Behavioral task
behavioral1
Sample
68bcbba39acaaf7c867ecd7d5955d3a7890580f3331db3ec88c74ac8f26018ae.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
68bcbba39acaaf7c867ecd7d5955d3a7890580f3331db3ec88c74ac8f26018ae.exe
Resource
win10v2004-20231215-en
General
-
Target
68bcbba39acaaf7c867ecd7d5955d3a7890580f3331db3ec88c74ac8f26018ae.exe
-
Size
26KB
-
MD5
34ab623715e4479239f4f821c18cd85a
-
SHA1
633e82a38ee68fc53b603387467c7db9762ac898
-
SHA256
be9db8b3802dfb081530ce9058741d3ec377876687174615d56d525d23474eb8
-
SHA512
83ccd072c2246a89f164fca550fcda45208a64b0eff8e0bd3ee74d0fd2c5f292c69d00cbf999199fb2a412da5108d8b40752657a12e5d3c895f60e70bba853c8
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91QgIb5hxDG/:5OElB6sc9GHbXxDU
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68bcbba39acaaf7c867ecd7d5955d3a7890580f3331db3ec88c74ac8f26018ae.exe
Files
-
68bcbba39acaaf7c867ecd7d5955d3a7890580f3331db3ec88c74ac8f26018ae.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ