Behavioral task
behavioral1
Sample
Trojan-Ransom.Win32.Blocker.exe
Resource
win7-20220812-en
General
-
Target
Trojan-Ransom.Win32.Blocker.ezxj-ed4f4d1c793df2039ff33416bfa650a392492720fcd684bff997261f22f391d1
-
Size
584KB
-
MD5
b60424fa1a6e4ed0deb5610101d5c31c
-
SHA1
b5d3467d8a377ba925d1ddcf0a26c1a077838d01
-
SHA256
ed4f4d1c793df2039ff33416bfa650a392492720fcd684bff997261f22f391d1
-
SHA512
4620d1d59d821ae7500af490c8ec0c83a4fe782891a15c2887eca76622e76700132dbeb54d0ffe5436d205399cea147de1f8484cf8a3ad98939fc3fcebb44daf
-
SSDEEP
12288:+j35Pjg+dio2pc9XmQipZ1VRqqqI250gBVz+v3+jH5p:+j35PjgKmcUpZ1VE1h5svujZp
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
Trojan-Ransom.Win32.Blocker.ezxj-ed4f4d1c793df2039ff33416bfa650a392492720fcd684bff997261f22f391d1.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 272KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 553KB - Virtual size: 556KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736KB - Virtual size: 736KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ