C:\Users\User\Desktop\projects\Builder\CustomWindowsForm\obj\Debug\Chaos Ransomware Builder v5.1.pdb
Behavioral task
behavioral1
Sample
c12b5cdfe9ceaa7102571ed7479a540acd0a31059af547b366b78180f1b1c893.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c12b5cdfe9ceaa7102571ed7479a540acd0a31059af547b366b78180f1b1c893.exe
Resource
win10v2004-20240226-en
General
-
Target
c12b5cdfe9ceaa7102571ed7479a540acd0a31059af547b366b78180f1b1c893
-
Size
559KB
-
MD5
0dc52e06b21db8468d6692c77fbf8f03
-
SHA1
0ba31eebbcacb53fde4de77dc117628de63fe254
-
SHA256
c12b5cdfe9ceaa7102571ed7479a540acd0a31059af547b366b78180f1b1c893
-
SHA512
6ac0bf179283c45d6d99349718f4dceb4e7e178dc5463498ce8f5cf4ad513bb454dfe280cc7c4358597e7035d174e80538045ed9b1e2bd60812d9cf7d6c3bd58
-
SSDEEP
3072:lhgbQIbpny6h3Ey3/OrLZt1i9i2YcRVm16Pn61ADuHOi2YcRTmH6PG6d5kCZKi2H:DaQMpyWN9iWm16iyiqmH650ibmK6J
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c12b5cdfe9ceaa7102571ed7479a540acd0a31059af547b366b78180f1b1c893
Files
-
c12b5cdfe9ceaa7102571ed7479a540acd0a31059af547b366b78180f1b1c893.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 438KB - Virtual size: 437KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ