Behavioral task
behavioral1
Sample
4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe
Resource
win10v2004-20230915-en
General
-
Target
4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe
-
Size
843KB
-
MD5
871564bb0c6973e4eb3f4aafa368fabd
-
SHA1
da616d5082f810c153ba2ae5cb75a1a44778c57c
-
SHA256
4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8
-
SHA512
af92e1306dd61ea7a075aa522cc50b73462f240c979091a33d15b069d6ab928af5edccb032ff650459c75bb617b3c75fee6deb361840d59c60f8c62f4eeb7c05
-
SSDEEP
192:H/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMwu8V:HebFNw4Pk1itKkpAjjI2Ypdmw
Malware Config
Signatures
-
Detected Xorist Ransomware 1 IoCs
resource yara_rule sample family_xorist -
Xorist family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe
Files
-
4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 832KB - Virtual size: 832KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE