VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: |
Ransomware
Wiper
|
Threat Names: |
Generic.Ransom.Hiddentear.A.ACC650CF
Generic.Cert.Downloader.1.A6DD1C15
|
FMQfOR9qzmUMMeEO.exe
Windows Exe (x86-32)
Created at 2020-11-13T11:16:00
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\FD1HVy\Desktop\FMQfOR9qzmUMMeEO.exe | Sample File | Binary |
Malicious
|
...
|
»
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x403f0e |
Size Of Code | 0x2000 |
Size Of Initialized Data | 0x36400 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2020-11-13 08:57:45+00:00 |
Version Information (7)
»
Assembly Version | 0.0.0.0 |
FileDescription | |
FileVersion | 0.0.0.0 |
InternalName | ransomware.exe |
LegalCopyright | |
OriginalFilename | ransomware.exe |
ProductVersion | 0.0.0.0 |
Sections (3)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x402000 | 0x1f14 | 0x2000 | 0x200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.09 |
.rsrc | 0x404000 | 0x361b8 | 0x36200 | 0x2200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.4 |
.reloc | 0x43c000 | 0xc | 0x200 | 0x38400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.08 |
Imports (1)
»
mscoree.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
_CorExeMain | 0x0 | 0x402000 | 0x3ee4 | 0x20e4 | 0x0 |
Memory Dumps (1)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
fmqfor9qzmummeeo.exe | 1 | 0x00390000 | 0x003CDFFF | Relevant Image |
![]() |
64-bit | - |
![]() |
![]() |
...
|
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Generic.Ransom.Hiddentear.A.ACC650CF |
Malicious
|
c:\users\fd1hvy\appdata\local\microsoft\windows\inetcache\counters2.dat | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\5q0zODZ-LfMVxb3ilnOK.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\7zeOs_9hXhC.xlsx.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\A02Z nq-WGU.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\bNR9FioQRzT.bmp.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\BS9yaJ_C6P.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\DrYVi8B0NgFJ6uMAsmK.xlsx.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\e5QSGhL0KO.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\GNqhTWL5zVRSDdWd4-.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\IHXCeH4- 6qh6Uvan.docx.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\iyDlR.docx.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\KJkjIAjuQSKeZ-kZiP.avi.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\Q5qz.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\wRQQ37a2M.avi.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\xnjlX4qTThmIA.png.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\YAWe8TJU.doc.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\_i-6kqrNHCc1Gp.xls.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\TE_1NVah4\BwJ0o.pdf.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\TE_1NVah4\eY7Vy fW9.avi.ZqVIkE | Dropped File | Binary |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\TE_1NVah4\FkeLyGSgPK Fr.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\TE_1NVah4\gSZ285dW.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\TE_1NVah4\k7jXCNM8fl.docx.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\TE_1NVah4\lHl2bH6.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\TE_1NVah4\R3p y ootSEDXa.csv.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\TE_1NVah4\RjRSPeb9rmoZaa.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\d t31.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\dC 8L.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\DCRB V6-a54Gsv1Rv.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\metiWtCzWYSrh.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\TM6eV_jyRFbhOXTEd.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\FjIzw\7ycGseY0T7Nxcp67gz.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\FjIzw\hVdWL77-1kjmLt7caqTC.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\FjIzw\lqqu.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Music\FjIzw\WNqzGcGlDEEkkyCzX4.wav.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\QLE-SQXqAh\z1rs5R.avi.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\QLE-SQXqAh\NyhrpyDgQUdwKFr\EDYsB.avi.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\QLE-SQXqAh\NyhrpyDgQUdwKFr\iOd5if\gP6n0mM3n9QEg9X4.avi.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\QLE-SQXqAh\NyhrpyDgQUdwKFr\iOd5if\I0hlXAGLV4.avi.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Videos\QLE-SQXqAh\NyhrpyDgQUdwKFr\iOd5if\w-fGTFHpR69LMhw.avi.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\2nSufFm2nHe0H6.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\eW-adj0sosb SJ3L.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\tWw8S4.png.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\HA6vcr0InhEz.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\n6mK4.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\sOewv7.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\0XkSo\AUW9hr-.bmp.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\0XkSo\JQPxJptzNG_pAT.bmp.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\0XkSo\KC6AiHlo5RnPEM0G.bmp.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\0XkSo\vILyNMY_x.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\0XkSo\zwNRi4_ioiLgHw.bmp.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\0XkSo\CDLFcGE\sBIB.bmp.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\0XkSo\CDLFcGE\4j1k1xF\mYvM8iMUSbzh.png.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\0XkSo\kQzXlpTZkm577\32Jaog_erQwMsdNVPp.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\0XkSo\kQzXlpTZkm577\HxGD.png.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\0XkSo\kQzXlpTZkm577\Z9ciBpYwf0b_s5J.bmp.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\8mq_\HsGly8uxz9s.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\8mq_\IyFftDJrx8ROGs0AZ.png.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\8mq_\W6FCb4MO2JqQHIFAetG.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\8mq_\f2jVPKj4tPZ\K1QxIRb51Bk JPz9Y7M.png.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\8mq_\f2jVPKj4tPZ\swCSaVC_.gif.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Pictures\L_CU\_xsW54t\kUKoKO.bmp.ZqVIkE | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\@READ_ME@.txt | Dropped File | Text |
Unknown
|
...
|
»
c:\users\fd1hvy\appdata\locallow\microsoft\cryptneturlcache\metadata\9314add2c65b5d757083280afbd70ec0 | Dropped File | Stream |
Unknown
|
...
|
»