2024-05-11_a3a37223271177a47950288e6200ed7b_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-11_a3a37223271177a47950288e6200ed7b_bkransomware
Size

254KB
MD5

a3a37223271177a47950288e6200ed7b
SHA1

326eaece9135e4e0775011ef242a3496b102389a
SHA256

631f5aedac15204031e0f984947342a8ef0c6b6bd05fe0012454489c32d9086c
SHA512

e059e0937eb2f9c8b1d9bdffb61b64db09fcda400f6e2c6c451131740a5988c943c5e92c02035ce3c781c1a74d79eb0f4daa32c9d65fce3ef1226b3e0a2c0e39
SSDEEP

3072:eROjJ2QcmYnFIBLTqWZJyOKYlRsnrUOly51Z+LGGWu5:lj4mYELTqTmoyGWu

Score

1^/10

Malware Config

Signatures

Files

2024-05-11_a3a37223271177a47950288e6200ed7b_bkransomware
.exe windows:5 windows x86 arch:x86

20cdb48c048eea45771e21b0573d6acf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

37:61:cf:d0:cf:b6:da:df:5f:fe:98:7a:84:b8:9e:4b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/01/2015, 00:00

Not After

16/03/2018, 23:59

Subject

CN=INFORMATICA 68\, S.A.,O=INFORMATICA 68\, S.A.,L=SAN SEBASTIAN,ST=GUIPUZCOA,C=ES

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3b:0f:a4:c5:80:7b:82:ce:cc:47:93:92:6d:33:21:df:80:70:78:a8
Signer

Actual PE Digest

3b:0f:a4:c5:80:7b:82:ce:cc:47:93:92:6d:33:21:df:80:70:78:a8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libadm

admuser
ref_opc
nom_tex
empre
foptions_gem
fstartlogno
fgraba_lac
fstartlog_pquery
fver_sys
fquery_pasa
fquery_pasa_ope
frequery_interactivo
fexiste_fadmbqu
fdame_interactivo
fnav2h_leer_nav
fnav2h_dame_datos_nav
fquery_pasa_ini
fnav2h_navegando
ftraduce_mens_p
fnav2h_dame_codigos
fquery_pasa_din
fcons_externa
fquery_doconsulta
fnav2p_es_origen_que
fnav2p_cerrard
fbusseq
fini_lista_query
fquery_despliegue
fgemidioma
fquery_do
ffinishlog
ffinishlog_pquery
op_key
usu_gem
tty
ferror
fmsp_errs
fdisp_nomcol
fperdi
fnav2h_query_salir
fnav2h_cambia
ffunque_text
fdichlp
fnav2h_titulo_ventana
ftitulo
fmsp_pant

libgui

dspTo
displayEvent
displayEnd
frmOpen
winOpen
frmDisplay
Wscreen
rowNext
displayNew
set_count
arr_curr
fgl_messagebox
fgl_rowchecked
fgl_setcolumn
fgl_setcomments
fgl_setcaption
keyNext

libsql

ord16
ord9
ord1
ord20
ord18
ord7
ord6
ord3

librun

clipOper
numberPop
matchOper
retString
nullOper
sysMemcpy
cmpOper
addOper
boolTest
catOper
shortPush
shortPop
fcnCall2
longPush
charPush
charPop
fcnEnter3
excepGet
progThrow
stackPop
negOper
subOper
numberPush
stackPush
status
sqlca
length
arg_val
longPop
substrPush
substrPop
progEnd
stackGet
progWin
stackNew
notOper
cmpWhen

kernel32

GetCurrentProcess
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
GetLastError
GetCurrentThread
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapFree
IsValidCodePage
CreateFileW
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapSize
GetStringTypeW
HeapReAlloc
HeapAlloc
OutputDebugStringW
RtlUnwind
LoadLibraryExW
FreeLibrary
SetConsoleCtrlHandler
GetCPInfo
GetOEMCP
GetACP
TerminateProcess

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 1004KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20cdb48c048eea45771e21b0573d6acf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

37:61:cf:d0:cf:b6:da:df:5f:fe:98:7a:84:b8:9e:4bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

3b:0f:a4:c5:80:7b:82:ce:cc:47:93:92:6d:33:21:df:80:70:78:a8Signer

Headers

DLL Characteristics

File Characteristics

Imports

libadm

libgui

libsql

librun

kernel32

Sections

.text Size: 171KB - Virtual size: 171KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 17KB - Virtual size: 1004KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 10KB - Virtual size: 10KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

37:61:cf:d0:cf:b6:da:df:5f:fe:98:7a:84:b8:9e:4b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

3b:0f:a4:c5:80:7b:82:ce:cc:47:93:92:6d:33:21:df:80:70:78:a8
Signer

.text
Size: 171KB - Virtual size: 171KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 17KB - Virtual size: 1004KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 10KB - Virtual size: 10KB