Static task
static1
Behavioral task
behavioral1
Sample
edcccd772c68c75f56becea7f54fb7ee677863b6beaca956c52ee20ec23b472d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
edcccd772c68c75f56becea7f54fb7ee677863b6beaca956c52ee20ec23b472d.exe
Resource
win10v2004-20240226-en
General
-
Target
edcccd772c68c75f56becea7f54fb7ee677863b6beaca956c52ee20ec23b472d.sample
-
Size
161KB
-
MD5
1dde7e42e33b9ed602f9c839cca7150b
-
SHA1
538a0f38f2745dff05c7f2e05fc1fe3165b7767e
-
SHA256
edcccd772c68c75f56becea7f54fb7ee677863b6beaca956c52ee20ec23b472d
-
SHA512
c4d5a9288237a7f06295ea7bbb86b8917b9caba23673421dad6277506771ce87e233bb6894c30802a1cda927c2a3360be49ea2c96c245e9dc5944461e256f2b0
-
SSDEEP
3072:X2+fD5RiXm5v/ACvkIF/o7t4PX5AvJ+juO4LcVm8:VfD5RiXmh5sIm7t4PyaELcE8
Malware Config
Signatures
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource edcccd772c68c75f56becea7f54fb7ee677863b6beaca956c52ee20ec23b472d.sample
Files
-
edcccd772c68c75f56becea7f54fb7ee677863b6beaca956c52ee20ec23b472d.sample.exe windows:5 windows x86 arch:x86
3a9d8d3df56e44da448e2fafa92efb25
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
ExitProcess
GetModuleHandleW
GetConsoleWindow
SetConsoleCursorPosition
AllocConsole
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindFirstVolumeW
FindNextFileW
GetFinalPathNameByHandleW
WaitForMultipleObjects
SetThreadPriority
GetQueuedCompletionStatus
lstrlenA
FindClose
PostQueuedCompletionStatus
SetFileAttributesW
GetCurrentThread
GetSystemInfo
WriteConsoleW
TerminateProcess
SetVolumeMountPointW
SetFilePointerEx
LocalFree
MoveFileExW
FindVolumeClose
GetCurrentProcessId
SetThreadExecutionState
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
CreateIoCompletionPort
GetDriveTypeW
HeapCreate
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
SetStdHandle
ScrollConsoleScreenBufferW
GetNativeSystemInfo
GetLastError
Sleep
OpenProcess
ReleaseMutex
WaitForSingleObject
CreateMutexW
LoadLibraryW
SetProcessShutdownParameters
GetStdHandle
GetCommandLineW
GetCurrentProcess
SetPriorityClass
GetConsoleScreenBufferInfo
ReadFile
DeleteCriticalSection
GetLocalTime
CloseHandle
lstrcatW
CreateFileW
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
CreateThread
LCMapStringW
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetFileType
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetACP
RaiseException
user32
wsprintfA
wsprintfW
ShowWindow
advapi32
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
shell32
SHEmptyRecycleBinW
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
ole32
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
VariantClear
SysAllocString
VariantInit
rstrtmgr
RmStartSession
RmGetList
RmRegisterResources
RmEndSession
shlwapi
PathRemoveFileSpecW
PathFindExtensionW
StrStrIW
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ