C:\Users\bdeline\Downloads\Fransom-main\Fransom-main\Fransom\bin\Release\Fransom.pdb
Behavioral task
behavioral1
Sample
Fransom.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Fransom.exe
Resource
win10v2004-20240412-en
General
-
Target
Fransom.exe
-
Size
2.5MB
-
MD5
2b7c57a4af3d266393fdd781faabd946
-
SHA1
d83c2a6a55fa4637d657ef856091ae7b523bb6ea
-
SHA256
c0ee4fb324783653aaf15ada6d8ea65abb71e5a93a8768d5c48444d31e45e664
-
SHA512
113a034f737f613f83edbceea46167f3d60dadbe3d57724a0aa672b6df24856b6b8a6bc6109e5ad9d4db27db6497baeec0524b94e26b190bd9be6d2e9b07e58c
-
SSDEEP
24576:tKHHnXUVcw49b0hslTPyWqfPaTBDJxgnbJ3ZBrALa0YiBLSzUX+HFcDubpQik57C:ZiwYTyUDJxAF3CXopQTsc
Malware Config
Extracted
metasploit
windows/exec
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fransom.exe
Files
-
Fransom.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ