680949c3c5b4b6ffdbe297fcb15096b5d53c8480d0c53ab4dd9801d711a78f31 (SHA256)
ransom_poc.exe
Windows Exe (x86-32)
Created at 2019-01-18 15:12:00
Notifications (1/1)
Every analysis has a preconfigured maximum VM disk size for temporary changes. This limit was reached during this analysis and, as an result, the analysis was terminated prematurely.
Top Threat Indicators (View all 7 threat indicators)
| Category | Operation | Classification |
|---|---|---|
| File System | Encrypts content of user files | Ransomware |
| Process | Creates process with hidden window | - |
| File System | Modifies operating system directory | - |
Screenshots
Monitored Processes
Analysis Information
| Creation Time | 2019-01-18 16:12 (UTC+1) |
| Analysis Duration | 00:01:34 |
| Number of Monitored Processes | 1 |
| Execution Successful |
|
| Reputation Enabled |
|
| WHOIS Enabled |
|
| YARA Enabled |
|
| Termination Reason | VM disk exhausted |
| Tags |
Sample Information
| ID | #421994 |
| MD5 |
5ea82f3fecbebe37cf282c813a0b8466
|
| SHA1 |
ee9f072a9c774f3a75ec2dc61cdca97c70196be5
|
| SHA256 |
680949c3c5b4b6ffdbe297fcb15096b5d53c8480d0c53ab4dd9801d711a78f31
|
| SSDeep |
3072:skX/5R+RdZCrw3xieUnoVpboZoYztsQiQuo5c:skX/AXZUOboqjQ35
|
| ImpHash |
208424e0e795541cc838516fef4d77b4
|
| Filename | ransom_poc.exe |
| File Size | 134.50 KB |
| File Type | Windows Exe (x86-32) |
Analyzer Information
| Dynamic Analyzer Build Date | 2019-01-08 16:19 (UTC+1) |
| Dynamic Analyzer Version | 2.3.2 |
| Static Analyzer Version | 1.0.1 |
| VTI Ruleset Version | 3.1 |
| YARA Built-in Ruleset Version | 1.1 |
| Analysis Report Layout Version | 3 |
