Static task
static1
Behavioral task
behavioral1
Sample
2024-05-07_8507a5f1ac1e4187d0087a686488f040_bkransomware.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-07_8507a5f1ac1e4187d0087a686488f040_bkransomware.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-07_8507a5f1ac1e4187d0087a686488f040_bkransomware
-
Size
277KB
-
MD5
8507a5f1ac1e4187d0087a686488f040
-
SHA1
1fb2d0a4b7d0ef675db036e87106dab4b14c8524
-
SHA256
7c20d9a46c5fcb17e6a79f3481c68d6d2a2ea2332673546a5aaac08ee7cd5760
-
SHA512
5b4129fd3dc985b784684ca6b62a22b7a120d64fa32c307c99ad45c48740aeecc8f244a73e3d9da17c9a7d340fd6b08c75e21c018b5b4283e149fbab0fdfe883
-
SSDEEP
3072:agVlYj0WScWWIpJYC5bEurqzHflPAsLS8XOr67Fnq805QxQw+i9ma8dgI1lY:dVbfWIj+uiFLS88674w+EmFxl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-07_8507a5f1ac1e4187d0087a686488f040_bkransomware
Files
-
2024-05-07_8507a5f1ac1e4187d0087a686488f040_bkransomware.exe windows:5 windows x86 arch:x86
e4042767f0281dc2dcdb6daff2dcf9bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadPriority
GetCurrentThread
QueryPerformanceCounter
QueryPerformanceFrequency
LocalHandle
LocalAlloc
GetPrivateProfileStringA
GetWindowsDirectoryA
Sleep
GetTickCount
GetPrivateProfileIntA
CreateSemaphoreA
LoadLibraryA
FreeLibrary
DeviceIoControl
lstrcpyA
UnlockFile
_lread
SetFilePointer
_lclose
LockFile
GetFileSize
OpenFile
_lwrite
SetEndOfFile
lstrlenA
lstrcatA
GetComputerNameA
CreateEventA
GetOverlappedResult
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetPriorityClass
CreateFileW
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetStringTypeW
RtlUnwind
LCMapStringW
CompareStringW
HeapReAlloc
HeapSize
OutputDebugStringW
GetFileAttributesExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
GetModuleFileNameA
GetFileType
GetProcessHeap
SetPriorityClass
SetThreadPriority
GetVersionExA
GetSystemDirectoryA
CreateFileA
MulDiv
CreateProcessA
GetModuleHandleA
GetCurrentThreadId
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FormatMessageA
CloseHandle
WaitForSingleObject
GetLastError
GetExitCodeProcess
GetCurrentProcess
LocalFree
GetProcAddress
GetCurrentDirectoryA
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCommandLineA
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetStdHandle
WriteFile
GetModuleFileNameW
LoadLibraryExW
SetEnvironmentVariableA
user32
SendMessageA
GetDC
ReleaseDC
MessageBoxA
wsprintfA
LoadBitmapA
InvalidateRect
UpdateWindow
EnableWindow
SetFocus
SendDlgItemMessageA
SetDlgItemTextA
GetDlgItem
EndDialog
DialogBoxParamA
PostQuitMessage
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
LoadImageA
LoadIconA
GetWindowLongA
IsWindow
gdi32
SelectObject
DeleteObject
RemoveFontResourceA
GetDeviceCaps
CreateFontA
AddFontResourceA
GetStockObject
winspool.drv
SetPrinterA
OpenPrinterA
EnumPrintersA
ClosePrinter
advapi32
GetUserNameA
DeleteService
OpenSCManagerA
ControlService
OpenServiceA
StartServiceA
ChangeServiceConfigA
CreateServiceA
CloseServiceHandle
Sections
.text Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mx_api Size: 512B - Virtual size: 10B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ