VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: |
Ransomware
Wiper
|
Threat Names: |
Gen:Heur.Ransom.RTH.1
|
Ransomware.exe
Windows Exe (x86-32)
Created at 2020-06-14T16:13:00
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x406e22 |
Size Of Code | 0x5000 |
Size Of Initialized Data | 0x2fc00 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2047-01-13 11:31:55+00:00 |
Version Information (11)
»
Assembly Version | 1.0.0.0 |
Comments | - |
CompanyName | - |
FileDescription | Ransomware |
FileVersion | 1.0.0.0 |
InternalName | Ransomware.exe |
LegalCopyright | Copyright © 2020 |
LegalTrademarks | - |
OriginalFilename | Ransomware.exe |
ProductName | - |
ProductVersion | 1.0.0.0 |
Sections (3)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x402000 | 0x4e28 | 0x5000 | 0x200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.76 |
.rsrc | 0x408000 | 0x2f86c | 0x2fa00 | 0x5200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.86 |
.reloc | 0x438000 | 0xc | 0x200 | 0x34c00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.08 |
Imports (1)
»
mscoree.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
_CorExeMain | 0x0 | 0x402000 | 0x6df8 | 0x4ff8 | 0x0 |
Memory Dumps (34)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
ransomware.exe | 1 | 0x00170000 | 0x001A9FFF | Relevant Image |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x02145000 | 0x02145FFF | First Execution |
![]() |
32-bit | 0x02145000 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | First Execution |
![]() |
32-bit | 0x04BF3AE6 |
![]() |
![]() |
...
|
buffer | 1 | 0x02146000 | 0x02146FFF | First Execution |
![]() |
32-bit | 0x021460E8 |
![]() |
![]() |
...
|
buffer | 1 | 0x0081B000 | 0x0081BFFF | First Execution |
![]() |
32-bit | 0x0081B2D1 |
![]() |
![]() |
...
|
buffer | 1 | 0x02145000 | 0x02145FFF | Content Changed |
![]() |
32-bit | 0x021455CC |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF3DDE |
![]() |
![]() |
...
|
buffer | 1 | 0x02147000 | 0x02147FFF | First Execution |
![]() |
32-bit | 0x0214702B |
![]() |
![]() |
...
|
buffer | 1 | 0x0081B000 | 0x0081BFFF | Content Changed |
![]() |
32-bit | 0x0081B2D1 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF44D6 |
![]() |
![]() |
...
|
buffer | 1 | 0x02146000 | 0x02146FFF | Content Changed |
![]() |
32-bit | 0x02146A8F |
![]() |
![]() |
...
|
buffer | 1 | 0x02145000 | 0x02145FFF | Content Changed |
![]() |
32-bit | 0x02145E60 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF46B6 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF4706 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF4576 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF4706 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF48BE |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF3AE6 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF3BD6 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF3A96 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF495E |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF4D2E |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF5000 | 0x04BF5FFF | First Execution |
![]() |
32-bit | 0x04BF5026 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF4F5E |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF5000 | 0x04BF5FFF | Content Changed |
![]() |
32-bit | 0x04BF5586 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF4E46 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF3000 | 0x04BF4FFF | Content Changed |
![]() |
32-bit | 0x04BF3D16 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF6000 | 0x04BF6FFF | First Execution |
![]() |
32-bit | 0x04BF623E |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF6000 | 0x04BF6FFF | Content Changed |
![]() |
32-bit | 0x04BF62DE |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF6000 | 0x04BF6FFF | Content Changed |
![]() |
32-bit | 0x04BF61C6 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF5000 | 0x04BF5FFF | Content Changed |
![]() |
32-bit | 0x04BF5C26 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF5000 | 0x04BF5FFF | Content Changed |
![]() |
32-bit | 0x04BF5DDE |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF5000 | 0x04BF5FFF | Content Changed |
![]() |
32-bit | 0x04BF5D66 |
![]() |
![]() |
...
|
buffer | 1 | 0x04BF6000 | 0x04BF6FFF | Content Changed |
![]() |
32-bit | 0x04BF69F6 |
![]() |
![]() |
...
|
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Gen:Heur.Ransom.RTH.1 |
Malicious
|
C:\Users\FD1HVy\Desktop\-pOUvA49q9yDM-0.mp4.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\34aMTfpLUW1K.gif.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\5lmH1kaD1rJ.doc.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\8NSrnaP_Poci.gif.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\8oM0fBFRw.png.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\boER.bmp.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\bUMP5sioT8bBpe5Z.bmp.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\CYRbwNZnNUjgINU SHVp.flv.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\desktop.ini.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\dqdSV4kY9.pptx.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\EOfkT_rHDDLu4.wav.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\G1JIgLVEFPxfFron.doc.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\G9ab7E_UM.png.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\GNHCb.mkv.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\HP5W0_xtTy4_IV.jpg.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\IIi7TDDxZ8.wav.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\IUcs1x8V.swf.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\kWAJNH0.wav.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\lgm4cLHmP1c_TDDe-f J.avi.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\mUsss9M.m4a.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\q KD9Zan-WxpTnH.avi.Cobra | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\FD1HVy\Desktop\Q0E9HxM mfXEN.gif.Cobra | Dropped File | Text |
Unknown
|
...
|
»