Behavioral task
behavioral1
Sample
2892340x00000000004000000x0000000000537000memory_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2892340x00000000004000000x0000000000537000memory_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2892340x00000000004000000x0000000000537000memory_JC.dmp
-
Size
1.2MB
-
MD5
91934deac8ba8ae9a49d4633e0585823
-
SHA1
b19289e869f1e64da8d4bdffd39ee5a1a0caa1ab
-
SHA256
a119d5a964b59c07fab59ae16e539bee5df7b805c105e100a61103b8817ad932
-
SHA512
596fa82b18d3c64bda54e69b133ea45d26705bc6f96bff08a33560630984a6dd9ca0c5e2fb8aeb082ec8c2350e714a6dbeb8366d5913ec546873a5e06fa685ae
-
SSDEEP
24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8hWQHUq7:F0dwAYZt6C31WeTVRPOhh7Uq7
Malware Config
Signatures
-
Detected Djvu ransomware 1 IoCs
resource yara_rule sample family_djvu -
Djvu family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2892340x00000000004000000x0000000000537000memory_JC.dmp
Files
-
2892340x00000000004000000x0000000000537000memory_JC.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 809KB - Virtual size: 809KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 247KB - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ