Trojan-Ransom[.]Win32[.]Blocker[.]hedh-c56d1f06cf31d899dc835ba899cc0adb42fff7ae2d3c0cf83b64cf418d59b964

Sharing

Copy URL

Twitter E-mail

General

Target

Trojan-Ransom.Win32.Blocker.hedh-c56d1f06cf31d899dc835ba899cc0adb42fff7ae2d3c0cf83b64cf418d59b964
Size

53KB
MD5

19715371b2e7d19daccda45c33650d88
SHA1

609f6d2049b9b1fce81a46abd8a1c1309ff24454
SHA256

c56d1f06cf31d899dc835ba899cc0adb42fff7ae2d3c0cf83b64cf418d59b964
SHA512

1b5f2368a95c046ebd02c4a9243020faaff7ab6555dc58e5a3837baf48125868b8562c2ce5cd70e5e8cf2ed5c7376bf224805f1fbec0f838ae8a87a039aad840
SSDEEP

768:6JKH3OUJzRPTPTIFa+hdrhMN+jcoJxzAM8I4opzsNbAkhO3BzsPKwGoOyD+w0fsv:o5UHya+Du+BANNNJORwtOo0Uv

Score

N/A

Malware Config

Signatures

Files

Trojan-Ransom.Win32.Blocker.hedh-c56d1f06cf31d899dc835ba899cc0adb42fff7ae2d3c0cf83b64cf418d59b964
.exe windows x86

63ee4124520f8b8cad569033621a85ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

WSAStartup
recv
WSACleanup
gethostname
gethostbyname
inet_addr
closesocket
socket
ioctlsocket
htons
connect
send

wininet

InternetReadFile
InternetOpenA
InternetCloseHandle
InternetOpenUrlA

kernel32

GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
ExitThread
SetEvent
Sleep
CloseHandle
WaitForSingleObject
CreateThread
CreateEventA
GetComputerNameA
GetLocaleInfoA
GetTickCount
GetModuleFileNameA
CopyFileA
GetWindowsDirectoryA
GetTempPathA
GetVolumeInformationA
ExitProcess
WinExec
GetLastError
GetCurrentProcessId
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
Module32Next
Module32First
SetFileAttributesA
CreateMutexA
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess

user32

SetWindowsHookExA
CallNextHookEx
GetKeyState
GetKeyboardState
ToAscii
MapVirtualKeyA
GetLastInputInfo
MessageBoxA
GetForegroundWindow
GetWindowTextA
GetMessageA
DispatchMessageA
TranslateMessage

advapi32

GetCurrentHwProfileA
GetUserNameA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

msvcr100

_fmode
_commode
__setusermatherr
_configthreadlocale
__set_app_type
_initterm
_crt_debugger_hook
_except_handler4_common
_invoke_watson
_controlfp_s
?terminate@@YAXXZ
_initterm_e
_itoa
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_acmdln
_ismbblead
_XcptFilter
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
memcpy
memmove
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
memset
strchr
fclose
fopen
sprintf
atoi
printf
fread
calloc
ftell
fseek
system
remove
_ctime64
_time64
fputs
exit
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_cexit
_exit

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

urlmon

URLDownloadToFileA

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63ee4124520f8b8cad569033621a85ab

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

wininet

kernel32

user32

advapi32

shell32

msvcr100

msvcp100

urlmon

Sections

.text Size: 38KB - Virtual size: 38KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 968B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 38KB - Virtual size: 38KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 3KB - Virtual size: 2KB