Behavioral task
behavioral1
Sample
951dce6731c5f3d2dae570597bc19d59.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
951dce6731c5f3d2dae570597bc19d59.exe
Resource
win10v2004-20231215-en
General
-
Target
951dce6731c5f3d2dae570597bc19d59
-
Size
34KB
-
MD5
951dce6731c5f3d2dae570597bc19d59
-
SHA1
cb32d6679e51d454bc9b3aa5ceb071302cbe2147
-
SHA256
eee8150ba918a7ed099074a1b87a97b3c7f6648a763eedd7096acf16f40e0a73
-
SHA512
3ea6dca684a7671e3371740f9d91f8bc6b10119ae492949585e1bc8789b56f6d110f833f8684489fbfc4dda3d733fc127c242ae840cd262a89b44952dcc4fb09
-
SSDEEP
768:N+0DG/+G4RmQj4HjKbkpSndT6Rwh1llAok5zHDKZNhfwPdrQ+:pDGyRmQjoK9SwvDAh9eNJw1rQ+
Malware Config
Signatures
-
MAKOP ransomware payload 1 IoCs
resource yara_rule sample family_makop -
Makop family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 951dce6731c5f3d2dae570597bc19d59
Files
-
951dce6731c5f3d2dae570597bc19d59.exe windows:4 windows x86 arch:x86
30b12ffca85f4bf373298efe50603379
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
kernel32
FindFirstFileW
DeviceIoControl
GetDriveTypeW
WaitForMultipleObjects
SetErrorMode
FindNextFileW
Sleep
WriteFile
ReadFile
FlushFileBuffers
GetFileSizeEx
MoveFileW
SetFileAttributesW
SetEndOfFile
SetFilePointerEx
HeapFree
GetProcessHeap
FindClose
GetVersion
HeapAlloc
GetCurrentProcess
GetCurrentProcessId
OpenProcess
GetProcAddress
GetFileType
GetModuleHandleA
DuplicateHandle
ExitProcess
GetCommandLineW
CreatePipe
GetLastError
GetSystemWindowsDirectoryW
SetHandleInformation
Process32NextW
CreateMutexA
CreateToolhelp32Snapshot
GetLocaleInfoW
GetEnvironmentVariableW
GetModuleFileNameW
PeekNamedPipe
CreateProcessW
CreateDirectoryW
CreateFileW
GetFileAttributesW
GetLogicalDrives
CreateThread
WaitForSingleObject
GetVolumeInformationW
TerminateProcess
DeleteCriticalSection
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CloseHandle
Process32FirstW
user32
wsprintfW
GetWindowThreadProcessId
GetShellWindow
wsprintfA
advapi32
CryptSetKeyParam
CryptAcquireContextW
CryptDecrypt
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
GetTokenInformation
SetTokenInformation
OpenProcessToken
RegCloseKey
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
CryptEncrypt
CryptImportKey
shell32
ord680
CommandLineToArgvW
SHGetSpecialFolderPathW
netapi32
NetApiBufferFree
NetGetJoinInformation
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE