VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: |
Ransomware
|
Threat Names: |
Trojan.GenericKD.33656853
Trojan.Ransom.CDQ
Dropped:Trojan.Ransom.CDQ
...
|
CUsersHARLAN4096Desktop11-04-2020#CS fun - MWTfun.exe
Windows Exe (x86-32)
Created at 2020-04-16T18:45:00
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\FD1HVy\Desktop\CUsersHARLAN4096Desktop11-04-2020#CS fun - MWTfun.exe | Sample File | Binary |
Malicious
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
Names | Mal/Generic-S |
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x401000 |
Size Of Code | 0x10c00 |
Size Of Initialized Data | 0x2f800 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2019-07-30 08:52:50+00:00 |
Packer | PureBasic 4.x -> Neil Hodgson |
Sections (5)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.code | 0x401000 | 0x37f0 | 0x3800 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.61 |
.text | 0x405000 | 0xd2c2 | 0xd400 | 0x3c00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.56 |
.rdata | 0x413000 | 0x339d | 0x3400 | 0x11000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.11 |
.data | 0x417000 | 0x172c | 0x1200 | 0x14400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.0 |
.rsrc | 0x419000 | 0x2b07c | 0x2b200 | 0x15600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.74 |
Imports (9)
»
MSVCRT.dll (16)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
memset | 0x0 | 0x417470 | 0x17244 | 0x14644 | 0x299 |
wcsncmp | 0x0 | 0x417474 | 0x17248 | 0x14648 | 0x2e8 |
memmove | 0x0 | 0x417478 | 0x1724c | 0x1464c | 0x298 |
wcsncpy | 0x0 | 0x41747c | 0x17250 | 0x14650 | 0x2e9 |
wcsstr | 0x0 | 0x417480 | 0x17254 | 0x14654 | 0x2ed |
_wcsnicmp | 0x0 | 0x417484 | 0x17258 | 0x14658 | 0x1ee |
_wcsdup | 0x0 | 0x417488 | 0x1725c | 0x1465c | 0x1e9 |
free | 0x0 | 0x41748c | 0x17260 | 0x14660 | 0x25e |
_wcsicmp | 0x0 | 0x417490 | 0x17264 | 0x14664 | 0x1ea |
wcslen | 0x0 | 0x417494 | 0x17268 | 0x14668 | 0x2e6 |
wcscpy | 0x0 | 0x417498 | 0x1726c | 0x1466c | 0x2e3 |
wcscmp | 0x0 | 0x41749c | 0x17270 | 0x14670 | 0x2e1 |
memcpy | 0x0 | 0x4174a0 | 0x17274 | 0x14674 | 0x297 |
tolower | 0x0 | 0x4174a4 | 0x17278 | 0x14678 | 0x2d3 |
wcscat | 0x0 | 0x4174a8 | 0x1727c | 0x1467c | 0x2df |
malloc | 0x0 | 0x4174ac | 0x17280 | 0x14680 | 0x291 |
KERNEL32.dll (68)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetModuleHandleW | 0x0 | 0x4174b4 | 0x17288 | 0x14688 | 0x1fa |
HeapCreate | 0x0 | 0x4174b8 | 0x1728c | 0x1468c | 0x2a4 |
GetStdHandle | 0x0 | 0x4174bc | 0x17290 | 0x14690 | 0x23e |
HeapDestroy | 0x0 | 0x4174c0 | 0x17294 | 0x14694 | 0x2a5 |
ExitProcess | 0x0 | 0x4174c4 | 0x17298 | 0x14698 | 0x105 |
WriteFile | 0x0 | 0x4174c8 | 0x1729c | 0x1469c | 0x497 |
GetTempFileNameW | 0x0 | 0x4174cc | 0x172a0 | 0x146a0 | 0x25d |
LoadLibraryExW | 0x0 | 0x4174d0 | 0x172a4 | 0x146a4 | 0x2f8 |
EnumResourceTypesW | 0x0 | 0x4174d4 | 0x172a8 | 0x146a8 | 0xf2 |
FreeLibrary | 0x0 | 0x4174d8 | 0x172ac | 0x146ac | 0x14d |
RemoveDirectoryW | 0x0 | 0x4174dc | 0x172b0 | 0x146b0 | 0x386 |
GetExitCodeProcess | 0x0 | 0x4174e0 | 0x172b4 | 0x146b4 | 0x1c6 |
EnumResourceNamesW | 0x0 | 0x4174e4 | 0x172b8 | 0x146b8 | 0xee |
GetCommandLineW | 0x0 | 0x4174e8 | 0x172bc | 0x146bc | 0x171 |
LoadResource | 0x0 | 0x4174ec | 0x172c0 | 0x146c0 | 0x2fb |
SizeofResource | 0x0 | 0x4174f0 | 0x172c4 | 0x146c4 | 0x42a |
FreeResource | 0x0 | 0x4174f4 | 0x172c8 | 0x146c8 | 0x150 |
FindResourceW | 0x0 | 0x4174f8 | 0x172cc | 0x146cc | 0x13a |
GetNativeSystemInfo | 0x0 | 0x4174fc | 0x172d0 | 0x146d0 | 0x207 |
GetShortPathNameW | 0x0 | 0x417500 | 0x172d4 | 0x146d4 | 0x23b |
GetWindowsDirectoryW | 0x0 | 0x417504 | 0x172d8 | 0x146d8 | 0x286 |
GetSystemDirectoryW | 0x0 | 0x417508 | 0x172dc | 0x146dc | 0x24a |
EnterCriticalSection | 0x0 | 0x41750c | 0x172e0 | 0x146e0 | 0xda |
CloseHandle | 0x0 | 0x417510 | 0x172e4 | 0x146e4 | 0x44 |
LeaveCriticalSection | 0x0 | 0x417514 | 0x172e8 | 0x146e8 | 0x2f4 |
InitializeCriticalSection | 0x0 | 0x417518 | 0x172ec | 0x146ec | 0x2b9 |
WaitForSingleObject | 0x0 | 0x41751c | 0x172f0 | 0x146f0 | 0x46e |
TerminateThread | 0x0 | 0x417520 | 0x172f4 | 0x146f4 | 0x438 |
CreateThread | 0x0 | 0x417524 | 0x172f8 | 0x146f8 | 0xa4 |
Sleep | 0x0 | 0x417528 | 0x172fc | 0x146fc | 0x42b |
GetProcAddress | 0x0 | 0x41752c | 0x17300 | 0x14700 | 0x222 |
GetVersionExW | 0x0 | 0x417530 | 0x17304 | 0x14704 | 0x27b |
WideCharToMultiByte | 0x0 | 0x417534 | 0x17308 | 0x14708 | 0x484 |
HeapAlloc | 0x0 | 0x417538 | 0x1730c | 0x1470c | 0x2a2 |
HeapFree | 0x0 | 0x41753c | 0x17310 | 0x14710 | 0x2a6 |
LoadLibraryW | 0x0 | 0x417540 | 0x17314 | 0x14714 | 0x2f9 |
GetCurrentProcessId | 0x0 | 0x417544 | 0x17318 | 0x14718 | 0x1ab |
GetCurrentThreadId | 0x0 | 0x417548 | 0x1731c | 0x1471c | 0x1ae |
GetModuleFileNameW | 0x0 | 0x41754c | 0x17320 | 0x14720 | 0x1f6 |
GetEnvironmentVariableW | 0x0 | 0x417550 | 0x17324 | 0x14724 | 0x1c4 |
SetEnvironmentVariableW | 0x0 | 0x417554 | 0x17328 | 0x14728 | 0x3d9 |
GetCurrentProcess | 0x0 | 0x417558 | 0x1732c | 0x1472c | 0x1aa |
TerminateProcess | 0x0 | 0x41755c | 0x17330 | 0x14730 | 0x437 |
SetUnhandledExceptionFilter | 0x0 | 0x417560 | 0x17334 | 0x14734 | 0x41f |
HeapSize | 0x0 | 0x417564 | 0x17338 | 0x14738 | 0x2ab |
MultiByteToWideChar | 0x0 | 0x417568 | 0x1733c | 0x1473c | 0x31f |
CreateDirectoryW | 0x0 | 0x41756c | 0x17340 | 0x14740 | 0x72 |
SetFileAttributesW | 0x0 | 0x417570 | 0x17344 | 0x14744 | 0x3e2 |
GetTempPathW | 0x0 | 0x417574 | 0x17348 | 0x14748 | 0x25f |
DeleteFileW | 0x0 | 0x417578 | 0x1734c | 0x1474c | 0xc4 |
GetCurrentDirectoryW | 0x0 | 0x41757c | 0x17350 | 0x14750 | 0x1a9 |
SetCurrentDirectoryW | 0x0 | 0x417580 | 0x17354 | 0x14754 | 0x3cf |
CreateFileW | 0x0 | 0x417584 | 0x17358 | 0x14758 | 0x80 |
SetFilePointer | 0x0 | 0x417588 | 0x1735c | 0x1475c | 0x3e7 |
TlsFree | 0x0 | 0x41758c | 0x17360 | 0x14760 | 0x43d |
TlsGetValue | 0x0 | 0x417590 | 0x17364 | 0x14764 | 0x43e |
TlsSetValue | 0x0 | 0x417594 | 0x17368 | 0x14768 | 0x43f |
TlsAlloc | 0x0 | 0x417598 | 0x1736c | 0x1476c | 0x43c |
HeapReAlloc | 0x0 | 0x41759c | 0x17370 | 0x14770 | 0x2a9 |
DeleteCriticalSection | 0x0 | 0x4175a0 | 0x17374 | 0x14774 | 0xbf |
InterlockedCompareExchange | 0x0 | 0x4175a4 | 0x17378 | 0x14778 | 0x2bf |
InterlockedExchange | 0x0 | 0x4175a8 | 0x1737c | 0x1477c | 0x2c2 |
GetLastError | 0x0 | 0x4175ac | 0x17380 | 0x14780 | 0x1e7 |
SetLastError | 0x0 | 0x4175b0 | 0x17384 | 0x14784 | 0x3f4 |
UnregisterWait | 0x0 | 0x4175b4 | 0x17388 | 0x14788 | 0x44f |
GetCurrentThread | 0x0 | 0x4175b8 | 0x1738c | 0x1478c | 0x1ad |
DuplicateHandle | 0x0 | 0x4175bc | 0x17390 | 0x14790 | 0xd5 |
RegisterWaitForSingleObject | 0x0 | 0x4175c0 | 0x17394 | 0x14794 | 0x378 |
USER32.DLL (33)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CharUpperW | 0x0 | 0x4175c8 | 0x1739c | 0x1479c | 0x0 |
CharLowerW | 0x0 | 0x4175cc | 0x173a0 | 0x147a0 | 0x0 |
MessageBoxW | 0x0 | 0x4175d0 | 0x173a4 | 0x147a4 | 0x0 |
DefWindowProcW | 0x0 | 0x4175d4 | 0x173a8 | 0x147a8 | 0x0 |
DestroyWindow | 0x0 | 0x4175d8 | 0x173ac | 0x147ac | 0x0 |
GetWindowLongW | 0x0 | 0x4175dc | 0x173b0 | 0x147b0 | 0x0 |
GetWindowTextLengthW | 0x0 | 0x4175e0 | 0x173b4 | 0x147b4 | 0x0 |
GetWindowTextW | 0x0 | 0x4175e4 | 0x173b8 | 0x147b8 | 0x0 |
UnregisterClassW | 0x0 | 0x4175e8 | 0x173bc | 0x147bc | 0x0 |
LoadIconW | 0x0 | 0x4175ec | 0x173c0 | 0x147c0 | 0x0 |
LoadCursorW | 0x0 | 0x4175f0 | 0x173c4 | 0x147c4 | 0x0 |
RegisterClassExW | 0x0 | 0x4175f4 | 0x173c8 | 0x147c8 | 0x0 |
IsWindowEnabled | 0x0 | 0x4175f8 | 0x173cc | 0x147cc | 0x0 |
EnableWindow | 0x0 | 0x4175fc | 0x173d0 | 0x147d0 | 0x0 |
GetSystemMetrics | 0x0 | 0x417600 | 0x173d4 | 0x147d4 | 0x0 |
CreateWindowExW | 0x0 | 0x417604 | 0x173d8 | 0x147d8 | 0x0 |
SetWindowLongW | 0x0 | 0x417608 | 0x173dc | 0x147dc | 0x0 |
SendMessageW | 0x0 | 0x41760c | 0x173e0 | 0x147e0 | 0x0 |
SetFocus | 0x0 | 0x417610 | 0x173e4 | 0x147e4 | 0x0 |
CreateAcceleratorTableW | 0x0 | 0x417614 | 0x173e8 | 0x147e8 | 0x0 |
SetForegroundWindow | 0x0 | 0x417618 | 0x173ec | 0x147ec | 0x0 |
BringWindowToTop | 0x0 | 0x41761c | 0x173f0 | 0x147f0 | 0x0 |
GetMessageW | 0x0 | 0x417620 | 0x173f4 | 0x147f4 | 0x0 |
TranslateAcceleratorW | 0x0 | 0x417624 | 0x173f8 | 0x147f8 | 0x0 |
TranslateMessage | 0x0 | 0x417628 | 0x173fc | 0x147fc | 0x0 |
DispatchMessageW | 0x0 | 0x41762c | 0x17400 | 0x14800 | 0x0 |
DestroyAcceleratorTable | 0x0 | 0x417630 | 0x17404 | 0x14804 | 0x0 |
PostMessageW | 0x0 | 0x417634 | 0x17408 | 0x14808 | 0x0 |
GetForegroundWindow | 0x0 | 0x417638 | 0x1740c | 0x1480c | 0x0 |
GetWindowThreadProcessId | 0x0 | 0x41763c | 0x17410 | 0x14810 | 0x0 |
IsWindowVisible | 0x0 | 0x417640 | 0x17414 | 0x14814 | 0x0 |
EnumWindows | 0x0 | 0x417644 | 0x17418 | 0x14818 | 0x0 |
SetWindowPos | 0x0 | 0x417648 | 0x1741c | 0x1481c | 0x0 |
GDI32.DLL (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetStockObject | 0x0 | 0x417650 | 0x17424 | 0x14824 | 0x0 |
COMCTL32.DLL (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
InitCommonControlsEx | 0x0 | 0x417658 | 0x1742c | 0x1482c | 0x0 |
SHELL32.DLL (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ShellExecuteExW | 0x0 | 0x417660 | 0x17434 | 0x14834 | 0x0 |
SHGetFolderLocation | 0x0 | 0x417664 | 0x17438 | 0x14838 | 0x0 |
SHGetPathFromIDListW | 0x0 | 0x417668 | 0x1743c | 0x1483c | 0x0 |
WINMM.DLL (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
timeBeginPeriod | 0x0 | 0x417670 | 0x17444 | 0x14844 | 0x0 |
OLE32.DLL (2)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CoInitialize | 0x0 | 0x417678 | 0x1744c | 0x1484c | 0x0 |
CoTaskMemFree | 0x0 | 0x41767c | 0x17450 | 0x14850 | 0x0 |
SHLWAPI.DLL (5)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
PathAddBackslashW | 0x0 | 0x417684 | 0x17458 | 0x14858 | 0x0 |
PathRenameExtensionW | 0x0 | 0x417688 | 0x1745c | 0x1485c | 0x0 |
PathQuoteSpacesW | 0x0 | 0x41768c | 0x17460 | 0x14860 | 0x0 |
PathRemoveArgsW | 0x0 | 0x417690 | 0x17464 | 0x14864 | 0x0 |
PathRemoveBackslashW | 0x0 | 0x417694 | 0x17468 | 0x14868 | 0x0 |
Memory Dumps (2)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
cusersharlan4096desktop11-04-2020#cs fun - mwtfun.exe | 1 | 0x00400000 | 0x00444FFF | Relevant Image |
![]() |
32-bit | 0x0040DE30 |
![]() |
![]() |
...
|
cusersharlan4096desktop11-04-2020#cs fun - mwtfun.exe | 1 | 0x00400000 | 0x00444FFF | Final Dump |
![]() |
32-bit | - |
![]() |
![]() |
...
|
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Trojan.GenericKD.33656853 |
Malicious
|
C:\Users\FD1HVy\AppData\Local\Temp\AC92.tmp\ACA2.tmp\ACA3.bat | Dropped File | Batch |
Malicious
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
Names | Mal/Generic-S |
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Trojan.Ransom.CDQ |
Malicious
|
C:\Users\FD1HVy\Desktop\1KOAcYCUfFYg9R3cp_.ods.Sister | Dropped File | ZIP |
Unknown
|
...
|
»
C:\Users\FD1HVy\AppData\Local\Temp\AC92.tmp | Dropped File | Unknown |
Not Queried
|
...
|
»