2024-05-21_5d12992c602009b2a67a3c2108f8fcd8_bkransomware

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-21_5d12992c602009b2a67a3c2108f8fcd8_bkransomware
Size

508KB
MD5

5d12992c602009b2a67a3c2108f8fcd8
SHA1

1ea9ee9b805094fa1cea610779212128fab9c69b
SHA256

65b57badff889bfeda0e227d4e4cee8b1abf1477cb3c6304921ec7127178e2e1
SHA512

f6b8d32ab414377822d293070b227846ecc40cdf8212c4fa5395ff391bb1ca7e9cc0292469cf523141b945b380f845a56775053e0cc48ba0504888a34f19788d
SSDEEP

6144:hqmDOLjRh0EZbG01WYQEehZjHTNdZMJoHiJ:h1DOPTvl1WYQEehZjHTNvMJUiJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-21_5d12992c602009b2a67a3c2108f8fcd8_bkransomware

Files

2024-05-21_5d12992c602009b2a67a3c2108f8fcd8_bkransomware
.exe windows:5 windows x86 arch:x86

329ad7e4afaf1110bf095bcd1c5abb2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\P\q818rRyHw1PirxN5\w53hn1WrOrNB\LRtrshKzVAMtbY\qvg0JxhELD\E11EapwEnS\jrNFDicfHen\Release\jrNFDicfHen.pdb

Imports

kernel32

GetSystemDefaultLangID
GetCommandLineW
DebugActiveProcess
EncodePointer
GetThreadContext
EnumResourceNamesW
GetNumaNodeProcessorMask
RemoveVectoredExceptionHandler
SetThreadContext
GetNumaProcessorNode
RtlCaptureContext
DebugActiveProcessStop
GetSystemDefaultUILanguage
FindResourceExW
FindResourceW
LoadResource
FindActCtxSectionGuid
SetUnhandledExceptionFilter
EndUpdateResourceW
GetCurrentProcess
GetSystemDEPPolicy
SetHandleInformation
GetUserDefaultLCID
GetLogicalDrives
GetNumaAvailableMemoryNode
GetSystemDefaultLCID
OutputDebugStringW
EncodeSystemPointer
GetCurrentThread
DecodeSystemPointer
GetUserDefaultLangID
CreateActCtxW
SetHandleCount
ActivateActCtx
AddRefActCtx
GetThreadSelectorEntry
SizeofResource
ReadProcessMemory
lstrcpynW
lstrcmpW
lstrlenW
FlushInstructionCache
DeactivateActCtx
GetHandleInformation
GetThreadLocale
VirtualAlloc
BeginUpdateResourceW
GetNumaHighestNodeNumber
GetDiskFreeSpaceW
UnhandledExceptionFilter
AddVectoredExceptionHandler
LockResource
DecodePointer
EnumResourceTypesW
lstrcmpiW
DebugSetProcessKillOnExit
lstrcatW
DebugBreakProcess
IsDebuggerPresent
FatalExit
WaitForDebugEvent
GetCurrentThreadId
DuplicateHandle
GetDiskFreeSpaceExW
CloseHandle
GetVersion
EnumResourceLanguagesW
GetCurrentProcessId
DebugBreak
FindActCtxSectionStringW
lstrcpyW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapSize
GetStringTypeW
CreateFileW
HeapReAlloc
HeapAlloc
RtlUnwind
LoadLibraryExW
FreeLibrary
SetConsoleCtrlHandler
IsProcessorFeaturePresent
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapFree
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreW
GetModuleHandleW
GetTickCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCommandLineA
GetLastError
SetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep

user32

EnumDesktopsA
GetProcessWindowStation

shell32

CommandLineToArgvW
ord23
DragFinish
ord66
ord152
ExtractAssociatedIconW
ord239
DragQueryPoint
ord155
DragQueryFileW
ExtractIconExW
ord25
ord680
ord16
ord63
DragAcceptFiles
ord43
ord21
ord17
ord92
ord153
DuplicateIcon
ord85
FindExecutableW
ord154
ord19
SHChangeNotify
ord190
ord18
DoEnvironmentSubstW
ord27
ord47
ExtractIconW
ord171
ord24

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

329ad7e4afaf1110bf095bcd1c5abb2f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

Sections

.text Size: 95KB - Virtual size: 95KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 364KB - Virtual size: 364KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 95KB - Virtual size: 95KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 364KB - Virtual size: 364KB

.reloc
Size: 6KB - Virtual size: 5KB