ransomware_test sample[.]zip | Triage

Resubmissions

26/03/2024, 03:19

240326-dvb66afc8t 10

25/03/2024, 15:36

240325-s16ehseg31 10

20/03/2024, 15:19

240320-sqh68sbe83 10

Sharing

Copy URL Twitter E-mail

General

Target

ransomware_test sample.zip
Size

367KB
MD5

6e512621c83d14077a27fb67945eb18d
SHA1

4c33d891fe0845a89542d165eceecd3bb5b2a269
SHA256

0c9eaf91a5624009915eea03744066948358d5a697a999ed3ba4d615d44da276
SHA512

53153a21b93ac9798beaec34573a4364e2b335f26e1e307aef6b7d087a829fb044097d3076632cd93a12df5a0ed5d2991a94fa75808189530de5b8e3daad014e
SSDEEP

6144:yWIOZUcGqxaULmYfbdnzTIBgXiQkCne7Y2y8G5SqrMnTg9p2zI/itZ20x3E:5ZUrabNIBQW28d+Az/Xx3E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ransomware_test sample. bin

Files

ransomware_test sample.zip
.zip

Password: asd123!@#
ransomware_test sample. bin
.exe windows:5 windows x86 arch:x86

Password: asd123!@#

216df81b1ef7bc2aa8ec52bbeef137c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAppendW

activeds

ord9
ord15

kernel32

CreateProcessW
GetSystemTime
lstrlenW
LocalFree

advapi32

CheckTokenMembership
CreateWellKnownSid

ole32

CoCreateInstance
CoSetProxyBlanket

Sections

.text
Size: 896KB - Virtual size: 895KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 470B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ