Behavioral task
behavioral1
Sample
fefe1facc6b82deca26e952cfbf3753eb1d1a5ecf3d7f82374b93f851aad6fff.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fefe1facc6b82deca26e952cfbf3753eb1d1a5ecf3d7f82374b93f851aad6fff.exe
Resource
win10v2004-20230220-en
General
-
Target
424411ee1f1594eb0350d589b2bbb292.bin
-
Size
10KB
-
MD5
27ab894036cb7bfc54229c5add37a49c
-
SHA1
79947c890487195127215f39b14e264877df011a
-
SHA256
cf9e43a1b641caf79aedab5ad41b38c40c170ec55fe59c2894e9ab47e23242cb
-
SHA512
a49a1ecf8c7a457ee8da6b5573fea0575432127fa578102a778e801c6fb5564bde3aa9463956cba3f62896d6aad5a0934b26c9f79c1e937c9d629d25a45c6200
-
SSDEEP
192:QfUDmezzPCuKiD/olNVJ7ewET3WVnbSijj5tafWC8DZwTeBJ1CYe0s:0yPeux+NVww23WnjqXUbnxeh
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule static1/unpack001/fefe1facc6b82deca26e952cfbf3753eb1d1a5ecf3d7f82374b93f851aad6fff.exe family_chaos -
Chaos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fefe1facc6b82deca26e952cfbf3753eb1d1a5ecf3d7f82374b93f851aad6fff.exe
Files
-
424411ee1f1594eb0350d589b2bbb292.bin.zip
Password: infected
-
fefe1facc6b82deca26e952cfbf3753eb1d1a5ecf3d7f82374b93f851aad6fff.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ