1.exe
Windows Exe (x86-32)
Created at 2019-07-08T08:36:00
Remarks (1/1)
(0x200000e): The overall sleep time of all monitored processes was truncated from "10 minutes" to "10 seconds" to reveal dormant functionality.
VMRay Threat Indicators (6 rules, 6 matches)
| Severity | Category | Operation | Count | Classification | |
|---|---|---|---|---|---|
|
4/5
|
File System | Renames user files | 1 | Ransomware | |
|
|||||
|
2/5
|
Anti Analysis | Delays execution | 1 | - | |
|
|||||
|
2/5
|
Network | Sets up server that accepts incoming connections | 1 | Backdoor | |
|
|||||
|
1/5
|
Process | Creates system object | 1 | - | |
|
|||||
|
1/5
|
File System | Creates an unusually large number of files | 1 | - | |
|
|||||
|
1/5
|
Static | Unparsable sections in file | 1 | - | |
|
|||||
Screenshots
Monitored Processes
Sample Information
| ID | #102008 |
| MD5 |
92e2dbc6f65417ffb5119d848726f8d3
|
| SHA1 |
5602e640d2d5462cb7b018cacb0e76b727193dbd
|
| SHA256 |
667bf4d26482bbf661465f884bc9a72bb6bc5b0c32e11f89e57c499000648852
|
| SSDeep |
384:NnPoN10YAo6ygLPgv5ddVfsyK2eQ31LChPfid0aYoBTLZvP96ucAtDv:NnPoN10Y1kLPgJVfpoaRTLTVv
|
| ImpHash |
f34d5f2d4577ed6d9ceec516c1f5a744
|
| Filename | 1.exe |
| File Size | 282.50 KB |
| Sample Type | Windows Exe (x86-32) |
Analysis Information
| Creation Time | 2019-07-08 10:36 (UTC+2) |
| Analysis Duration | 00:04:41 |
| Number of Monitored Processes | 1 |
| Execution Successful |
|
| Reputation Enabled |
|
| WHOIS Enabled |
|
| Local AV Enabled |
|
| YARA Enabled |
|
| Number of AV Matches | 0 |
| Number of YARA Matches | 0 |
| Termination Reason | Timeout |
| Tags |
