VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: |
Ransomware
|
Threat Names: |
Gen:Heur.Ransom.HiddenTears.1
|
Salary.exe
Windows Exe (x86-32)
Created at 2020-09-01T07:43:00
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x41d48a |
Size Of Code | 0x1b600 |
Size Of Initialized Data | 0x19c00 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2020-08-15 10:44:59+00:00 |
Version Information (11)
»
Assembly Version | 1.0.0.0 |
Comments | - |
CompanyName | - |
FileDescription | hidden-tear |
FileVersion | 1.0.0.0 |
InternalName | hidden-tear.exe |
LegalCopyright | Copyright © 2015 |
LegalTrademarks | - |
OriginalFilename | hidden-tear.exe |
ProductName | hidden-tear |
ProductVersion | 1.0.0.0 |
Sections (3)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x402000 | 0x1b498 | 0x1b600 | 0x200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 4.65 |
.rsrc | 0x41e000 | 0x198d4 | 0x19a00 | 0x1b800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.46 |
.reloc | 0x438000 | 0xc | 0x200 | 0x35200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.1 |
Imports (1)
»
mscoree.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
_CorExeMain | 0x0 | 0x402000 | 0x1d460 | 0x1b660 | 0x0 |
Memory Dumps (6)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
salary.exe | 1 | 0x00B20000 | 0x00B59FFF | Relevant Image |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x01411000 | 0x01411FFF | First Execution |
![]() |
32-bit | 0x014110C8 |
![]() |
![]() |
...
|
buffer | 1 | 0x01411000 | 0x01411FFF | Content Changed |
![]() |
32-bit | 0x01411EB7 |
![]() |
![]() |
...
|
buffer | 1 | 0x01412000 | 0x01412FFF | First Execution |
![]() |
32-bit | 0x01412000 |
![]() |
![]() |
...
|
buffer | 1 | 0x01412000 | 0x01412FFF | Content Changed |
![]() |
32-bit | 0x0141242C |
![]() |
![]() |
...
|
buffer | 1 | 0x01411000 | 0x01411FFF | Content Changed |
![]() |
32-bit | 0x01411067 |
![]() |
![]() |
...
|
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Gen:Heur.Ransom.HiddenTears.1 |
Malicious
|
C:\Users\FD1HVy\Desktop\-hNL3OcngCIZAr219.avi | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\3WQMoZqxtfxvMQK.mp4 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\6iCPTll49y.avi | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\DPDskqIc2.mkv.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\eA-CcPkssw4kHgXe.bmp | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\eAGGa29zIdAHHTYD9.xlsx | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\E_cmfpG.mp3 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\geNLXx1UJHj5cvhn.mp4.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\IKlpA0NfijVXH.png | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\IUfRKqu81Ri.mp3.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\kDNWA.avi.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\kpKG IbF.mp3.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\n67Tv9.mp3.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\nEUOkP9.mp4 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\NmC1S11.png | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\NsB5NpMvHsgPQiue-.png | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\NvL60GwqP.ppt | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\tEL KEKy5u2J3QD3I7.bmp | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\ux3rT5FNwZkNBWR.bmp.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\V89ICi2G.pdf.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\vzq8yByGgLRh.mkv.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\w-tMU4AmH_pKak.png.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\XduHjTYUvMSMI6_qg.bmp.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\xkHvjMU.bmp.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\uJvn1eNK\AfgARJ.mp3 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\uJvn1eNK\Apu_3HKNloAeD.pptx | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\uJvn1eNK\F52q7h1ytKx.xls | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\uJvn1eNK\huGql8L_ DP0Oe6yT.bmp.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\uJvn1eNK\iDZ244LOqe122Zu.xls.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Links\Desktop.lnk.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Links\Downloads.lnk | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Links\OneDrive.lnk.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\-A3FjvCXPw1dp0zdl4.docx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\6m-40aatQp3v.xlsx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\Am31E.doc.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\C94Om.pptx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\cfg_3frcDN_.docx | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\HLN9AR-.ppt.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\jf46cCQHTHUr6bLu.pptx | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\LoQPvjHxg.pptx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\m6mWzL3kkF98Qys.xlsx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\MFkMq.xlsx | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\N_qeU.xlsx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\PWEo-4fye6Te.xlsx | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\rCp7bOOMZeyG1.pptx | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\sC _ 6S20Gfa3.docx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\tBecqP4TCoDMzd0nx.xlsx | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\vgOo3uvsomC 6v.docx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\W3hC.ppt.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\wjIta66KnkjINWkE2.pptx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\WKavgS-3C.pptx | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\z_jXH-7D9cZO.docx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\9WWI\3XiE.ppt.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\9WWI\5zo2z0GfAzDF6m.xlsx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\9WWI\6I8aiqdPKPoPUC.docx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\9WWI\fIOJ129jLEtR.rtf.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\9WWI\NP0C3ihvqG5p44O8.rtf | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\9WWI\VQUy.ppt | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\fyf3ROce0MqAXxsy\5CRpSexs288Od0cP5SHE.pdf.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\fyf3ROce0MqAXxsy\LxdHMV.pdf.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\fyf3ROce0MqAXxsy\M6HZIFQIm4S0tKzaytnN.doc.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\fyf3ROce0MqAXxsy\op_rvj.xls.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\fyf3ROce0MqAXxsy\RjZQCFqkbwx5z rYrXh.xls.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\fyf3ROce0MqAXxsy\vuxUSCOR3Z p3QB2vQ.odt.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\fyf3ROce0MqAXxsy\yquKKuMk_s.rtf.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\fyf3ROce0MqAXxsy\aFyYZcH\3GVdelo.xlsx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\fyf3ROce0MqAXxsy\aFyYZcH\PuNS.xls.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\fyf3ROce0MqAXxsy\aFyYZcH\yFIH e.xlsx.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\gtt6jcr9z38XE35b3n\A-MSuTAXuIfkK9JATMN.ppt.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\gtt6jcr9z38XE35b3n\GkpC1ABWiI.odt.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\gtt6jcr9z38XE35b3n\oH6IT.xlsx | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\gtt6jcr9z38XE35b3n\rncd2pZINg5w.doc | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\gtt6jcr9z38XE35b3n\scrVqEg59wDdW.xls | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\gtt6jcr9z38XE35b3n\U2cLoBYj5C0tADEd.ppt | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\gtt6jcr9z38XE35b3n\_ooMGcKju2rrUaD0DU.odt | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\6Nn11Y0e.bmp.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\7V4AVib8x4wyo.png | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L72Z5-ELuJcj.bmp | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\m7BL5a.jpg | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\MjhsPG2iTtDmzmYBCz.bmp.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\phmTCJUAc7iJYkpmC2.png | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\uG4TT2SFNmM7Jrnq Vw.png | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\v766XG5EArmit.bmp | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\xkVuTsOTDp.png | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\xUW3FKRmScAl_pqs.bmp.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\Jxc7y0\D6OUDRvTgb.bmp.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\Jxc7y0\i8b9f.png.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\Jxc7y0\pCa06Rdzr0.png.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\Jxc7y0\qjcs8zuSx.jpg | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\Jxc7y0\RjNASMUryXOapBb74Vr.png | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\Jxc7y0\s8O40VOQJ_Qf-hBfIY.png | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\Jxc7y0\V92B-iZNhN.png | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\-H eaU6f.mp3 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\pDdn3on3G_2s9DFz3.mp3.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\F3HJ\VVXwFsguq.mp3.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\F3HJ\GhMaO25CyRMLjzks-X3f\ij9xGWa__Lkq.mp3.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\F3HJ\GhMaO25CyRMLjzks-X3f\MBulO\DaLT4B6kRiRbr9iiH.mp3 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\LePxLflso 1buBvQm K\09rreVyx.mp3 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\LePxLflso 1buBvQm K\8RpqCPMx1ojPwm.mp3.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\LePxLflso 1buBvQm K\xT6CFKfiZA1Ue_bNKO5\j-cqq.mp3.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\LePxLflso 1buBvQm K\xT6CFKfiZA1Ue_bNKO5\phK3Wky39cda3ZUE0.mp3.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\LePxLflso 1buBvQm K\xT6CFKfiZA1Ue_bNKO5\XffLqyVGZsxclhsBc5.mp3 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\T_Q-w.avi | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\k32VUR\0KNIuMeFfMCBO.mkv | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\k32VUR\7QwzXjh.avi.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\1HZNBATI9d37t3BgpT.mp4 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\D2RtRM6UaLLjbcK3xC.mp4.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\F LdJDjH.mkv.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\RarvuTpM3bbHYvDgB.avi | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\OfsPu 8NUy7mO1n\Dpl0o9E rhhHO0DOYALh.mp4 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\OfsPu 8NUy7mO1n\pUouyTxP.avi | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\OfsPu 8NUy7mO1n\S725Tj.avi.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Uha8\IZvs706XiyQFlrc\dT4ipHywERntWmavAQ.mp4 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Uha8\IZvs706XiyQFlrc\NaTuTXk.mkv | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Uha8\IZvs706XiyQFlrc\Ov0f0zVd74vnx.avi.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Uha8\IZvs706XiyQFlrc\UXGhp.mkv.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Uha8\IZvs706XiyQFlrc\YsOWzCeNczRQJHzFLMi1.mkv | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Yio0J\duekHlmObDZYAeVuvJ.mkv | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Yio0J\ltvs sc0QMv.avi.UGMH | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Yio0J\pd0PEn Mcf7JTIRM0t\9DmrWOL.mkv | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Yio0J\pd0PEn Mcf7JTIRM0t\i88R.mp4 | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Yio0J\pd0PEn Mcf7JTIRM0t\P21UaK4uFmS2exm.mkv | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\LrqG45 pQjyr9v\Yio0J\pd0PEn Mcf7JTIRM0t\uta0.mp4 | Modified File | Stream |
Unknown
|
...
|
»