E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Behavioral task
behavioral1
Sample
2024-05-25_59abfbb0ee544b1e6e0b4ebf8ed0edab_stop.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-25_59abfbb0ee544b1e6e0b4ebf8ed0edab_stop.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-25_59abfbb0ee544b1e6e0b4ebf8ed0edab_stop
-
Size
1.1MB
-
MD5
59abfbb0ee544b1e6e0b4ebf8ed0edab
-
SHA1
91f08dfaeeec7a04c72d7ba170471e3d24d0fcf6
-
SHA256
38bf9fbfd96c5103d3aca4b85364021626cd1d6e64b04dc8a981bb0fbb6980f9
-
SHA512
74bdb4fe247793ed1aa2962489fa90d09f9a061566ca1eadd4211094964b3264365a7f2c48f892e65a546e031418080f9e9b0d57f93c0ddb2feaf5c01a4c9584
-
SSDEEP
24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/L8RPOO86bHUq7:F0dwAYZt6C31WeTARPOh6TUq7
Malware Config
Signatures
-
Detected Djvu ransomware 1 IoCs
resource yara_rule sample family_djvu -
Djvu family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-25_59abfbb0ee544b1e6e0b4ebf8ed0edab_stop
Files
-
2024-05-25_59abfbb0ee544b1e6e0b4ebf8ed0edab_stop.exe windows:5 windows x86 arch:x86
0c756c849bc7b459f78f7a5ce46cd4a7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
rpcrt4
RpcStringFreeW
UuidCreate
UuidToStringW
RpcStringFreeA
UuidToStringA
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
wininet
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW
HttpQueryInfoW
InternetOpenA
InternetOpenUrlA
winmm
timeGetTime
shlwapi
PathAppendA
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsA
PathFileExistsW
PathAppendW
PathFindExtensionW
kernel32
VirtualFree
WriteFile
GetDriveTypeA
OpenProcess
GlobalAlloc
GetSystemDirectoryW
WideCharToMultiByte
LoadLibraryW
Sleep
CopyFileW
FormatMessageW
lstrcpynW
CreateProcessA
TerminateProcess
ReadFile
CreateFileW
lstrcatA
GetEnvironmentVariableA
lstrcmpW
MultiByteToWideChar
lstrlenW
FlushFileBuffers
GetShortPathNameA
GetFileSizeEx
GetLastError
SetLastError
GetProcAddress
VirtualAlloc
MoveFileW
FindClose
Process32FirstW
LocalAlloc
CreateEventW
GetModuleFileNameA
Process32NextW
lstrcatW
CreateMutexA
FindNextFileW
CreateToolhelp32Snapshot
SetEnvironmentVariableA
DeleteFileW
LocalFree
lstrcpyW
DeleteFileA
lstrcpyA
SetPriorityClass
GetCurrentProcess
GetComputerNameW
GetLogicalDrives
GetModuleFileNameW
SetStdHandle
GetVersion
CreateDirectoryA
CreateThread
CompareStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
CreateSemaphoreW
GetModuleHandleW
GetTickCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleA
GetVersionExA
GlobalMemoryStatus
LoadLibraryA
FlushConsoleInputBuffer
WaitForSingleObject
CreateDirectoryW
SetFilePointerEx
CreateProcessW
FreeLibrary
SetErrorMode
lstrlenA
SetFilePointer
FindFirstFileW
SetConsoleMode
CreateFileA
GetCommandLineW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetTimeZoneInformation
RaiseException
GetStringTypeW
GetConsoleCP
ReadConsoleW
GetConsoleMode
HeapSize
LoadLibraryExW
OutputDebugStringW
SetConsoleCtrlHandler
RtlUnwind
FatalAppExitA
GetStartupInfoW
GetExitCodeProcess
LCMapStringW
DeleteCriticalSection
AreFileApisANSI
ExitProcess
GetProcessHeap
HeapReAlloc
GlobalFree
SetEndOfFile
ReadConsoleInputA
CloseHandle
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThread
GetCurrentThreadId
user32
PeekMessageW
PostThreadMessageW
DefWindowProcW
DispatchMessageW
UpdateWindow
CreateWindowExW
LoadCursorW
IsWindow
ShowWindow
RegisterClassExW
PostQuitMessage
GetMessageW
DestroyWindow
SendMessageW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
GetDesktopWindow
MessageBoxW
TranslateMessage
advapi32
RegCloseKey
CloseServiceHandle
GetUserNameW
ReportEventA
RegisterEventSourceA
DeregisterEventSource
CryptHashData
RegSetValueExW
CryptDestroyHash
ControlService
RegOpenKeyExW
CryptCreateHash
CryptEncrypt
CryptImportKey
QueryServiceStatus
RegQueryValueExW
CryptReleaseContext
OpenServiceW
OpenSCManagerW
CryptAcquireContextW
CryptGetHashParam
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteA
ShellExecuteExW
CommandLineToArgvW
SHGetFolderPathA
ole32
CoInitialize
CoInitializeSecurity
CoUninitialize
CoCreateInstance
oleaut32
SysFreeString
VariantInit
VariantClear
GetErrorInfo
CreateErrorInfo
SetErrorInfo
VariantChangeType
SysAllocString
iphlpapi
GetAdaptersInfo
ws2_32
inet_ntoa
inet_addr
gethostbyname
dnsapi
DnsFree
DnsQuery_W
crypt32
CryptStringToBinaryA
gdi32
DeleteObject
GetObjectA
SelectObject
GetDeviceCaps
GetBitmapBits
BitBlt
DeleteDC
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
Sections
.text Size: 809KB - Virtual size: 809KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 247KB - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ