Loading... Additional Content is being loaded
Analysis Report Sample_5fba9b06c7da400016eb6275.exe
Overview
General Information
| Sample Name: | Sample_5fba9b06c7da400016eb6275.exe |
| Analysis ID: | 326335 |
| MD5: | 0e285f30f30dedd812295d2408f4b84c |
| SHA1: | 24e8a7a0b9fdf929e6cc4b52b0470bf4f7b6f244 |
| SHA256: | d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95 |
|
Most interesting Screenshot:  |
|
Detection
Sodinokibi
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Found malware configuration
Found ransom note / readme
Multi AV Scanner detection for submitted file
Yara detected Sodinokibi Ransomware
Contains functionality to detect sleep reduction / modifications
Found Tor onion address
Found evasive API chain (may stop execution after checking mutex)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Checks for available system drives (often done to infect USB drives)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to delete services
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
AV Detection: |
  |
|---|
| Antivirus / Scanner detection for submitted sample |
| Source: |
Avira: |
||
| Found malware configuration |
| Source: |
Malware Configuration Extractor: | ||