Behavioral task
behavioral1
Sample
Trojan-Ransom.Win32.Blocker.exe
Resource
win7-20220901-en
General
-
Target
Trojan-Ransom.Win32.Blocker.fhfs-6cacffacc5e42fbd6eea2f5c0912ed1d12cf60159af14b5934466be782bb878b
-
Size
213KB
-
MD5
44c631011c24a3b7caa06d953b1bcf01
-
SHA1
b0c9d7d5c99dd019a6900bebb74884ba509e6da9
-
SHA256
6cacffacc5e42fbd6eea2f5c0912ed1d12cf60159af14b5934466be782bb878b
-
SHA512
0b37ab46a791de852c96409f352bdc594f9654cde167e5162b8af775c2b940b7754a9124885c9bc1a65fa9735570b5d3260e8ada50ee50d80c595c12af3fe61d
-
SSDEEP
6144:ffM8H/CEYmoa4VQhnx9KB4uU4sLL3gHi0lPNoS+:lRYxaGQo4uU4sLL3g5NoS+
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
Trojan-Ransom.Win32.Blocker.fhfs-6cacffacc5e42fbd6eea2f5c0912ed1d12cf60159af14b5934466be782bb878b.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 464KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 208KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE