5b575566c36b34240af7edcec548f56e
- SHA256 11ef5e8bc8535c90bf67ad487313fcf9db5bdf724c7f683e8f35b122f80b2fff
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RAGNAR~1.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
RAGNAR~1.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
xxx.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
General
- Target 5b575566c36b34240af7edcec548f56e
- Size 710KB
- Sample240114-ql2fxabfe8
- SHA256 11ef5e8bc8535c90bf67ad487313fcf9db5bdf724c7f683e8f35b122f80b2fff
- MD5 5b575566c36b34240af7edcec548f56e
- SHA1 b9c840cc4099f9a9acc06c7a2c492941efb16214
- SHA512 3cd5f52af5eccaf9d802ef2ad355179d98fdc69af89df1a4406c3440bf6e6bf6436e41bfcebdbb8d263bb9f3b373b040cb7887ee3bec572c928b0fe9f3462290
- SSDEEP 12288:QAQJXYEO6Q0g0SFFivT9fsIIBpBwxc1fgldJAcrT0tIMIxnbbDMObQG7nw:EQ0g9eT9URrX1fEAY8CrcG7w
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/RAGNAR~1.EXE unpack001/xxx.exe
File Explorer
-
5b575566c36b34240af7edcec548f56e.cab 710KB
-
RAGNAR~1.EXE.exe 496KB
-
xxx.exe.exe 539KB
RAGNAR~1.EXE
- IMPHASH 86632da30434ccfc050190a47fb559c4
- SHA256 38426503e6797af6d0eba4b1504de5b4785548eb8c43f6e7c9320d11eacdf2cf
- MD5 280c548e48051dd256fe9aa819b569e7
- SHA1 ffbec20fc4d2895c6d3d28f78a70d4c39676424f
- SHA512 9e84eb8551c5cf6b2ddedcff33bbf56cf021378b294f873f5ba7774a977919f78757ef501863ae15db94634a052a52c15d0ee64657b53869da4cbcb2d498d6c1
- SSDEEP 12288:J6QJX4b8yQyg0k1FfoT9fsIITWBDxD1f4jBiRx1C+HdJAco:2Qygf6T9URKT1f0iv1C+TAX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_acmdln
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
calloc
exit
memcpy
memset
_itow
??2@YAPAXI@Z
_wcsdup
??3@YAXPAX@Z
free
__p__commode
kernel32
GetModuleHandleA
GetTempPathW
GetModuleHandleW
GetModuleFileNameW
CreateFileW
SetFilePointer
CloseHandle
GetTempFileNameW
FreeLibrary
DeleteFileW
WriteFile
ReadFile
LoadLibraryW
GetProcAddress
GetStartupInfoA
user32
MessageBoxW
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=41, id=1, productName=Unmarked objects,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=14, version=7299,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=5, id=110, productName=VS2005 build 50727, version=50727,
count=8, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
xxx.exe
- SHA256 643d0fc4c7e7b062d1bdb9dd173a25e9ab8191c30420202a27c4c2f521d6e1ea
- MD5 0d2361786ac8ab9f426ac13c5c1d8118
- SHA1 b7cb32d675c90bd8776a31e1d0f77145698c8b7f
- SHA512 feeee7ec9aae0e794cd2207d39e74c5482d128d6cf9b26d4e81cd99a0e2316f46bc8bf425e616a53e0b456760b6f6b73fdbab2a71b4c7362d1dff83d171d03e5
- SSDEEP 12288:0nYalCGHckvIXYSCfOlw+Ch9VXbLGh53NS:qhl5cktBOlwldbqL9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
467484
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
453KB
Virtual Size
452KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ