Behavioral task
behavioral1
Sample
24871ec6c3da2d03deae2bbeab24b0c65f7091164ccb6682429e1f1b056aa4d2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
24871ec6c3da2d03deae2bbeab24b0c65f7091164ccb6682429e1f1b056aa4d2.exe
Resource
win10v2004-20231222-en
General
-
Target
24871ec6c3da2d03deae2bbeab24b0c65f7091164ccb6682429e1f1b056aa4d2
-
Size
26KB
-
MD5
32b07d7d5a328bb9a1cc0515228bffe6
-
SHA1
f983e8b80d951b7a5ae894be50ef8d3c6a535d33
-
SHA256
136dfa3692389018c3f7d013b0babaaa47f0a6f903e658b73e331edd4637bf93
-
SHA512
fef4f7789a49d1a3a8b53bd25a2818a91438bc0f17443540f882eadded516f338b3f558dbfb282f21a5edd4738409f350a1a5a3cf5af2bdbee2d6b4c7ba4251d
-
SSDEEP
384:zYenjLLAps4T5lBavzb/xlhKOVp91QCb5hxDGa:aOElB6sc9GCbXxDV
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 24871ec6c3da2d03deae2bbeab24b0c65f7091164ccb6682429e1f1b056aa4d2
Files
-
24871ec6c3da2d03deae2bbeab24b0c65f7091164ccb6682429e1f1b056aa4d2.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ