Static task
static1
Behavioral task
behavioral1
Sample
Annabelle_ransom.exe
Resource
win7-20240215-en
General
-
Target
Annabelle_ransom.bin.zip
-
Size
15.6MB
-
MD5
32b59c2b1cb0fd2b058edcb5c6e7aebd
-
SHA1
c51b79a052d9c97434f9deccb973c39000965b96
-
SHA256
8755ff4ea42e3910261105f3887c4aca181b3c0f868e9f7431714aa573f6d314
-
SHA512
f1275e0c1068e0e78dde0bf28472f839dbd4d10e3ca10771976ea8a4fa48d63dd1a17ba59b80d5a003273ca5b369eb9d0a4bce406f144a749cd6067bcb049ed8
-
SSDEEP
393216:/zbQHnK/SsYx8qToIuwBo+615Yfl87/JZjDSa9QhbdFtT:/zbQq/spoPwcY8LJlZ6hZF9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Annabelle_ransom.bin
Files
-
Annabelle_ransom.bin.zip.zip
Password: infected
-
Annabelle_ransom.bin.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 15.7MB - Virtual size: 15.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ