Behavioral task
behavioral1
Sample
2023-05-19_e41395a425a5893dd132acf35c4a5b22_revil.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-19_e41395a425a5893dd132acf35c4a5b22_revil.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-19_e41395a425a5893dd132acf35c4a5b22_revil
-
Size
166KB
-
MD5
e41395a425a5893dd132acf35c4a5b22
-
SHA1
caa591c1738e8dc70816efa988ec2740f680e963
-
SHA256
96eab1ef06e3aa876934084636ae1f28c95c14a5badcb69be370825206b4b510
-
SHA512
b1fa4cc9ca66681ac897bd19a8ce0b1f9733bf1922fdd68888bde133e05b9ae6d872281522686056addf608d4277bb9bd2eae8312ffe5c23d4d6961ef586f4f1
-
SSDEEP
3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QXRDg+cdN:ZJ0BXScFy2RsQJ8zgBM+cd
Malware Config
Signatures
-
Sodinokibi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-05-19_e41395a425a5893dd132acf35c4a5b22_revil
Files
-
2023-05-19_e41395a425a5893dd132acf35c4a5b22_revil.exe windows x86
7ecacfc6f1d64067e0047425ad885408
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenW
SetErrorMode
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yhwfq9 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ