Trojan-Ransom[.]Win32[.]Blocker[.]heoy-b79780c4f258ae255110ce438b31a8d0b355bc852706fab212d1284df5c65650 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Trojan-Ransom.Win32.Blocker.heoy-b79780c4f258ae255110ce438b31a8d0b355bc852706fab212d1284df5c65650
Size

308KB
MD5

0e7460fe4160e0caff923afb79b2a5da
SHA1

39263ad111cf8bf9135ed752578236f1c7020bd4
SHA256

b79780c4f258ae255110ce438b31a8d0b355bc852706fab212d1284df5c65650
SHA512

69e144ca62ea672faaad415e5c571153365595e5aeaaef35a1492001282bfa6a463799b72d8bc3e6db677ecb0b15e7e46ad5a0a4b2fc56e015e3f419948a18ec
SSDEEP

6144:WBZPbEkTLCBTvUgldtu34dKXqKjIdoCXdaONE5FhdPr:WBZbEkTLCBTvUgldtu34dKXqZ5XdaaEj

Score

N/A

Malware Config

Signatures

Files

Trojan-Ransom.Win32.Blocker.heoy-b79780c4f258ae255110ce438b31a8d0b355bc852706fab212d1284df5c65650
.exe windows x86

cad9d7a1e55dc4edd87135d205fee319

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlMoveMemory

msvbvm60

MethCallEngine
ord516
ord631
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ProcCallEngine
ord537
ord644
ord100
ord616
ord581

Sections

.text
Size: 176KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ