1f8feaad...55da

VTI SCORE: 91/100

Dynamic Analysis Report

Classification: Riskware, Trojan, Ransomware

1f8feaadbc4921aae2e51ad6d43513a915bd6081ca7bcc65b412f30ef8f155da (SHA256)

whzqnu.exe

Windows Exe (x86-32)

Created at 2019-01-14 07:50:00

Notifications (1/1)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

Severity	Category	Operation	Classification
4/5	File System	Renames user files	Ransomware
Renames multiple user files. This is an indicator for an encryption attempt. ... VTI Actions Go to function call
3/5	Persistence	Adds file to open the next time Excel is launched	-
Adds "c:\program files\microsoft office\office14\startup\how_to_return_files.txt" to a default Excel XLStart folder ... VTI Actions
2/5	File System	Known suspicious file	Trojan
File "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\whzqnu.exe" is a known suspicious file. ... VTI Actions Go to file details
1/5	Anti Analysis	Resolves APIs dynamically	-
Resolves an unusually high number of APIs. ... VTI Actions Go to function call
1/5	Process	Creates process with hidden window	-
The process "C:\Windows\system32\cmd.exe" starts with hidden window. ... VTI Actions Go to function call
1/5	Masquerade	Changes folder appearance	Riskware
Folder "c:\program files\microsoft office\office14\1033\dataservices" has a changed appearance. ... VTI Actions
1/5	File System	Creates an unusually large number of files	-
Creates an unusually large number of files. ... VTI Actions Go to file details

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Notifications (1/1)

Before

After