFile

• 0x4331ac CreateFileA

• 0x4331b0 GetCurrentProcess

• 0x4331b4 DuplicateHandle

• 0x4331b8 SetErrorMode

• 0x4331bc GetThreadLocale

• 0x4331c0 WritePrivateProfileStringA

• 0x4331c4 GetOEMCP

• 0x4331c8 GetCPInfo

• 0x4331cc GetProcessVersion

• 0x4331d0 TlsGetValue

• 0x4331d4 LocalReAlloc

• 0x4331d8 TlsSetValue

• 0x4331dc EnterCriticalSection

• 0x4331e0 GlobalReAlloc

• 0x4331e4 LeaveCriticalSection

• 0x4331e8 TlsFree

• 0x4331ec GlobalHandle

• 0x4331f0 DeleteCriticalSection

• 0x4331f4 TlsAlloc

• 0x4331f8 InitializeCriticalSection

• 0x4331fc LocalFree

• 0x433200 LocalAlloc

• 0x433204 SizeofResource

• 0x433208 GlobalFlags

• 0x43320c lstrcpynA

• 0x433210 MulDiv

• 0x433214 SetLastError

• 0x433218 MultiByteToWideChar

• 0x43321c WideCharToMultiByte

• 0x433220 InterlockedIncrement

• 0x433224 InterlockedDecrement

• 0x433228 CloseHandle

• 0x43322c GetModuleFileNameA

• 0x433230 GlobalAlloc

• 0x433234 lstrcmpA

• 0x433238 GetCurrentThread

• 0x43323c lstrlenA

• 0x433240 LoadLibraryA

• 0x433244 FreeLibrary

• 0x433248 GetVersion

• 0x43324c lstrcatA

• 0x433250 GetCurrentThreadId

• 0x433254 GlobalGetAtomNameA

• 0x433258 lstrcmpiA

• 0x43325c GlobalAddAtomA

• 0x433260 GlobalFindAtomA

• 0x433264 GlobalDeleteAtom

• 0x433268 lstrcpyA

• 0x43326c GetModuleHandleA

• 0x433270 GetProcAddress

• 0x433274 GlobalLock

• 0x433278 GlobalUnlock

• 0x43327c GlobalFree

• 0x433280 LockResource

• 0x433284 FindResourceA

• 0x433288 LoadResource

• 0x43328c GetLastError

• 0x433290 GetTickCount

• 0x433294 LCMapStringA

• 0x433298 LoadLibraryExW

Library USER32.dll:

• 0x4332d0 CharUpperA

• 0x4332d4 RegisterClipboardFormatA

• 0x4332d8 PostThreadMessageA

• 0x4332dc GetDlgItemInt

• 0x4332e0 SendDlgItemMessageA

• 0x4332e4 MapWindowPoints

• 0x4332e8 GetSysColor

• 0x4332ec PeekMessageA

• 0x4332f0 DispatchMessageA

• 0x4332f4 GetFocus

• 0x4332f8 AdjustWindowRectEx

• 0x4332fc CopyRect

• 0x433300 IsWindowVisible

• 0x433304 GetTopWindow

• 0x433308 MessageBoxA

• 0x43330c IsChild

• 0x433310 GetCapture

• 0x433314 WinHelpA

• 0x433318 wsprintfA

• 0x43331c GetMenu

• 0x433320 GetMenuItemCount

• 0x433324 GetSubMenu

• 0x433328 GetMenuItemID

• 0x43332c GetWindowTextLengthA

• 0x433330 GetDlgCtrlID

• 0x433334 SetWindowsHookExA

• 0x433338 CallNextHookEx

• 0x43333c GetClassLongA

• 0x433340 SetPropA

• 0x433344 UnhookWindowsHookEx

• 0x433348 GetPropA

• 0x43334c RemovePropA

• 0x433350 GetMessageTime

• 0x433354 GetMessagePos

• 0x433358 GetLastActivePopup

• 0x43335c MessageBeep

• 0x433360 SetForegroundWindow

• 0x433364 GetWindow

• 0x433368 SetWindowPos

• 0x43336c RegisterWindowMessageA

• 0x433370 IntersectRect

• 0x433374 SystemParametersInfoA

• 0x433378 GetWindowPlacement

• 0x43337c GetWindowRect

• 0x433380 GetNextDlgTabItem

• 0x433384 EndDialog

• 0x433388 GetActiveWindow

• 0x43338c SetActiveWindow

• 0x433390 IsWindow

• 0x433394 CreateDialogIndirectParamA

• 0x433398 DestroyWindow

• 0x43339c GetDlgItem

• 0x4333a0 IsWindowEnabled

• 0x4333a4 PostMessageA

• 0x4333a8 CallWindowProcA

• 0x4333ac SetWindowTextA

• 0x4333b0 CreateWindowExA

• 0x4333b4 UpdateWindow

• 0x4333b8 GetClassInfoA

• 0x4333bc RegisterClassA

• 0x4333c0 GetWindowLongA

• 0x4333c4 DefWindowProcA

• 0x4333c8 GetCursorPos

• 0x4333cc ScreenToClient

• 0x4333d0 SetCursor

• 0x4333d4 SetTimer

• 0x4333d8 ReleaseCapture

• 0x4333dc KillTimer

• 0x4333e0 PtInRect

• 0x4333e4 SetCapture

• 0x4333e8 GetKeyState

• 0x4333ec GetScrollInfo

• 0x4333f0 SendMessageA

• 0x4333f4 UnregisterClassA

• 0x4333f8 HideCaret

• 0x4333fc ShowCaret

• 0x433400 ExcludeUpdateRgn

• 0x433404 DrawFocusRect

• 0x433408 DefDlgProcA

• 0x43340c IsWindowUnicode

• 0x433410 SetScrollRange

• 0x433414 GetDC

• 0x433418 ReleaseDC

• 0x43341c GetWindowTextA

• 0x433420 ShowWindow

• 0x433424 SetFocus

• 0x433428 SetScrollPos

• 0x43342c InflateRect

• 0x433430 DrawTextA

• 0x433434 SetRect

• 0x433438 FillRect

• 0x43343c DestroyCursor

• 0x433440 LoadCursorA

• 0x433444 GetNextDlgGroupItem

• 0x433448 CopyAcceleratorTableA

• 0x43344c CharNextA

• 0x433450 GetForegroundWindow

• 0x433454 GetParent

• 0x433458 SetWindowLongA

• 0x43345c InvalidateRect

• 0x433460 IsIconic

• 0x433464 GetSystemMetrics

• 0x433468 GetClientRect

• 0x43346c DrawIcon

• 0x433470 GetSystemMenu

• 0x433474 AppendMenuA

• 0x433478 LoadIconA

• 0x43347c EnableWindow

• 0x433480 GetSysColorBrush

• 0x433484 GetDesktopWindow

• 0x433488 GetClassNameA

• 0x43348c GrayStringA

• 0x433490 TabbedTextOutA

• 0x433494 EndPaint

• 0x433498 BeginPaint

• 0x43349c GetWindowDC

• 0x4334a0 ClientToScreen

• 0x4334a4 DestroyMenu

• 0x4334a8 LoadStringA

• 0x4334ac MapDialogRect

• 0x4334b0 SetWindowContextHelpId

• 0x4334b4 GetMessageA

• 0x4334b8 TranslateMessage

• 0x4334bc ValidateRect

• 0x4334c0 PostQuitMessage

• 0x4334c4 GetMenuCheckMarkDimensions

• 0x4334c8 LoadBitmapA

• 0x4334cc GetMenuState

• 0x4334d0 ModifyMenuA

• 0x4334d4 SetMenuItemBitmaps

• 0x4334d8 CheckMenuItem

• 0x4334dc EnableMenuItem

• 0x4334e0 IsDialogMessageA

• 0x4334e4 MoveWindow

• 0x4334e8 OffsetRect

• 0x4334ec SetDlgItemInt

Library GDI32.dll:

• 0x43301c SaveDC

• 0x433020 RestoreDC

• 0x433024 SetMapMode

• 0x433028 SetViewportOrgEx

• 0x43302c OffsetViewportOrgEx

• 0x433030 SetViewportExtEx

• 0x433034 ScaleViewportExtEx

• 0x433038 SetWindowExtEx

• 0x43303c ScaleWindowExtEx

• 0x433040 IntersectClipRect

• 0x433044 GetDeviceCaps

• 0x433048 GetViewportExtEx

• 0x43304c GetWindowExtEx

• 0x433050 PtVisible

• 0x433054 RectVisible

• 0x433058 TextOutA

• 0x43305c ExtTextOutA

• 0x433060 Escape

• 0x433064 GetMapMode

• 0x433068 DPtoLP

• 0x43306c GetTextColor

• 0x433070 GetBkColor

• 0x433074 LPtoDP

• 0x433078 PatBlt

• 0x43307c CreateBitmap

• 0x433080 SetBkColor

• 0x433084 SetTextColor

• 0x433088 BitBlt

• 0x43308c DeleteDC

• 0x433090 CreateCompatibleDC

• 0x433094 CreateCompatibleBitmap

• 0x433098 SetWindowOrgEx

• 0x43309c SetBkMode

• 0x4330a0 SetROP2

• 0x4330a4 SelectObject

• 0x4330a8 MoveToEx

• 0x4330ac LineTo

• 0x4330b0 GetClipBox

• 0x4330b4 GetObjectA

• 0x4330b8 CreateFontIndirectA

• 0x4330bc DeleteObject

• 0x4330c0 CreatePen

• 0x4330c4 CreateSolidBrush

• 0x4330c8 CreateDIBitmap

• 0x4330cc GetTextExtentPointA

• 0x4330d0 GetStockObject

Library comdlg32.dll:

• 0x433504 GetFileTitleA

Library WINSPOOL.DRV:

• 0x4334f4 ClosePrinter

• 0x4334f8 DocumentPropertiesA

• 0x4334fc OpenPrinterA

Library ADVAPI32.dll:

• 0x433000 RegCreateKeyExA

• 0x433004 RegOpenKeyExA

• 0x433008 RegSetValueExA

• 0x43300c RegCloseKey

Library COMCTL32.dll:

• 0x433014

Library oledlg.dll:

• 0x43354c

Library ole32.dll:

• 0x43350c CoFreeUnusedLibraries

• 0x433510 OleInitialize

• 0x433514 CoTaskMemAlloc

• 0x433518 CoTaskMemFree

• 0x43351c CreateILockBytesOnHGlobal

• 0x433520 StgCreateDocfileOnILockBytes

• 0x433524 StgOpenStorageOnILockBytes

• 0x433528 CoGetClassObject

• 0x43352c CLSIDFromString

• 0x433530 CLSIDFromProgID

• 0x433534 CoRegisterMessageFilter

• 0x433538 CoRevokeClassObject

• 0x43353c OleFlushClipboard

• 0x433540 OleIsCurrentClipboard

• 0x433544 OleUninitialize

Library OLEPRO32.DLL:

• 0x4332c8

Library OLEAUT32.dll:

• 0x4332a0 SysAllocStringLen

• 0x4332a4 VariantClear

• 0x4332a8 VariantTimeToSystemTime

• 0x4332ac VariantCopy

• 0x4332b0 VariantChangeType

• 0x4332b4 SysAllocString

• 0x4332b8 SysAllocStringByteLen

• 0x4332bc SysStringLen

• 0x4332c0 SysFreeString

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 51.105.208.173 CNAME time.microsoft.akadns.net
support.oracle.com	A 23.195.77.161 CNAME e870.x.akamaiedge.net CNAME support.oracle.com.edgekey.net	23.195.77.161
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
www.intel.com	A 184.26.156.5 CNAME intel11.cn.edgekey.net CNAME e11.dsca.akamaiedge.net	184.26.156.5
help.twitter.com	A 31.13.73.23 A 31.13.94.23 CNAME s.twitter.com A 104.244.42.67 A 104.244.42.195 A 104.244.42.3 A 104.244.42.131	98.159.108.71
loadcanti.top
support.apple.com	CNAME support-china.apple-support.akadns.net CNAME prod-support.apple-support.akadns.net CNAME ioshost.qtlcdn.com A 113.16.209.193	45.124.126.250
www.download.windowsupdate.com	A 218.75.176.168 A 121.12.123.242 CNAME 3573033.pack.cdntip.com CNAME www.download.windowsupdate.com.cdn.dnsv1.com CNAME windowsupdate.sched.s11.tdnsv5.com CNAME 2-01-3cf7-0009.cdx.cedexis.net A 119.147.227.210 CNAME wu-fg-shim.trafficmanager.net	205.185.216.42
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49174	113.16.209.193 support.apple.com	443
192.168.56.101	49177	119.147.227.210 www.download.windowsupdate.com	80
192.168.56.101	49182	184.26.156.5 www.intel.com	443
192.168.56.101	49183	184.26.156.5 www.intel.com	443
192.168.56.101	49186	23.195.77.161 support.oracle.com	443
192.168.56.101	49187	23.195.77.161 support.oracle.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51809	239.255.255.250	3702

HTTP & HTTPS Requests

URI	Data
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Cache-Control: max-age = 3600 Connection: Keep-Alive Accept: / If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT If-None-Match: "0d8f4f3f6fd71:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Cache-Control: max-age = 900 Connection: Keep-Alive Accept: / If-Modified-Since: Mon, 19 Apr 2021 20:17:25 GMT If-None-Match: "80f8835935d71:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com

URI

Data

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT
If-None-Match: "0d8f4f3f6fd71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 19 Apr 2021 20:17:25 GMT
If-None-Match: "80f8835935d71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.