HEUR-Trojan-Ransom[.]Win32[.]Generic-8e98c2dbb6c9fccebaca440ac922aada5609ee6550bc965da5124d262bef4e49[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

HEUR-Trojan-Ransom.Win32.Generic-8e98c2dbb6c9fccebaca440ac922aada5609ee6550bc965da5124d262bef4e49.exe
Size

895KB
MD5

0ae4d3e7d7e15458063a9404c822ae10
SHA1

67917520834b5a7aa9355a77959a0ee42e25fa25
SHA256

8e98c2dbb6c9fccebaca440ac922aada5609ee6550bc965da5124d262bef4e49
SHA512

1d5c6af03a872c97904fca4f9cdc741b316565cc0bd83a41d93a3b895bc95f5e72ed85683054561740c94e16522e0f898be0f9cff711bfc4841bd4b2c3c4f339
SSDEEP

12288:dX1bx1JZ/lY7NNsBceiGGpwIJl+nxVmU0a5Z8qa6b/4aepxOR1y/KuvBP:ttfJpi7f6ywIyPmU0sva6bg/no1IvBP

Score

N/A

Malware Config

Signatures

Files

HEUR-Trojan-Ransom.Win32.Generic-8e98c2dbb6c9fccebaca440ac922aada5609ee6550bc965da5124d262bef4e49.exe
.exe windows x86

2f14a93e45bcb13ad64a748a43de69c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
SetEndOfFile
SetPriorityClass
GetSystemTime
GetDiskFreeSpaceExW
OpenProcess
GetTempPathW
LocalFree
DeleteFileW
FindFirstFileW
FindClose
GetVolumeNameForVolumeMountPointW
FindNextFileW
SetThreadPriority
GetCurrentThread
GetFileAttributesW
WaitForMultipleObjects
SetEvent
CreateEventA
ReOpenFile
SetLastError
GlobalSize
GlobalLock
GlobalUnlock
GetProcAddress
LoadLibraryA
GetCurrentProcessId
DeleteFileA
ResetEvent
HeapAlloc
GetProcessHeap
GetFileSize
lstrcmpiA
GlobalMemoryStatusEx
IsWow64Process
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetConsoleWindow
SetFilePointerEx
DeviceIoControl
CreateFileA
GetDriveTypeA
GetSystemWindowsDirectoryW
GetLogicalDrives
GetLastError
MoveFileW
SetFileAttributesW
CreateDirectoryW
ReadFile
GetFileSizeEx
Wow64RevertWow64FsRedirection
CreateProcessW
Wow64DisableWow64FsRedirection
CloseHandle
FlushFileBuffers
WriteFile
CreateFileW
OutputDebugStringW
WaitForSingleObject
CreateThread
GetModuleFileNameW
Sleep
FindFirstFileExW
ReadConsoleW
GetConsoleMode
GetConsoleCP
HeapQueryInformation
HeapSize
HeapReAlloc
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCommandLineW
GetCommandLineA
GetStdHandle
FreeLibraryAndExitThread
HeapFree
GetCurrentProcess
ExitThread
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
WriteConsoleW
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
CreateEventW
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent

user32

wsprintfA
GetDC
GetSystemMetrics
ShowWindow
ReleaseDC

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
DeleteDC
BitBlt
SelectObject

advapi32

RegCloseKey
RegisterServiceCtrlHandlerW
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetEntriesInAclW
SetNamedSecurityInfoW
GetTokenInformation
ConvertSidToStringSidA
OpenProcessToken
SetServiceStatus
RegSetValueExA
RegCreateKeyExA
StartServiceCtrlDispatcherW

ole32

GetHGlobalFromStream
CLSIDFromString
CreateStreamOnHGlobal

psapi

GetModuleFileNameExW
GetModuleFileNameExA
EnumProcesses

ws2_32

select
ioctlsocket
WSAStartup
closesocket
recv
send
setsockopt
connect
htons
inet_addr
socket

iphlpapi

GetAdaptersInfo

netapi32

NetApiBufferFree
NetShareEnum

gdiplus

GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipFree
GdipSaveImageToStream
GdipBitmapGetPixel
GdipGetImageWidth
GdipGetImageHeight
GdipCloneImage
GdipDisposeImage
GdipAlloc

rstrtmgr

RmRegisterResources
RmGetList
RmEndSession
RmStartSession

Sections

.text
Size: 497KB - Virtual size: 496KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 240KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f14a93e45bcb13ad64a748a43de69c2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

psapi

ws2_32

iphlpapi

netapi32

gdiplus

rstrtmgr

Sections

.text Size: 497KB - Virtual size: 496KB

.rdata Size: 134KB - Virtual size: 134KB

.data Size: 240KB - Virtual size: 244KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 497KB - Virtual size: 496KB

.rdata
Size: 134KB - Virtual size: 134KB

.data
Size: 240KB - Virtual size: 244KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 22KB - Virtual size: 21KB