Behavioral task
behavioral1
Sample
2cef841a4ebfbf18c6589bc02652c1755123399d413c4884af6dfc1e002b9b6a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2cef841a4ebfbf18c6589bc02652c1755123399d413c4884af6dfc1e002b9b6a.exe
Resource
win10v2004-20231215-en
General
-
Target
2cef841a4ebfbf18c6589bc02652c1755123399d413c4884af6dfc1e002b9b6a
-
Size
26KB
-
MD5
66227b6950d29336c7cf1ba743ef668e
-
SHA1
5d9cf98ab70c5162d8cecfa5fc5a9840f9dab09e
-
SHA256
2cef841a4ebfbf18c6589bc02652c1755123399d413c4884af6dfc1e002b9b6a
-
SHA512
f7f515ab790334f9843b45035f109a40ac74dfd1a0c6f0bdd6a38fee407a68e818fd3978f94f6dc47b62640b3c4c38a5fbdcd537b555db0884e6a02eabc11d48
-
SSDEEP
384:OYenjLLAps4T5lBavzb/xlhKOVp91QYb5hxDGZ:9OElB6sc9GYbXxDe
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2cef841a4ebfbf18c6589bc02652c1755123399d413c4884af6dfc1e002b9b6a
Files
-
2cef841a4ebfbf18c6589bc02652c1755123399d413c4884af6dfc1e002b9b6a.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ