Behavioral task
behavioral1
Sample
35c888dce3ed1a65c080cec0cb27bc0a9a6f90fcf552642f8f9a63c35176936d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
35c888dce3ed1a65c080cec0cb27bc0a9a6f90fcf552642f8f9a63c35176936d.exe
Resource
win10v2004-20231222-en
General
-
Target
35c888dce3ed1a65c080cec0cb27bc0a9a6f90fcf552642f8f9a63c35176936d.exe
-
Size
26KB
-
MD5
d2b202e37dc709a319b41bd9ecb75f3b
-
SHA1
a051e775e2a2170803300f105fb15e64d3a16967
-
SHA256
5a5af2621cd37caa1e2caa3feab568f56f6ae2212be6896b8058454a6936c355
-
SHA512
3a2abc1269e8bea303c71dd227d91fbd4e16d83be0261300636d545d484e5dff605a772148cbd4d0be4ad159629766ce4e556e3dbede512443d980aee669eed5
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91QTb5hxDGM:5OElB6sc9GTbXxDX
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 35c888dce3ed1a65c080cec0cb27bc0a9a6f90fcf552642f8f9a63c35176936d.exe
Files
-
35c888dce3ed1a65c080cec0cb27bc0a9a6f90fcf552642f8f9a63c35176936d.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ