Static task
static1
Behavioral task
behavioral1
Sample
RootFinder_Ransomware.bin.exe
Resource
win7-20230220-en
General
-
Target
RootFinder_Ransomware.bin.exe
-
Size
100KB
-
MD5
a4af347d20fd13f9d07e53ccd7aa5d14
-
SHA1
4d699af90fe02fd16b08316367493ac614e75c91
-
SHA256
0a4d4889a853bc29486d58d8b1010a0b64fd6b6835e28bfda7019b7f1f46e64a
-
SHA512
957a505e1928b8cbd5e1621701bdd08874bb6cc4a0ad42c0e3735dd3b418d39fcf40b0bbd59e3197d77fa457becee81be7d55328019b858fec2dfd3386a42777
-
SSDEEP
3072:YtS8Pqxc/WOcLeaUUEnQKfh9NVgnf0N3XqY:YtS8yG+OcLtUUE1yiHq
Malware Config
Signatures
Files
-
RootFinder_Ransomware.bin.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 498B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ