2024-05-03_c2c6a538971537f0786c3e32f2de57b2_bkransomware

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-03_c2c6a538971537f0786c3e32f2de57b2_bkransomware
Size

183KB
MD5

c2c6a538971537f0786c3e32f2de57b2
SHA1

b81572f9aa8ae711513abcded6345f2e65e88d46
SHA256

9ff9823fee697a3aaacf3deee3103247b4212424eb4423e66b3709e4fbad62ff
SHA512

0607243b6567dfaa29c89e6ee62929e1aa77839ac6cd5ceff47737a358f089909a349971b0fe85b8748d5bb620e64f64b01b1b9ee87dfacd90c7ade9182f83e6
SSDEEP

3072:WptTysh/wGv0Tr7CKuh56QJvzze8JlnFeAWnP3+SdLl:Wrrh3sTrq6QVzze06PXj

Score

1^/10

Malware Config

Signatures

Files

2024-05-03_c2c6a538971537f0786c3e32f2de57b2_bkransomware
.exe windows:5 windows x86 arch:x86

d9ba68d88b39d401671629d04a0f1893

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05-05-2015 00:00

Not After

31-12-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0b:67:ad:0e:6f:be:3e:ca:46:8a:44:7e:13:75:fa:de
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

10-11-2015 00:00

Not After

08-01-2019 23:59

Subject

CN=baramundi software AG,O=baramundi software AG,L=Augsburg,ST=Bavaria,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:0f:94:71:bb:a3:aa:b8:0e:7d:25:7e:46:17:82:f3:8d:28:73:e8
Signer

Actual PE Digest

5a:0f:94:71:bb:a3:aa:b8:0e:7d:25:7e:46:17:82:f3:8d:28:73:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Builds\1\bms\15.2\src\Output\Release\Watcher.pdb

Imports

kernel32

Sleep
WriteConsoleW
HeapSize
SetEndOfFile
HeapReAlloc
RtlUnwind
GetConsoleCP
OutputDebugStringW
LoadLibraryExW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
CloseHandle
GetLastError
ReadFile
MultiByteToWideChar
GetConsoleMode
ReadConsoleW
GetCommandLineA
EncodePointer
DecodePointer
RaiseException
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThread
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
SetStdHandle
GetFileType
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetFilePointerEx
CreateFileW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
FatalAppExitA
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
SetConsoleCtrlHandler
FreeLibrary
FlushFileBuffers

user32

EnumWindows
MessageBoxA
GetWindowTextA
SetForegroundWindow
MapVirtualKeyA
keybd_event
VkKeyScanA

Sections

.text
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9ba68d88b39d401671629d04a0f1893

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

0b:67:ad:0e:6f:be:3e:ca:46:8a:44:7e:13:75:fa:deCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

5a:0f:94:71:bb:a3:aa:b8:0e:7d:25:7e:46:17:82:f3:8d:28:73:e8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 142KB - Virtual size: 142KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 1KB - Virtual size: 1KB

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

0b:67:ad:0e:6f:be:3e:ca:46:8a:44:7e:13:75:fa:de
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

5a:0f:94:71:bb:a3:aa:b8:0e:7d:25:7e:46:17:82:f3:8d:28:73:e8
Signer

.text
Size: 142KB - Virtual size: 142KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 1KB - Virtual size: 1KB