e75e6de7...15ca | VTI
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Riskware, Downloader, Wiper, Ransomware

e75e6de7b10900b328ff8f80504a191874ee8c45ca6df94c7ceb59e62cbb15ca (SHA256)

Ransomware.exe

Windows Exe (x86-32)

Created at 2018-09-23 21:30:00

Notifications (1/1)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

Severity Category Operation Classification
5/5
File System Encrypts content of user files Ransomware
  • Encrypts the content of multiple user files. This is an indicator for ransomware.
2/5
Anti Analysis Tries to detect debugger -
2/5
Anti Analysis Resolves APIs dynamically to possibly evade static detection -
1/5
Masquerade Changes folder appearance Riskware
  • Folder "c:\users\ciihmnxmn6ps\pictures\saved pictures" has a changed appearance.
  • Folder "c:\users\ciihmnxmn6ps\pictures\camera roll" has a changed appearance.
  • Folder "c:\users\ciihmnxmn6ps\documents\my shapes" has a changed appearance.
1/5
File System Creates an unusually large number of files -
1/5
Network Downloads data Downloader
1/5
Network Connects to HTTP server -
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image