2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma

General

Target
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma
Size 92KB
Sample240217-c9fx8aab6v
SHA256 6d5d20215c64f189add3d76f6c2efc5f4ac4176ccf74a33e527f00c5f36793b5
MD5 dff72ddc745929160ea5f725aecf2460
SHA1 54a73d8a9c8c435f23789c5d98a31e27ffe21ac2
SHA512 d604b1400e1bbb43d4befe36710449f14067da11e68d9d46c621417b2732de0bba04768b62ea3d1789095e717752339c1e8b898dea1c53747a4762a3138b50cd
SSDEEP 1536:mBwl+KXpsqN5vlwWYyhY9S4AndTS2KdAHo3XJ+y+fDDQtT/GF:Qw+asqN5aW/hL1dTaJ3Xt+UTu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detects win.dharma. 1 IoCs

resource	yara_rule
sample	win_dharma_auto

Identifies DHARMA ransomware 4 IoCs

resource	yara_rule
sample	Windows_Ransomware_Dharma_aa5eefed
sample	Windows_Ransomware_Dharma_b31cac3f
sample	Windows_Ransomware_Dharma_e9319e4a
sample	Windows_Ransomware_Dharma_942142e3

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma

IMPHASH f86dec4a80961955a89e7ed62046cc0e
SHA256 6d5d20215c64f189add3d76f6c2efc5f4ac4176ccf74a33e527f00c5f36793b5
MD5 dff72ddc745929160ea5f725aecf2460
SHA1 54a73d8a9c8c435f23789c5d98a31e27ffe21ac2
SHA512 d604b1400e1bbb43d4befe36710449f14067da11e68d9d46c621417b2732de0bba04768b62ea3d1789095e717752339c1e8b898dea1c53747a4762a3138b50cd
SSDEEP 1536:mBwl+KXpsqN5vlwWYyhY9S4AndTS2KdAHo3XJ+y+fDDQtT/GF:Qw+asqN5aW/hL1dTaJ3Xt+UTu
MD5 SHA1 SHA512 SSDEEP

Minor OS version

1

Major OS version

5

Entry point

43472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\crysis\Release\PDB\payload.pdb