2024-05-03_e38d9d89b66ed23e2974e6243c358c1f_bkransomware

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-03_e38d9d89b66ed23e2974e6243c358c1f_bkransomware
Size

4.2MB
MD5

e38d9d89b66ed23e2974e6243c358c1f
SHA1

c0f2aafdb93d1ad6b1f2fb7dcda3c1a55e004261
SHA256

f2d9df14f436d1c65b60aa254a2883577e29ea303cbd0e87c1eb2e6c2da01a96
SHA512

a108269441acb86fa684904ec693b9568f9c473783ac96fb53cee82a85c7becf08d7100368127c9f892e61341b9dba3d213f9521eb11aaf3c674995469707123
SSDEEP

3072:W59vBKhjSzygg5Y0CEGh1OQ1v+lYAeCirt:WDBtwGh1OQ1v+yAeCirt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-03_e38d9d89b66ed23e2974e6243c358c1f_bkransomware

Files

2024-05-03_e38d9d89b66ed23e2974e6243c358c1f_bkransomware
.exe windows:5 windows x86 arch:x86

a89f36c174dde665daef5de38b08b08c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Projects\BlackMesa\xen\src\launcher_main\Release\bms.pdb

Imports

shell32

CommandLineToArgvW

user32

MessageBoxW

kernel32

UnhandledExceptionFilter
CloseHandle
CreateFileW
FlushFileBuffers
GetProcAddress
LocalAlloc
LocalFree
GetCurrentProcess
SetThreadExecutionState
GetLastError
SetLastError
FormatMessageW
LoadLibraryW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
GetCommandLineA
GetEnvironmentVariableW
SetEnvironmentVariableW
SetDllDirectoryW
SetPriorityClass
RaiseException
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
GetStringTypeW
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapFree
RtlUnwind
OutputDebugStringW
SetStdHandle
WriteConsoleW
HeapAlloc
HeapReAlloc
HeapSize
LCMapStringW

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.0MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a89f36c174dde665daef5de38b08b08c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

user32

kernel32

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 51KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 4.0MB - Virtual size: 4.1MB

.rsrc Size: 138KB - Virtual size: 137KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 51KB - Virtual size: 51KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4.0MB - Virtual size: 4.1MB

.rsrc
Size: 138KB - Virtual size: 137KB

.reloc
Size: 4KB - Virtual size: 3KB