Try VMRay Platform
Malicious
Classifications

Ransomware Virus

Threat Names

CryptoLocker PetiteVirus Mal/HTMLGen-A

Dynamic Analysis Report

Created on 2025-04-03T00:45:44+00:00

G5NW8TTWbyYGaxWc.exe

Windows Exe (x86-32)
...
Filters:
File Name Category Type Verdict Actions
C:\Users\RDhJ0CNFevzX\Desktop\G5NW8TTWbyYGaxWc.exe Sample File Binary
Malicious
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 44.39 KB
MD5 5b4ecbb1566d2546e02780b3ea51539e Copy to Clipboard
SHA1 0b53e3ac91230bca2fd6479a87d0b30fd6ba2881 Copy to Clipboard
SHA256 4550696e6e67e66e34d2785a7b81dc728dd59d87b86a3dc77d311ba3858280d5 Copy to Clipboard
SSDeep 768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1wsr:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ11 Copy to Clipboard
ImpHash 9470ea6ce8a031743fbf1e256278f573 Copy to Clipboard
Static Analysis Parser Error malformed string file info
File Reputation Information
»
Verdict
Malicious
PE Information
»
Image Base 0x00500000
Entry Point 0x005037A0
Size Of Code 0x00002A00
Size Of Initialized Data 0x00002D4E
File Type IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type IMAGE_FILE_MACHINE_I386
Compile Timestamp 2013-10-02 14:54 (UTC+2)
Sections (4)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
0x00501000 0x00005000 0x00002A00 0x00000400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 7.79
.rsrc 0x00506000 0x00003000 0x00002C00 0x00002E00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.98
.reloc 0x00509000 0x00001000 0x00000000 0x00000000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 0.0
petite 0x0050A000 0x0000014E 0x0000014E 0x00005A00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.82
Imports (3)
»
user32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
MessageBoxA - 0x0050A0F8 0x0000A0F8 0x00005AF8 0x00000000
wsprintfA - 0x0050A0FC 0x0000A0FC 0x00005AFC 0x00000000
kernel32.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ExitProcess - 0x0050A104 0x0000A104 0x00005B04 0x00000000
GetModuleHandleA - 0x0050A108 0x0000A108 0x00005B08 0x00000000
GetProcAddress - 0x0050A10C 0x0000A10C 0x00005B0C 0x00000000
VirtualProtect - 0x0050A110 0x0000A110 0x00005B10 0x00000000
VirtualAlloc - 0x0050A114 0x0000A114 0x00005B14 0x00000000
VirtualFree - 0x0050A118 0x0000A118 0x00005B18 0x00000000
LoadLibraryA - 0x0050A11C 0x0000A11C 0x00005B1C 0x00000000
gdi32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CreateFontIndirectA - 0x0050A124 0x0000A124 0x00005B24 0x00000000
Memory Dumps (12)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
g5nw8ttwbyygaxwc.exe 1 0x00500000 0x0050AFFF Relevant Image False 32-bit - True
...
buffer 1 0x001E0000 0x001E2FFF First Execution False 32-bit 0x001E0000 False
...
g5nw8ttwbyygaxwc.exe 1 0x00500000 0x0050AFFF Content Changed False 32-bit 0x00501000 True
...
buffer 1 0x001E0000 0x001E2FFF Content Changed False 32-bit - True
...
buffer 1 0x00610000 0x00615FFF First Execution False 32-bit 0x00610009 False
...
buffer 1 0x00640000 0x00645FFF Marked Executable False 32-bit - False
...
buffer 1 0x00640000 0x00645FFF Marked Executable False 32-bit - False
...
buffer 1 0x00640000 0x00645FFF Marked Executable False 32-bit - False
...
buffer 1 0x00640000 0x00645FFF Marked Executable False 32-bit - False
...
buffer 1 0x00640000 0x00645FFF First Execution False 32-bit 0x00641020 False
...
buffer 1 0x02080048 0x0208B243 Image In Buffer False 32-bit - True
...
g5nw8ttwbyygaxwc.exe 1 0x00500000 0x0050AFFF Process Termination False 32-bit - True
...
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
CryptoLocker_rule2 CryptoLocker ransomware Ransomware
5/5
...
C:\Users\RDHJ0C~1\AppData\Local\Temp\misid.exe Dropped File Binary
Malicious
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 44.49 KB
MD5 5d1c137fad1581de3e56137e80dbd32d Copy to Clipboard
SHA1 d2d853b94ec64dc065dfa4d89c7d0b027f538527 Copy to Clipboard
SHA256 1ba676f734bc0c00ba88e8641f47faba717cba41f836b314ef68007f2e8fe7b7 Copy to Clipboard
SSDeep 768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1wsc:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ1+ Copy to Clipboard
ImpHash 9470ea6ce8a031743fbf1e256278f573 Copy to Clipboard
Static Analysis Parser Error malformed string file info
PE Information
»
Image Base 0x00500000
Entry Point 0x005037A0
Size Of Code 0x00002A00
Size Of Initialized Data 0x00002D4E
File Type IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type IMAGE_FILE_MACHINE_I386
Compile Timestamp 2013-10-02 14:54 (UTC+2)
Sections (4)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
0x00501000 0x00005000 0x00002A00 0x00000400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 7.79
.rsrc 0x00506000 0x00003000 0x00002C00 0x00002E00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.98
.reloc 0x00509000 0x00001000 0x00000000 0x00000000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 0.0
petite 0x0050A000 0x0000014E 0x0000014E 0x00005A00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.82
Imports (3)
»
user32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
MessageBoxA - 0x0050A0F8 0x0000A0F8 0x00005AF8 0x00000000
wsprintfA - 0x0050A0FC 0x0000A0FC 0x00005AFC 0x00000000
kernel32.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ExitProcess - 0x0050A104 0x0000A104 0x00005B04 0x00000000
GetModuleHandleA - 0x0050A108 0x0000A108 0x00005B08 0x00000000
GetProcAddress - 0x0050A10C 0x0000A10C 0x00005B0C 0x00000000
VirtualProtect - 0x0050A110 0x0000A110 0x00005B10 0x00000000
VirtualAlloc - 0x0050A114 0x0000A114 0x00005B14 0x00000000
VirtualFree - 0x0050A118 0x0000A118 0x00005B18 0x00000000
LoadLibraryA - 0x0050A11C 0x0000A11C 0x00005B1C 0x00000000
gdi32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CreateFontIndirectA - 0x0050A124 0x0000A124 0x00005B24 0x00000000
Memory Dumps (18)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
misid.exe 2 0x00500000 0x0050AFFF Relevant Image False 32-bit - True
...
buffer 2 0x001E0000 0x001E2FFF First Execution False 32-bit 0x001E0000 False
...
misid.exe 2 0x00500000 0x0050AFFF Content Changed False 32-bit 0x00501000 True
...
buffer 2 0x001E0000 0x001E2FFF Content Changed False 32-bit - True
...
buffer 2 0x00510000 0x00515FFF First Execution False 32-bit 0x00510009 False
...
buffer 2 0x00630000 0x00635FFF Marked Executable False 32-bit - False
...
buffer 2 0x00630000 0x00635FFF Marked Executable False 32-bit - False
...
buffer 2 0x00630000 0x00635FFF Marked Executable False 32-bit - False
...
buffer 2 0x00630000 0x00635FFF Marked Executable False 32-bit - False
...
buffer 2 0x00630000 0x00635FFF First Execution False 32-bit 0x00631020 False
...
buffer 2 0x0019A000 0x0019FFFF First Network Behavior False 32-bit - False
...
buffer 2 0x001F0000 0x001F5FFF First Network Behavior False 32-bit - False
...
buffer 2 0x00510000 0x00515FFF First Network Behavior False 32-bit - False
...
buffer 2 0x00630000 0x00635FFF First Network Behavior False 32-bit - False
...
buffer 2 0x02000000 0x0212FFFF First Network Behavior False 32-bit - True
...
misid.exe 2 0x00500000 0x0050AFFF First Network Behavior False 32-bit - True
...
counters.dat 2 0x00640000 0x00640FFF First Network Behavior False 32-bit - False
...
misid.exe 2 0x00500000 0x0050AFFF Process Termination False 32-bit - True
...
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
CryptoLocker_rule2 CryptoLocker ransomware Ransomware
5/5
...
c:\users\rdhj0cnfevzx\appdata\local\temp\misids.exe Downloaded File HTML
Clean
Known to be clean.
...
»
Also Known As misids.exe (Downloaded File, Accessed File)
MIME Type text/html
File Size 315 Bytes
MD5 a34ac19f4afae63adc5d2f7bc970c07f Copy to Clipboard
SHA1 a82190fc530c265aa40a045c21770d967f4767b8 Copy to Clipboard
SHA256 d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Copy to Clipboard
SSDeep 6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR Copy to Clipboard
ImpHash -
File Reputation Information
»
Verdict
Clean
Known to be clean.
c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\counters.dat Modified File Stream
Clean
...
»
MIME Type application/octet-stream
File Size 128 Bytes
MD5 cc90851958032b8c8bbb7b24ec6271dd Copy to Clipboard
SHA1 e027ad2ea4049374a3b01af2e3626b667dc816bc Copy to Clipboard
SHA256 c2d814a34b184b7cdf10e4e7a4311ff15db99326d6dd8d328b53bf9e19ccf858 Copy to Clipboard
SSDeep 3:Fl: Copy to Clipboard
ImpHash -
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    

     Exit-Icon
    

    

     

      WHOIS Domain Information
     

     

      

       
        Domain Name
       
       
       
      

      

       
        WHOIS Response
       
       
        

       		
      

     

    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image