Static task
static1
Behavioral task
behavioral1
Sample
0b3add1edb40d5164ee57e84f7462ee4ff3ef6da65b14ebb6b50b2222d45bc1c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0b3add1edb40d5164ee57e84f7462ee4ff3ef6da65b14ebb6b50b2222d45bc1c.exe
Resource
win10v2004-en-20220113
General
-
Target
0b3add1edb40d5164ee57e84f7462ee4ff3ef6da65b14ebb6b50b2222d45bc1c
-
Size
70KB
-
MD5
a95e39d38e764abb019d4c9b08dbee67
-
SHA1
e5e612f680fd17fb5cd4f2efc7ebd026ad169406
-
SHA256
0b3add1edb40d5164ee57e84f7462ee4ff3ef6da65b14ebb6b50b2222d45bc1c
-
SHA512
2f19f1471c4ad75ce109af9d5305232a33d5ac7423dcfffddbeb401e5cabb6f62586e27cec6e0e8770eb2822c6fc2275592fa25f3193198bfa26afa5f82a6e81
-
SSDEEP
768:lXStkFWTBhyugDC60CPJkEBx9w7mSDh3vkkjv4hT3ED18nv04ZPqpb348Uq1krH2:liMWV3gDCk6EBwT/kLbvkbuq1kfj0D
Malware Config
Signatures
-
Nefilim Ransomware Executable 1 IoCs
File contains patterns typical of Nefilim samples.
Processes:
resource yara_rule sample nefilim_ransomware -
Nefilim family
Files
-
0b3add1edb40d5164ee57e84f7462ee4ff3ef6da65b14ebb6b50b2222d45bc1c.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ