VMRay Analyzer Report
File Information
Sample files count1
Created files count2
Modified files count0
9c0ce809c87b54cbd8aa589a2644a74f7f656462.malware.exe, ...
-
File Properties
Names9c0ce809c87b54cbd8aa589a2644a74f7f656462.malware.exe (Sample File)
c:\users\wi2yhmti onvscy7pe\appdata\roaming\wtrrifwf\dafgfvjv.exe (Created File)
Size211.00 KB (216064 bytes)
Hash ValuesMD5: 5babf25f698870abea3f10393a1abf31
SHA1: 9c0ce809c87b54cbd8aa589a2644a74f7f656462
SHA256: e6d5efed898e2e51a2782bb959b23e2ab3d9dd53bd4ff7f56019901f6fa93a76
Actions
PE Information
+
File Properties
Image Base0x400000
Entry Point0x40a797
Size Of Code0x1ba00
Size Of Initialized Data0x18e00
Size Of Uninitialized Data0x0
Formatx86
TypeExecutable
SubsystemIMAGE_SUBSYSTEM_WINDOWS_GUI
Machine TypeIMAGE_FILE_MACHINE_I386
Compile Timestamp2016-09-01 20:12:16
Compiler/PackerUnknown
Sections (6)
+
NameVirtual AddressVirtual SizeRaw Data SizeRaw Data OffsetFlagsEntropy
.text0x4010000x1b96d0x1ba000x400CNT_CODE, MEM_EXECUTE, MEM_READ6.66
.rdata0x41d0000x8e600x90000x1be00CNT_INITIALIZED_DATA, MEM_READ6.24
.data0x4260000x8b500x6e000x24e00CNT_INITIALIZED_DATA, MEM_READ, MEM_WRITE7.05
.tls0x42f0000x90x2000x2bc00CNT_INITIALIZED_DATA, MEM_READ, MEM_WRITE0.0
.rsrc0x4300000x62a80x64000x2be00CNT_INITIALIZED_DATA, MEM_READ4.56
.reloc0x4370000x1a28f20x2a000x32200CNT_INITIALIZED_DATA, MEM_DISCARDABLE, MEM_READ4.98
Imports (225)
+
KERNEL32.dll (95)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
GetModuleFileNameA0x00x41d0e80x24bb80x239b8
ExitProcess0x00x41d0ec0x24bbc0x239bc
SetFilePointer0x00x41d0f00x24bc00x239c0
FlushFileBuffers0x00x41d0f40x24bc40x239c4
GetConsoleMode0x00x41d0f80x24bc80x239c8
GetConsoleCP0x00x41d0fc0x24bcc0x239cc
WriteFile0x00x41d1000x24bd00x239d0
GetFileType0x00x41d1040x24bd40x239d4
SetHandleCount0x00x41d1080x24bd80x239d8
HeapReAlloc0x00x41d10c0x24bdc0x239dc
VirtualAlloc0x00x41d1100x24be00x239e0
VirtualFree0x00x41d1140x24be40x239e4
HeapCreate0x00x41d1180x24be80x239e8
GetCurrentThreadId0x00x41d11c0x24bec0x239ec
SetLastError0x00x41d1200x24bf00x239f0
TlsFree0x00x41d1240x24bf40x239f4
TlsSetValue0x00x41d1280x24bf80x239f8
QueryPerformanceCounter0x00x41d12c0x24bfc0x239fc
GetTickCount0x00x41d1300x24c000x23a00
GetCurrentProcessId0x00x41d1340x24c040x23a04
GetSystemTimeAsFileTime0x00x41d1380x24c080x23a08
GetStringTypeA0x00x41d13c0x24c0c0x23a0c
GetStringTypeW0x00x41d1400x24c100x23a10
HeapSize0x00x41d1440x24c140x23a14
GetUserDefaultLCID0x00x41d1480x24c180x23a18
IsValidLocale0x00x41d14c0x24c1c0x23a1c
InitializeCriticalSectionAndSpinCount0x00x41d1500x24c200x23a20
WriteConsoleA0x00x41d1540x24c240x23a24
GetConsoleOutputCP0x00x41d1580x24c280x23a28
WriteConsoleW0x00x41d15c0x24c2c0x23a2c
SetStdHandle0x00x41d1600x24c300x23a30
GetLocaleInfoW0x00x41d1640x24c340x23a34
CreateEventA0x00x41d1680x24c380x23a38
CreateIoCompletionPort0x00x41d16c0x24c3c0x23a3c
PostQueuedCompletionStatus0x00x41d1700x24c400x23a40
SetConsoleCtrlHandler0x00x41d1740x24c440x23a44
GetLastError0x00x41d1780x24c480x23a48
FreeEnvironmentStringsA0x00x41d17c0x24c4c0x23a4c
GlobalFree0x00x41d1800x24c500x23a50
DeviceIoControl0x00x41d1840x24c540x23a54
FreeEnvironmentStringsW0x00x41d1880x24c580x23a58
GetConsoleScreenBufferInfo0x00x41d18c0x24c5c0x23a5c
FillConsoleOutputCharacterA0x00x41d1900x24c600x23a60
FillConsoleOutputAttribute0x00x41d1940x24c640x23a64
SetConsoleCursorPosition0x00x41d1980x24c680x23a68
LoadLibraryW0x00x41d19c0x24c6c0x23a6c
GetProcAddress0x00x41d1a00x24c700x23a70
HeapAlloc0x00x41d1a40x24c740x23a74
FreeLibrary0x00x41d1a80x24c780x23a78
GetVersion0x00x41d1ac0x24c7c0x23a7c
GetProcessHeap0x00x41d1b00x24c800x23a80
HeapFree0x00x41d1b40x24c840x23a84
LocalAlloc0x00x41d1b80x24c880x23a88
GetLocaleInfoA0x00x41d1bc0x24c8c0x23a8c
EnumSystemLocalesA0x00x41d1c00x24c900x23a90
CreateFileA0x00x41d1c40x24c940x23a94
GetFileSize0x00x41d1c80x24c980x23a98
GlobalAlloc0x00x41d1cc0x24c9c0x23a9c
TlsAlloc0x00x41d1d00x24ca00x23aa0
TlsGetValue0x00x41d1d40x24ca40x23aa4
GetModuleHandleW0x00x41d1d80x24ca80x23aa8
IsValidCodePage0x00x41d1dc0x24cac0x23aac
GetOEMCP0x00x41d1e00x24cb00x23ab0
GetACP0x00x41d1e40x24cb40x23ab4
GetCPInfo0x00x41d1e80x24cb80x23ab8
LCMapStringW0x00x41d1ec0x24cbc0x23abc
WideCharToMultiByte0x00x41d1f00x24cc00x23ac0
LCMapStringA0x00x41d1f40x24cc40x23ac4
GetStartupInfoA0x00x41d1f80x24cc80x23ac8
GetCommandLineA0x00x41d1fc0x24ccc0x23acc
RtlUnwind0x00x41d2000x24cd00x23ad0
RaiseException0x00x41d2040x24cd40x23ad4
IsDebuggerPresent0x00x41d2080x24cd80x23ad8
SetUnhandledExceptionFilter0x00x41d20c0x24cdc0x23adc
UnhandledExceptionFilter0x00x41d2100x24ce00x23ae0
GetCurrentProcess0x00x41d2140x24ce40x23ae4
TerminateProcess0x00x41d2180x24ce80x23ae8
LeaveCriticalSection0x00x41d21c0x24cec0x23aec
GlobalLock0x00x41d2200x24cf00x23af0
ReadFile0x00x41d2240x24cf40x23af4
GlobalUnlock0x00x41d2280x24cf80x23af8
EnterCriticalSection0x00x41d22c0x24cfc0x23afc
DeleteCriticalSection0x00x41d2300x24d000x23b00
InitializeCriticalSection0x00x41d2340x24d040x23b04
LocalFree0x00x41d2380x24d080x23b08
GetEnvironmentStrings0x00x41d23c0x24d0c0x23b0c
CloseHandle0x00x41d2400x24d100x23b10
MultiByteToWideChar0x00x41d2440x24d140x23b14
Sleep0x00x41d2480x24d180x23b18
InterlockedDecrement0x00x41d24c0x24d1c0x23b1c
InterlockedIncrement0x00x41d2500x24d200x23b20
GetStdHandle0x00x41d2540x24d240x23b24
GetEnvironmentStringsW0x00x41d2580x24d280x23b28
GetModuleHandleA0x00x41d25c0x24d2c0x23b2c
LoadLibraryA0x00x41d2600x24d300x23b30
USER32.dll (42)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
FillRect0x00x41d2d00x24da00x23ba0
DefWindowProcA0x00x41d2d40x24da40x23ba4
ReleaseDC0x00x41d2d80x24da80x23ba8
GetDC0x00x41d2dc0x24dac0x23bac
GetDesktopWindow0x00x41d2e00x24db00x23bb0
GetWindowLongA0x00x41d2e40x24db40x23bb4
IsWindowVisible0x00x41d2e80x24db80x23bb8
GetForegroundWindow0x00x41d2ec0x24dbc0x23bbc
EndDialog0x00x41d2f00x24dc00x23bc0
GetDlgItem0x00x41d2f40x24dc40x23bc4
GetWindowDC0x00x41d2f80x24dc80x23bc8
SetWindowPlacement0x00x41d2fc0x24dcc0x23bcc
GetWindowPlacement0x00x41d3000x24dd00x23bd0
ShowWindow0x00x41d3040x24dd40x23bd4
CreateWindowExA0x00x41d3080x24dd80x23bd8
LoadStringA0x00x41d30c0x24ddc0x23bdc
RegisterClassA0x00x41d3100x24de00x23be0
LoadCursorA0x00x41d3140x24de40x23be4
LoadIconA0x00x41d3180x24de80x23be8
GetMenuBarInfo0x00x41d31c0x24dec0x23bec
GetMenu0x00x41d3200x24df00x23bf0
CheckMenuItem0x00x41d3240x24df40x23bf4
InvalidateRect0x00x41d3280x24df80x23bf8
IsWindowEnabled0x00x41d32c0x24dfc0x23bfc
MessageBoxW0x00x41d3300x24e000x23c00
BeginPaint0x00x41d3340x24e040x23c04
EndPaint0x00x41d3380x24e080x23c08
DestroyWindow0x00x41d33c0x24e0c0x23c0c
FrameRect0x00x41d3400x24e100x23c10
GetWindowRect0x00x41d3440x24e140x23c14
MapWindowPoints0x00x41d3480x24e180x23c18
IsDlgButtonChecked0x00x41d34c0x24e1c0x23c1c
GetDlgItemTextA0x00x41d3500x24e200x23c20
FindWindowA0x00x41d3540x24e240x23c24
SetWindowTextA0x00x41d3580x24e280x23c28
MessageBoxA0x00x41d35c0x24e2c0x23c2c
GetClientRect0x00x41d3600x24e300x23c30
GetFocus0x00x41d3640x24e340x23c34
SendMessageA0x00x41d3680x24e380x23c38
OffsetRect0x00x41d36c0x24e3c0x23c3c
DestroyIcon0x00x41d3700x24e400x23c40
DrawTextA0x00x41d3740x24e440x23c44
GDI32.dll (26)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
Pie0x00x41d0640x24b340x23934
GetDeviceCaps0x00x41d0680x24b380x23938
SetBkColor0x00x41d06c0x24b3c0x2393c
Rectangle0x00x41d0700x24b400x23940
CreateSolidBrush0x00x41d0740x24b440x23944
SelectObject0x00x41d0780x24b480x23948
DeleteObject0x00x41d07c0x24b4c0x2394c
CreateHatchBrush0x00x41d0800x24b500x23950
SetBkMode0x00x41d0840x24b540x23954
GetStockObject0x00x41d0880x24b580x23958
SelectClipRgn0x00x41d08c0x24b5c0x2395c
FrameRgn0x00x41d0900x24b600x23960
OffsetRgn0x00x41d0940x24b640x23964
CreateCompatibleBitmap0x00x41d0980x24b680x23968
CreatePen0x00x41d09c0x24b6c0x2396c
MoveToEx0x00x41d0a00x24b700x23970
LineTo0x00x41d0a40x24b740x23974
BitBlt0x00x41d0a80x24b780x23978
ExtTextOutA0x00x41d0ac0x24b7c0x2397c
DeleteDC0x00x41d0b00x24b800x23980
SetMapMode0x00x41d0b40x24b840x23984
SetWindowExtEx0x00x41d0b80x24b880x23988
SetViewportExtEx0x00x41d0bc0x24b8c0x2398c
RestoreDC0x00x41d0c00x24b900x23990
SaveDC0x00x41d0c40x24b940x23994
CreateCompatibleDC0x00x41d0c80x24b980x23998
COMDLG32.dll (1)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
GetOpenFileNameA0x00x41d05c0x24b2c0x2392c
ADVAPI32.dll (17)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
CryptHashData0x00x41d0000x24ad00x238d0
CryptImportKey0x00x41d0040x24ad40x238d4
CryptSignHashA0x00x41d0080x24ad80x238d8
CryptExportKey0x00x41d00c0x24adc0x238dc
CryptGetUserKey0x00x41d0100x24ae00x238e0
CryptReleaseContext0x00x41d0140x24ae40x238e4
CryptDestroyKey0x00x41d0180x24ae80x238e8
RegOpenKeyExA0x00x41d01c0x24aec0x238ec
RegQueryValueExA0x00x41d0200x24af00x238f0
RegCloseKey0x00x41d0240x24af40x238f4
CryptAcquireContextA0x00x41d0280x24af80x238f8
CryptCreateHash0x00x41d02c0x24afc0x238fc
CryptDestroyHash0x00x41d0300x24b000x23900
CryptDeriveKey0x00x41d0340x24b040x23904
CryptSetHashParam0x00x41d0380x24b080x23908
CryptGetHashParam0x00x41d03c0x24b0c0x2390c
CryptVerifySignatureA0x00x41d0400x24b100x23910
SHELL32.dll (3)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
SHGetFileInfoA0x00x41d2c00x24d900x23b90
SHGetMalloc0x00x41d2c40x24d940x23b94
SHGetSpecialFolderLocation0x00x41d2c80x24d980x23b98
ole32.dll (5)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
CoInitialize0x00x41d3b40x24e840x23c84
CreateStreamOnHGlobal0x00x41d3b80x24e880x23c88
OleDraw0x00x41d3bc0x24e8c0x23c8c
StringFromGUID20x00x41d3c00x24e900x23c90
StringFromCLSID0x00x41d3c40x24e940x23c94
OLEAUT32.dll (2)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
OleLoadPicture0x1a20x41d2680x24d380x23b38
OleLoadPicturePath0x1a80x41d26c0x24d3c0x23b3c
WS2_32.dll (7)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
WSAStartup0x730x41d37c0x24e4c0x23c4c
htons0x90x41d3800x24e500x23c50
bind0x20x41d3840x24e540x23c54
recvfrom0x110x41d3880x24e580x23c58
listen0xd0x41d38c0x24e5c0x23c5c
closesocket0x30x41d3900x24e600x23c60
ioctlsocket0xa0x41d3940x24e640x23c64
AVIFIL32.dll (2)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
AVIStreamOpenFromFileA0x00x41d0480x24b180x23918
AVIStreamGetFrame0x00x41d04c0x24b1c0x2391c
WinSCard.dll (2)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
SCardIntroduceReaderW0x00x41d39c0x24e6c0x23c6c
SCardIsValidContext0x00x41d3a00x24e700x23c70
IPHLPAPI.DLL (1)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
GetInterfaceInfo0x00x41d0e00x24bb00x239b0
COMCTL32.dll (1)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
ImageList_ReplaceIcon0x00x41d0540x24b240x23924
OPENGL32.dll (13)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
glBegin0x00x41d2740x24d440x23b44
glTexSubImage2D0x00x41d2780x24d480x23b48
glTexCoord2f0x00x41d27c0x24d4c0x23b4c
glRotatef0x00x41d2800x24d500x23b50
glEnable0x00x41d2840x24d540x23b54
glHint0x00x41d2880x24d580x23b58
glVertex3f0x00x41d28c0x24d5c0x23b5c
glTranslatef0x00x41d2900x24d600x23b60
glLoadIdentity0x00x41d2940x24d640x23b64
glEnd0x00x41d2980x24d680x23b68
glMatrixMode0x00x41d29c0x24d6c0x23b6c
glClear0x00x41d2a00x24d700x23b70
glClearColor0x00x41d2a40x24d740x23b74
GLU32.dll (1)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
gluOrtho2D0x00x41d0d00x24ba00x239a0
IMM32.dll (1)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
ImmGetGuideLineA0x00x41d0d80x24ba80x239a8
SETUPAPI.dll (4)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
SetupDiEnumDeviceInterfaces0x00x41d2ac0x24d7c0x23b7c
SetupDiDestroyDeviceInfoList0x00x41d2b00x24d800x23b80
SetupDiGetDeviceInterfaceDetailA0x00x41d2b40x24d840x23b84
SetupDiGetClassDevsA0x00x41d2b80x24d880x23b88
Wlanapi.dll (2)
+
API NameOrdinalIAT AddressThunk RVAThunk Offset
WlanOpenHandle0x00x41d3a80x24e780x23c78
WlanEnumInterfaces0x00x41d3ac0x24e7c0x23c7c
Icons (1)
+
Icon
c:\users\wi2yhmti onvscy7pe\appdata\roaming\wtrrifwf\dafgfvjv.exe
-
File Properties
Namesc:\users\wi2yhmti onvscy7pe\appdata\roaming\wtrrifwf\dafgfvjv.exe (Created File)
Size0.00 KB (0 bytes)
Hash ValuesMD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefox with deactivated setting "security.fileuri.strict_origin_policy". 
































Screenshot



Expand-Icon


Exit-Icon






icon_left




icon_left








image