2024-05-26_856de58fea2c1ab158818a2c697d3f17_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-26_856de58fea2c1ab158818a2c697d3f17_bkransomware
Size

292KB
MD5

856de58fea2c1ab158818a2c697d3f17
SHA1

0331566741e52951966e3e20a73468cb03f7500c
SHA256

2caf3d2fb61b905dd8f6ac602f496fd24a4c00c52b65bbb5e0419ea43185aafb
SHA512

989b1075b0846c9e6d1c1de2cb41731644de99eaefca01d0ab7200ce94c0fb4569a3e23fecccb49dd8dd51e23cccee1b6b031e3fb309d12556fd7ec93b6a1c39
SSDEEP

6144:rGZvtbuRhFJxa6WsYuDmLYSz0nGRvwPXU22:rqQFJxT1mkSz02vaXs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-26_856de58fea2c1ab158818a2c697d3f17_bkransomware

Files

2024-05-26_856de58fea2c1ab158818a2c697d3f17_bkransomware
.exe windows:5 windows x86 arch:x86

1a52e52d1e11e6bf6867b0249260f0c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Administrator\Desktop\百度2014\HidePCMgr\Release\HideTarget.pdb

Imports

kernel32

FindResourceW
FindResourceExW
GetLastError
WaitForSingleObject
TerminateProcess
GetProcAddress
GetModuleHandleW
FindFirstChangeNotificationW
OutputDebugStringW
DeleteFileW
FindNextChangeNotification
FindClose
SetLastError
GetFullPathNameW
FindFirstFileW
lstrlenW
FindNextFileW
VerSetConditionMask
VerifyVersionInfoW
CloseHandle
FindCloseChangeNotification
VirtualAllocEx
FlushInstructionCache
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RaiseException
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
MultiByteToWideChar
LoadLibraryExW
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
CreateTimerQueueTimer
WritePrivateProfileStringW
lstrcmpA
GetPrivateProfileIntW
GetPrivateProfileStringW
WriteConsoleW
SetStdHandle
GetStringTypeW
LoadResource
LCMapStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
lstrcmpiW
Process32NextW
Process32FirstW
GetCurrentProcess
CreateToolhelp32Snapshot
VirtualFreeEx
WriteFile
GetStdHandle
LoadLibraryW
WideCharToMultiByte
GetModuleHandleExW
ExitProcess
CreateFileW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
VirtualProtect
GetVersionExW
UnregisterWaitEx
ReleaseSemaphore
RtlUnwind
ReadProcessMemory
CreateSemaphoreW
GetTickCount
GetStartupInfoW
CreateEventW
SetUnhandledExceptionFilter
FlushFileBuffers
OpenProcess
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
DuplicateHandle
GetCurrentThread
InterlockedFlushSList
QueryDepthSList
SetEvent
WaitForSingleObjectEx
Sleep
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
CreateTimerQueue
GetCommandLineW
UnhandledExceptionFilter

user32

DefWindowProcW
GetWindowLongW
CallWindowProcW
EnumWindows
GetWindowThreadProcessId
PostMessageW
FindWindowW
FindWindowExW
wsprintfW
SetWindowLongW
LoadCursorW
PostQuitMessage
CreateWindowExW
UnregisterClassW
GetClassInfoExW
RegisterClassExW
DispatchMessageW
TranslateMessage
GetMessageW
UpdateWindow
ShowWindow
SetWindowPos
DestroyWindow
CharNextW
RegisterWindowMessageW
SendMessageW

advapi32

RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegSetValueExW
OpenProcessToken
RegNotifyChangeKeyValue
RegEnumKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey

shell32

SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

PathRenameExtensionW
PathFileExistsW
PathCombineW

comctl32

InitCommonControlsEx

wininet

InternetOpenUrlW
InternetReadFile
InternetCloseHandle
InternetOpenW

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a52e52d1e11e6bf6867b0249260f0c5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wininet

iphlpapi

Sections

.text Size: 199KB - Virtual size: 198KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 16KB - Virtual size: 32KB

.rsrc Size: 1024B - Virtual size: 752B

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 199KB - Virtual size: 198KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 16KB - Virtual size: 32KB

.rsrc
Size: 1024B - Virtual size: 752B

.reloc
Size: 15KB - Virtual size: 14KB