2024-05-26_b728ae85f367f1fb27e407c8534c5438_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-26_b728ae85f367f1fb27e407c8534c5438_bkransomware
Size

254KB
MD5

b728ae85f367f1fb27e407c8534c5438
SHA1

276f94280636ee29df9b37853165dc8db1e89519
SHA256

e0cd6220052b0dfd9317f585ab08ec6a342767ee60229301caf4172008d1b190
SHA512

5c334a85d436d52d9450d48076112e75b36e82f2efc61e98c7940f128e80de381e96daf990d57148dd7e3da90c5b6f9c0298e7acee2f6d5e5543da861b16549b
SSDEEP

3072:WROjJ2QcmYnFIBLTqWZJyOKYlRsnrUOly3Y8+LGGWuI:Nj4mYELTqTmoyGWu

Score

1^/10

Malware Config

Signatures

Files

2024-05-26_b728ae85f367f1fb27e407c8534c5438_bkransomware
.exe windows:5 windows x86 arch:x86

20cdb48c048eea45771e21b0573d6acf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

37:61:cf:d0:cf:b6:da:df:5f:fe:98:7a:84:b8:9e:4b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/01/2015, 00:00

Not After

16/03/2018, 23:59

Subject

CN=INFORMATICA 68\, S.A.,O=INFORMATICA 68\, S.A.,L=SAN SEBASTIAN,ST=GUIPUZCOA,C=ES

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:7a:f6:59:b8:00:eb:e4:d3:bb:8a:09:f2:e8:dd:f2:c0:33:7b:70
Signer

Actual PE Digest

4b:7a:f6:59:b8:00:eb:e4:d3:bb:8a:09:f2:e8:dd:f2:c0:33:7b:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libadm

admuser
ref_opc
nom_tex
empre
foptions_gem
fstartlogno
fgraba_lac
fstartlog_pquery
fver_sys
fquery_pasa
fquery_pasa_ope
frequery_interactivo
fexiste_fadmbqu
fdame_interactivo
fnav2h_leer_nav
fnav2h_dame_datos_nav
fquery_pasa_ini
fnav2h_navegando
ftraduce_mens_p
fnav2h_dame_codigos
fquery_pasa_din
fcons_externa
fquery_doconsulta
fnav2p_es_origen_que
fnav2p_cerrard
fbusseq
fini_lista_query
fquery_despliegue
fgemidioma
fquery_do
ffinishlog
ffinishlog_pquery
op_key
usu_gem
tty
ferror
fmsp_errs
fdisp_nomcol
fperdi
fnav2h_query_salir
fnav2h_cambia
ffunque_text
fdichlp
fnav2h_titulo_ventana
ftitulo
fmsp_pant

libgui

dspTo
displayEvent
displayEnd
frmOpen
winOpen
frmDisplay
Wscreen
rowNext
displayNew
set_count
arr_curr
fgl_messagebox
fgl_rowchecked
fgl_setcolumn
fgl_setcomments
fgl_setcaption
keyNext

libsql

ord16
ord9
ord1
ord20
ord18
ord7
ord6
ord3

librun

clipOper
numberPop
matchOper
retString
nullOper
sysMemcpy
cmpOper
addOper
boolTest
catOper
shortPush
shortPop
fcnCall2
longPush
charPush
charPop
fcnEnter3
excepGet
progThrow
stackPop
negOper
subOper
numberPush
stackPush
status
sqlca
length
arg_val
longPop
substrPush
substrPop
progEnd
stackGet
progWin
stackNew
notOper
cmpWhen

kernel32

GetCurrentProcess
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
GetLastError
GetCurrentThread
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapFree
IsValidCodePage
CreateFileW
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapSize
GetStringTypeW
HeapReAlloc
HeapAlloc
OutputDebugStringW
RtlUnwind
LoadLibraryExW
FreeLibrary
SetConsoleCtrlHandler
GetCPInfo
GetOEMCP
GetACP
TerminateProcess

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 1004KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20cdb48c048eea45771e21b0573d6acf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

37:61:cf:d0:cf:b6:da:df:5f:fe:98:7a:84:b8:9e:4bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

4b:7a:f6:59:b8:00:eb:e4:d3:bb:8a:09:f2:e8:dd:f2:c0:33:7b:70Signer

Headers

DLL Characteristics

File Characteristics

Imports

libadm

libgui

libsql

librun

kernel32

Sections

.text Size: 171KB - Virtual size: 171KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 17KB - Virtual size: 1004KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 10KB - Virtual size: 10KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

37:61:cf:d0:cf:b6:da:df:5f:fe:98:7a:84:b8:9e:4b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

4b:7a:f6:59:b8:00:eb:e4:d3:bb:8a:09:f2:e8:dd:f2:c0:33:7b:70
Signer

.text
Size: 171KB - Virtual size: 171KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 17KB - Virtual size: 1004KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 10KB - Virtual size: 10KB