Behavioral task
behavioral1
Sample
c94542c28e58c0035c6913cdf75e0c225a0758fc9872704fd5761e31e72b5b83.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c94542c28e58c0035c6913cdf75e0c225a0758fc9872704fd5761e31e72b5b83.exe
Resource
win10v2004-20231222-en
General
-
Target
c94542c28e58c0035c6913cdf75e0c225a0758fc9872704fd5761e31e72b5b83
-
Size
26KB
-
MD5
023117a51f5296b436f6244f5dafb6a4
-
SHA1
77eb4925ab22a613f9f9c7c54555d0a804e9451e
-
SHA256
e64dc77a23d94fff5c5b24cf79058ec263ba3706ec5462fc579511b62588b48b
-
SHA512
710cbb3a9e6cd0480446487d578a5dbdcf52c2db326bf6669195639baf27bbf42d36e9a77c04137273120c821f85b03ce907f46b6b8aba5dea8b3e025091661a
-
SSDEEP
384:CYenjLLAps4T5lBavzb/xlhKOVp91QDb5hxDG5:hOElB6sc9GDbXxDe
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c94542c28e58c0035c6913cdf75e0c225a0758fc9872704fd5761e31e72b5b83
Files
-
c94542c28e58c0035c6913cdf75e0c225a0758fc9872704fd5761e31e72b5b83.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ