7850996135.zip
- SHA256 8ec919064791aa84aad6bb1374d6c67a8f5c254820f2f9a849a78f61eb6fada2
Password
infected
Behavioral task
behavioral1
Sample
d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 7850996135.zip
- Size 201KB
- Sample220818-vb3y7scbb9
- SHA256 8ec919064791aa84aad6bb1374d6c67a8f5c254820f2f9a849a78f61eb6fada2
- MD5 0699b5531c4fc2cee19d321270a8685b
- SHA1 3f2195d6496e7a476fa080a4da78750ad9eadfbe
- SHA512 fcb744230d0a279135007f38324bc27d09dbb0f330fff90fe0fe19571fbce353c885c86153c96ba9c72080b57cc0403af1a3256ce8cec81a7a913f9cd0a59039
- SSDEEP 6144:JPTudNtlyg33EW9biyHAU6cc1Ivfh3wFU:JSfyE04bWU6cc1mfhIU
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Yanluowang ransomware 1 IoCs
resource yara_rule static1/unpack001/d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c family_yanluowang - Yanluowang family
File Explorer
-
7850996135.zip.zip 201KB
-
d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe 398KB
d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c
- IMPHASH 380467bc2cc16b8ce64d4802632fe491
- SHA256 d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c
- MD5 afaf2d4ebb6dc47e79a955df5ad1fc8a
- SHA1 c418ce055d97928f94ba06b5de8124a601d8f632
- SHA512 321424ac21ebdb7f759a84236cb95c533b3000b3143099e1697f4a1f534c11782dafa68e5fa9e662b973b9669c1177b69c2fd0b83455625e57aa123385f581e6
- SSDEEP 12288:EfaLQyGK6kAa2XgsA1RUa+jE6S3qRTjO0:EwIHnXp/O0
- MD5 SHA1 SHA512 SSDEEP
-
Detects Yanluowang ransomware
Password
infected
Digest
13:75:f2:56:f6:c0:e3:b2:b3:4e:2f:1a:72:f9:5d:97:d7:c3:e7:74
Digest Algorithm
sha1
PE Digests Matches
Trusted
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2013 - Jan 15, 2038
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=701872,CN=AdClearance Limited,O=AdClearance Limited,L=Dublin,C=IE,1.3.6.1.4.1.311.60.2.1.3=#13024945,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0d:0d:a8:84:0c:1a:95:9d:09:32:47:fa:33:6e:5a:2d
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 3, 2021 - Sep 3, 2022
Minor OS version
Major OS version
Entry point
145671
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Process32FirstW
CloseHandle
GetLogicalDriveStringsA
SetFilePointerEx
LocalFree
SystemTimeToFileTime
GetSystemTime
MoveFileW
GetDriveTypeW
CreateFileA
LocalAlloc
SetFilePointer
FindNextFileA
SetFileTime
TerminateProcess
WriteFile
GetCurrentProcess
FindFirstFileA
Process32NextW
GetLastError
CreateToolhelp32Snapshot
OpenProcess
CreateFileW
GetCurrentDirectoryA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
GetFileSizeEx
GetModuleHandleW
GetProcAddress
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
InterlockedPushEntrySList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
HeapAlloc
HeapFree
GetFileType
GetFileAttributesExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
HeapReAlloc
HeapSize
FindClose
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
WriteConsoleW
FindFirstFileW
CreateEventW
ReadFile
advapi32
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
SetNamedSecurityInfoA
CryptEncrypt
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken
FreeSid
shell32
ShellExecuteA
crypt32
CryptStringToBinaryA
CryptDecodeObjectEx
CryptBinaryToStringA
CryptImportPublicKeyInfo
Name
.text
Size
279KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ