ransomware[.]exe | Triage™

General

Target
ransomware.exe
Size 709KB
Sample240115-xt332aeeh9
SHA256 b5ebf4054d626e0602fd52c351ffba4c7c43f06d61c9e590c4f4bd77347094d7
MD5 d2243b032f9b9226d85de43b5b88480d
SHA1 7643fc0978122e1862d855af3c2b066c715beacd
SHA512 c2561dbb57fe48a6591a70b3ab48de866013f8d03f5b18356a7304f546b0b852097ff6800f98ab319929089631d59eef00384f6619fb4a271c31b22b54f87b75
SSDEEP 12288:f6aD7FoQiBMyk5EYvgPZfJGrFWCyYTI84EPSW+z7AuLQ59GnIZvmZHst9HhUUX:hPFoQiBMf5EYYDYFBCNEaWyLQ93v2Hkd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ransomware.exe

File Explorer

ransomware.exe

.exe 709KB

ransomware.exe

IMPHASH ea183dffdf44ba25a8bf1bd3c29672ef
SHA256 b5ebf4054d626e0602fd52c351ffba4c7c43f06d61c9e590c4f4bd77347094d7
MD5 d2243b032f9b9226d85de43b5b88480d
SHA1 7643fc0978122e1862d855af3c2b066c715beacd
SHA512 c2561dbb57fe48a6591a70b3ab48de866013f8d03f5b18356a7304f546b0b852097ff6800f98ab319929089631d59eef00384f6619fb4a271c31b22b54f87b75
SSDEEP 12288:f6aD7FoQiBMyk5EYvgPZfJGrFWCyYTI84EPSW+z7AuLQ59GnIZvmZHst9HhUUX:hPFoQiBMf5EYYDYFBCNEaWyLQ93v2Hkd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

12447

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumCalendarInfoW OpenJobObjectA GetCurrentProcess CreateHardLinkA GetModuleHandleW GetCommConfig GetProcessHeap GetWindowsDirectoryA LoadLibraryW SizeofResource ReadProcessMemory ExitThread GetVolumePathNameA LCMapStringA InterlockedExchange OpenMutexW GetLastError SetLastError GetProcAddress VirtualAlloc BackupWrite InterlockedIncrement LocalAlloc FindFirstVolumeMountPointW RemoveDirectoryW BeginUpdateResourceA AddAtomA DeviceIoControl GlobalFindAtomW VirtualProtect _lopen GetVersionExA FindAtomW EnumResourceLanguagesW OpenFileMappingA lstrcpyA CreateFileA WriteConsoleA GetComputerNameA InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ExitProcess GetStartupInfoW RaiseException RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree TerminateProcess IsDebuggerPresent HeapAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA LoadLibraryA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW GetModuleHandleA WideCharToMultiByte LCMapStringW

user32

WindowFromDC GetCaretPos

gdi32

GetDeviceGammaRamp

advapi32

BackupEventLogA

Sharing