Trojan-Ransom[.]Win32[.]Blocker[.]horu-29d49f92dff3b30a84fd115cad082d46f944229b610d7b05e15f56ba0c1e3c93 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Trojan-Ransom.Win32.Blocker.horu-29d49f92dff3b30a84fd115cad082d46f944229b610d7b05e15f56ba0c1e3c93
Size

98KB
MD5

dad503ae940e3848d89c706175e29152
SHA1

0aeb66fcbdb572f79f1a10910b4c72103b4a4391
SHA256

29d49f92dff3b30a84fd115cad082d46f944229b610d7b05e15f56ba0c1e3c93
SHA512

1ce082f1fb888a3b4505889d6323f5802724b945702d7c475cb0e9efbb407d9918c3449703f356e7eb732eb21c1998694373354417bcadc06394723d46c22886
SSDEEP

768:KE4H+/nzgmnFX0YXmTXVoQr3pbexjsvKQ3mNO9eM9EJfsyEqvzGGBKn4rqoIYJ:6efzgSFXf2rr3hR9AuyEq7GGU2qoIYJ

Score

N/A

Malware Config

Signatures

Files

Trojan-Ransom.Win32.Blocker.horu-29d49f92dff3b30a84fd115cad082d46f944229b610d7b05e15f56ba0c1e3c93
.exe windows x86

cde0a219f8ff2e695c89dba0042b6865

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
WriteFile
ReadFile
SetFilePointer
CreateFileA
GetTickCount
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
Sleep
GetTempPathA
lstrlenA

shell32

ShellExecuteExA
ShellExecuteA
SHChangeNotify

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ivrfbpy
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE