Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
Ransomware.CryptoWall.zip
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
Ransomware.CryptoWall.exe
Resource
win10-20240221-en
General
-
Target
Ransomware.CryptoWall.zip
-
Size
59KB
-
MD5
ef0fff38bd2c9dfdb24d73c6861dcb9e
-
SHA1
f17b98dcdd5a93f0a9ea3961de381ff3898add56
-
SHA256
8bccc78422858ec95ce2b9b29e53c1ae4aacfd37fdcc35d38e90410ef8cd8c0b
-
SHA512
04f5299c1905d4f4da18585cf843273aa547c4e4d84b84befff9da749d5690ce378dc7b9dd19d77bd54761ede5f9bf8c388bb7563dffb0045023c580792fcae9
-
SSDEEP
768:LIa0DdTKY1MaPGlD5cmttnlNndZJjOvkFRxlRS49hF3ZI+ozfbq8GyeYgS3Qb90S:MhgaPaWmf/1jO0RVnPo7OQewjT8Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Ransomware.CryptoWall.exe
Files
-
Ransomware.CryptoWall.zip.zip
Password: infected
-
Ransomware.CryptoWall.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ