Behavioral task
behavioral1
Sample
9f4fbe8555dc51d71d7e8aba1f5e3725a295589ce807ee26e3670f999d7018bf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9f4fbe8555dc51d71d7e8aba1f5e3725a295589ce807ee26e3670f999d7018bf.exe
Resource
win10v2004-20231222-en
General
-
Target
9f4fbe8555dc51d71d7e8aba1f5e3725a295589ce807ee26e3670f999d7018bf
-
Size
26KB
-
MD5
c3df6b6801b64fac5c488e4f79e82bdd
-
SHA1
f3ff752b86175e338d692149004804ad05c7bc56
-
SHA256
f03e1311b93bb3127d23268baef74d4fc32f1e73ff8d48a02b8d508d18bbd654
-
SHA512
29bba2eafc7ab49323f9ce0b75b0347f1dc2aee7c9fca42ed6966343f935587aa6c02042dcc94421190ec9d18bd095ab9c55f70f7a585a93fa3542ec7fd55743
-
SSDEEP
384:CYenjLLAps4T5lBavzb/xlhKOVp91QCb5hxDG0:hOElB6sc9GCbXxDP
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9f4fbe8555dc51d71d7e8aba1f5e3725a295589ce807ee26e3670f999d7018bf
Files
-
9f4fbe8555dc51d71d7e8aba1f5e3725a295589ce807ee26e3670f999d7018bf.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ