Static task
static1
Behavioral task
behavioral1
Sample
2024-06-04_bc1cea134c8b98f45ec376c0b90b2bc8_bkransomware.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-04_bc1cea134c8b98f45ec376c0b90b2bc8_bkransomware.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-04_bc1cea134c8b98f45ec376c0b90b2bc8_bkransomware
-
Size
2.8MB
-
MD5
bc1cea134c8b98f45ec376c0b90b2bc8
-
SHA1
1482fd1f53bc17b8475092de9b9f7dbdcea99e48
-
SHA256
b3d57e7cb7dd2e592a1ef554b4a6834c0e5aa86f9bb69a90fbd32bbcec6c31ac
-
SHA512
c3111f7d575ea796115089952185b5d7f0729a0941ba01ddaac1fda44641024e2a257e38e360d3c76fab1c56a86e8c814a3fc78d8745315559152e607ffb5589
-
SSDEEP
49152:ecydxcrabvwMIz4VpsxgvsFoadsxDjy45AeioI752bvI752bDI752bVI752bkI7P:QeObvwMdslsxXy45BcxI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-04_bc1cea134c8b98f45ec376c0b90b2bc8_bkransomware
Files
-
2024-06-04_bc1cea134c8b98f45ec376c0b90b2bc8_bkransomware.exe windows:6 windows x86 arch:x86
b1705569ab645519a26eaaacf7f747fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wbtrv32
ord1
user32
MessageBoxA
GetFocus
UpdateWindow
ShowWindow
CreateWindowExA
PostQuitMessage
KillTimer
DestroyWindow
SetTimer
DefWindowProcA
RegisterClassA
LoadCursorA
LoadIconA
DispatchMessageA
TranslateMessage
GetMessageA
gdi32
GetStockObject
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32
PeekNamedPipe
CreateFileW
SetEnvironmentVariableA
LCMapStringW
CompareStringW
GetStringTypeW
OutputDebugStringW
ReadConsoleW
GetCurrentDirectoryW
GetExitCodeProcess
VirtualQuery
CreateProcessA
SetCurrentDirectoryA
GetLastError
GetWindowsDirectoryA
GetTempFileNameA
WriteFile
GetFileType
SetFilePointer
VirtualAlloc
VirtualFree
SystemTimeToFileTime
GetLocalTime
FileTimeToLocalFileTime
FormatMessageA
CloseHandle
GetStdHandle
LoadLibraryA
GetThreadLocale
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
CreateFileA
CreateMutexA
ReleaseMutex
WaitForSingleObject
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CreateEventA
SetEvent
TerminateThread
Sleep
SetEndOfFile
ReadFile
SetLastError
GetFileInformationByHandle
GetTempPathA
GetFullPathNameA
GetSystemDefaultLangID
GetFullPathNameW
GetUserDefaultLangID
InterlockedExchange
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
GetHandleInformation
IsBadReadPtr
DeleteFileA
GetVersionExA
SetThreadPriority
FindNextFileW
SetErrorMode
GetCommandLineA
GetACP
SetConsoleCtrlHandler
FlushFileBuffers
GetSystemTimeAsFileTime
GetCurrentProcess
SleepEx
GetDiskFreeSpaceA
HeapAlloc
HeapReAlloc
HeapFree
MultiByteToWideChar
WideCharToMultiByte
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetConsoleCP
GetConsoleMode
SetStdHandle
GetCurrentProcessId
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
GetCurrentThread
GetProcessHeap
GetStartupInfoW
GetModuleFileNameA
GetModuleFileNameW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetCPInfo
HeapSize
LoadLibraryExW
RtlUnwind
SetFilePointerEx
WriteConsoleW
GetFileAttributesExW
MoveFileExW
FindFirstFileExW
GetDriveTypeW
imagehlp
SymInitialize
StackWalk64
SymCleanup
Sections
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 232KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 296KB - Virtual size: 688KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.trace Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 167KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ