2024-05-30_527f969b84fc262e8fd1be64d6a71eac_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-30_527f969b84fc262e8fd1be64d6a71eac_bkransomware
Size

279KB
MD5

527f969b84fc262e8fd1be64d6a71eac
SHA1

6f2861a8f21d4e7becd578d6880f6ad6c90fa4ec
SHA256

0a3a326e3dc119524a9d43a8e7492c7ea813eca0af0ec8dc959bf064b2ae46b6
SHA512

93bdce8b0a18ff6e229b98598e600e3306cc742cbc0a9615bcec73bca2eed540ddfdc9f8c608bcf211959cdd0c1d3ad1030930398811ef1831c4dbbab3213cd4
SSDEEP

6144:bX6trqn940OtwZ45SD5AjZMx2E7ZNrdD7rH7G/:bKten9401dA62EXrZrH7G/

Score

1^/10

Malware Config

Signatures

Files

2024-05-30_527f969b84fc262e8fd1be64d6a71eac_bkransomware
.exe windows:5 windows x86 arch:x86

061c85279b0b5eb088bbb3ffade47114

Code Sign

04:14:da:82:38:58:b7:11:c8:81:32:24:9e:4a:38:e9
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/05/2014, 00:00

Not After

06/09/2017, 12:00

Subject

CN=Psiphon Inc.,O=Psiphon Inc.,L=Toronto,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:64:01:46:e9:80:e0:0e:60:a1:4d:8f:44:4a:59:58
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/05/2014, 00:00

Not After

03/06/2015, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e8:c0:41:fd:c5:f3:3d:64:87:ac:05:85:bc:47:a4:62:68:a0:de:4a
Signer

Actual PE Digest

e8:c0:41:fd:c5:f3:3d:64:87:ac:05:85:bc:47:a4:62:68:a0:de:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Adam\Code\psiphon\polipo\Release\polipo.pdb

Imports

ws2_32

getpeername
ioctlsocket
connect
htonl
select
shutdown
socket
__WSAFDIsSet
closesocket
accept
WSAStartup
setsockopt
bind
listen
gethostname
gethostbyaddr
ntohl
WSAGetLastError
htons
ntohs
recv
gethostbyname
send

kernel32

DeleteFileW
DuplicateHandle
SetEndOfFile
SetEnvironmentVariableA
CreateFileW
GetFileAttributesExW
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualFree
VirtualAlloc
GetSystemTimeAsFileTime
Sleep
FreeConsole
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
GetTempPathA
GetCurrentProcessId
GetCommandLineA
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
RaiseException
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetFileType
RtlUnwind
GetConsoleCP
GetConsoleMode
CloseHandle
GetTimeZoneInformation
FlushFileBuffers
SetFilePointerEx
ReadFile
ReadConsoleW
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
HeapSize

Sections

.text
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

061c85279b0b5eb088bbb3ffade47114

Code Sign

04:14:da:82:38:58:b7:11:c8:81:32:24:9e:4a:38:e9Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

06:64:01:46:e9:80:e0:0e:60:a1:4d:8f:44:4a:59:58Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

e8:c0:41:fd:c5:f3:3d:64:87:ac:05:85:bc:47:a4:62:68:a0:de:4aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

Sections

.text Size: 203KB - Virtual size: 202KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 35KB - Virtual size: 43KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 11KB - Virtual size: 11KB

04:14:da:82:38:58:b7:11:c8:81:32:24:9e:4a:38:e9
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

06:64:01:46:e9:80:e0:0e:60:a1:4d:8f:44:4a:59:58
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

e8:c0:41:fd:c5:f3:3d:64:87:ac:05:85:bc:47:a4:62:68:a0:de:4a
Signer

.text
Size: 203KB - Virtual size: 202KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 35KB - Virtual size: 43KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 11KB - Virtual size: 11KB