netwalker | e35d0d61c0a6ba265e826435eb222ade8272668df6094595fd6a9a21b3f843c3 | Triage

Sharing

General

Target

e35d0d61c0a6ba265e826435eb222ade8272668df6094595fd6a9a21b3f843c3
Size

65KB
MD5

17c00e51b802ca73c3fe75dc4fc9c4f3
SHA1

df10c7190b811a19abaf3814520a3a78bb0e5194
SHA256

e35d0d61c0a6ba265e826435eb222ade8272668df6094595fd6a9a21b3f843c3
SHA512

4c6cfb7d149be0db7eca2b4f8d6d31d737e134e72956d32154641aaa7ff048b2ee917bb4981bdca3c16c20149ac8f2f46af1582ed72085339513ad187b935cdd
SSDEEP

1536:9wX4BHaWAMfo5Kc3lBnXOU+hhOZuIW0C7RZiuxi4mL:9dYSf0j3lxXxkhOZu10C7Rhi

Score

10^/10

netwalker

Malware Config

Signatures

Detected Netwalker Ransomware 1 IoCs

Detected unpacked Netwalker executable.

resource	yara_rule
sample	netwalker_ransomware

Netwalker family
netwalker

Files

e35d0d61c0a6ba265e826435eb222ade8272668df6094595fd6a9a21b3f843c3
.exe windows x86

e82dd51b077167be63c004bed23d0c1e

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ