General

Malware Config

Signatures

Files

• ransomwares.zip

  .zip
• ransomwares/7ev3n.zip

  .zip
• 7ev3n.exe

  .exe windows:6 windows x86 arch:x86

  008aca28b7c001acc5e0ab32fabaad84

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  J:\Win32Project9\Release\Win32Project9.pdb

  Imports

  kernel32

  GetCurrentProcess

  ExitThread

  SetEndOfFile

  CreateFileW

  HeapSize

  WriteConsoleW

  ReadConsoleW

  SetStdHandle

  FindFirstFileExW

  FindClose

  GetProcAddress

  GetCommandLineW

  GetCommandLineA

  GetProcessHeap

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetOEMCP

  IsValidCodePage

  SetFilePointerEx

  ReadFile

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  WinExec

  CreateProcessA

  GetStartupInfoA

  GetModuleFileNameW

  CopyFileA

  GetFileAttributesA

  GetModuleFileNameA

  FindNextFileW

  GetLocalTime

  FindFirstFileW

  CreateThread

  GetModuleHandleW

  Sleep

  GetLogicalDrives

  VerifyVersionInfoW

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetFileAttributesExW

  GetExitCodeProcess

  WaitForSingleObject

  GetFileType

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  CloseHandle

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  SetEvent

  ResetEvent

  WaitForSingleObjectEx

  CreateEventW

  IsDebuggerPresent

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  WideCharToMultiByte

  MultiByteToWideChar

  GetStringTypeW

  EncodePointer

  DecodePointer

  SetLastError

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  GetCPInfo

  GetLastError

  FreeLibrary

  LoadLibraryExW

  RaiseException

  RtlUnwind

  MoveFileExW

  ExitProcess

  GetModuleHandleExW

  GetStdHandle

  WriteFile

  GetACP

  HeapAlloc

  HeapReAlloc

  HeapFree

  VerSetConditionMask

  user32

  ShowWindow

  SendMessageW

  FindWindowW

  DrawTextA

  CallNextHookEx

  GetAsyncKeyState

  DefWindowProcW

  PostQuitMessage

  DestroyWindow

  KillTimer

  InvalidateRect

  SetTimer

  EndPaint

  SetWindowsHookExW

  DrawTextW

  BeginPaint

  GetSystemMetrics

  ShowCursor

  DispatchMessageW

  TranslateMessage

  GetMessageW

  SetForegroundWindow

  SetWindowLongW

  SetWindowPos

  CreateWindowExW

  RegisterClassExW

  LoadCursorW

  gdi32

  MoveToEx

  CreatePen

  DeleteObject

  SetTextColor

  SetBkMode

  SelectObject

  CreateFontIndirectW

  CreateSolidBrush

  LineTo

  advapi32

  SystemFunction036

  GetUserNameA

  RegCloseKey

  RegQueryValueExW

  RegOpenKeyExW

  GetUserNameW

  shell32

  ord680

  wininet

  InternetOpenW

  InternetOpenUrlW

  InternetReadFile

  InternetCloseHandle

  netapi32

  NetUserGetInfo

  Sections

  .text

  Size: 174KB - Virtual size: 174KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 122KB - Virtual size: 121KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 840B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ransomwares/Annabelle.zip

  .zip
• Annabelle.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 15.7MB - Virtual size: 15.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 268KB - Virtual size: 267KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• ransomwares/BadRabbit.zip

  .zip
• BadRabbit.exe

  .exe windows:5 windows x86 arch:x86

  e3bda9df66f1f9b2b9b7b068518f2af1

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0e:bf:ea:68:d6:77:b3:e2:6c:ab:41:c3:3f:3e:69:de

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  16-12-2016 00:00

  Not After

  17-12-2017 23:59

  Subject

  CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:6b:e6:bd:11:a8:67:6e:6c:57:90:9e:9b:0d:5f:57

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  15-03-2017 00:00

  Not After

  13-04-2018 23:59

  Subject

  CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  22-07-2014 00:00

  Not After

  21-07-2024 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  02-01-2017 00:00

  Not After

  01-04-2028 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  c9:13:30:16:a3:e5:cf:bf:b1:aa:8b:50:d1:16:0f:a5:35:73:41:3d:4f:81:f8:71:05:4e:c7:39:6d:5a:8b:17

  Signer

  Actual PE Digest

  c9:13:30:16:a3:e5:cf:bf:b1:aa:8b:50:d1:16:0f:a5:35:73:41:3d:4f:81:f8:71:05:4e:c7:39:6d:5a:8b:17

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  bd:ae:90:d3:3b:42:bf:69:31:7c:f4:d9:c1:9d:fd:c2:69:86:ca:f0

  Signer

  Actual PE Digest

  bd:ae:90:d3:3b:42:bf:69:31:7c:f4:d9:c1:9d:fd:c2:69:86:ca:f0

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  ExitProcess

  GetCommandLineW

  GetFileSize

  CreateProcessW

  HeapAlloc

  HeapFree

  GetModuleHandleW

  GetProcessHeap

  WriteFile

  GetSystemDirectoryW

  ReadFile

  GetModuleFileNameW

  CreateFileW

  lstrcatW

  CloseHandle

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  SetUnhandledExceptionFilter

  user32

  wsprintfW

  shell32

  CommandLineToArgvW

  msvcrt

  wcsstr

  memcpy

  free

  malloc

  Sections

  .text

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 828B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 590B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ransomwares/Birele.zip

  .zip
• Birele.exe

  .exe windows:10 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Sections

  UPX0

  Size: - Virtual size: 100KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 114KB - Virtual size: 116KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .exe windows:10 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Sections

  .unp_1

  Size: - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .text

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 17KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 788B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  BSS

  Size: - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 124KB - Virtual size: 131KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  BSS

  Size: - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  BSS

  Size: - Virtual size: 1.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• ransomwares/Cerber 5.zip

  .zip
• Cerber 5.exe

  .exe windows:5 windows x86 arch:x86

  604de9c4534997ea4f32f86753fab871

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  90:21:24:73:c7:06:f5:23:fe:84:bd:b9:a7:8a:01:f4

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  17-07-2017 00:00

  Not After

  17-07-2018 23:59

  Subject

  CN=DEMUS\, OOO,OU=IT,O=DEMUS\, OOO,POSTALCODE=410010,STREET=d. 84 of. 2\, ul.Tankistov,L=Saratov,ST=RU,C=RU,2.5.4.18=#1306343130303130

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  fb:f7:43:25:3a:5f:2f:99:ab:87:3e:d6:da:c8:11:b0:70:ec:8e:54

  Signer

  Actual PE Digest

  fb:f7:43:25:3a:5f:2f:99:ab:87:3e:d6:da:c8:11:b0:70:ec:8e:54

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CreateFileW

  LoadLibraryA

  lstrlenA

  lstrcpyA

  lstrcmpW

  WriteFile

  WriteConsoleInputW

  WideCharToMultiByte

  WaitForSingleObject

  WaitForMultipleObjects

  UnhandledExceptionFilter

  TerminateProcess

  TerminateJobObject

  Sleep

  SetUnhandledExceptionFilter

  SetThreadPriority

  SetThreadLocale

  SetThreadExecutionState

  SetPriorityClass

  SetLastError

  SetFilePointer

  SetFileAttributesA

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ReleaseMutex

  ReadConsoleOutputCharacterA

  RaiseException

  QueryPerformanceCounter

  OutputDebugStringW

  OutputDebugStringA

  OpenEventW

  MultiByteToWideChar

  MoveFileExW

  LocalFree

  LocalAlloc

  LoadLibraryW

  LeaveCriticalSection

  IsDebuggerPresent

  InterlockedIncrement

  InterlockedCompareExchange

  InitializeCriticalSection

  HeapReAlloc

  HeapFree

  HeapAlloc

  GetWindowsDirectoryW

  GetWindowsDirectoryA

  GetVersionExW

  GetVersionExA

  GetTickCount

  GetThreadLocale

  GetSystemTimeAsFileTime

  GetSystemTime

  GetStartupInfoA

  GetProcessPriorityBoost

  GetProcessHeap

  GetProcAddress

  GetModuleHandleW

  GetModuleHandleA

  GetModuleFileNameW

  GetLastError

  GetCurrentThreadId

  GetCurrentThread

  GetCurrentProcessId

  GetCurrentProcess

  GetConsoleAliasExesLengthA

  GetComputerNameW

  FreeLibrary

  FormatMessageW

  FormatMessageA

  ExitProcess

  EnterCriticalSection

  DeleteFileA

  DeleteCriticalSection

  CreateProcessW

  CreateMutexA

  CreateJobObjectA

  CreateFileA

  CloseHandle

  CreateEventW

  CreateEventA

  InterlockedExchange

  user32

  SetKeyboardState

  SetForegroundWindow

  SetFocus

  SetCursor

  SendMessageW

  SendIMEMessageExW

  RegisterDeviceNotificationW

  RegisterClassW

  PostMessageW

  PeekMessageW

  OpenWindowStationW

  MessageBoxW

  MessageBoxA

  MessageBeep

  MapDialogRect

  LoadMenuA

  LoadCursorW

  KillTimer

  IMPGetIMEW

  GetWindowTextW

  GetWindowRect

  SetTimer

  GetMenuItemID

  GetKeyboardLayout

  GetForegroundWindow

  GetDlgItemTextW

  GetDlgItem

  GetDesktopWindow

  EnumDesktopWindows

  EndDialog

  EnableMenuItem

  DrawStateA

  DispatchMessageW

  DispatchMessageA

  DialogBoxParamW

  DestroyWindow

  DestroyAcceleratorTable

  DefWindowProcW

  DdeQueryStringW

  DdeGetLastError

  CreateWindowExW

  CreateDialogIndirectParamA

  CreateAcceleratorTableW

  SetWindowLongW

  SetWindowTextW

  ShowWindowAsync

  TranslateMessage

  UnregisterClassW

  UnregisterDeviceNotification

  wvsprintfW

  IsWindowEnabled

  LoadIconA

  GetClipboardData

  GetDlgCtrlID

  GetOpenClipboardWindow

  IsMenu

  CreatePopupMenu

  GetMenuItemCount

  GetKBCodePage

  GetMenuContextHelpId

  GetFocus

  GetInputState

  GetShellWindow

  GetAsyncKeyState

  GetCapture

  GetClipboardSequenceNumber

  OemKeyScan

  GetActiveWindow

  CharUpperA

  GetWindowDC

  IsWindowUnicode

  GetKeyboardType

  EnumClipboardFormats

  CopyIcon

  GetMenuCheckMarkDimensions

  EndMenu

  GetListBoxInfo

  ReleaseCapture

  GetMessageExtraInfo

  GetWindowLongW

  CharToOemW

  CharLowerW

  BroadcastSystemMessageA

  GetWindowContextHelpId

  gdi32

  SelectObject

  SetBrushOrgEx

  SetDCBrushColor

  SetICMMode

  SetPixelV

  CancelDC

  PathToRegion

  CloseFigure

  GetBkColor

  AbortDoc

  FlattenPath

  GetObjectType

  PlayMetaFileRecord

  RealizePalette

  WidenPath

  SaveDC

  BeginPath

  SetMetaRgn

  UnrealizeObject

  AbortPath

  EndPage

  CreateMetaFileA

  AddFontResourceA

  SwapBuffers

  OffsetWindowOrgEx

  GetTextMetricsW

  GetTextExtentPointW

  GetTextCharset

  GetMetaRgn

  GetKerningPairsW

  GetCurrentObject

  GetCharWidth32A

  GdiSwapBuffers

  GdiStartPageEMF

  GdiQueryTable

  GdiGradientFill

  GdiComment

  GdiCleanCacheDC

  FixBrushOrgEx

  EngGradientFill

  EngDeletePath

  DescribePixelFormat

  DeleteObject

  DeleteDC

  CreatePolygonRgn

  CreateICA

  CreateHatchBrush

  CreateEllipticRgn

  CreateDIBSection

  CreateDCW

  ChoosePixelFormat

  AngleArc

  BRUSHOBJ_pvAllocRbrush

  GetTextColor

  advapi32

  RegEnumValueW

  RegOpenKeyW

  StartServiceCtrlDispatcherW

  SetServiceStatus

  SetSecurityDescriptorOwner

  SetSecurityDescriptorDacl

  SetEntriesInAclW

  ReportEventW

  RegisterServiceCtrlHandlerExW

  RegisterEventSourceW

  RegSetValueExW

  RegQueryValueExW

  RegOpenKeyExW

  AllocateAndInitializeSid

  RegDeleteValueW

  RegDeleteKeyW

  RegCreateKeyW

  RegCloseKey

  OpenServiceW

  OpenSCManagerW

  InitializeSecurityDescriptor

  GetUserNameW

  FreeSid

  DeregisterEventSource

  DeleteService

  CreateServiceW

  CloseServiceHandle

  shell32

  Shell_NotifyIconW

  ShellExecuteExA

  SHPathPrepareForWriteW

  SHLoadNonloadedIconOverlayIdentifiers

  SHInvokePrinterCommandW

  SHGetSpecialFolderPathA

  SHGetSpecialFolderLocation

  SHGetSettings

  SHGetPathFromIDListW

  SHGetMalloc

  CommandLineToArgvW

  DoEnvironmentSubstA

  DoEnvironmentSubstW

  DragQueryFileA

  DragQueryFileAorW

  DragQueryFileW

  ExtractAssociatedIconW

  ExtractIconA

  ExtractIconEx

  SHAddToRecentDocs

  SHBindToParent

  SHBrowseForFolderW

  SHCreateProcessAsUserW

  SHEmptyRecycleBinW

  SHGetFolderPathA

  SHGetFolderPathW

  ShellExecuteExW

  shlwapi

  StrChrW

  StrCmpNIA

  StrCmpNIW

  StrCmpNW

  StrRChrA

  StrRChrIA

  StrRStrIW

  StrStrIA

  StrChrA

  comctl32

  InitCommonControlsEx

  msvcrt

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _abnormal_termination

  _acmdln

  _adjust_fdiv

  _c_exit

  _cexit

  _controlfp

  _except_handler3

  _exit

  _initterm

  _iob

  _mbscmp

  _mbscpy

  _mbsicmp

  _mbsinc

  _mbslwr

  _mbsnbcmp

  _mbsnbicmp

  _snwprintf

  _vsnwprintf

  _wcsicmp

  _wcsnicmp

  exit

  fwprintf

  iswctype

  memmove

  setlocale

  wcschr

  wcscmp

  wcscpy

  wcslen

  wcsncmp

  wcsrchr

  _XcptFilter

  __getmainargs

  imm32

  ImmDisableIME

  Sections

  .text

  Size: 293KB - Virtual size: 292KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 424B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• ransomwares/Darkside.zip

  .zip
• Darkside.exe

  .exe windows:5 windows x86 arch:x86

  17a4bd9c95f2898add97f309fc6f9bcd

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetProcAddress

  LoadLibraryA

  ExitProcess

  Sections

  .text

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 374B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 26KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ransomwares/DeriaLock.zip

  .zip
• DeriaLock.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\Windows.old\Users\ArizonaCode\Documents\Visual Studio 2013\Projects\LOGON\LOGON\obj\Debug\LOGON.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 313KB - Virtual size: 313KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .sdata

  Size: 512B - Virtual size: 312B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 168KB - Virtual size: 168KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ransomwares/Fake GoldenEye.zip

  .zip
• ransomwares/Fake PetrWrap.zip

  .zip
• ransomwares/FakePetya.zip

  .zip
• ransomwares/Fantom.zip

  .zip
• ransomwares/GandCrab.zip

  .zip
• ransomwares/GoldenEye.zip

  .zip
• ransomwares/Huzuni.zip

  .zip
• ransomwares/InfinityCrypt.zip

  .zip
• ransomwares/JanusPetya.zip

  .zip
• ransomwares/Krotten.zip

  .zip
• ransomwares/Locky.zip

  .zip
• ransomwares/Mischa.zip

  .zip
• ransomwares/MischaV2.zip

  .zip
• ransomwares/NoMoreRansom.zip

  .zip
• ransomwares/NotPetya.zip

  .zip
• ransomwares/PetrWrap.zip

  .zip
• ransomwares/Petya.A.zip

  .zip
• ransomwares/PetyaMFTDestroyer.zip

  .zip
• ransomwares/PolyRansom.zip

  .zip
• ransomwares/PowerPoint.zip

  .zip
• ransomwares/RansomBlox.zip

  .zip
• ransomwares/RedBoot.zip

  .zip
• ransomwares/RedEye.zip

  .zip
• ransomwares/Rensenware.zip

  .zip
• ransomwares/Rokku.zip

  .zip
• ransomwares/Seftad.zip

  .zip
• ransomwares/Sodinokibi.zip

  .zip
• ransomwares/ViraLock.zip

  .zip
• ransomwares/WannaCry 1.0.zip

  .zip
• ransomwares/WannaCrypt0r.zip

  .zip
• ransomwares/Wannacry (Plus).zip

  .zip
• ransomwares/Windows10Update.zip

  .zip
• ransomwares/Winlocker.VB6.Blacksod.zip

  .zip
• ransomwares/Xyeta.zip

  .zip