89f35f20...01a1 | Files
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Riskware, Downloader, Wiper, Ransomware

89f35f20af62201010e3218a22c50ed6994c79fb6f9f2210fd55203e6e6b01a1 (SHA256)

svchost.jpg.exe

Windows Exe (x86-32)

Created at 2019-01-04 10:33:00

...

Notifications (1/1)

Every worker has a preconfigured RAM disk size for temporary changes for all VMs and analyses. During this analysis, the amount of free RAM disk space dropped to a value below the minimum configured level, and as an result, the analysis was terminated prematurely.

Filters:
Filename Category Type Severity Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\svchost.jpg.exe Sample File Binary
Unknown
...
»
Mime Type application/x-dosexec
File Size 428.00 KB
MD5 4b6f0113007cddea4ad31237add23786 Copy to Clipboard
SHA1 7c90fa7d2ed727a1c1c4b4a4db98ac85a1a973f6 Copy to Clipboard
SHA256 89f35f20af62201010e3218a22c50ed6994c79fb6f9f2210fd55203e6e6b01a1 Copy to Clipboard
SSDeep 12288:qpwePcLP/ztVHayvrtvC07Wc/Hn7KJFnmRysbt7V3X:/umPrtsQnCsHWnKPLn Copy to Clipboard
ImpHash 58cdf9f3ee6b6834d4e6101ba2891355 Copy to Clipboard
PE Information
»
Image Base 0x400000
Entry Point 0x4115bf
Size Of Code 0x49400
Size Of Initialized Data 0x22c00
File Type executable
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2018-12-30 17:10:06+00:00
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x49378 0x49400 0x400 cnt_code, mem_execute, mem_read 6.65
.rdata 0x44b000 0x171c4 0x17200 0x49800 cnt_initialized_data, mem_read 5.3
.data 0x463000 0x6468 0x5200 0x60a00 cnt_initialized_data, mem_read, mem_write 2.61
.rsrc 0x46a000 0x1e0 0x200 0x65c00 cnt_initialized_data, mem_read 4.72
.reloc 0x46b000 0x50dc 0x5200 0x65e00 cnt_initialized_data, mem_discardable, mem_read 6.63
Imports (6)
»
KERNEL32.dll (136)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetFileSize 0x0 0x44b02c 0x61370 0x5fb70 0x24b
ReadFile 0x0 0x44b030 0x61374 0x5fb74 0x473
WriteFile 0x0 0x44b034 0x61378 0x5fb78 0x612
MultiByteToWideChar 0x0 0x44b038 0x6137c 0x5fb7c 0x3ef
WideCharToMultiByte 0x0 0x44b03c 0x61380 0x5fb80 0x5fe
DeleteFileW 0x0 0x44b040 0x61384 0x5fb84 0x115
FindFirstFileW 0x0 0x44b044 0x61388 0x5fb88 0x180
GetDriveTypeA 0x0 0x44b048 0x6138c 0x5fb8c 0x22e
GetModuleFileNameA 0x0 0x44b04c 0x61390 0x5fb90 0x273
CopyFileW 0x0 0x44b050 0x61394 0x5fb94 0xad
FindNextFileW 0x0 0x44b054 0x61398 0x5fb98 0x18c
FindClose 0x0 0x44b058 0x6139c 0x5fb9c 0x175
GetLogicalDrives 0x0 0x44b05c 0x613a0 0x5fba0 0x268
GetModuleFileNameW 0x0 0x44b060 0x613a4 0x5fba4 0x274
CreateProcessW 0x0 0x44b064 0x613a8 0x5fba8 0xe5
GetTempPathA 0x0 0x44b068 0x613ac 0x5fbac 0x2f5
SetEndOfFile 0x0 0x44b06c 0x613b0 0x5fbb0 0x510
WriteConsoleW 0x0 0x44b070 0x613b4 0x5fbb4 0x611
SetStdHandle 0x0 0x44b074 0x613b8 0x5fbb8 0x54a
CreateFileW 0x0 0x44b078 0x613bc 0x5fbbc 0xcb
ReleaseMutex 0x0 0x44b07c 0x613c0 0x5fbc0 0x4b0
Sleep 0x0 0x44b080 0x613c4 0x5fbc4 0x57d
CreateMutexW 0x0 0x44b084 0x613c8 0x5fbc8 0xda
GetProcessHeap 0x0 0x44b088 0x613cc 0x5fbcc 0x2b4
HeapSize 0x0 0x44b08c 0x613d0 0x5fbd0 0x34e
HeapReAlloc 0x0 0x44b090 0x613d4 0x5fbd4 0x34c
HeapFree 0x0 0x44b094 0x613d8 0x5fbd8 0x349
HeapAlloc 0x0 0x44b098 0x613dc 0x5fbdc 0x345
HeapDestroy 0x0 0x44b09c 0x613e0 0x5fbe0 0x348
CloseHandle 0x0 0x44b0a0 0x613e4 0x5fbe4 0x86
DecodePointer 0x0 0x44b0a4 0x613e8 0x5fbe8 0x109
FindResourceExW 0x0 0x44b0a8 0x613ec 0x5fbec 0x195
FindResourceW 0x0 0x44b0ac 0x613f0 0x5fbf0 0x196
SizeofResource 0x0 0x44b0b0 0x613f4 0x5fbf4 0x57c
LockResource 0x0 0x44b0b4 0x613f8 0x5fbf8 0x3db
LoadResource 0x0 0x44b0b8 0x613fc 0x5fbfc 0x3c7
DeleteCriticalSection 0x0 0x44b0bc 0x61400 0x5fc00 0x110
InitializeCriticalSectionEx 0x0 0x44b0c0 0x61404 0x5fc04 0x360
SetEnvironmentVariableW 0x0 0x44b0c4 0x61408 0x5fc08 0x514
FreeEnvironmentStringsW 0x0 0x44b0c8 0x6140c 0x5fc0c 0x1aa
GetEnvironmentStringsW 0x0 0x44b0cc 0x61410 0x5fc10 0x237
GetCommandLineW 0x0 0x44b0d0 0x61414 0x5fc14 0x1d7
GetCommandLineA 0x0 0x44b0d4 0x61418 0x5fc18 0x1d6
GetOEMCP 0x0 0x44b0d8 0x6141c 0x5fc1c 0x297
GetACP 0x0 0x44b0dc 0x61420 0x5fc20 0x1b2
IsValidCodePage 0x0 0x44b0e0 0x61424 0x5fc24 0x38b
FindFirstFileExW 0x0 0x44b0e4 0x61428 0x5fc28 0x17b
EnumSystemLocalesW 0x0 0x44b0e8 0x6142c 0x5fc2c 0x154
GetUserDefaultLCID 0x0 0x44b0ec 0x61430 0x5fc30 0x312
IsValidLocale 0x0 0x44b0f0 0x61434 0x5fc34 0x38d
ReadConsoleW 0x0 0x44b0f4 0x61438 0x5fc38 0x470
GetConsoleMode 0x0 0x44b0f8 0x6143c 0x5fc3c 0x1fc
GetConsoleCP 0x0 0x44b0fc 0x61440 0x5fc40 0x1ea
FlushFileBuffers 0x0 0x44b100 0x61444 0x5fc44 0x19f
SetFilePointerEx 0x0 0x44b104 0x61448 0x5fc48 0x523
GetFileSizeEx 0x0 0x44b108 0x6144c 0x5fc4c 0x24c
GetFileAttributesExW 0x0 0x44b10c 0x61450 0x5fc50 0x242
GetExitCodeProcess 0x0 0x44b110 0x61454 0x5fc54 0x23c
GetFileType 0x0 0x44b114 0x61458 0x5fc58 0x24e
GetLastError 0x0 0x44b118 0x6145c 0x5fc5c 0x261
RaiseException 0x0 0x44b11c 0x61460 0x5fc60 0x462
DuplicateHandle 0x0 0x44b120 0x61464 0x5fc64 0x12b
WaitForSingleObjectEx 0x0 0x44b124 0x61468 0x5fc68 0x5d8
GetCurrentProcess 0x0 0x44b128 0x6146c 0x5fc6c 0x217
SwitchToThread 0x0 0x44b12c 0x61470 0x5fc70 0x587
GetCurrentThread 0x0 0x44b130 0x61474 0x5fc74 0x21b
GetCurrentThreadId 0x0 0x44b134 0x61478 0x5fc78 0x21c
GetExitCodeThread 0x0 0x44b138 0x6147c 0x5fc7c 0x23d
EnterCriticalSection 0x0 0x44b13c 0x61480 0x5fc80 0x131
LeaveCriticalSection 0x0 0x44b140 0x61484 0x5fc84 0x3bd
TryEnterCriticalSection 0x0 0x44b144 0x61488 0x5fc88 0x5a7
QueryPerformanceCounter 0x0 0x44b148 0x6148c 0x5fc8c 0x44d
SetLastError 0x0 0x44b14c 0x61490 0x5fc90 0x532
InitializeCriticalSectionAndSpinCount 0x0 0x44b150 0x61494 0x5fc94 0x35f
CreateEventW 0x0 0x44b154 0x61498 0x5fc98 0xbf
TlsAlloc 0x0 0x44b158 0x6149c 0x5fc9c 0x59e
TlsGetValue 0x0 0x44b15c 0x614a0 0x5fca0 0x5a0
TlsSetValue 0x0 0x44b160 0x614a4 0x5fca4 0x5a1
TlsFree 0x0 0x44b164 0x614a8 0x5fca8 0x59f
GetSystemTimeAsFileTime 0x0 0x44b168 0x614ac 0x5fcac 0x2e9
GetTickCount 0x0 0x44b16c 0x614b0 0x5fcb0 0x307
GetModuleHandleW 0x0 0x44b170 0x614b4 0x5fcb4 0x278
GetProcAddress 0x0 0x44b174 0x614b8 0x5fcb8 0x2ae
EncodePointer 0x0 0x44b178 0x614bc 0x5fcbc 0x12d
CompareStringW 0x0 0x44b17c 0x614c0 0x5fcc0 0x9b
LCMapStringW 0x0 0x44b180 0x614c4 0x5fcc4 0x3b1
GetLocaleInfoW 0x0 0x44b184 0x614c8 0x5fcc8 0x265
GetStringTypeW 0x0 0x44b188 0x614cc 0x5fccc 0x2d7
GetCPInfo 0x0 0x44b18c 0x614d0 0x5fcd0 0x1c1
IsDebuggerPresent 0x0 0x44b190 0x614d4 0x5fcd4 0x37f
OutputDebugStringW 0x0 0x44b194 0x614d8 0x5fcd8 0x419
SetEvent 0x0 0x44b198 0x614dc 0x5fcdc 0x516
ResetEvent 0x0 0x44b19c 0x614e0 0x5fce0 0x4c6
GetCurrentProcessId 0x0 0x44b1a0 0x614e4 0x5fce4 0x218
InitializeSListHead 0x0 0x44b1a4 0x614e8 0x5fce8 0x363
UnhandledExceptionFilter 0x0 0x44b1a8 0x614ec 0x5fcec 0x5ad
SetUnhandledExceptionFilter 0x0 0x44b1ac 0x614f0 0x5fcf0 0x56d
GetStartupInfoW 0x0 0x44b1b0 0x614f4 0x5fcf4 0x2d0
IsProcessorFeaturePresent 0x0 0x44b1b4 0x614f8 0x5fcf8 0x386
TerminateProcess 0x0 0x44b1b8 0x614fc 0x5fcfc 0x58c
CreateTimerQueue 0x0 0x44b1bc 0x61500 0x5fd00 0xfa
SignalObjectAndWait 0x0 0x44b1c0 0x61504 0x5fd04 0x57b
CreateThread 0x0 0x44b1c4 0x61508 0x5fd08 0xf3
SetThreadPriority 0x0 0x44b1c8 0x6150c 0x5fd0c 0x55e
GetThreadPriority 0x0 0x44b1cc 0x61510 0x5fd10 0x301
GetLogicalProcessorInformation 0x0 0x44b1d0 0x61514 0x5fd14 0x269
CreateTimerQueueTimer 0x0 0x44b1d4 0x61518 0x5fd18 0xfb
ChangeTimerQueueTimer 0x0 0x44b1d8 0x6151c 0x5fd1c 0x78
DeleteTimerQueueTimer 0x0 0x44b1dc 0x61520 0x5fd20 0x11a
GetNumaHighestNodeNumber 0x0 0x44b1e0 0x61524 0x5fd24 0x289
GetProcessAffinityMask 0x0 0x44b1e4 0x61528 0x5fd28 0x2af
SetThreadAffinityMask 0x0 0x44b1e8 0x6152c 0x5fd2c 0x553
RegisterWaitForSingleObject 0x0 0x44b1ec 0x61530 0x5fd30 0x4a9
UnregisterWait 0x0 0x44b1f0 0x61534 0x5fd34 0x5b6
GetThreadTimes 0x0 0x44b1f4 0x61538 0x5fd38 0x305
FreeLibrary 0x0 0x44b1f8 0x6153c 0x5fd3c 0x1ab
FreeLibraryAndExitThread 0x0 0x44b1fc 0x61540 0x5fd40 0x1ac
GetModuleHandleA 0x0 0x44b200 0x61544 0x5fd44 0x275
LoadLibraryExW 0x0 0x44b204 0x61548 0x5fd48 0x3c3
GetVersionExW 0x0 0x44b208 0x6154c 0x5fd4c 0x31b
VirtualAlloc 0x0 0x44b20c 0x61550 0x5fd50 0x5c6
VirtualProtect 0x0 0x44b210 0x61554 0x5fd54 0x5cc
VirtualFree 0x0 0x44b214 0x61558 0x5fd58 0x5c9
ReleaseSemaphore 0x0 0x44b218 0x6155c 0x5fd5c 0x4b4
InterlockedPopEntrySList 0x0 0x44b21c 0x61560 0x5fd60 0x36e
InterlockedPushEntrySList 0x0 0x44b220 0x61564 0x5fd64 0x36f
InterlockedFlushSList 0x0 0x44b224 0x61568 0x5fd68 0x36c
QueryDepthSList 0x0 0x44b228 0x6156c 0x5fd6c 0x443
UnregisterWaitEx 0x0 0x44b22c 0x61570 0x5fd70 0x5b7
LoadLibraryW 0x0 0x44b230 0x61574 0x5fd74 0x3c4
WaitForSingleObject 0x0 0x44b234 0x61578 0x5fd78 0x5d7
RtlUnwind 0x0 0x44b238 0x6157c 0x5fd7c 0x4d3
ExitThread 0x0 0x44b23c 0x61580 0x5fd80 0x15f
GetModuleHandleExW 0x0 0x44b240 0x61584 0x5fd84 0x277
GetStdHandle 0x0 0x44b244 0x61588 0x5fd88 0x2d2
ExitProcess 0x0 0x44b248 0x6158c 0x5fd8c 0x15e
ADVAPI32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CryptHashData 0x0 0x44b000 0x61344 0x5fb44 0xd9
CryptCreateHash 0x0 0x44b004 0x61348 0x5fb48 0xc4
CryptDeriveKey 0x0 0x44b008 0x6134c 0x5fb4c 0xc6
CryptReleaseContext 0x0 0x44b00c 0x61350 0x5fb50 0xdc
CryptDestroyKey 0x0 0x44b010 0x61354 0x5fb54 0xc8
CryptDestroyHash 0x0 0x44b014 0x61358 0x5fb58 0xc7
CryptEncrypt 0x0 0x44b018 0x6135c 0x5fb5c 0xcb
CryptAcquireContextW 0x0 0x44b01c 0x61360 0x5fb60 0xc2
NETAPI32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
NetShareEnum 0x0 0x44b250 0x61594 0x5fd94 0xde
NetApiBufferFree 0x0 0x44b254 0x61598 0x5fd98 0x51
WINHTTP.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
WinHttpOpen 0x0 0x44b25c 0x615a0 0x5fda0 0x25
WinHttpConnect 0x0 0x44b260 0x615a4 0x5fda4 0x8
WinHttpOpenRequest 0x0 0x44b264 0x615a8 0x5fda8 0x26
WinHttpSendRequest 0x0 0x44b268 0x615ac 0x5fdac 0x33
WinHttpReceiveResponse 0x0 0x44b26c 0x615b0 0x5fdb0 0x30
WinHttpQueryDataAvailable 0x0 0x44b270 0x615b4 0x5fdb4 0x2a
WinHttpReadData 0x0 0x44b274 0x615b8 0x5fdb8 0x2d
WS2_32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
inet_pton 0x0 0x44b27c 0x615c0 0x5fdc0 0xa7
ntohl 0xe 0x44b280 0x615c4 0x5fdc4 -
htonl 0x8 0x44b284 0x615c8 0x5fdc8 -
inet_ntoa 0xc 0x44b288 0x615cc 0x5fdcc -
WSAStartup 0x73 0x44b28c 0x615d0 0x5fdd0 -
socket 0x17 0x44b290 0x615d4 0x5fdd4 -
inet_addr 0xb 0x44b294 0x615d8 0x5fdd8 -
htons 0x9 0x44b298 0x615dc 0x5fddc -
ioctlsocket 0xa 0x44b29c 0x615e0 0x5fde0 -
connect 0x4 0x44b2a0 0x615e4 0x5fde4 -
select 0x12 0x44b2a4 0x615e8 0x5fde8 -
__WSAFDIsSet 0x97 0x44b2a8 0x615ec 0x5fdec -
IPHLPAPI.DLL (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetAdaptersInfo 0x0 0x44b024 0x61368 0x5fb68 0x44
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.VNE3fKaJ Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 24.22 KB
MD5 856081727b71205daaa51425fb7046c6 Copy to Clipboard
SHA1 ceefe266fb2703a7b73386c4ebb364a28d53e324 Copy to Clipboard
SHA256 b6b4345fabe8a7269448762a4bcd5034cfd52d11fa10b54f1bb007be9fa09c5b Copy to Clipboard
SSDeep 384:p9QrBGoSZCxXTLFhvpT+aEg+laPQY3YCJQm7/rih0WNV0RzxYN9+iNSy2Dw:p+/BXTLFhvpTSu3D7roPz+l49Aw Copy to Clipboard
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.VNE3fKaJ Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 2.25 KB
MD5 fa26b644569b22e7400e3e3b09a15b56 Copy to Clipboard
SHA1 f6a5706d79eca9776d7ad347dfed61412a13f153 Copy to Clipboard
SHA256 0a84b4cf3a8e590c54eebc36d617275b1d9a4aa8d1a81bf8887547559fed4410 Copy to Clipboard
SSDeep 48:bxhKDAGAgiNuvPCQY+RfDaY96/GM2YLquT/IQgqAsU:zKDA0gunCQY+RDa9/j7dgXsU Copy to Clipboard
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.VNE3fKaJ Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 1.53 KB
MD5 aafc6fadf396126d1493d45e4ab2e522 Copy to Clipboard
SHA1 464ad07e620ac3513fdf0a6593e5907b9248a615 Copy to Clipboard
SHA256 4ed618e9c889ef2b2fb9389545203c82f768e0e136564e8e2228b1b99b6ddbc7 Copy to Clipboard
SSDeep 24:bjs6VAZuZ7t5Iunei0SiDUybw0w5Qqo5kMpLkoZwnPJ90IaEd51rVuHd7u5eTSTa:bFVA0ZyiTyU0+Km312JeTzCz Copy to Clipboard
C:\Users\5P5NRG~1\AppData\Local\Temp\notepad.vbs Created File Text
Unknown
...
»
Mime Type text/plain
File Size 0.25 KB
MD5 63b8523edc05ea6c81480dd6a3cce310 Copy to Clipboard
SHA1 d52e00a8a62f9760a6f25bd02fcee99bcbe0a006 Copy to Clipboard
SHA256 12e2d89e3e42b299fff86a00e89f5755d19547c4ed7c20bb83470a74c984f37b Copy to Clipboard
SSDeep 6:j+q9NhtLk+hit8OEf2MMfGDG0Emy11Grsn:Kq7k+hit8ZdMfexSUs Copy to Clipboard
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\_HELP.txt Created File Text
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\_HELP.txt (Created File)
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\_HELP.txt (Created File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\_HELP.txt (Created File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\_HELP.txt (Created File)
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\_HELP.txt (Created File)
Mime Type text/plain
File Size 0.23 KB
MD5 a8b45225d9d555bd9c58436519d17868 Copy to Clipboard
SHA1 3d3e60792a3d8779af9419fbf85c70beb63f6e67 Copy to Clipboard
SHA256 ac277d82c1ace787402e6c9e2c8896be3c0cccc73f26359b2cdbbef6d14e6688 Copy to Clipboard
SSDeep 6:Ao5xCi+m6fmrMjnElZKfwvRvp8ATWFcJaev27TAjtG3KUWoPdz:AWzOewzg/RK4aev27T3UgZ Copy to Clipboard
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image