General
-
Target
feba562bff88f991bf0591f63846426af0244ba8d7790a55f29dd5ca1e4edc19.exe
-
Size
707KB
-
MD5
01d4187206630211f4a31747f0c3ca98
-
SHA1
f9e8c3d07ae13e3c2f6213895e3f917ba30d3fc7
-
SHA256
feba562bff88f991bf0591f63846426af0244ba8d7790a55f29dd5ca1e4edc19
-
SHA512
217caafa9ea48ac3802f39418089e3bd7d2f5115cc903d94cbbc417314d856e9643236ece0f1af5b565f04b77911ed9c18215acd70cb5e06fcd2f02c8cf15a5f
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1F8ivnh:6uaTmkZJ+naie5OTamgEoKxLWwsh
Score
10/10
Malware Config
Signatures
-
Detects command variations typically used by ransomware 1 IoCs
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
-
Detects executables containing commands for clearing Windows Event Logs 1 IoCs
-
Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
feba562bff88f991bf0591f63846426af0244ba8d7790a55f29dd5ca1e4edc19.exe
2f7da257a3159bdb9faeb823ef872a56
Headers
Imports
Sections