016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451[.]unknown

Resubmissions

03/04/2024, 17:41

240403-v9rzlagd86

03/04/2024, 17:37

240403-v68g6sga2w10

Sharing

Copy URL Twitter E-mail

General

Target
016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451.unknown
Size 7.0MB
Sample240403-v9rzlagd86
SHA256 016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451
MD5 ad11e4ce54e0c37b77fc47efe6f6ddd1
SHA1 1045d499c1099edb576f1468796fe5520fc8e689
SHA512 54fd5afabd7c12ea7656c13cdc6c332efa490a068a9d2ada918f02d5e47e6e72949fe53b0ad3e664d9df17820bcb125c60453b2277fe69e8788656fe9c963091
SSDEEP 49152:VXlOslYQt+5oXlabPyyNHb/GMO6d+5M+HKXlayIsy81hvfHXl9Ife9b/GMefR:5EUYQtXQFC6s5M+HInh33f9u
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/FoxRansomware/0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65
unpack001/FoxRansomware/0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7
unpack001/FoxRansomware/42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620
unpack001/FoxRansomware/6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b
unpack001/FoxRansomware/91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53
unpack001/FoxRansomware/941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1

File Explorer

016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451.unknown

.zip 7.0MB
FoxRansomware/0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65

.exe 1.2MB
FoxRansomware/0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7

.exe 1.2MB
FoxRansomware/42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620

.exe 1.2MB
FoxRansomware/6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b

.exe 1.2MB
FoxRansomware/91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

.exe 1.2MB
FoxRansomware/941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1

.exe 1.2MB

016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451.unknown

SHA256 016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451
MD5 ad11e4ce54e0c37b77fc47efe6f6ddd1
SHA1 1045d499c1099edb576f1468796fe5520fc8e689
SHA512 54fd5afabd7c12ea7656c13cdc6c332efa490a068a9d2ada918f02d5e47e6e72949fe53b0ad3e664d9df17820bcb125c60453b2277fe69e8788656fe9c963091
SSDEEP 49152:VXlOslYQt+5oXlabPyyNHb/GMO6d+5M+HKXlayIsy81hvfHXl9Ife9b/GMefR:5EUYQtXQFC6s5M+HInh33f9u
MD5 SHA1 SHA512 SSDEEP

FoxRansomware/0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65

IMPHASH 12679be776260472e438f0b9f6410526
SHA256 0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65
MD5 607d292bdcdde297252e002e613282ae
SHA1 0161d2dd582d064f7e7f50ccb43478ff0884916a
SHA512 2bdc2ff857f9f52aac5071d3a695f7baf822a971969ba263ad03769c41af7916b558bada6bfe76fe78f730235a4ca5d2dd1cf3eaa2a59c5efef06af0a798acb8
SSDEEP 24576:J/SA+2lraRrjSJR5ezmT1dM9bB5slYQt2e8F/KpXcd:PXlOslYQt+5
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

903764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit GetErrorInfo

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameA CryptGenRandom CryptReleaseContext CryptAcquireContextW

user32

MessageBoxA CharNextW LoadStringW PeekMessageW MsgWaitForMultipleObjects MessageBoxW GetSystemMetrics CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW VirtualQuery GetTickCount GetSystemInfo GetVersion CompareStringW IsDBCSLeadByteEx IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetConsoleOutputCP GetConsoleCP GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess ExitThread SwitchToThread GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile SetFilePointer SetEndOfFile ReadFile GetFileType GetFileSize CreateFileW GetStdHandle CloseHandle LoadLibraryA TlsSetValue TlsGetValue LocalFree LocalAlloc WaitForSingleObject WaitForMultipleObjects VirtualQueryEx VirtualProtect VerSetConditionMask VerifyVersionInfoW SuspendThread SizeofResource SetThreadPriority SetLastError SetEvent SetErrorMode ResumeThread ResetEvent ReleaseMutex QueryPerformanceFrequency QueryPerformanceCounter OpenMutexW MoveFileExW LockResource LoadResource LoadLibraryW HeapFree HeapDestroy HeapCreate HeapAlloc GetVolumeInformationW GetVersionExW GetThreadTimes GetThreadPriority GetThreadLocale GetSystemTimes GetProcessTimes GetLocalTime GetFullPathNameW GetFileAttributesW GetExitCodeThread GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThread GetCurrentProcessId GetCurrentProcess GetComputerNameA GetCPInfoExW GetCPInfo FreeResource InterlockedCompareExchange FormatMessageW FindResourceW FindNextFileW ExpandEnvironmentStringsW EnumSystemLocalesW EnumCalendarInfoW DeleteFileW CreateProcessW CreateMutexW CreateEventW

ole32

CoUninitialize CoInitialize

shell32

SHGetSpecialFolderPathW

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

873KB

Virtual Size

872KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

250B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

107B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

297KB

Virtual Size

297KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

FoxRansomware/0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7

IMPHASH 12679be776260472e438f0b9f6410526
SHA256 0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7
MD5 76b640aa00354e46b29ca7ac2adfd732
SHA1 afebf9d72ba7186afefebf4deda87675621b0b8b
SHA512 fecb15238714c786098f1dd0bb18696ab15634228ec3a48c900fd843e817d4c24607bdf6fb58e0321da3e1c1e49305ec919dddabbd34727acec8fbd6cb6fd552
SSDEEP 24576:l/SA+2lraRrjSJR5ezmT1dM9tZBrPyvaNn:zXlabPyyN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

903764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit GetErrorInfo

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameA CryptGenRandom CryptReleaseContext CryptAcquireContextW

user32

MessageBoxA CharNextW LoadStringW PeekMessageW MsgWaitForMultipleObjects MessageBoxW GetSystemMetrics CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

ole32

CoUninitialize CoInitialize

shell32

SHGetSpecialFolderPathW

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

873KB

Virtual Size

873KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

250B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

268KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

FoxRansomware/42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620

IMPHASH e32abd8275a2ccad5d7a565658bb73cc
SHA256 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620
MD5 268360527625d09e747d9f7ab1f84da5
SHA1 09772eb89c9743d3a6d7b2709c76e9740aa4c4b1
SHA512 07fba0c06040fe4ef5f812a52d639bdea6cbe5bf7ff4560403ad12955e6b1ff2b4615361ac4533696a6c5e12d36fb2d2e0df3da2927f6b45f154f0a4e83315e1
SSDEEP 24576:mLeb4QFvTn5TuJR5ezGPMy4EnBB/CPVd+5M89H:Xb/GMO6d+5M+H
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

903764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit GetErrorInfo

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameA CryptGenRandom CryptReleaseContext CryptAcquireContextW

user32

MessageBoxA CharNextW LoadStringW PeekMessageW MsgWaitForMultipleObjects MessageBoxW GetSystemMetrics CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW VirtualQuery GetTickCount GetSystemInfo GetVersion CompareStringW IsDBCSLeadByteEx IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetConsoleOutputCP GetConsoleCP GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess ExitThread SwitchToThread GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile SetFilePointer SetEndOfFile ReadFile GetFileType GetFileSize CreateFileW GetStdHandle CloseHandle LoadLibraryA TlsSetValue TlsGetValue LocalFree LocalAlloc WaitForSingleObject WaitForMultipleObjects VirtualQueryEx VirtualProtect VerSetConditionMask VerifyVersionInfoW SuspendThread SizeofResource SetThreadPriority SetLastError SetFileAttributesW SetEvent SetErrorMode ResumeThread ResetEvent ReleaseMutex QueryPerformanceFrequency QueryPerformanceCounter OpenMutexW MoveFileExW LockResource LoadResource LoadLibraryW HeapFree HeapDestroy HeapCreate HeapAlloc GetVolumeInformationW GetVersionExW GetThreadTimes GetThreadPriority GetThreadLocale GetSystemTimes GetProcessTimes GetLocalTime GetFullPathNameW GetFileAttributesW GetExitCodeThread GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThread GetCurrentProcessId GetCurrentProcess GetComputerNameA GetCPInfoExW GetCPInfo FreeResource InterlockedCompareExchange FormatMessageW FindResourceW FindNextFileW ExpandEnvironmentStringsW EnumSystemLocalesW EnumCalendarInfoW DeleteFileW CreateProcessW CreateMutexW CreateEventW

ole32

CoUninitialize CoInitialize

shell32

SHGetSpecialFolderPathW

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

873KB

Virtual Size

873KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

250B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

107B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

281KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

FoxRansomware/6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b

IMPHASH 12679be776260472e438f0b9f6410526
SHA256 6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b
MD5 907636b28d162f7110b067a8178fa38c
SHA1 048ae4691fe267e7c8d9eda5361663593747142a
SHA512 501a7ee7fc8c0869d3cb57be3a75be02f6a17583e524fae9fa29e149a7391a5ed79c45143c09c667eed7d2fe217503121e23edd6f1bac47c8ba7ec7a4ecbe04a
SSDEEP 24576:R/SA+2lraRrjSJR5ezmT1dM9tZBb5t+wb8fq/81mkvfW:3XlayIsy81hvf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

903764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit GetErrorInfo

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameA CryptGenRandom CryptReleaseContext CryptAcquireContextW

user32

MessageBoxA CharNextW LoadStringW PeekMessageW MsgWaitForMultipleObjects MessageBoxW GetSystemMetrics CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

ole32

CoUninitialize CoInitialize

shell32

SHGetSpecialFolderPathW

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

873KB

Virtual Size

873KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

250B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

281KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

FoxRansomware/91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

IMPHASH 12679be776260472e438f0b9f6410526
SHA256 91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53
MD5 1fa1b6d4b3ed867c1d4baffc77417611
SHA1 afb5e385f9cc8910d7a970b6c32b8d79295579da
SHA512 0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5
SSDEEP 24576:K/SA+2lraRrjSJR5ezmT1dM9bBkNIDreFqO:2Xl9Ife
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

903764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit GetErrorInfo

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameA CryptGenRandom CryptReleaseContext CryptAcquireContextW

user32

MessageBoxA CharNextW LoadStringW PeekMessageW MsgWaitForMultipleObjects MessageBoxW GetSystemMetrics CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

ole32

CoUninitialize CoInitialize

shell32

SHGetSpecialFolderPathW

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

873KB

Virtual Size

872KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

250B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

107B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

276KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

FoxRansomware/941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1

IMPHASH e32abd8275a2ccad5d7a565658bb73cc
SHA256 941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1
MD5 c82d64850d35cc6a536c11adbd261cf6
SHA1 9f4d070a1b4668d110b57c167c4527fa2752c1fe
SHA512 777a06d73e70a881d5b3872236ba8b53aa4d42f94ad247c109980847ccd6d0c531d30afef10315d7b5fe70c7fe4496f932aaac41f6aec76e98474c44bb781002
SSDEEP 24576:pLeb4QFvTn5TuJR5ezGPMy4EnBBuKfDW:Qb/GMef
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

903764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit GetErrorInfo

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameA CryptGenRandom CryptReleaseContext CryptAcquireContextW

user32

MessageBoxA CharNextW LoadStringW PeekMessageW MsgWaitForMultipleObjects MessageBoxW GetSystemMetrics CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW VirtualQuery GetTickCount GetSystemInfo GetVersion CompareStringW IsDBCSLeadByteEx IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetConsoleOutputCP GetConsoleCP GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess ExitThread SwitchToThread GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile SetFilePointer SetEndOfFile ReadFile GetFileType GetFileSize CreateFileW GetStdHandle CloseHandle LoadLibraryA TlsSetValue TlsGetValue LocalFree LocalAlloc WaitForSingleObject WaitForMultipleObjects VirtualQueryEx VirtualProtect VerSetConditionMask VerifyVersionInfoW SuspendThread SizeofResource SetThreadPriority SetLastError SetFileAttributesW SetEvent SetErrorMode ResumeThread ResetEvent ReleaseMutex QueryPerformanceFrequency QueryPerformanceCounter OpenMutexW MoveFileExW LockResource LoadResource LoadLibraryW HeapFree HeapDestroy HeapCreate HeapAlloc GetVolumeInformationW GetVersionExW GetThreadTimes GetThreadPriority GetThreadLocale GetSystemTimes GetProcessTimes GetLocalTime GetFullPathNameW GetFileAttributesW GetExitCodeThread GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThread GetCurrentProcessId GetCurrentProcess GetComputerNameA GetCPInfoExW GetCPInfo FreeResource InterlockedCompareExchange FormatMessageW FindResourceW FindNextFileW ExpandEnvironmentStringsW EnumSystemLocalesW EnumCalendarInfoW DeleteFileW CreateProcessW CreateMutexW CreateEventW

ole32

CoUninitialize CoInitialize

shell32

SHGetSpecialFolderPathW

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

873KB

Virtual Size

873KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

250B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

107B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

267KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451.unknown

FoxRansomware/0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65

oleaut32

advapi32

user32

kernel32

ole32

shell32

wsock32

netapi32

generic

FoxRansomware/0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7

oleaut32

advapi32

user32

kernel32

ole32

shell32

wsock32

netapi32

generic

FoxRansomware/42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620

oleaut32

advapi32

user32

kernel32

ole32

shell32

wsock32

netapi32

generic

FoxRansomware/6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b

oleaut32

advapi32

user32

kernel32

ole32

shell32

wsock32

netapi32

generic

FoxRansomware/91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

oleaut32

advapi32

user32

kernel32

ole32

shell32

wsock32

netapi32

generic

FoxRansomware/941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1

oleaut32

advapi32

user32

kernel32

ole32

shell32

wsock32

netapi32

generic