cylance_ransomware_Windows-sample[.]exe[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cylance_ransomware_Windows-sample.exe.bin.exe
Size 151KB
Sample230331-asb7lahc8w
SHA256 7a5e813ec451cde49346d7e18aca31065846cafe52d88d08918a297196a6a49f
MD5 31ed39e13ae9da7fa610f85b56838dde
SHA1 ff602997ce7bdd695a282bd373daf57bea7a051f
SHA512 199d70b70636555fbe753e83662cc672b5b06428050229856e9912488037cb4dae34a0766c3fcc560afd8fb07a4dcb5cfd8435a0fe3db86484a7929218cab5ee
SSDEEP 3072:lAMP+TYgJWo6QD6ivAFvvYknplbZVaX6TEQZwRNfysqdoTPwum3n:OZNMnQFvM/lbbHTFZw/fLm3n
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

cylance_ransomware_Windows-sample.exe.bin.exe

.exe 151KB

cylance_ransomware_Windows-sample.exe.bin.exe

IMPHASH 4cd23d66c8d8b98e270477f817f6b6f7
SHA256 7a5e813ec451cde49346d7e18aca31065846cafe52d88d08918a297196a6a49f
MD5 31ed39e13ae9da7fa610f85b56838dde
SHA1 ff602997ce7bdd695a282bd373daf57bea7a051f
SHA512 199d70b70636555fbe753e83662cc672b5b06428050229856e9912488037cb4dae34a0766c3fcc560afd8fb07a4dcb5cfd8435a0fe3db86484a7929218cab5ee
SSDEEP 3072:lAMP+TYgJWo6QD6ivAFvvYknplbZVaX6TEQZwRNfysqdoTPwum3n:OZNMnQFvM/lbbHTFZw/fLm3n
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

34021

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress ExitProcess GetComputerNameW GetCurrentProcessId GlobalMemoryStatusEx GetModuleHandleW GetConsoleWindow SetConsoleCursorPosition GetTickCount AllocConsole GetDriveTypeW FindFirstFileW GetFileSizeEx FindFirstVolumeW FindNextFileW GetFinalPathNameByHandleW WaitForMultipleObjects SetThreadPriority GetQueuedCompletionStatus FindClose PostQueuedCompletionStatus SetFileAttributesW GetCurrentThread WriteConsoleW TerminateProcess CreateThread SetVolumeMountPointW SetFilePointerEx LocalFree MoveFileExW FindVolumeClose SetThreadExecutionState GetVolumePathNamesForVolumeNameW FindNextVolumeW CreateIoCompletionPort HeapCreate HeapFree HeapSize HeapAlloc GetProcessHeap GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc LCMapStringW CompareStringW ScrollConsoleScreenBufferW GetSystemInfo GetNativeSystemInfo GetDiskFreeSpaceExW GetLastError Sleep OpenProcess ReleaseMutex WaitForSingleObject lstrlenA CreateMutexW SetProcessShutdownParameters GetStdHandle GetCurrentProcess SetPriorityClass GetConsoleScreenBufferInfo GetLogicalDrives GetCommandLineW ReadFile DeleteCriticalSection GetLocalTime CloseHandle lstrcatW CreateFileW SetFilePointer InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW WriteFile EnterCriticalSection lstrcmpiW lstrcpyW lstrlenW LoadLibraryW GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType GetCommandLineA GetModuleHandleExW RaiseException LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwind DecodePointer

user32

ShowWindow wsprintfW

advapi32

RegOpenKeyExW AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW FreeSid LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegCreateKeyExW OpenProcessToken GetUserNameW RegQueryValueExW GetTokenInformation

shell32

SHGetFolderPathW SHEmptyRecycleBinW CommandLineToArgvW ShellExecuteW

ole32

CoUninitialize CoInitialize CoSetProxyBlanket CoCreateInstance

oleaut32

VariantInit SysAllocString VariantClear

wininet

InternetCloseHandle HttpSendRequestW HttpOpenRequestW InternetOpenW InternetConnectW

netapi32

NetApiBufferFree NetGetJoinInformation

rstrtmgr

RmGetList RmStartSession RmEndSession RmRegisterResources

shlwapi

PathRemoveFileSpecW StrStrIW PathFindExtensionW