80ca3de5...03af

VTI SCORE: 100/100

Dynamic Analysis Report

Classification: Riskware, Wiper, Trojan, Ransomware

80ca3de5d5f991c872ba07a0ffc035bf019f985bac71f4f379bcdea2de6203af (SHA256)

80ca3de5d5f991c872ba07a0ffc035bf019f985bac71f4f379bcdea2de6203af.exe

Windows Exe (x86-32)

Created at 2018-09-18 12:19:00

Notifications (2/3)

Some extracted files may be missing in the report since the total file extraction size limit was reached during the analysis. You can increase the limit in the configuration settings.

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

The operating system was rebooted during the analysis.

Kernel Graph 1

Code Block #1 (EP #1)

Information	Value
Trigger	IopLoadDriver+0x7eb
Start Address	0x915f13ec

Execution Path #1 (length: 21, count: 1, processes: 1)

Information	Value
Sequence Length	21

Processes

Process	Count
Process 7 (System, PID: 4)	1

Sequence

Symbol	Parameters
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156aaf4
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156ab14
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156ab34
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156ab54
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156ab74
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156ab94
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156abb4
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156abd4
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156abf4
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156ac14
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156ac34
KeInitializeEvent	Type_unk = 0x1, State = 0, Event_unk_out = 0x9156ac54
imp_WdfDriverCreate	ret_val_out = 0x0
imp_WdfControlDeviceInitAllocate	ret_val_out = 0x85eb45d8
ExInitializeResourceLite	Resource_unk_out = 0x9156aec0, ret_val_out = 0x0
ExInitializeResourceLite	Resource_unk_out = 0x9156b360, ret_val_out = 0x0
ExInitializeResourceLite	Resource_unk_out = 0x9156af00, ret_val_out = 0x0
ExAllocatePoolWithTag	PoolType_unk = 0x1, NumberOfBytes_ptr = 0x15e7, Tag = 0x5045, ret_val_ptr_out = 0x9583d000
HalpHpetClockInterrupt	ret_val_out = 0xd77
PsSetCreateProcessNotifyRoutine	NotifyRoutine_unk = 0x9156d1d9, Remove = 0, ret_val_out = 0x0
ExFreePoolWithTag	P_ptr = 0x9583d000, Tag = 0x0

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Notifications (2/3)

Kernel Graph 1

Before

After