VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: |
Ransomware
Wiper
|
Threat Names: |
Trojan.GenericKD.36171502
Gen:Variant.MSILHeracles.10464
Mal/Generic-S
|
WindowsFormsApp1.exe
Windows Exe (x86-32)
Created at 2021-02-05T02:39:00
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\FD1HVy\Desktop\WindowsFormsApp1.exe | Sample File | Binary |
Malicious
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
Names | Mal/Generic-S |
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x418ae6 |
Size Of Code | 0x16c00 |
Size Of Initialized Data | 0x8000 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2105-11-02 10:58:35+00:00 |
Version Information (11)
»
Assembly Version | 1.0.0.0 |
Comments | - |
CompanyName | - |
FileDescription | WindowsFormsApp1 |
FileVersion | 1.0.0.0 |
InternalName | WindowsFormsApp1.exe |
LegalCopyright | Copyright © 2020 |
LegalTrademarks | - |
OriginalFilename | WindowsFormsApp1.exe |
ProductName | WindowsFormsApp1 |
ProductVersion | 1.0.0.0 |
Sections (3)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x402000 | 0x16aec | 0x16c00 | 0x200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.74 |
.rsrc | 0x41a000 | 0x7c58 | 0x7e00 | 0x16e00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.05 |
.reloc | 0x422000 | 0xc | 0x200 | 0x1ec00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.1 |
Imports (1)
»
mscoree.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
_CorExeMain | 0x0 | 0x402000 | 0x18aba | 0x16cba | 0x0 |
Memory Dumps (5)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
windowsformsapp1.exe | 1 | 0x00450000 | 0x00473FFF | Relevant Image |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x04B83000 | 0x04B84FFF | First Execution |
![]() |
32-bit | 0x04B83ABE |
![]() |
![]() |
...
|
buffer | 1 | 0x00A32000 | 0x00A32FFF | First Execution |
![]() |
32-bit | 0x00A32110 |
![]() |
![]() |
...
|
buffer | 1 | 0x00A32000 | 0x00A32FFF | Content Changed |
![]() |
32-bit | 0x00A3270A |
![]() |
![]() |
...
|
windowsformsapp1.exe | 1 | 0x00450000 | 0x00473FFF | Final Dump |
![]() |
32-bit | - |
![]() |
![]() |
...
|
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Trojan.GenericKD.36171502 |
Malicious
|
C:\Users\FD1HVy\Desktop\0l0j5qsF7nQzLnBN3lmf.swf.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\0LJl9cqM.m4a.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\0tx_B3ZtTjj9.mkv.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\4mRn85VhgY.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\81ehNBmd9Z.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\98v1-HRDDxHlpd.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\9NHojs4KGpHZ2tK_mr.wav.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\B2wxCWV NeK.jpg.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\bexMIcYLR.mp4.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\deJdal_h-Ghz1S-rp.wav.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\desktop.ini.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\GR3hVa_lqJKuzZUW.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\H5QT5PzwoFrPt.mkv.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\hnsTMu6MY8bIRoaE.odp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\iwt0UXy_6j83u_hYrR4k.mkv.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\mvD4wSfuIQXQzOdec.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\ovj WB7PmlGqC6pw.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\pc9Z7XSZsXrvfp8OiIsA.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\QZTvCz0FFAxSe0OXTZ.m4a.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\Sb23DHgVHWLDZ3K.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\sJF6kRBQM.mkv.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\sRzwd0uphFzOuRb.pps.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\SzAqbDkPqXeoz.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\T cE.m4a.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\tXLvK5sswGB-Igr7XE.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\09z5.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\7ClJZ0nxJQii.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\WindowsFormsApp1.exe.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\D GyVgEwhaiN3vw7bFZ.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\desktop.ini.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\gOdut.png.locked | Dropped File | Binary |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\JLcZQgq5.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\JYS2lay-.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\NPX2Axr.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\nrF1xa7I2tAH0TN6.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\UZgVJPD-cJpA_4Gf.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\VP-Vv.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\Camera Roll\desktop.ini.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\-I-vQylmw8Ifl.jpg.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\36sUlNDBK_1qZR_kbQ5A.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CGIsPmhqq7 0v6w1Q.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\Inux dk8bmT4or7wBr.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\ivuRLbIQ1akqO6uxG5ko.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\jvvEVXOvwgvX.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\l5IYWWMz.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\QkOqp.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\S1WHxrs Dm-PA7m.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\XVnVVs4dA7ikVtE9V.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\6-RjFIuJLJh.jpg.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\7d3Y6juDmbs.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\8xxtQxGDlp.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\c-yT.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\CHYDLYWbYsGpbVD.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\Gg8 5lLeHHAOjbU.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\ghQmrENna-.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\lZ7uxeal.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\nJmd8TPS_Nws_Rync.jpg.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\Yw9swM0ZUxGA.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\DNqI0M\9-TnJ3.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\DNqI0M\b4fE6EgCqzdwvP95kfh.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\DNqI0M\DiCiaX TFUu0.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\DNqI0M\JPtlkPPe.jpg.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\DNqI0M\lwLNZ9L2.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\DNqI0M\mzLNeGD.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\DNqI0M\SK 6diP9tzBJ.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\DNqI0M\ulIX3r3287MRKv L.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\DNqI0M\vVA42vUIN.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\dHwEefAsn7xqd-\CZUf tqlcPkMdYYqO\DNqI0M\zWNJgu_E3ZG6MTJSo.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\Saved Pictures\desktop.ini.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\-Uhoch.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\0tHoUSG2-9zGg R.doc.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\4M4RPyy.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\8aclWgLFdg-E.csv.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\BfYdEnt0aL.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\cucyL.odt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\CUFv0Ude.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\Database1.accdb.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\desktop.ini.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\dVddonu6g4Q69vQTOhi.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\e-cJYfWW7d.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\EfPzrjGucHVIG4aB.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\evxrwLajfekQ0MYh.odt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\Fw_.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\HN-eE.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\JAZPWfinV.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\mbqXSaY.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\mfGUeqia2d4NY4DZsqxe.pps.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\MGm2RtZaI.xls.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\oIHTAL.ots.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\P0yAA1UNt_AeGs.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\R0o03ux1o.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\rbf3wxxAvTJg.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\RfOZfwQP oYTWlHa.ods.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\RPBREJYDP8jN2.odt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\v cbuLol-Xgmqz_W.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\WsbU.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\ykBv0s0N.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\z8KGKougj.ots.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\A 45siGRhQlvz.ods.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\bc u.ods.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\SmK-kDE.ppt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\Zte8Ja2AKP6.odt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\kDDaxo_0hno2qBX\0U5e tG.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\kDDaxo_0hno2qBX\bf9p6M8RugI8hKdTEw.pdf.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\kDDaxo_0hno2qBX\VHH9Bs.xlsx.locked | Dropped File | Audio |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\kDDaxo_0hno2qBX\YgdL3w.ods.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\WuX HUM1UOjiQM9JKAEh\cz0QFFzHRCCKAk2U.odt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\WuX HUM1UOjiQM9JKAEh\Dl-0VcvE7AT.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\WuX HUM1UOjiQM9JKAEh\fGJKcy.ods.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\WuX HUM1UOjiQM9JKAEh\hPhD1K2F55.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\WuX HUM1UOjiQM9JKAEh\MVenpLguM.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\WuX HUM1UOjiQM9JKAEh\cokdrv3_kpPUpbGAy\06HHYZgt.ots.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\WuX HUM1UOjiQM9JKAEh\cokdrv3_kpPUpbGAy\54gj 45mKt9Rr.pdf.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\WuX HUM1UOjiQM9JKAEh\cokdrv3_kpPUpbGAy\bERt.odt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\0WXsxR-HBmfStF5Lqwpj\WuX HUM1UOjiQM9JKAEh\cokdrv3_kpPUpbGAy\CrTDbEHpWYL6F.ppt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\gwXegIJB\bVsbwxsIENwUzs.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Documents\edP6exS5\gwXegIJB\eI4gjwE2bdUzK.xls.locked | Dropped File | Stream |
Unknown
|
...
|
»