VMRay Analyzer Report
VTI Information
VTI Score
77 / 100
VTI Database Version2.2
VTI Rule Match Count25
VTI Rule TypeDefault (PE, ...)
Detected Threats
ArrowAnti Analysis
Arrow
Try to detect application sandbox
Possibly trying to detect "Sandboxie" by checking for existance of module "SbieDll.dll".
Arrow
Try to detect virtual machine
Possibly trying to detect VirtualPC via vpcext instruction at "0xb073f0f".
Arrow
Dynamic API usage
Resolve more than 50 APIs.
ArrowFile System
Arrow
Modify operating system directory
Modify "c:\windows\system32\install\svhost.exe".
ArrowInjection
Arrow
Write into memory of an other process
"c:\users\wi2yhmti onvscy7pe\desktop\1129c5049ff7842161800d20141de5848888ea44_(b-ware)_vt.malware.exe" modifies memory of "c:\windows\explorer.exe"
"c:\users\wi2yhmti onvscy7pe\desktop\1129c5049ff7842161800d20141de5848888ea44_(b-ware)_vt.malware.exe" modifies memory of "c:\windows\syswow64\explorer.exe"
"c:\users\wi2yhmti onvscy7pe\desktop\1129c5049ff7842161800d20141de5848888ea44_(b-ware)_vt.malware.exe" modifies memory of "c:\program files\internet explorer\iexplore.exe"
"c:\windows\syswow64\install\svhost.exe" modifies memory of "c:\program files\internet explorer\iexplore.exe"
Arrow
Modify control flow of an other process
"c:\users\wi2yhmti onvscy7pe\desktop\1129c5049ff7842161800d20141de5848888ea44_(b-ware)_vt.malware.exe" creates thread in "c:\windows\syswow64\explorer.exe"
ArrowPersistence
Arrow
Install system startup script or application
Add "C:\Windows\system32\install\svhost.exe" to windows startup via registry.
Add "C:\Users\WI2yhmtI onvScY7Pe\AppData\Roaming\install\svhost.exe" to windows startup via registry.
ArrowProcess
Arrow
Create many processes
More than 50 processes were monitored.
Arrow
Create system object
Create mutex with name "_x_X_UPDATE_X_x_".
Create mutex with name "_x_X_PASSWORDLIST_X_x_".
Create mutex with name "_x_X_BLOCKMOUSE_X_x_".
Create mutex with name "***MUTEX***".
Create mutex with name "***MUTEX***_PERSIST".
Create mutex with name "***MUTEX***_SAIR".
Arrow
Allocate a page with write and execute permissions
Allocate a page with "PAGE_EXECUTE_READWRITE" permissions, often used to dynamically unpack code.
Allocate a page in a foreign process with "PAGE_EXECUTE_READWRITE" permissions, often used to dynamically unpack code.
Change the protection of a page from writable ("PAGE_READWRITE") to executable ("PAGE_EXECUTE_READ").
Arrow
Create process with hidden window
The process "explorer.exe" starts with hidden window.
The process "C:\Program Files\Internet Explorer\iexplore.exe" starts with hidden window.
The process "C:\Windows\system32\install\svhost.exe" starts with hidden window.
Arrow
Obfuscate control flow
Modify exception handler (e.g., the instruction pointer is modified within an exception handler filter).
-Browser
-Device
-Hide Tracks
-Information Stealing
-Kernel
-Masquerade
-Network
-OS
-PE
-VBA Macro
-YARA
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefox with deactivated setting "security.fileuri.strict_origin_policy".


Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image