2024-06-04_9d489ba34b20d59fadbf17b3c6a654a6_bkransomware

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-04_9d489ba34b20d59fadbf17b3c6a654a6_bkransomware
Size

1.3MB
MD5

9d489ba34b20d59fadbf17b3c6a654a6
SHA1

d52d6018cd59e244468637f7a9e689965b3ee762
SHA256

5e0ff9b9a82ff88b1500dfb8d1e0f8d626a94e74caf5422dbd8850e4d4952d34
SHA512

49b4b81857731b020901ea3cd51f7fd3e0f1c2c47c92eb24e6f68c947b51eded0125730f913aae0a2c78b36dd29916949b9d523821a222d9428d2bf944023bf7
SSDEEP

24576:dV03hJMM8FnXkR1vIwfH+WBzBiiws346ogmNG:dy3wFnXkLZfH+8FiT60NG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-04_9d489ba34b20d59fadbf17b3c6a654a6_bkransomware

Files

2024-06-04_9d489ba34b20d59fadbf17b3c6a654a6_bkransomware
.exe windows:6 windows x86 arch:x86

b02404fa925386533c9533ce9c52aa49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\OpenStack\build\OpenvSwitch\Build\ovs\utilities\ovs-ofctl.pdb

Imports

pthreadvc2

pthread_rwlockattr_destroy
pthread_rwlockattr_init
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlock_rdlock
pthread_rwlock_trywrlock
pthread_rwlock_tryrdlock
pthread_rwlock_destroy
pthread_rwlock_init
pthread_cond_broadcast
pthread_cond_signal
pthread_cond_wait
pthread_cond_destroy
pthread_cond_init
pthread_mutex_unlock
pthread_mutex_trylock
pthread_mutex_lock
pthread_mutex_destroy
pthread_mutex_init
pthread_mutexattr_gettype
pthread_mutexattr_settype
pthread_mutexattr_destroy
pthread_mutexattr_init
pthread_key_delete
pthread_join
pthread_create
pthread_setspecific
pthread_self
pthread_detach
pthread_getspecific
pthread_key_create
pthread_once

ws2_32

recv
accept
freeaddrinfo
getaddrinfo
WSAPoll
socket
setsockopt
send
listen
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
gethostname
WSAEventSelect
inet_pton
inet_ntop
WSAGetLastError
WSAStartup
ntohs
ntohl
htons
htonl

iphlpapi

GetIpNetTable
GetAdaptersAddresses

advapi32

CryptReleaseContext
CryptAcquireContextA
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenServiceA
OpenSCManagerA
ChangeServiceConfig2A
CryptGenRandom

kernel32

EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
OutputDebugStringW
RaiseException
GetTimeZoneInformation
HeapSize
SetFilePointerEx
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetModuleFileNameA
ReadConsoleW
RtlUnwind
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetDateFormatW
FindClose
LoadLibraryExW
FreeLibrary
CreateSemaphoreW
GetModuleHandleW
GetTickCount
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
CreateEventW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FatalAppExitA
DeleteCriticalSection
GetCurrentThreadId
SetLastError
GetCPInfo
GetOEMCP
GetACP
GetTimeFormatW
LCMapStringW
CompareStringW
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateFileW
SetEnvironmentVariableA
GetFullPathNameA
DuplicateHandle
FindFirstFileExW
GetProcessTimes
GetLastError
GetErrorMode
SetErrorMode
Sleep
FormatMessageA
GetCommandLineA
GetFileAttributesA
ReadFile
WriteFile
CloseHandle
CreatePipe
SetEvent
ResetEvent
CreateEventA
CreateProcessA
GetStartupInfoA
SetConsoleCtrlHandler
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
WaitForMultipleObjects
GetSystemInfo
DeleteFileW
GetCurrentProcess
GetCurrentThread
GetThreadTimes
K32GetProcessMemoryInfo
CreateFileA
DeviceIoControl
GlobalMemoryStatusEx
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
IsProcessorFeaturePresent
HeapFree
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapReAlloc
SetEndOfFile
GetProcessHeap
GetCurrentProcessId
IsDebuggerPresent
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileType
PeekNamedPipe
FileTimeToSystemTime
GetStdHandle
GetModuleFileNameW
WriteConsoleW
IsValidCodePage

Sections

.text
Size: 992KB - Virtual size: 991KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 182KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b02404fa925386533c9533ce9c52aa49

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

pthreadvc2

ws2_32

iphlpapi

advapi32

kernel32

Sections

.text Size: 992KB - Virtual size: 991KB

.rdata Size: 182KB - Virtual size: 181KB

.data Size: 96KB - Virtual size: 110KB

.idata Size: 6KB - Virtual size: 6KB

.reloc Size: 44KB - Virtual size: 43KB

.text
Size: 992KB - Virtual size: 991KB

.rdata
Size: 182KB - Virtual size: 181KB

.data
Size: 96KB - Virtual size: 110KB

.idata
Size: 6KB - Virtual size: 6KB

.reloc
Size: 44KB - Virtual size: 43KB