Static task
static1
Behavioral task
behavioral1
Sample
SAT-NWM9709244W4-CAIW89615-763889hi7F9211309cfdid1ab201401d4f916b1d7DF.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SAT-NWM9709244W4-CAIW89615-763889hi7F9211309cfdid1ab201401d4f916b1d7DF.exe
Resource
win10v2004-20220901-en
General
-
Target
Trojan-Ransom.Win32.Blocker.eppv-be1cdcf3e4809bed3443711d7af9f604e385a8301a3fe9c6692c444201e9023c
-
Size
45KB
-
MD5
0427ac1598de5a99771df5b8d0625229
-
SHA1
73fa4418fb23d7b46780925e294e9f7b6bcc705d
-
SHA256
be1cdcf3e4809bed3443711d7af9f604e385a8301a3fe9c6692c444201e9023c
-
SHA512
6b9825d76e7507ccc9d4e949e56cb196892a2b9ffabbdd309873c92679be3a557ab153547bbc375f048110aa44b12990861ff08470821b17553203e3b4cce56f
-
SSDEEP
768:D1OBvGdchcOkTJ8IFgEJpyr5lzfc4/1nfSxCcVOMH1b7EAumAkfW:DSv3cOk98IFgEJpIfc4/FfSRAWeku
Malware Config
Signatures
Files
-
Trojan-Ransom.Win32.Blocker.eppv-be1cdcf3e4809bed3443711d7af9f604e385a8301a3fe9c6692c444201e9023c.rar
-
SAT-NWM9709244W4-CAIW89615-763889hi7F9211309cfdid1ab201401d4f916b1d7DF.exe.exe windows x86
a7889d7d19b06d02aa7286ee5d9ca95b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
SelectFontLocal
LineDDA
GetOutlineTextMetricsA
CopyMetaFileA
GdiPlayScript
GetCharWidth32A
CreateBitmap
GetTextExtentExPointI
LineTo
CreateFontA
SetMapperFlags
GetGlyphOutlineA
SetDeviceGammaRamp
ExtEscape
UpdateICMRegKeyA
CreateMetaFileW
PlayEnhMetaFile
GetColorSpace
SetEnhMetaFileBits
OffsetRgn
LPtoDP
CreateDCW
SetAbortProc
GetPixel
SetRectRgn
UnrealizeObject
GetTextCharsetInfo
RemoveFontResourceExA
Pie
SetWinMetaFileBits
ExtCreatePen
EnumObjects
RestoreDC
StretchBlt
GetDCOrgEx
CreateCompatibleDC
SelectObject
PolylineTo
GdiGetSpoolFileHandle
EndDoc
SetPixel
DPtoLP
GetWorldTransform
CopyEnhMetaFileA
PatBlt
GdiResetDCEMF
GetObjectA
CreateColorSpaceW
GetClipRgn
gdiPlaySpoolStream
GetStretchBltMode
OffsetClipRgn
GetMetaFileBitsEx
FlattenPath
SetRelAbs
SetMetaRgn
GetTextFaceA
GdiEndPageEMF
CreateHatchBrush
GdiComment
SetICMMode
PlayEnhMetaFileRecord
CreateDIBPatternBrush
GdiDeleteSpoolFileHandle
GetTextCharset
SetTextAlign
EndPath
GdiStartPageEMF
ExtSelectClipRgn
DeleteMetaFile
PaintRgn
GetNearestColor
ColorMatchToTarget
GetColorAdjustment
SelectPalette
CreateColorSpaceA
GdiStartDocEMF
EndPage
SetColorSpace
CheckColorsInGamut
GetMetaFileW
EnumEnhMetaFile
PolyPolygon
GetBkColor
ExtTextOutA
ModifyWorldTransform
MaskBlt
Rectangle
SelectClipPath
GetSystemPaletteEntries
UpdateICMRegKeyW
GetRandomRgn
GetKerningPairsW
GdiSetBatchLimit
CreateDIBPatternBrushPt
GetDCBrushColor
CreateBrushIndirect
ResetDCW
SetTextCharacterExtra
Escape
GetEnhMetaFileW
EnumFontFamiliesA
GetMapMode
CreateDIBSection
GetDeviceCaps
GetRasterizerCaps
BeginPath
GdiEndDocEMF
GetICMProfileW
GetDIBits
Polyline
EndFormPage
EnumFontFamiliesW
PolyDraw
IntersectClipRect
FloodFill
CreateScalableFontResourceA
RemoveFontResourceExW
GetEnhMetaFileHeader
GetNearestPaletteIndex
CreateICA
SetPixelV
ExtTextOutW
GetEnhMetaFileDescriptionA
GetCharacterPlacementW
GetRegionData
CreatePolyPolygonRgn
SetSystemPaletteUse
CreateRectRgn
DrawEscape
SetArcDirection
SetBkColor
GetEnhMetaFilePaletteEntries
CombineTransform
SetPixelFormat
GetViewportExtEx
PlgBlt
PlayMetaFileRecord
CreateDCA
CloseFigure
EnumICMProfilesA
GdiArtificialDecrementDriver
SetBkMode
GetClipBox
StartDocA
EnumFontFamiliesExA
PolyBezier
CreateRoundRectRgn
PtInRegion
GetFontAssocStatus
SetWorldTransform
CopyMetaFileW
EnumFontsA
GetBitmapDimensionEx
GdiPlayPrivatePageEMF
GetLogColorSpaceA
EqualRgn
GetBoundsRect
PathToRegion
CreateEllipticRgnIndirect
GetWindowOrgEx
CombineRgn
RemoveFontMemResourceEx
GetTextColor
GetCurrentObject
GetObjectW
GetTextFaceW
CopyEnhMetaFileW
CreateRectRgnIndirect
SetPolyFillMode
SetBitmapDimensionEx
SetStretchBltMode
CreateFontIndirectExW
PlayMetaFile
GetTextExtentPointI
TranslateCharsetInfo
CreateEnhMetaFileA
GetGlyphIndicesA
SetROP2
GetEnhMetaFilePixelFormat
SetDIBits
GetGlyphOutlineW
PolyBezierTo
GetCharABCWidthsI
FixBrushOrgEx
GetCharWidthFloatW
FillRgn
PolyPolyline
GdiGetBatchLimit
GdiGetPageCount
UpdateColors
SetMapMode
GetDeviceGammaRamp
GdiPlayJournal
EudcUnloadLinkW
CreatePen
ResizePalette
GdiPlayPageEMF
RoundRect
SelectBrushLocal
ChoosePixelFormat
WidenPath
GetGlyphIndicesW
CreateFontIndirectExA
TextOutW
StartPage
CreateFontW
rpcrt4
RpcTestCancel
RpcAsyncRegisterInfo
RpcBindingInqObject
RpcMgmtEnableIdleCleanup
NdrComplexStructUnmarshall
RpcMgmtEpEltInqDone
RpcServerUseProtseqEpExA
I_RpcAsyncAbortCall
RpcServerUseProtseqEpExW
RpcNetworkInqProtseqsA
NDRSContextUnmarshallEx
NdrPointerMarshall
NdrStubGetBuffer
I_RpcConnectionInqSockBuffSize
NdrRpcSsDisableAllocate
NdrConformantStructUnmarshall
RpcServerUseProtseqEpW
RpcSsSetClientAllocFree
NdrVaryingArrayUnmarshall
NdrComplexStructMemorySize
RpcServerRegisterAuthInfoW
RpcServerInqBindings
NdrNsSendReceive
NdrFullPointerInsertRefId
NdrXmitOrRepAsBufferSize
I_RpcClearMutex
RpcServerUseAllProtseqs
NdrConformantArrayUnmarshall
MesEncodeDynBufferHandleCreate
NdrProxyErrorHandler
NdrSimpleStructFree
CStdStubBuffer_IsIIDSupported
I_RpcSendReceive
TowerConstruct
NdrNonConformantStringMarshall
NdrConformantStructFree
I_RpcServerInqAddressChangeFn
I_RpcGetBuffer
RpcSsDestroyClientContext
NdrConformantVaryingArrayMemorySize
IUnknown_QueryInterface_Proxy
I_RpcTransConnectionReallocPacket
NdrRpcSmClientAllocate
RpcBindingToStringBindingA
NDRSContextMarshall
NdrComplexStructMarshall
RpcBindingInqAuthInfoExA
NdrConformantVaryingStructMemorySize
NdrFullPointerQueryPointer
NdrNonEncapsulatedUnionUnmarshall
RpcMgmtInqIfIds
I_RpcServerUseProtseq2W
UuidToStringW
I_RpcReceive
NdrServerInitializePartial
NdrCorrelationInitialize
RpcBindingInqAuthInfoA
I_RpcSend
NdrConformantVaryingArrayBufferSize
NdrNonConformantStringMemorySize
DceErrorInqTextA
NdrInterfacePointerUnmarshall
NdrServerContextNewUnmarshall
NdrRpcSmSetClientToOsf
NdrPointerUnmarshall
I_UuidCreate
RpcBindingFromStringBindingA
RpcBindingInqAuthClientW
NdrConvert2
MesHandleFree
I_RpcTransDatagramFree
I_RpcTransConnectionFreePacket
NdrGetUserMarshalInfo
NdrEncapsulatedUnionMemorySize
RpcBindingInqAuthClientExA
UuidCreateNil
NdrXmitOrRepAsMarshall
RpcNetworkInqProtseqsW
RpcBindingSetAuthInfoW
I_RpcNsInterfaceUnexported
RpcServerUseProtseqEpA
NdrXmitOrRepAsMemorySize
I_RpcTransConnectionAllocatePacket
RpcEpRegisterW
I_RpcRequestMutex
RpcMgmtSetComTimeout
RpcServerRegisterIfEx
I_RpcFreePipeBuffer
MesDecodeBufferHandleCreate
NDRSContextMarshall2
I_RpcTransDatagramAllocate2
RpcProtseqVectorFreeW
RpcMgmtInqDefaultProtectLevel
NdrByteCountPointerBufferSize
NdrMesTypeAlignSize
NdrConformantArrayBufferSize
RpcServerYield
NdrConformantStructBufferSize
RpcRevertToSelf
I_RpcServerInqTransportType
MesEncodeIncrementalHandleCreate
IUnknown_AddRef_Proxy
I_RpcBindingInqSecurityContext
NdrEncapsulatedUnionMarshall
RpcBindingSetAuthInfoExA
NdrRpcSsDefaultFree
RpcMgmtInqServerPrincNameW
NdrServerCall2
NdrNonEncapsulatedUnionFree
I_RpcBindingInqTransportType
NdrConformantVaryingStructBufferSize
RpcAsyncCancelCall
I_RpcBindingToStaticStringBindingW
RpcMgmtInqServerPrincNameA
RpcEpResolveBinding
RpcCancelThread
NdrClearOutParameters
RpcAsyncInitializeHandle
I_RpcBindingCopy
RpcServerUseProtseqIfExA
RpcBindingInqAuthClientExW
RpcServerInqDefaultPrincNameW
NdrConformantArrayMarshall
RpcServerUseProtseqExW
RpcBindingInqAuthInfoExW
RpcMgmtEpEltInqNextW
NdrInterfacePointerFree
NdrStubForwardingFunction
RpcMgmtInqStats
RpcSmSetThreadHandle
NdrClientInitializeNew
NdrNonEncapsulatedUnionMemorySize
NdrByteCountPointerMarshall
I_RpcSsDontSerializeContext
NdrUserMarshalMarshall
RpcServerInqDefaultPrincNameA
RpcImpersonateClient
RpcServerUseAllProtseqsIf
RpcBindingSetAuthInfoExW
RpcCancelThreadEx
NdrComplexArrayFree
NdrFixedArrayFree
NdrSimpleTypeMarshall
NdrSendReceive
I_RpcServerUseProtseqEp2A
NdrServerContextUnmarshall
NdrSimpleTypeUnmarshall
NdrContextHandleInitialize
RpcEpRegisterNoReplaceW
RpcStringBindingComposeA
RpcBindingVectorFree
UuidFromStringA
RpcSmGetThreadHandle
NdrEncapsulatedUnionBufferSize
RpcBindingServerFromClient
RpcObjectInqType
UuidEqual
I_RpcPauseExecution
NdrClientContextUnmarshall
NdrComplexStructFree
RpcMgmtEpUnregister
RpcMgmtSetAuthorizationFn
I_RpcServerSetAddressChangeFn
NdrConformantVaryingStructFree
RpcSmAllocate
I_RpcBindingInqDynamicEndpointA
RpcIfIdVectorFree
RpcBindingReset
I_RpcTransDatagramAllocate
advpack
GetVersionFromFile
DelNodeRunDLL32
OpenINFEngine
RegInstall
TranslateInfString
AddDelBackupEntry
FileSaveRestore
RegisterOCX
RunSetupCommand
IsNTAdmin
ExecuteCab
CloseINFEngine
UserUnInstStubWrapper
TranslateInfStringEx
AdvInstallFile
shell32
CheckEscapesW
SHUpdateRecycleBinIcon
SHGetIconOverlayIndexA
SHAppBarMessage
ExtractAssociatedIconExW
ExtractIconW
ShellHookProc
DoEnvironmentSubstW
RealShellExecuteW
RealShellExecuteExW
SHGetSpecialFolderPathA
ExtractIconExA
ShellExecuteExW
ShellExecuteExA
SHEmptyRecycleBinA
ExtractAssociatedIconW
ExtractIconA
SHGetInstanceExplorer
SHGetIconOverlayIndexW
SHGetFolderPathW
SheChangeDirA
DragQueryFileW
SHFreeNameMappings
SHBrowseForFolderW
SHFormatDrive
comdlg32
ChooseColorA
kernel32
GetProcAddress
MulDiv
InterlockedIncrement
FileTimeToDosDateTime
InterlockedDecrement
CreateHardLinkA
user32
WinHelpA
OpenClipboard
SendMessageA
DialogBoxParamW
EndDialog
LockWorkStation
MenuItemFromPoint
CreateDesktopW
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 6KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE