2024-05-13_fbaec7e1ffa757239c4e8c7281efdaed_bkransomware

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-13_fbaec7e1ffa757239c4e8c7281efdaed_bkransomware
Size

3.3MB
MD5

fbaec7e1ffa757239c4e8c7281efdaed
SHA1

80b07b7575b78459f3c90d7d8a82820d64d008cf
SHA256

e900f393605b9b39d0021cb39f5f4acc124cb244f8788d48482aae7a5d012214
SHA512

e4b9a4300c6a12fef74b6e6c8a710692db3c5af4c7f640720d03d1109ce4c036c39b6e3d59ef3160a0bb8fd58bf7af03ff5c8d70a4c754759b95b71483d94639
SSDEEP

98304:eUhAwLHy1OBADqZpeNadce1LAn/CDfHboU8WF2:TaGKDOeFH/CDfoM2

Score

1^/10

Malware Config

Signatures

Files

2024-05-13_fbaec7e1ffa757239c4e8c7281efdaed_bkransomware
.exe windows:5 windows x86 arch:x86

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:80:60:fa:e4:3d:97:c2:81:30:15:36
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04-04-2022 01:32

Not After

04-04-2025 01:32

Subject

SERIALNUMBER=91350105705119984B,CN=Fujian NetDragon Computer Network Information Technology Co.\,Ltd,O=Fujian NetDragon Computer Network Information Technology Co.\,Ltd,STREET=开发区君竹路83号科技发展中心大楼第四层Q475室（自贸试验区内）,L=Fuzhou,ST=Fujian,C=CN,1.3.6.1.4.1.311.60.2.1.1=#130646555a484f55,1.3.6.1.4.1.311.60.2.1.2=#130646554a49414e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:80:60:fa:e4:3d:97:c2:81:30:15:36
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04-04-2022 01:32

Not After

04-04-2025 01:32

Subject

SERIALNUMBER=91350105705119984B,CN=Fujian NetDragon Computer Network Information Technology Co.\,Ltd,O=Fujian NetDragon Computer Network Information Technology Co.\,Ltd,STREET=开发区君竹路83号科技发展中心大楼第四层Q475室（自贸试验区内）,L=Fuzhou,ST=Fujian,C=CN,1.3.6.1.4.1.311.60.2.1.1=#130646555a484f55,1.3.6.1.4.1.311.60.2.1.2=#130646554a49414e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06-04-2022 07:44

Not After

08-05-2033 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:a9:41:61:77:13:36:36:7c:50:56:72:54:36:1a:aa:25:36:78:a7:16:13:50:d6:86:91:8d:28:91:16:1a:03
Signer

Actual PE Digest

02:a9:41:61:77:13:36:36:7c:50:56:72:54:36:1a:aa:25:36:78:a7:16:13:50:d6:86:91:8d:28:91:16:1a:03

Digest Algorithm

sha256

PE Digest Matches

false

b6:cd:2a:2a:cd:8f:39:c3:6b:52:fd:5f:08:e3:e6:59:f4:e8:07:95
Signer

Actual PE Digest

b6:cd:2a:2a:cd:8f:39:c3:6b:52:fd:5f:08:e3:e6:59:f4:e8:07:95

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\work\svn\Svn_SecurityLogon\trunk\魔域登录平台\login\Release\autoP.pdb

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 470KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 597KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

04:80:60:fa:e4:3d:97:c2:81:30:15:36Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

04:80:60:fa:e4:3d:97:c2:81:30:15:36Certificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

02:a9:41:61:77:13:36:36:7c:50:56:72:54:36:1a:aa:25:36:78:a7:16:13:50:d6:86:91:8d:28:91:16:1a:03Signer

b6:cd:2a:2a:cd:8f:39:c3:6b:52:fd:5f:08:e3:e6:59:f4:e8:07:95Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 470KB - Virtual size: 470KB

.data Size: 35KB - Virtual size: 71KB

.rsrc Size: 597KB - Virtual size: 596KB

.reloc Size: 161KB - Virtual size: 161KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

04:80:60:fa:e4:3d:97:c2:81:30:15:36
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

04:80:60:fa:e4:3d:97:c2:81:30:15:36
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

02:a9:41:61:77:13:36:36:7c:50:56:72:54:36:1a:aa:25:36:78:a7:16:13:50:d6:86:91:8d:28:91:16:1a:03
Signer

b6:cd:2a:2a:cd:8f:39:c3:6b:52:fd:5f:08:e3:e6:59:f4:e8:07:95
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 470KB - Virtual size: 470KB

.data
Size: 35KB - Virtual size: 71KB

.rsrc
Size: 597KB - Virtual size: 596KB

.reloc
Size: 161KB - Virtual size: 161KB