Static task
static1
Behavioral task
behavioral1
Sample
Trojan-Ransom.Win32.Blocker.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Trojan-Ransom.Win32.Blocker.exe
Resource
win10v2004-20220812-en
General
-
Target
Trojan-Ransom.Win32.Blocker.gueg-aa8e7b2ecb4dc7d3692ae934f924c695953d8183105eb3c445d1183c114eeee3
-
Size
436KB
-
MD5
0a4512a77336ab433cfa6ffb11a1b82e
-
SHA1
2e42b509ef8c980f95ab33e3d651695913436704
-
SHA256
aa8e7b2ecb4dc7d3692ae934f924c695953d8183105eb3c445d1183c114eeee3
-
SHA512
d2a295cf613e410a3ca214041d7abafb3657c664b226c2cf42d705540c11bb2e8a014a68a17a21364d0a724e242c4d3c17573ccb369e063fb1d6b8463005c44a
-
SSDEEP
12288:XnklJv9T21DywVCp2YqTL5mU+myoQGR/0Q:XKJFT2FCBwV9PYGRh
Malware Config
Signatures
Files
-
Trojan-Ransom.Win32.Blocker.gueg-aa8e7b2ecb4dc7d3692ae934f924c695953d8183105eb3c445d1183c114eeee3.exe windows x86
c413cad49f8cc506f9d6f4ad44265abe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
WriteFile
WideCharToMultiByte
GetVolumeInformationA
Sleep
CreateProcessA
ReadFile
GetTickCount
GetProcAddress
CopyFileA
LoadLibraryA
GetModuleFileNameA
GetVersionExA
CloseHandle
GetTempPathA
FreeLibrary
GetFileSize
MultiByteToWideChar
CreateFileA
CreateFileW
LoadLibraryW
ReadConsoleW
WriteConsoleW
SetStdHandle
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
DuplicateHandle
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
GetCommandLineA
RaiseException
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CreateSemaphoreW
CreateThread
ExitThread
LoadLibraryExW
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
advapi32
RegCreateKeyExA
RegSetValueExA
RegCloseKey
shell32
SHGetFolderPathA
ws2_32
inet_ntoa
WSAStartup
htons
connect
socket
closesocket
gethostbyname
send
getpeername
recv
Sections
.text Size: 325KB - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ