# Squid Game

## The Room is about Forensic analysis malware documents

## Attacker 1

The toolkit that helps analyze malicious macros or malicious code in .doc documents is called the general ole toolkit

First lookup from oledump :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FDaiKVpcFWxSeQNTJeA2J%2Fimage.png?alt=media&#x26;token=f46112c3-b7f8-4cfa-977d-77d99481df78" alt=""><figcaption></figcaption></figure>

In first question , malicious C2 domain can found in the maldoc where an executable download , finding the C2 is kind find some exucutable strings ,obfuscate code so we will look through stream to see what inside&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FFWVbMXssJptkJElBkfs0%2Fimage.png?alt=media&#x26;token=dc933e0d-de24-4be3-9683-588a12ba6c6f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FukqvSqg4I2RR83TJGX5P%2Fimage.png?alt=media&#x26;token=a16fdaeb-a63f-4f7a-a23a-1d713edf522f" alt=""><figcaption></figcaption></figure>

In stream 4 contained something like a powershell command and it was obfuscated and encoded in base64 so it looks like this command when called it will download something and call to C2 domain&#x20;

Need more infomation to identify&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FC8P8eYCoBDHhnm5nv66y%2Fimage.png?alt=media&#x26;token=4ed04f37-006c-42cc-8f53-8c45893d6c96" alt=""><figcaption></figcaption></figure>

Let try analyze the source code, using olveba :&#x20;

highlight this, it replaces 'A' to '\[' so we can try this on the code we had in the previous section

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FNiWkm2erKpWQIW0ydYqk%2Fimage.png?alt=media&#x26;token=9ec0cf3d-4870-46e2-92c8-f11cc9692feb" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FEYZXOxV2MACt6EnCj9Wd%2Fimage.png?alt=media&#x26;token=1a698a26-ed0c-441e-90ec-09e92c5a81a9" alt=""><figcaption></figcaption></figure>

now we can see the C2 domain and the answer for the ques 2 too, it try get the folder have the file right there.

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F4tDmUHx9TgtidIXELN5z%2Fimage.png?alt=media&#x26;token=3a7fcce8-52a4-46de-a3f6-fd6b11bae99c" alt=""><figcaption></figcaption></figure>

This will be next answer question let try take a look when use powershell checking that

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FpE02r4AVKnzrIFk0duL4%2Fimage.png?alt=media&#x26;token=36b423c7-d055-43aa-9897-b86852a7c6c5" alt=""><figcaption></figcaption></figure>

Follow the hint and some research that telling about clsid so we have the clsis here too : &#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FBrAzKeaYoHKUDSQusEr9%2Fimage.png?alt=media&#x26;token=3dc0f38b-56ac-467a-a692-75970272b469" alt=""><figcaption></figcaption></figure>

Let research about this clsid found an aritcle about this : <https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/>

And got the answer we need :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FiewSCowJs4iOa7hb2HRH%2Fimage.png?alt=media&#x26;token=5d1fd09f-6dae-4e75-b7f4-ef43e7d42ce1" alt=""><figcaption></figcaption></figure>

Also we can see the ip and php extentions too :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FO9gAH115ETqqufEy8B8N%2Fimage.png?alt=media&#x26;token=59cbea33-ee96-4fd6-ad61-13d60ffe3225" alt=""><figcaption></figcaption></figure>

Next question does not need that anymore , so switch to another tool in ole tool , it is olemeta : This will extract all standard properties

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FLFKaGEVOOfOMbAHZBQsH%2Fimage.png?alt=media&#x26;token=4ce4ca54-6ed3-42d1-b185-192071f12d84" alt=""><figcaption></figcaption></figure>

Got the answer about phone number too.

Back to olvba so we can get what we need in next question :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FDFn8k1Fd8CgkB3w0hQZS%2Fimage.png?alt=media&#x26;token=cf4be09e-cf4d-4091-8897-55624b906066" alt=""><figcaption></figcaption></figure>

So about subject it right on when use olemeta :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2Fel9JQ8EprSde73izPk6f%2Fimage.png?alt=media&#x26;token=1e12d143-b62d-4463-90ac-045e4413b6d9" alt=""><figcaption></figcaption></figure>

Oletimes will help for the next question:&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FWomntTR6Vh6KrEnS9nGa%2Fimage.png?alt=media&#x26;token=12a42da0-7880-4af2-ba3b-919b42d992ad" alt=""><figcaption></figcaption></figure>

Oledump will provides in last 2 questions:&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FURJbasuDJbenatNAgTZI%2Fimage.png?alt=media&#x26;token=32d8a8c2-f265-4888-bd7c-05a0e9afb9d1" alt=""><figcaption></figcaption></figure>

The M is for Marco and that what we need.

## Attacker 2

So we have familer with ole Tool ,now move on the second maldoc :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FR9YEzAfBhDhp7crZ1TXF%2Fimage.png?alt=media&#x26;token=67358ed6-c580-4095-bff1-effba9ee12c8" alt=""><figcaption><p>It provides more marco in this files also we have the answer for 1st question</p></figcaption></figure>

Option -i will provides extra infomation :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FinSTQw2CYX0Njlw3pK4M%2Fimage.png?alt=media&#x26;token=98c99241-a2d4-453c-8551-be948d15643a" alt=""><figcaption></figcaption></figure>

So 15671 is the total of code not and had compile so 13867 is the code compiled in that stream contain marco and we can see the highest byte for next question.

We will finding through hold stream and  with option -v in oledumpy will help decompress the VBA script might contain in some stream : &#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2Fq3k0mgDW2AFk7wkjnZc1%2Fimage.png?alt=media&#x26;token=da7a5f02-c5cd-4036-a91f-2c8bc9e7cdb7" alt=""><figcaption></figcaption></figure>

So it might the string we need , reverse that and get the answer :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F95V3dpwxHNuXK9taAbQU%2Fimage.png?alt=media&#x26;token=267eba2f-bae5-4621-bbc6-172b9e93290e" alt=""><figcaption></figcaption></figure>

So next is finding 2 domain , it will start with http and i will do the finding again with that , i prefer option -S to execute the string output&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FjAIIkC3I8o6CYRrvT38c%2Fimage.png?alt=media&#x26;token=87a2704d-da9b-43e0-b17f-203c29e5ef77" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FBBQFboCIiv25Ij4KXj0v%2Fimage.png?alt=media&#x26;token=cde99392-40b6-42d0-b6ea-df86772fd1fa" alt=""><figcaption></figcaption></figure>

So from number 9 it looks like a suspect domain, and we got the first 2 domains for the answer and taking a closer look we can also get the answer for the next 2 questions, The dll file name and number are right there also the path too.( C:\\)

Rundll32.exe will perform to run file dll , we can research to read more about that.

Stream 9 contain information we need for next question , so because VBS script contain in here that why contain important information we need to find out and investigate :

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FCOfXEV1O3aJUCEtnmvpT%2Fimage.png?alt=media&#x26;token=9d1f876f-6f64-48bf-97a6-eddceabaaf13" alt=""><figcaption></figcaption></figure>

Found the times of the  maldoc sleep for to fully execute the malicious DLLs (15000 miliseconds)  and the stream name again in last question just run the oledump and we can get that .

## Attacker 3

Let take a look at oledump first : &#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FKIwGMIMpILLp3JoWCycy%2Fimage.png?alt=media&#x26;token=796541d7-23b0-40a3-b777-b2411ed07c5d" alt=""><figcaption></figcaption></figure>

Now is finding executable so we can do like previous step in the Attacker 2 ,change what we want finding and the file doc&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FgBmZdQWMNWkNbiNnDwxC%2Fimage.png?alt=media&#x26;token=3cf0f0bb-87ba-4c2d-9487-0a3dec56ba95" alt=""><figcaption><p>Got answer for the 1st question</p></figcaption></figure>

Look in this we can see the % represent for variable and that replace&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FRDZGgZCdxM72Z56DMmCl%2Fimage.png?alt=media&#x26;token=937b5639-40d2-40c9-9b34-6bf6cecc2745" alt=""><figcaption></figcaption></figure>

So the answer for next is certutil .

So do same method to finding the http or https doesn't give back to us anything good , at here we have another tool for this it is Vipermonkey : ViperMonkey is a VBA Emulation engine written in Python, designed to analyze and deobfuscate malicious VBA Macros contained in Microsoft Office files.

Read more about this on this github : <https://github.com/decalage2/ViperMonkey>

Let try use that on this file :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F2UixijGkmO2KxGeME3Nb%2Fimage.png?alt=media&#x26;token=c868067c-5238-4507-b456-49f25cda115c" alt=""><figcaption></figcaption></figure>

Scroll down and look carefully we can see the suspect http link at here :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FL4gRL6ICZJvKu18moC4o%2Fimage.png?alt=media&#x26;token=f1641bc3-a8ec-4df9-8420-708e8b286c32" alt=""><figcaption><p>Also the folder which it drop in ( ProgramData)</p></figcaption></figure>

Look again at result from previous by using oledump we can see the stream that execute the binary :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FcHlrGYnBbFI8tcp0X2eJ%2Fimage.png?alt=media&#x26;token=6e506663-e38d-4818-9629-bdb658bec2f5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FJWL0sxvkjnyvbBcMpZaU%2Fimage.png?alt=media&#x26;token=abe585ad-60fe-4056-9e45-39b1f438dcec" alt=""><figcaption><p>So A3 is the answer we need</p></figcaption></figure>

## Attacker 4

Again with oledump first to look the stream :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FzWEVq0YE7nPilzCIdzFe%2Fimage.png?alt=media&#x26;token=1feedfe4-b876-4bf4-bad2-bb30d3308859" alt=""><figcaption></figcaption></figure>

So stream 7 contain the marco , let take a look deep into it

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FawYx88VYjezgKswkJNQK%2Fimage.png?alt=media&#x26;token=e338bf2e-ea33-4e41-8764-923841832035" alt=""><figcaption></figcaption></figure>

Scroll down and we can see this&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FrLZPmkPM4qX8WmgW7bsT%2Fimage.png?alt=media&#x26;token=3a9a226c-c480-493b-a8a5-93a47f9636d6" alt=""><figcaption></figcaption></figure>

It is the XORI function in vba , first param take the text and the second is the key ,we can read more about this at here : <https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/deobfuscating-malicious-macros-using-python/>

So let decode that string&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FL2NvYjoClIaVY0AsDgaN%2Fimage.png?alt=media&#x26;token=fa135b03-94e7-4efc-8e7f-1745a736bce8" alt=""><figcaption><p>Look like we got the answer for first question</p></figcaption></figure>

For next 2 questions , let try decode more string below which in function XORI and this is the what we need :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FPjdlZxgAvFB2wxKq8KdL%2Fimage.png?alt=media&#x26;token=d6c55a5a-2774-409e-ac03-b179f04133ae" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2Fi3EyOsQjo5asv8KjUTaE%2Fimage.png?alt=media&#x26;token=9dc3de2e-ab62-4c6b-b555-fa7279ee6afa" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FWRfeXtOyvLEhy4iiY5ei%2Fimage.png?alt=media&#x26;token=d6b6a760-bce0-49cd-9bcc-19ae32cd0d2a" alt=""><figcaption></figcaption></figure>

Same with next the second binary&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FSWQwA8lYwu94myv5Hmoz%2Fimage.png?alt=media&#x26;token=68501905-1510-422a-8c0c-afc203242ee7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F7PYMG4ARortFYRx27CGu%2Fimage.png?alt=media&#x26;token=3bd7218b-9aab-42cf-8dc3-5f58a6cc6b38" alt=""><figcaption><p>From here we got the last answer for attacker 4 too</p></figcaption></figure>

## Attacker 5

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FYTbkmSFbJdcrCvkosOBa%2Fimage.png?alt=media&#x26;token=d53a7cfe-ebcc-4a3d-bb2b-f2bac71535d9" alt=""><figcaption><p>oledump to take a first look at stream</p></figcaption></figure>

So now let finding the caption , with option -e we can extract embedded in the file&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FWEaASn9n2mg8HQuv4phc%2Fimage.png?alt=media&#x26;token=74f3539d-36d1-4094-b61b-50fe194f012b" alt=""><figcaption><p>Got the answer we need for the first question</p></figcaption></figure>

Next , try vmonkey on this file we can get de base64 encoded&#x20;

Remove the null byte we got some infomation&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FG2WBRoBYjpo41M7LEi6j%2Fimage.png?alt=media&#x26;token=9890706f-a0d3-412c-9d2c-df51f6fcf423" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F7DBZisIPPbpt59QRgZ9l%2Fimage.png?alt=media&#x26;token=b7829665-1c26-4ceb-8e71-f3e4c07cb869" alt=""><figcaption></figcaption></figure>

We can see the gzip compress in here so luckly cyberchef have the plugin call gunzip can help for decompress the base64 output of that

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FMcYfR8UFW9GadP4E6FOl%2Fimage.png?alt=media&#x26;token=2dfa352e-934a-4c72-b0ae-21fea579628c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FPBFWYMfGRd5lPoe9klsI%2Fimage.png?alt=media&#x26;token=d70db7c5-ea4c-4613-887e-1e09e691151f" alt=""><figcaption><p>We got the answer at here too</p></figcaption></figure>

That code is telling the math xoring the data base64 with 35 too let take another decode on that&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FUUpY2ZKDG0f5WpQSOVA2%2Fimage.png?alt=media&#x26;token=ced93780-f5f8-4e89-af30-4111381395e6" alt=""><figcaption><p>Also we can see the ip address right there and the answer for user-agent question</p></figcaption></figure>

Not readable much but we can see the User-Agent which meanprobably look like here is the shellcode , we have a tool for analyzy this is `scdbg`&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FmfxfryBfjmk78O957Uvf%2Fimage.png?alt=media&#x26;token=bc7d09cd-953d-4de3-86af-a2e794c3d11a" alt=""><figcaption><p>we can try another right there</p></figcaption></figure>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FAlKc6dmF9PrCTrlLLt31%2Fimage.png?alt=media&#x26;token=0a361c09-1d43-47b6-9fb3-5030aba0c735" alt=""><figcaption><p>take a look on the option of this tool </p></figcaption></figure>

Let save the file first then use this tool for analyze shellcode&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FuVzqWepypwtxOizBJpRs%2Fimage.png?alt=media&#x26;token=41b7aeaa-8211-4a43-a208-836ba7c073e5" alt=""><figcaption></figcaption></figure>

Let try use basic first :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F4PLTlp9fYNgLnYN3eLOy%2Fimage.png?alt=media&#x26;token=a41f1697-6554-46d2-90e1-04ba2e2eb136" alt=""><figcaption><p>I got the port number too</p></figcaption></figure>

For the path value we can use /s or up this file to virustotal is another way ( virustotal also provides the port number of the connect server and the IP too)&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F0NkU4eRGC1GsTZFnpAHM%2Fimage.png?alt=media&#x26;token=e226075c-47c1-4e8e-82e7-d2c729c1abd2" alt=""><figcaption><p>Also we can see the first 2 API right there ( LoadLibraryA and InternetOpenA)</p></figcaption></figure>

Note : we can try upload file on virustotal outside of the machine&#x20;
