Behavioral task
behavioral1
Sample
d332b145aec1260fd7a4877377e0778c5cf4ea66ec98dd5e1fb711836fc6b38d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d332b145aec1260fd7a4877377e0778c5cf4ea66ec98dd5e1fb711836fc6b38d.exe
Resource
win10v2004-20231215-en
General
-
Target
d332b145aec1260fd7a4877377e0778c5cf4ea66ec98dd5e1fb711836fc6b38d
-
Size
26KB
-
MD5
47f7a07d58a42e6288edba0719f7accf
-
SHA1
885ae293ee9942dcd255f145c0f6581351fb1fa7
-
SHA256
0e3a88d2fcb105bf479c54b92b570a8d429f00e94fc8e5652e5a766b7ee065a7
-
SHA512
53bc4c95f48cc0acbff3c3a78fb467bc2e5aadd4c9540fc8c47b2151cde94d2997423c463d901b2ab8e0cab9004508541ffe7c50333284517680337e21b338a9
-
SSDEEP
384:CYenjLLAps4T5lBavzb/xlhKOVp91Q+b5hxDGq:hOElB6sc9G+bXxDF
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d332b145aec1260fd7a4877377e0778c5cf4ea66ec98dd5e1fb711836fc6b38d
Files
-
d332b145aec1260fd7a4877377e0778c5cf4ea66ec98dd5e1fb711836fc6b38d.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ