Static task
static1
Behavioral task
behavioral1
Sample
Annabelle_ransom.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Annabelle_ransom.exe
Resource
win10v2004-20230915-en
General
-
Target
Annabelle_ransom.bin.zip
-
Size
15.6MB
-
MD5
821b82f344e2276006a1244cf8b23466
-
SHA1
e8c747ecc314b6b8c6aa214c025ec929f063a848
-
SHA256
ea61a11fed5d2dcf4ca40d6fd782515e08c7182de6386244eb4a9590fe47d8db
-
SHA512
38d8cf9bfaf03c6f9213c40eff8c1105387ea2fae22ccb778c70ade101e9563a23b7e288a1459f897c2c79e15b380f2706d1a5963f77d1917a51295ba2d6326e
-
SSDEEP
393216:4aeYRJLnHs25+8OXHKhSwizIj8yOsR6UFJY5j00IFi:4al35+8OXHESwicTOQvFS5jHIFi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Annabelle_ransom.bin
Files
-
Annabelle_ransom.bin.zip.zip
Password: infected
-
Annabelle_ransom.bin.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 15.7MB - Virtual size: 15.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ