hive | 01c846bfc37b10ea43474e1781e0af52 | Triage

Sharing

General

Target

01c846bfc37b10ea43474e1781e0af52
Size

2.5MB
MD5

01c846bfc37b10ea43474e1781e0af52
SHA1

edba1b73ddd0e32784ae21844c940d7850531b82
SHA256

50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609
SHA512

94345f6c4a2b1edce2875a022f3daafff945e74a6f6a00e257379f3e4a52d99f5e969376fe6be37d5f8d76fb4afcda2a451445a203bc676f599c855703ae11cd
SSDEEP

49152:idLnd8aOF7Bc/KwjmQn/w2Cp4OOPkMGKU1:i9d8aOF7Bc/PT/hPF

Score

10^/10

hive

Malware Config

Signatures

Detects Go variant of Hive Ransomware 1 IoCs

Processes:

resource yara_rule

sample hive_go
Hive family
hive
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

01c846bfc37b10ea43474e1781e0af52

Files

01c846bfc37b10ea43474e1781e0af52
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 170KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ