Behavioral task
behavioral1
Sample
890050b9de356dcd6cad976f9fe21e28ed337ea0d3ba1a2f4413c870a77d8037.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
890050b9de356dcd6cad976f9fe21e28ed337ea0d3ba1a2f4413c870a77d8037.exe
Resource
win10v2004-20231222-en
General
-
Target
890050b9de356dcd6cad976f9fe21e28ed337ea0d3ba1a2f4413c870a77d8037.exe
-
Size
26KB
-
MD5
59f99213ebd87e14cff751a3ddaf7513
-
SHA1
a2960a80da6320c8c97ee3af76795d6d0b1922ae
-
SHA256
653f52015cdc9a18391c06b3d05c8495df3ca0bf17c5531236d60f10e8f13618
-
SHA512
cb79b9c154ba24ca287b32de6fbff8680959cdba0f91be6870632537bb107613d0293a29e4d9f5aa5cd615c0d2a4bb0b0f6739e790f0f3ecc6fe5623030a4ea5
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91Q8Pb5hxDGkd:5OElB6sc9G8PbXxDP
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 890050b9de356dcd6cad976f9fe21e28ed337ea0d3ba1a2f4413c870a77d8037.exe
Files
-
890050b9de356dcd6cad976f9fe21e28ed337ea0d3ba1a2f4413c870a77d8037.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ