Static task
static1
Behavioral task
behavioral1
Sample
d2dd95ab8754841524a840a32441f1c9ff0a1d83a42e7d6540c3265c0ae307e5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d2dd95ab8754841524a840a32441f1c9ff0a1d83a42e7d6540c3265c0ae307e5.exe
Resource
win10v2004-en-20220113
General
-
Target
d2dd95ab8754841524a840a32441f1c9ff0a1d83a42e7d6540c3265c0ae307e5
-
Size
80KB
-
MD5
50c6b1b805ec8888b55e21cfa0b57ece
-
SHA1
65780953a32da22a7f84076ec1510cd4e8528cf4
-
SHA256
d2dd95ab8754841524a840a32441f1c9ff0a1d83a42e7d6540c3265c0ae307e5
-
SHA512
c49fe7f6013a8e14214c17d483fcaf906bc8bcce98c297be9744aa4e0fd2a73cbe758bd786eb70926b27686ee294bacd68136583ac0226fae39d16c0b31666f1
-
SSDEEP
1536:9wX4BHaWAMfo5Kc3lBnXOU+hhOZuIW0C7RZiuxJNcvFMfQL:9dYSf0j3lxXxkhOZu10C7RhwvF
Malware Config
Signatures
-
Detected Netwalker Ransomware 1 IoCs
Detected unpacked Netwalker executable.
resource yara_rule sample netwalker_ransomware -
Netwalker family
Files
-
d2dd95ab8754841524a840a32441f1c9ff0a1d83a42e7d6540c3265c0ae307e5.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ