Behavioral task
behavioral1
Sample
36b7cce8707928859ba101afa5457b37bb764779dd0073d098586351613852bc.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
36b7cce8707928859ba101afa5457b37bb764779dd0073d098586351613852bc.exe
Resource
win10v2004-20231222-en
General
-
Target
36b7cce8707928859ba101afa5457b37bb764779dd0073d098586351613852bc.exe
-
Size
26KB
-
MD5
7a84f289584a01d2670c06875e810e70
-
SHA1
b6d58787f8309481c5b5338679534c74b07c8642
-
SHA256
4c1f14cd1ad3606791115fe43b7ce39af2ba5192bbe38b023bfb0928f4a8a344
-
SHA512
989356692f32b55d3ffef7224bdae69f27dd11a6197793c36fdde6085c4b6ec7d03088b7bfd5e3dba02e4d81873338eb6e35a399396e3c934cad62b9b1788add
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91Q9b5hxDGO:5OElB6sc9G9bXxD5
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36b7cce8707928859ba101afa5457b37bb764779dd0073d098586351613852bc.exe
Files
-
36b7cce8707928859ba101afa5457b37bb764779dd0073d098586351613852bc.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ