Static task
static1
Behavioral task
behavioral1
Sample
encryptor.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
encryptor.exe
Resource
win10v2004-20230220-en
General
-
Target
encryptor.zip
-
Size
357KB
-
MD5
53586770fa7c3483b5b6b626ad7130e8
-
SHA1
36e3f72106c29c83a87ad69d58375038d0b6a326
-
SHA256
a673316d048b600b1b9a36f2cb44d1ebd1ad775858c0b231bacd71d0c23d6d59
-
SHA512
360c55a718135790942444193b2a1d20a8fc3047af0d80dbe5eaa5f0a6348d431d6c9ee3b131642f56a5e6ea4b7af65a02a29dac064a102710a49c4a4c690b0f
-
SSDEEP
6144:pdskVMeoO/U+mSfW/t2qOnqbHRiZj3ZiIU594k9E+mcWFq:XskVBU+Ru/t2MbHRGj3WE+PWA
Malware Config
Signatures
Files
-
encryptor.zip.zip
-
encryptor.exe.exe windows x86
1fce1172b1846e03a9af5ff84d37390e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dbghelp
ImageNtHeader
mpr
WNetOpenEnumW
WNetCancelConnection2W
WNetAddConnection2W
WNetEnumResourceW
WNetCloseEnum
wtsapi32
WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory
kernel32
SetStdHandle
GetStdHandle
WriteFile
GetLastError
CreateMutexA
GetCurrentProcessId
GetCurrentThreadId
GetDynamicTimeZoneInformation
WideCharToMultiByte
GetConsoleMode
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
CloseHandle
Sleep
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFinalPathNameByHandleW
SetFileAttributesW
GetCurrentProcess
GetModuleHandleW
LocalFree
GetDriveTypeW
GetCurrentThread
FormatMessageA
GetFileSizeEx
HeapReAlloc
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
ExitThread
CreateThread
LoadLibraryExW
GetDateFormatW
IsValidCodePage
GetACP
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileType
FlushFileBuffers
ReadFile
ReadConsoleW
GetConsoleOutputCP
ExitProcess
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
GetProcAddress
MultiByteToWideChar
QueryPerformanceCounter
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
FreeLibrary
GetStringTypeW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
GetLocaleInfoEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RaiseException
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapFree
shell32
ShellExecuteW
ole32
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeEx
oleaut32
VariantInit
SysFreeString
SysAllocString
advapi32
LookupPrivilegeValueA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RevertToSelf
DuplicateTokenEx
SetThreadToken
SetNamedSecurityInfoW
SetEntriesInAclW
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
EnumServicesStatusExW
EnumDependentServicesW
ControlService
CloseServiceHandle
Sections
.text Size: 588KB - Virtual size: 588KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ