Try VMRay Platform
Malicious
Classifications

Spyware Injector

Threat Names

XWorm

Dynamic Analysis Report

Created on 2024-11-04T18:50:46+00:00

cry.exe

Windows Exe (x86-32)
...

Remarks (2/2)

(0x02000008): One or more processes crashed during the analysis. Analysis results may be incomplete.

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Filters:
File Name Category Type Verdict Actions
C:\Users\OqXZRaykm\AppData\Roaming\ReturnType.exe Sample File Binary
Malicious
...
»
Also Known As C:\Users\OqXZRaykm\Desktop\cry.exe (VM File, Sample File, Accessed File)
c:\users\oqxzraykm\appdata\roaming\returntype.exe (Accessed File)
c:\users\oqxzraykm\desktop\cry.exe (Accessed File)
MIME Type application/vnd.microsoft.portable-executable
File Size 1.25 MB
MD5 a4c1ea4b6e69e69462efa7659ff6f48c Copy to Clipboard
SHA1 cf71024bf28f10f63bf7cd27dba64d406c2ed97c Copy to Clipboard
SHA256 1abb33b881408b0341a530de14b0afdb88b96ffcd0254dd397848db3e6508803 Copy to Clipboard
SSDeep 24576:/84F/cDq4sTq+gdI2W+7nMS9LJf4bcwGCYVgERFh7IfEx0ECnaf:kEcyjgmkMS9L2cFCER0f+0ECna Copy to Clipboard
ImpHash f34d5f2d4577ed6d9ceec516c1f5a744 Copy to Clipboard
PE Information
»
Image Base 0x00400000
Entry Point 0x0054304E
Size Of Code 0x00141200
Size Of Initialized Data 0x00000800
File Type IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type IMAGE_FILE_MACHINE_I386
Compile Timestamp 2024-11-04 15:37 (UTC+1)
Version Information (11)
»
Comments -
CompanyName -
FileDescription DL
FileVersion 1.0.0.0
InternalName DL.exe
LegalCopyright Copyright © 2016
LegalTrademarks -
OriginalFilename DL.exe
ProductName DL
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0
Sections (3)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x00402000 0x00141054 0x00141200 0x00000200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 7.62
.rsrc 0x00544000 0x00000578 0x00000600 0x00141400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.0
.reloc 0x00546000 0x0000000C 0x00000200 0x00141A00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 0.1
Imports (1)
»
mscoree.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_CorExeMain - 0x00402000 0x00143028 0x00141228 0x00000000
Memory Dumps (11)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
cry.exe 1 0x00010000 0x00157FFF Relevant Image False 32-bit - False
...
buffer 1 0x04AB0000 0x04B91FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
buffer 1 0x04BF0000 0x04BF0FFF First Execution False 32-bit 0x04BF0000 False
...
clrjit.dll 1 0x6DF30000 0x6DFB8FFF First Execution False 32-bit 0x6DF77AB3 False
...
buffer 1 0x04DF0000 0x04E45FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
buffer 1 0x04F70000 0x04FB5FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
buffer 1 0x0276BA94 0x0276BA9A First Execution False 32-bit 0x0276BA94 False
...
amsi.dll 1 0x6CCA0000 0x6CCAFFFF First Execution False 32-bit 0x6CCA48F0 False
...
buffer 1 0x00610000 0x0065EFFF Reflectively Loaded .NET Assembly False 32-bit - False
...
cry.exe 1 0x00010000 0x00157FFF Final Dump False 32-bit - False
...
cry.exe 1 0x00010000 0x00157FFF Process Termination False 32-bit - False
...
C:\Users\OqXZRaykm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ReturnType.vbs Dropped File Text
Clean
...
»
MIME Type text/plain
File Size 89 Bytes
MD5 415af1a46ecad7605e9baeeb18c8e7b9 Copy to Clipboard
SHA1 ce470ca058e4bf7af16678a6189406f0d8ca72c1 Copy to Clipboard
SHA256 8826ad3144a42bbc2811755373739b19eb73ed8b748d6a6782fa4d2fbbbfff76 Copy to Clipboard
SSDeep 3:FER/n0eFHHov9/3Ec+wREaKC5w2XjJHn:FER/lFHIl/1+wiaZ5weJ Copy to Clipboard
ImpHash -
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    

     Exit-Icon
    

    

     

      WHOIS Domain Information
     

     

      

       
        Domain Name
       
       
       
      

      

       
        WHOIS Response
       
       
        

       		
      

     

    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image