Doc Dropper - Gandcrab Analysis

VTI SCORE: 100/100

Target:

Windows 10 (64-bit), MS Office 2016 | ms_office

Classification:

Dropper, Trojan, Downloader, Ransomware

99eb1d90eb5f0d012f35fcc2a7dedd2229312794354843637ebb7f40b74d0809 (SHA256)

sample_file.doc

Word Document

Created at 2018-04-20 18:19:00

Notifications (2/3)

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

The overall sleep time of all monitored processes was truncated from "1 minute, 10 seconds" to "1 minute, 10 seconds" to reveal dormant functionality.

The operating system was rebooted during the analysis because the sample installed a startup script or application for persistence.

YARA Information

Applied On	Sample Files, Created Files, Modified Files, PCAP File, Process Dumps
Number of YARA matches	0

There are no YARA matches for this sample

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Notifications (2/3)

YARA Information

There are no YARA matches for this sample

Before

After