Behavioral task
behavioral1
Sample
307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
Resource
win10v2004-20231215-en
General
-
Target
307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
-
Size
23KB
-
MD5
71d9e6ee26d46c4dbb3d8e6df19dda7d
-
SHA1
a88176cdd3df153349104442eac4e2d1c416e457
-
SHA256
ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda
-
SHA512
d6a61d6d32bf636bec7948323a422116b359dadf78e55327633ad5c3de41e6c15dcadd27a8c53453ef14dd63184c22dee82420b99338f5cc7359e9f6ec50cca7
-
SSDEEP
384:eebFNw4Pk1itKkpAjjI2Ypdm/nYi/8lhRea16Wv88oyLOixGqKWW0o:e0FmBkpKjPYpudR4v8x3iAE
Malware Config
Signatures
-
Detected Xorist Ransomware 1 IoCs
resource yara_rule sample family_xorist -
Detects ransomware indicator 1 IoCs
resource yara_rule sample SUSP_RANSOMWARE_Indicator_Jul20 -
Xorist family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
Files
-
307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE