General

  • Target

    e3992cfb3827d330a178af66dda05d149206e440acdc0ac8e4da93e6c0f161cd.exe

  • Size

    707KB

  • MD5

    2f0e99b3ea5b9eed6a0f6893e32137aa

  • SHA1

    b3c938fdfe294ed7c1bc6845820d1e87c3fe2211

  • SHA256

    e3992cfb3827d330a178af66dda05d149206e440acdc0ac8e4da93e6c0f161cd

  • SHA512

    f2b1daa01899e9d42ca0243fc5ad40d0652501a01494327c1a2975463ded12df14146773ba4c637753287223dc5fa91b733dfd2a2b20e3ff03470ce9c98d7239

  • SSDEEP

    6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1+82vnh:6uaTmkZJ+naie5OTamgEoKxLW1Ih

Score
10/10

Malware Config

Signatures

  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 1 IoCs
  • Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e3992cfb3827d330a178af66dda05d149206e440acdc0ac8e4da93e6c0f161cd.exe
    .exe windows:5 windows x86 arch:x86

    2f7da257a3159bdb9faeb823ef872a56


    Headers

    Imports

    Sections