DOCSLIB.ORG

Automated Malware Analysis Report for Vnmqdhyzya.Bin

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Automated Malware Analysis Report for Vnmqdhyzya.Bin ID: 450141 Sample Name: vnMQDhyZya.bin Cookbook: default.jbs Time: 00:31:14 Date: 17/07/2021 Version: 33.0.0 White Diamond Table of Contents Table of Contents 2 Windows Analysis Report vnMQDhyZya.bin 3 Overview 3 General Information 3 Detection 3 Signatures 3 Classification 3 Process Tree 3 Malware Configuration 3 Threatname: CryLock 3 Yara Overview 5 Dropped Files 6 Memory Dumps 6 Sigma Overview 6 Jbx Signature Overview 6 AV Detection: 6 Spam, unwanted Advertisements and Ransom Demands: 6 Hooking and other Techniques for Hiding and Protection: 6 Malware Analysis System Evasion: 6 Mitre Att&ck Matrix 7 Behavior Graph 7 Screenshots 8 Thumbnails 8 Antivirus, Machine Learning and Genetic Malware Detection 8 Initial Sample 8 Dropped Files 9 Unpacked PE Files 9 Domains 9 URLs 9 Domains and IPs 9 Contacted Domains 9 Contacted IPs 9 General Information 9 Simulations 10 Behavior and APIs 10 Joe Sandbox View / Context 10 IPs 10 Domains 10 ASN 10 JA3 Fingerprints 10 Dropped Files 10 Created / dropped Files 10 Static File Info 11 General 11 File Icon 11 Static PE Info 11 General 11 Entrypoint Preview 11 Data Directories 12 Sections 12 Resources 12 Imports 12 Possible Origin 12 Network Behavior 12 Code Manipulations 12 Statistics 12 System Behavior 12 Analysis Process: vnMQDhyZya.exe PID: 4580 Parent PID: 5692 12 General 12 File Activities 13 File Created 13 File Written 13 Disassembly 13 Code Analysis 13 Copyright Joe Security LLC 2021 Page 2 of 13 Windows Analysis Report vnMQDhyZya.bin Overview General Information Detection Signatures Classification Sample vnMQDhyZya.bin Name: (renamed file extension AAnntttiiivviiirrruuss /// SSccaannnneerrr ddeettteecctttiiioonn fffoorrr ssuubb… from bin to exe) FAFonoutuinvndidr u ms aa/ lllwSwcaaarrrene n cceoornn dfffiiigegutuerrrcaattttiiioionn for sub Analysis ID: 450141 FFoouunndd rrmraananslswooamre nn cooottteen f///i g rrreuearaaddtmioene MD5: 23755a33694adc… Ransomware Found ransom note / readme IIFIccoounnn md iiirssamnasatottccmhh,, , n bboiiintneaa rr/ry yr eiiinnaccdlllumuddeeess aann iiicc… Miner Spreading SHA1: 33a68ea32f34ab6… MIcuoulnltti i m AAViVs m SSaccatacnnhnn, eebrri n ddaeerttyee cicntticioolnun d ffoeorsr ssauunbb mic mmaallliiiccciiioouusss Multi AV Scanner detection for subm… malicious SHA256: e001f6a5b2d4d26… Muullttii AAVV SSccaannnneerr ddeetteeccttiioonn ffoorr ssuubbm… Evader Phishing sssuusssppiiiccciiioouusss suspicious Tags: crylock exe ransomware YMYaaurrrlatai dAdeeVttte eScccttteaednd n CCerrrryy LdLoeoctcekkc rtrraiaonnss ofoomr wswuaabrrreme cccllleeaann clean Infos: CYCoaonrnattta adiiinenstse fffcuutnencdcttt iiiCoonrnyaaLllliiiotttyyc ktttoo r addneesttteeoccmttt wsslllaeereee… Exploiter Banker Most interesting Screenshot: DCDeoellnleetttateeisns s ss hfhuaanddcootwiwo n ddarrriilivivteye dtdoaa tdttaae (t((emcaat yys lbebee … Spyware Trojan / Bot CryLock CDCoeonlnetttataeiiinsns ss fhffuuanndccotttiiwioon ndaarlliliivitttyey ffdfooarrr t rraree a(amdd a ddyaa tbttaae f ff… Adware Score: 96 CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy ttftoo r c craaellllall ndna adtttiiaivvteea fff… Range: 0 - 100 CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo cchahelel ccnkka itiiffif v aae w wf… Whitelisted: false CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo dcdehetetteeccckttt issf aann wdd… Confidence: 100% CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo ddyeyntneaacmt iisiccaaanlllllldyy… CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo edenynunumameerirrcaaatttelel y … Process Tree CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo qequnueuerrmryy e llloroacctaaellle e… CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo rrqreeuaaeddr y ttth hloeec ccalllilii…e System is w10x64 CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo rrreettatrrridiiee vtvheee ii inncfflfoio… vnMQDhyZya.exe (PID: 4580 cmdline: 'C:\Users\user\Desktop\vnMQDhyZya.
Load more

Recommended publications
  • Building Openjfx
    Building OpenJFX Building a UI toolkit for many different platforms is a complex and challenging endeavor. It requires platform specific tools such as C compilers as well as portable tools like Gradle and the JDK. Which tools must be installed differs from platform to platform. While the OpenJFX build system was designed to remove as many build hurdles as possible, it is necessary to build native code and have the requisite compilers and toolchains installed. On Mac and Linux this is fairly easy, but setting up Windows is more difficult. If you are looking for instructions to build FX for JDK 8uNNN, they have been archived here. Before you start Platform Prerequisites Windows Missing paths issue Mac Linux Ubuntu 18.04 Ubuntu 20.04 Oracle Enterprise Linux 7 and Fedora 21 CentOS 8 Common Prerequisites OpenJDK Git Gradle Ant Environment Variables Getting the Sources Using Gradle on The Command Line Build and Test Platform Builds NOTE: cross-build support is currently untested in the mainline jfx-dev/rt repo Customizing the Build Testing Running system tests with Robot Testing with JDK 9 or JDK 10 Integration with OpenJDK Understanding a JDK Modular world in our developer build Adding new packages in a modular world First Step - development Second Step - cleanup Before you start Do you really want to build OpenJFX? We would like you to, but the latest stable build is already available on the JavaFX website, and JavaFX 8 is bundled by default in Oracle JDK 8 (9 and 10 also included JavaFX, but were superseded by 11, which does not).
    [Show full text]
  • Using FXML in Javafx
    JavaFX and FXML How to use FXML to define the components in a user interface. FXML FXML is an XML format text file that describes an interface for a JavaFX application. You can define components, layouts, styles, and properties in FXML instead of writing code. <GridPane fx:id="root" hgap="10.0" vgap="5.0" xmlns="..."> <children> <Label fx:id="topMessage" GridPane.halignment="CENTER"/> <TextField fx:id="inputField" width="80.0" /> <Button fx:id="submitButton" onAction="#handleGuess" /> <!-- more components --> </children> </GridPane> Creating a UI from FXML The FXMLLoader class reads an FXML file and creates a scene graph for the UI (not the window or Stage). It creates objects for Buttons, Labels, Panes, etc. and performs layout according to the fxml file. creates FXMLLoader reads game.fxml Code to Provide Behavior The FXML scene define components, layouts, and property values, but no behavior or event handlers. You write a Java class called a Controller to provide behavior, including event handlers: class GameController { private TextField inputField; private Button submitButton; /** event handler */ void handleGuess(ActionEvent e)... Connecting References to Objects The FXML scene contains objects for Button, TextField, ... The Controller contains references to the objects, and methods to supply behavior. How to Connect Objects to References? class GameController { private TextField inputField; private Button submitButton; /** event handler */ void handleGuess(ActionEvent e)... fx:id and @FXML In the FXML file, you assign objects an "fx:id". The fx:id is the name of a variable in the Controller class annotated with @FXML. You can annotate methods, too. fx:id="inputField" class GameController { @FXML private TextField inputField; @FXML private Button submitButton; /** event handler */ @FXML void handleGuess(ActionEvent e) The fxml "code" You can use ScaneBuilder to create the fxml file.
    [Show full text]
  • Technical Project and Product Manager Solution Architect and Senior Full Stack Developer
    Technical project and product manager Solution architect and senior full stack developer Profile Technical project and product manager, working with R&D software innovation processes, with a background as solution architect and senior full stack developer. Experienced manager of outsourced teams in many different countries, working with team efficiency based on pragmatic Scrum approach. Experience from scaled agile projects with hundreds of people involved. I am used to working with confidential information and have been security cleared several times. Knowledge I have been programming more than 20 different programming, script and database languages the last 36 years. My recent programming skills include NodeJS, JavaScript, Python, C#, Java, React for progressive web apps (PWA) and some courses in React-Native Expo. I have worked mostly with REST API architecture and a little GraphQL. I have specialist knowledge from leading CMS and DMS systems like Sitecore, DOCUMENTUM and Public 360, were I as product manager had to know Danish law on personal data and record management (ESDH). I worked many years on products for the educational sector and non-profit projects like Oligo Academy, that uses virtual worlds in primary schools for teaching environmental issues and other study subjects. Nikolaj Lisberg Hansen Born 1973 and started programming early in 1984. Got first programming job in 1995 and started working as freelance solution architect and technical project manager in 2006. I practice Tai Chi, love music and like to travel the world. Languages Very good Danish, English and German. Availability 10-25 hours per week normally remote or on-site near Copenhagen. Flexible salary between 96€ / hour (600 DKK) for remote work and 144€ / hour (900 DKK) for on-site work on product innovation or as technical project manager, solution architect or senior developer.
    [Show full text]
  • Lossless Data Compression with Transformer
    Under review as a conference paper at ICLR 2020 LOSSLESS DATA COMPRESSION WITH TRANSFORMER Anonymous authors Paper under double-blind review ABSTRACT Transformers have replaced long-short term memory and other recurrent neural networks variants in sequence modeling. It achieves state-of-the-art performance on a wide range of tasks related to natural language processing, including lan- guage modeling, machine translation, and sentence representation. Lossless com- pression is another problem that can benefit from better sequence models. It is closely related to the problem of online learning of language models. But, despite this ressemblance, it is an area where purely neural network based methods have not yet reached the compression ratio of state-of-the-art algorithms. In this paper, we propose a Transformer based lossless compression method that match the best compression ratio for text. Our approach is purely based on neural networks and does not rely on hand-crafted features as other lossless compression algorithms. We also provide a thorough study of the impact of the different components of the Transformer and its training on the compression ratio. 1 INTRODUCTION Lossless compression is a class of compression algorithms that allows for the perfect reconstruc- tion of the original data. In the last decades, statistical methods for lossless compression have been dominated by PAQ-type approaches (Mahoney, 2005). The structure of these approaches is similar to the Prediction by Partial Matching (PPM) of Cleary & Witten (1984) and are composed of two separated parts: a predictor and an entropy encoding. Entropy coding scheme like arithmetic cod- ing (Rissanen & Langdon, 1979) are optimal and most of the compression gains are coming from improving the predictor.
    [Show full text]
  • Lossy Image Compression Based on Prediction Error and Vector Quantisation Mohamed Uvaze Ahamed Ayoobkhan* , Eswaran Chikkannan and Kannan Ramakrishnan
    Ayoobkhan et al. EURASIP Journal on Image and Video Processing (2017) 2017:35 EURASIP Journal on Image DOI 10.1186/s13640-017-0184-3 and Video Processing RESEARCH Open Access Lossy image compression based on prediction error and vector quantisation Mohamed Uvaze Ahamed Ayoobkhan* , Eswaran Chikkannan and Kannan Ramakrishnan Abstract Lossy image compression has been gaining importance in recent years due to the enormous increase in the volume of image data employed for Internet and other applications. In a lossy compression, it is essential to ensure that the compression process does not affect the quality of the image adversely. The performance of a lossy compression algorithm is evaluated based on two conflicting parameters, namely, compression ratio and image quality which is usually measured by PSNR values. In this paper, a new lossy compression method denoted as PE-VQ method is proposed which employs prediction error and vector quantization (VQ) concepts. An optimum codebook is generated by using a combination of two algorithms, namely, artificial bee colony and genetic algorithms. The performance of the proposed PE-VQ method is evaluated in terms of compression ratio (CR) and PSNR values using three different types of databases, namely, CLEF med 2009, Corel 1 k and standard images (Lena, Barbara etc.). Experiments are conducted for different codebook sizes and for different CR values. The results show that for a given CR, the proposed PE-VQ technique yields higher PSNR value compared to the existing algorithms. It is also shown that higher PSNR values can be obtained by applying VQ on prediction errors rather than on the original image pixels.
    [Show full text]
  • Top 10 Reasons to Choose Autocad Raster Design 2010
    Top 10 Reasons to Choose AutoCAD Raster Design 2010 The Power of AutoCAD Minimize Costly Redrafting and Data Entry Time 1 Convert your scanned paper drawings to vector with Raster Design interactive and semiautomatic conversion tools. Use dynamic dimensioning and grip editing with vectorization Extend the power of AutoCAD® and tools to speed up the conversion and verification of raster AutoCAD-based software with AutoCAD® primitives such as lines, arcs, and circles. Easily convert Raster Design software. Make the most of continuous raster entities into AutoCAD polylines and 3D rasterized scanned drawings, maps, aerial polylines with vectorization following tools. Create and photos, satellite imagery, and digital elevation effectively manage hybrid drawings by converting only the models. Get more out of your raster data and necessary raster geometry, thereby speeding document enhance your designs, plans, presentations, and drawing revisions and updates. In addition, use optical and maps. AutoCAD Raster Design enables character recognition (OCR) functionality to recognize you to work in an AutoCAD environment, machine- and hand-printed text and tables on raster significantly reducing the need to purchase images to create AutoCAD text or multiline text (mtext). and learn multiple applications. RESULT: Speed project completion by unlocking and making the most of existing scanned engineering drawings, plans, Now Is the Time and maps. Use the Imagery You Require Take a look at how AutoCAD Raster Design AutoCAD Raster Design software supports a wide variety can help you improve your design process. 2 of industry-standard file formats, including single-image and multispectral file formats such as CALS, ER Mapper For more information about ECW, GIF, JPEG, JPEG 2000, LizardTech™ MrSID, TGA, AutoCAD Raster Design, go to TIFF, and more.
    [Show full text]
  • Metadefender Core V4.12.2
    MetaDefender Core v4.12.2 © 2018 OPSWAT, Inc. All rights reserved. OPSWAT®, MetadefenderTM and the OPSWAT logo are trademarks of OPSWAT, Inc. All other trademarks, trade names, service marks, service names, and images mentioned and/or used herein belong to their respective owners. Table of Contents About This Guide 13 Key Features of Metadefender Core 14 1. Quick Start with Metadefender Core 15 1.1. Installation 15 Operating system invariant initial steps 15 Basic setup 16 1.1.1. Configuration wizard 16 1.2. License Activation 21 1.3. Scan Files with Metadefender Core 21 2. Installing or Upgrading Metadefender Core 22 2.1. Recommended System Requirements 22 System Requirements For Server 22 Browser Requirements for the Metadefender Core Management Console 24 2.2. Installing Metadefender 25 Installation 25 Installation notes 25 2.2.1. Installing Metadefender Core using command line 26 2.2.2. Installing Metadefender Core using the Install Wizard 27 2.3. Upgrading MetaDefender Core 27 Upgrading from MetaDefender Core 3.x 27 Upgrading from MetaDefender Core 4.x 28 2.4. Metadefender Core Licensing 28 2.4.1. Activating Metadefender Licenses 28 2.4.2. Checking Your Metadefender Core License 35 2.5. Performance and Load Estimation 36 What to know before reading the results: Some factors that affect performance 36 How test results are calculated 37 Test Reports 37 Performance Report - Multi-Scanning On Linux 37 Performance Report - Multi-Scanning On Windows 41 2.6. Special installation options 46 Use RAMDISK for the tempdirectory 46 3. Configuring Metadefender Core 50 3.1. Management Console 50 3.2.
    [Show full text]
  • Draft ETSI EN 301 549 V0.0.51
    (2018-02) Draft EN 301 549 V2.1.1 HARMONISED EUROPEAN STANDARD Accessibility requirements for ICT products and services 2 Draft EN 301 549 V2.1.1 (2018-02) Reference REN/HF-00 301 549 Keywords accessibility, HF, ICT, procurement CEN CENELEC ETSI Avenue Marnix 17 Avenue Marnix 17 650 Route des Lucioles B-1000 Brussels - BELGIUM B-1000 Brussels - BELGIUM F-06921 Sophia Antipolis Cedex - FRANCE Tel: + 32 2 550 08 11 Tel.: +32 2 519 68 71 Fax: + 32 2 550 08 19 Fax: +32 2 519 69 19 Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88 Important notice Individual copies of the present document can be downloaded from: ETSI Search & Browse Standards The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at ETSI deliverable status If you find errors in the present document, please send your comment to one of the following services: ETSI Committee Support Staff Copyright Notification No part may be reproduced except as authorized by written permission.
    [Show full text]
  • Manuel De Juk
    Manuel de JuK Lauri Watts Michael Pyne Scott Wheeler Traduction française : Robert Jacolin Traduction française : Ludovic Grossard Relecture de la documentation française : Ludovic Grossard Manuel de JuK 2 Table des matières 1 Introduction 5 2 Utiliser JuK 6 2.1 La liste des chansons . .7 2.2 Listes de lecture de JuK . .9 2.3 L’éditeur d’étiquettes de JuK . 10 2.3.1 Modifier les étiquettes d’un unique fichier . 10 2.3.2 Modification d’étiquettes dans plusieurs fichiers . 11 2.4 La boîte de dialogue pour renommer les fichiers . 12 2.5 La boîte de dialogue de configuration du devineur d’étiquettes . 13 2.6 La boîte de dialogue de recherche avancée . 14 3 La barre d’outils de JuK 15 3.1 La barre principale . 15 3.2 La barre de recherche . 16 4 Référence du menu et des commandes 17 4.1 Menus . 17 4.1.1 Menu Fichier . 17 4.1.2 Menu Édition . 18 4.1.3 Menu Affichage . 18 4.1.4 Menu Lecteur . 19 4.1.5 Menu Éditeur d’en-tête . 19 4.1.6 Menu Configuration . 20 4.2 Référence des raccourcis clavier . 21 5 Remerciements et licence 22 Résumé JuK est un juke-box, un éditeur d’étiquettes et un gestionnaire de discothèque. Manuel de JuK Chapitre 1 Introduction JuK est un vrai juke-box. Comme la plupart des applications juke-box, JuK vous permet de mo- difier les “étiquettes” de vos fichiers audio et de gérer votre collection et vos listes de lecture. 5 Manuel de JuK Chapitre 2 Utiliser JuK JuK maintient une liste de tous les fichiers qu’il connaît.
    [Show full text]
  • Unifying Modeling and Programming with ALF
    SOFTENG 2016 : The Second International Conference on Advances and Trends in Software Engineering Unifying Modeling and Programming with ALF Thomas Buchmann and Alexander Rimer University of Bayreuth Chair of Applied Computer Science I Bayreuth, Germany email: fthomas.buchmann, [email protected] Abstract—Model-driven software engineering has become more The Eclipse Modeling Framework (EMF) [5] has been and more popular during the last decade. While modeling the established as an extensible platform for the development of static structure of a software system is almost state-of-the art MDSE applications. It is based on the Ecore meta-model, nowadays, programming is still required to supply behavior, i.e., which is compatible with the Object Management Group method bodies. Unified Modeling Language (UML) class dia- (OMG) Meta Object Facility (MOF) specification [6]. Ideally, grams constitute the standard in structural modeling. Behavioral software engineers operate only on the level of models such modeling, on the other hand, may be achieved graphically with a set of UML diagrams or with textual languages. Unfortunately, that there is no need to inspect or edit the actual source code, not all UML diagrams come with a precisely defined execution which is generated from the models automatically. However, semantics and thus, code generation is hindered. In this paper, an practical experiences have shown that language-specific adap- implementation of the Action Language for Foundational UML tations to the generated source code are frequently necessary. (Alf) standard is presented, which allows for textual modeling In EMF, for instance, only structure is modeled by means of of software systems.
    [Show full text]
  • Plantuml Language Reference Guide (Version 1.2021.2)
    Drawing UML with PlantUML PlantUML Language Reference Guide (Version 1.2021.2) PlantUML is a component that allows to quickly write : • Sequence diagram • Usecase diagram • Class diagram • Object diagram • Activity diagram • Component diagram • Deployment diagram • State diagram • Timing diagram The following non-UML diagrams are also supported: • JSON Data • YAML Data • Network diagram (nwdiag) • Wireframe graphical interface • Archimate diagram • Specification and Description Language (SDL) • Ditaa diagram • Gantt diagram • MindMap diagram • Work Breakdown Structure diagram • Mathematic with AsciiMath or JLaTeXMath notation • Entity Relationship diagram Diagrams are defined using a simple and intuitive language. 1 SEQUENCE DIAGRAM 1 Sequence Diagram 1.1 Basic examples The sequence -> is used to draw a message between two participants. Participants do not have to be explicitly declared. To have a dotted arrow, you use --> It is also possible to use <- and <--. That does not change the drawing, but may improve readability. Note that this is only true for sequence diagrams, rules are different for the other diagrams. @startuml Alice -> Bob: Authentication Request Bob --> Alice: Authentication Response Alice -> Bob: Another authentication Request Alice <-- Bob: Another authentication Response @enduml 1.2 Declaring participant If the keyword participant is used to declare a participant, more control on that participant is possible. The order of declaration will be the (default) order of display. Using these other keywords to declare participants
    [Show full text]
  • Chapter 2 HISTORY and DEVELOPMENT of MILITARY LASERS
    History and Development of Military Lasers Chapter 2 HISTORY AND DEVELOPMENT OF MILITARY LASERS JACK B. KELLER, JR* INTRODUCTION INVENTING THE LASER MILITARIZING THE LASER SEARCHING FOR HIGH-ENERGY LASER WEAPONS SEARCHING FOR LOW-ENERGY LASER WEAPONS RETURNING TO HIGHER ENERGIES SUMMARY *Lieutenant Colonel, US Army (Retired); formerly, Foreign Science Information Officer, US Army Medical Research Detachment-Walter Reed Army Institute of Research, 7965 Dave Erwin Drive, Brooks City-Base, Texas 78235 25 Biomedical Implications of Military Laser Exposure INTRODUCTION This chapter will examine the history of the laser, Military advantage is greatest when details are con- from theory to demonstration, for its impact upon the US cealed from real or potential adversaries (eg, through military. In the field of military science, there was early classification). Classification can remain in place long recognition that lasers can be visually and cutaneously after a program is aborted, if warranted to conceal hazardous to military personnel—hazards documented technological details or pathways not obvious or easily in detail elsewhere in this volume—and that such hazards deduced but that may be relevant to future develop- must be mitigated to ensure military personnel safety ments. Thus, many details regarding developmental and mission success. At odds with this recognition was military laser systems cannot be made public; their the desire to harness the laser’s potential application to a descriptions here are necessarily vague. wide spectrum of military tasks. This chapter focuses on Once fielded, system details usually, but not always, the history and development of laser systems that, when become public. Laser systems identified here represent used, necessitate highly specialized biomedical research various evolutionary states of the art in laser technol- as described throughout this volume.
    [Show full text]