General

Malware Config

Signatures

Files

• Trojan.Ransom.zip.zip

  .zip

  Password: infected

• Trojan.Ransom.zip

  .zip
• eefa052da01c3faa1d1f516ddfefa8ceb8a5185bb9b5368142ffdf839aea4506

  .exe windows x86

  4f7e80b12e14587fc3c198bdef27ceee

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_AGGRESIVE_WS_TRIM

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ole32

  CoRevokeClassObject

  CoRegisterClassObject

  CoTaskMemAlloc

  CoTaskMemRealloc

  StringFromGUID2

  CoDisconnectObject

  CoUninitialize

  CoRevertToSelf

  CoInitializeSecurity

  CoCreateGuid

  CLSIDFromString

  CoGetClassObject

  CoGetCallContext

  StringFromIID

  CoCreateInstance

  CoSetProxyBlanket

  CoInitializeEx

  CoImpersonateClient

  CoQueryProxyBlanket

  StringFromCLSID

  CoTaskMemFree

  oleaut32

  SysFreeString

  SysAllocStringLen

  SysAllocString

  SafeArrayDestroy

  SafeArrayUnaccessData

  SafeArrayAccessData

  VarBstrCat

  VariantClear

  VariantInit

  VarUI4FromStr

  RegisterTypeLi

  UnRegisterTypeLi

  LoadTypeLi

  SysStringByteLen

  SysAllocStringByteLen

  SafeArrayCreate

  version

  GetFileVersionInfoA

  VerQueryValueA

  GetFileVersionInfoSizeA

  rpcrt4

  RpcStringFreeA

  RpcBindingFromStringBindingA

  RpcStringBindingComposeA

  NdrClientCall

  RpcBindingSetAuthInfoA

  shlwapi

  PathFindExtensionA

  advapi32

  RegOpenKeyExW

  QueryServiceStatus

  LookupAccountSidA

  PrivilegeCheck

  IsValidSecurityDescriptor

  DuplicateTokenEx

  AddAce

  GetSecurityDescriptorLength

  GetUserNameA

  InitializeSecurityDescriptor

  SetSecurityDescriptorOwner

  SetSecurityDescriptorGroup

  SetSecurityDescriptorSacl

  MakeAbsoluteSD

  SetSecurityDescriptorDacl

  MakeSelfRelativeSD

  InitializeAcl

  AddAccessAllowedAce

  AddAccessDeniedAce

  AllocateAndInitializeSid

  FreeSid

  RegConnectRegistryA

  RegSetKeySecurity

  LookupAccountNameA

  GetAclInformation

  GetAce

  DuplicateToken

  GetSidLengthRequired

  InitializeSid

  GetSidSubAuthority

  AccessCheck

  GetSecurityDescriptorOwner

  GetSecurityDescriptorGroup

  GetSecurityDescriptorDacl

  GetSecurityDescriptorSacl

  EqualSid

  GetSecurityDescriptorControl

  GetLengthSid

  CopySid

  IsValidSid

  LookupAccountSidW

  RegCreateKeyA

  RegEnumValueA

  RegQueryValueExA

  StartServiceCtrlDispatcherA

  RegisterServiceCtrlHandlerA

  ControlService

  DeleteService

  SetThreadToken

  RegDeleteKeyA

  RegCloseKey

  RegOpenKeyExA

  RegEnumKeyA

  SetServiceStatus

  AdjustTokenPrivileges

  OpenProcessToken

  LookupPrivilegeValueA

  GetTokenInformation

  OpenThreadToken

  RegDeleteValueA

  RegCreateKeyExA

  RegSetValueExA

  RegQueryInfoKeyA

  RegEnumKeyExA

  DeregisterEventSource

  ReportEventA

  RegisterEventSourceA

  CloseServiceHandle

  ChangeServiceConfigA

  OpenServiceA

  CreateServiceA

  OpenSCManagerA

  RegQueryValueExW

  kernel32

  HeapFree

  VirtualProtect

  VirtualAlloc

  GetSystemInfo

  VirtualQuery

  RtlUnwind

  IsBadWritePtr

  HeapSize

  GetOEMCP

  GetCPInfo

  HeapReAlloc

  WriteFile

  GetStdHandle

  UnhandledExceptionFilter

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  GetFileType

  TlsAlloc

  TlsFree

  TlsSetValue

  TlsGetValue

  HeapDestroy

  HeapCreate

  VirtualFree

  LCMapStringA

  LCMapStringW

  GetStringTypeA

  GetStringTypeW

  IsBadReadPtr

  IsBadCodePtr

  SetStdHandle

  FlushFileBuffers

  SetEndOfFile

  GetProcessHeap

  GetSystemTimeAsFileTime

  GetLastError

  FreeLibrary

  GetProcAddress

  LoadLibraryW

  InterlockedExchange

  GetACP

  GetLocaleInfoA

  GetThreadLocale

  GetVersionExA

  MultiByteToWideChar

  WideCharToMultiByte

  RaiseException

  InitializeCriticalSection

  DeleteCriticalSection

  GetVersion

  lstrcmpiA

  lstrlenW

  lstrlenA

  CloseHandle

  OpenProcess

  CompareStringA

  CompareStringW

  HeapAlloc

  InterlockedIncrement

  InterlockedDecrement

  LoadLibraryA

  GetModuleHandleA

  WaitForSingleObject

  CreateEventA

  SetEvent

  TerminateThread

  CreateThread

  GetCurrentThreadId

  EnterCriticalSection

  LeaveCriticalSection

  GetComputerNameA

  LocalFree

  GetCurrentProcess

  GetCurrentThread

  lstrcpynA

  lstrcpyA

  GetModuleFileNameA

  lstrcatA

  IsDBCSLeadByte

  FormatMessageA

  GetFileAttributesA

  SizeofResource

  LoadResource

  FindResourceA

  LoadLibraryExA

  SetUnhandledExceptionFilter

  GetCommandLineA

  GetCurrentProcessId

  SetErrorMode

  GetProcessTimes

  GetPrivateProfileStringA

  TerminateProcess

  GetPrivateProfileSectionA

  GetPrivateProfileIntA

  CreateFileA

  GetProfileStringA

  CreateDirectoryA

  WritePrivateProfileStringA

  WriteProfileStringA

  GetPrivateProfileSectionNamesA

  GetTickCount

  LocalAlloc

  LockResource

  CreateProcessA

  InterlockedCompareExchange

  SetEnvironmentVariableA

  GetSystemDirectoryA

  Sleep

  GetModuleHandleW

  LocalSize

  ReadFile

  SetFilePointer

  SetLastError

  ReadProcessMemory

  FindClose

  FindFirstFileA

  FindResourceExA

  UnmapViewOfFile

  DuplicateHandle

  GetModuleFileNameW

  MapViewOfFile

  CreateFileMappingA

  CreateMutexA

  ReleaseMutex

  GetExitCodeProcess

  CreateProcessW

  GetStartupInfoA

  ExitProcess

  QueryPerformanceCounter

  user32

  wsprintfA

  wsprintfW

  EnumWindows

  GetWindowThreadProcessId

  IsWindowVisible

  GetWindowTextA

  DispatchMessageA

  MessageBoxA

  LoadStringA

  CharNextA

  PeekMessageA

  SetTimer

  GetMessageA

  KillTimer

  PostThreadMessageA

  CharUpperA

  Sections

  .text

  Size: 300KB - Virtual size: 297KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 12KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 12KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ