cash_ransom_17214791148[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cash_ransom_17214791148.zip
Size

2.1MB
MD5

2c417ca4caf231798509baa6474ccc5f
SHA1

8c4cb34bcd2536370d2f546ce654d1d1f26199a7
SHA256

1f655e386f65d91af079592a0cb8a4b19767b99ccdd34bc077365b08bb26f89f
SHA512

daf6e1cd1e8249ddb8421575af036b33cbc12d0fd27d3a832d1fe20cffb6a87cf595db2eb0cd9794c60a4d20ed744f2bac28b9b738f40e4493fd84ecdfe499c4
SSDEEP

49152:T2BHu1UNlVozYL7hrga6Cc57Gr4vOGH8FlyENJ:Kw67lr6dGrEOGH8nyENJ

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
static1/unpack001/132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3	net_reactor

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3

Files

cash_ransom_17214791148.zip
.zip

Password: infected
132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ