Behavioral task
behavioral1
Sample
56ebb3620f464fe16edbd35626833145c69ff8b9ea49937c0e286f836c5a6a40.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
56ebb3620f464fe16edbd35626833145c69ff8b9ea49937c0e286f836c5a6a40.exe
Resource
win10v2004-20231215-en
General
-
Target
56ebb3620f464fe16edbd35626833145c69ff8b9ea49937c0e286f836c5a6a40
-
Size
26KB
-
MD5
67e93b2fabc4be50f0288c48ba32c5bc
-
SHA1
2b1058d63d85f31991005bc1114edff7dd43b273
-
SHA256
56ebb3620f464fe16edbd35626833145c69ff8b9ea49937c0e286f836c5a6a40
-
SHA512
d3982c4df638080da6166afe491fdfb0e7de0dc0b3c17bf489cc178ed4ba5cf582026ba4a9eb60410849650e503867a45568e4c5b499694d0342501accc44c65
-
SSDEEP
384:5YenjLLAps4T5lBavzb/xlhKOVp91Qfb5hxDGP:4OElB6sc9GfbXxDk
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56ebb3620f464fe16edbd35626833145c69ff8b9ea49937c0e286f836c5a6a40
Files
-
56ebb3620f464fe16edbd35626833145c69ff8b9ea49937c0e286f836c5a6a40.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ