chaos | 9c7ed72403a5634030c579918dc7de26f6ff54a531041a75a8dac0a4828ec937

Sharing

Copy URL Twitter E-mail

General

Target

9c7ed72403a5634030c579918dc7de26f6ff54a531041a75a8dac0a4828ec937
Size

117KB
MD5

d7b6db1727fbce074304a7f52e745410
SHA1

05289d8730edcf6998f7ca1ee04c15fb1287a106
SHA256

9c7ed72403a5634030c579918dc7de26f6ff54a531041a75a8dac0a4828ec937
SHA512

bbef23731a582003dadd07f1a424ead9d9e341cd76fe837b3fe474cd911ac603bd347d8824d2bc51f5db32daf068733b78830baba6639679ff3c8ead47bffbd3
SSDEEP

3072:4o2N8ur9MAHLPYBtBsGLUS3FTotB5CHcv+q1l3sBtENOZ:Udr9MSLPOB1L330GoE

Score

10^/10

chaos

Malware Config

Signatures

Chaos Ransomware 1 IoCs

resource	yara_rule
sample	family_chaos

Chaos family
chaos

Files

9c7ed72403a5634030c579918dc7de26f6ff54a531041a75a8dac0a4828ec937
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:02:f4:9e:46:9c:54:13:7b:85:e0:00:00:00:00:02:f4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

29/04/2021, 19:15

Not After

28/04/2022, 19:15

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b9:55:91:21:8b:44:86:88:9e:1f:19:d0:d1:05:2e:0a:1c:9f:c6:69:c1:fa:6b:75:e8:ab:2f:bf:5e:61:38:f5
Signer

Actual PE Digest

b9:55:91:21:8b:44:86:88:9e:1f:19:d0:d1:05:2e:0a:1c:9f:c6:69:c1:fa:6b:75:e8:ab:2f:bf:5e:61:38:f5

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

04/11/2022, 15:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:02:f4:9e:46:9c:54:13:7b:85:e0:00:00:00:00:02:f4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

b9:55:91:21:8b:44:86:88:9e:1f:19:d0:d1:05:2e:0a:1c:9f:c6:69:c1:fa:6b:75:e8:ab:2f:bf:5e:61:38:f5Signer

Signature Validations

Verification

04/11/2022, 15:42 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 98KB - Virtual size: 98KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:02:f4:9e:46:9c:54:13:7b:85:e0:00:00:00:00:02:f4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b9:55:91:21:8b:44:86:88:9e:1f:19:d0:d1:05:2e:0a:1c:9f:c6:69:c1:fa:6b:75:e8:ab:2f:bf:5e:61:38:f5
Signer

04/11/2022, 15:42
Valid: false

.text
Size: 98KB - Virtual size: 98KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B