Behavioral task
behavioral1
Sample
2ff0770b6785faee0c391a6c1568f63334200901f1f2c6c75840a17359a5f46d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2ff0770b6785faee0c391a6c1568f63334200901f1f2c6c75840a17359a5f46d.exe
Resource
win10v2004-20231215-en
General
-
Target
2ff0770b6785faee0c391a6c1568f63334200901f1f2c6c75840a17359a5f46d.exe
-
Size
26KB
-
MD5
5a89c11b990af68c53498cff01cf2906
-
SHA1
42718b232121d6bf65ecc50f5c0c8a2b53bf7894
-
SHA256
b79186618ef8b8cf6242b24c12e234914a0f51a7f3c92ca5c18ab5b578c47f0c
-
SHA512
152239b81345bc1f9d72141b273f9e413226e5824dba8f0de276279b3c92ce550a239f36562570f8361b425cae77d37f32eb29fb1c8c85da6550d4c6e9bc9bcc
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91Qib5hxDGP:5OElB6sc9GibXxDU
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ff0770b6785faee0c391a6c1568f63334200901f1f2c6c75840a17359a5f46d.exe
Files
-
2ff0770b6785faee0c391a6c1568f63334200901f1f2c6c75840a17359a5f46d.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ