Behavioral task
behavioral1
Sample
8be1c54a1a4d07c84b7454e789a26f04a30ca09933b41475423167e232abea2b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8be1c54a1a4d07c84b7454e789a26f04a30ca09933b41475423167e232abea2b.exe
Resource
win10v2004-20240226-en
General
-
Target
d234a973c777feee70d3fe7a614c71365b2a28d48bffb89f453fd96cbfd54ef5
-
Size
11KB
-
MD5
bcbc99c763a9bee40e762bf1f8c7dfbe
-
SHA1
59f46c0039851f8bd29cf702a7a2092dc920dc40
-
SHA256
d234a973c777feee70d3fe7a614c71365b2a28d48bffb89f453fd96cbfd54ef5
-
SHA512
c21f30f1fa092f847d9806f2b2cb6ea2d9cbc11287738970006a90dd7977700334e80a0241ace7c5436041dd672ecedcfa6abfd87e42b400a54bff38535ade17
-
SSDEEP
192:s6BVQVKGJ6e0hebUdBHlftMBvTF/8xo6zatMHqrZgk0wGTLtkFOoKmBc8e8E:nBe5J63ebUvHwBvl8xRzaWHwgkJGTLv1
Malware Config
Signatures
-
Nefilim family
-
Nefilim ransomware executable 1 IoCs
File contains patterns typical of Nefilim samples.
resource yara_rule static1/unpack001/8be1c54a1a4d07c84b7454e789a26f04a30ca09933b41475423167e232abea2b nefilim_ransomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/8be1c54a1a4d07c84b7454e789a26f04a30ca09933b41475423167e232abea2b
Files
-
d234a973c777feee70d3fe7a614c71365b2a28d48bffb89f453fd96cbfd54ef5.zip
Password: infected
-
8be1c54a1a4d07c84b7454e789a26f04a30ca09933b41475423167e232abea2b.exe windows:5 windows x86 arch:x86
35f7171c074e35f1274e48a67e3185dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
ExitProcess
FindFirstFileW
lstrlenA
GetDriveTypeW
HeapAlloc
SetFilePointerEx
HeapFree
WaitForSingleObject
GetLogicalDrives
GetProcessHeap
WriteFile
Sleep
ReadFile
CreateFileW
GetFileSizeEx
GetLastError
SetLastError
MoveFileW
FindClose
lstrcmpiW
lstrcatW
FindNextFileW
CloseHandle
lstrcpyW
CreateThread
GetTempPathW
GetProcAddress
LoadLibraryA
CreateMutexA
GetCommandLineW
Sections
.text Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.aspack Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE