Behavioral task
behavioral1
Sample
049a9af088000422abccb736925dee79bfab0b6fb38c5ea9422750109717f6d2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
049a9af088000422abccb736925dee79bfab0b6fb38c5ea9422750109717f6d2.exe
Resource
win10v2004-20231222-en
General
-
Target
049a9af088000422abccb736925dee79bfab0b6fb38c5ea9422750109717f6d2.exe
-
Size
26KB
-
MD5
f7a901c6df07d3ad10b21be7ce5845a4
-
SHA1
5a9cb68af7bb7223ad32bf8106a43ec58bd4f04e
-
SHA256
049a9af088000422abccb736925dee79bfab0b6fb38c5ea9422750109717f6d2
-
SHA512
b564841b6fb2a3d576e0d284005d6db0a71f4d30f33a61536a9081518fd9669bc44b9e01fccb5b95577def03ea9f3678d8c03b658e556aab5b3e1a7bf1b6a478
-
SSDEEP
384:DYenjLLAps4T5lBavzb/xlhKOVp91Q5b5hxDGPJ:qOElB6sc9G5bXxDeJ
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 049a9af088000422abccb736925dee79bfab0b6fb38c5ea9422750109717f6d2.exe
Files
-
049a9af088000422abccb736925dee79bfab0b6fb38c5ea9422750109717f6d2.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ