Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_363fe6e048b66a5be1f49ddbdc8c7fd7_bkransomware.exe
Resource
win7-20240221-en
General
-
Target
2024-06-05_363fe6e048b66a5be1f49ddbdc8c7fd7_bkransomware
-
Size
1.8MB
-
MD5
363fe6e048b66a5be1f49ddbdc8c7fd7
-
SHA1
99dd6e218a2f6469c41a6f3898d95aa02fab0689
-
SHA256
468e3fa7a0f581e2023696c3f868a9dd5a72821104c32394f0c41a2e5e52b550
-
SHA512
b61733d84cf377590d60bbff14c68a6a140db6a60b3b1aa32d6d311519c63ff82cfbfc7e7064308e556c70966424a16d568f207c3c24235c08a1c149f62a492c
-
SSDEEP
49152:2E19+ApwXk1QE1RzsEQPaxHNXMdFrIe78vH/:b93wXmoK0TjYvH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-05_363fe6e048b66a5be1f49ddbdc8c7fd7_bkransomware
Files
-
2024-06-05_363fe6e048b66a5be1f49ddbdc8c7fd7_bkransomware.exe windows:5 windows x86 arch:x86
4f062ee6f3ff9baef7efe7ca21de7747
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
CreateStatusWindowW
InitCommonControlsEx
kernel32
LockResource
GetTempPathW
GetTempFileNameW
DeleteFileW
CopyFileW
CreateFileW
CloseHandle
LoadLibraryA
GetProcAddress
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetFileSize
GetModuleHandleW
GetModuleFileNameW
InitializeCriticalSection
IsDebuggerPresent
lstrcmpiW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameW
lstrlenW
ReadFile
CreateProcessW
GetExitCodeProcess
Sleep
WideCharToMultiByte
CompareStringW
GetCommandLineW
FindResourceW
EnumResourceNamesW
BeginUpdateResourceW
SetFilePointer
UpdateResourceW
EndUpdateResourceW
GetVersionExW
IsWow64Process
GetCurrentProcess
GetSystemInfo
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WriteFile
DuplicateHandle
GetStdHandle
CreatePipe
CreateThread
InterlockedExchange
TerminateThread
WaitForSingleObject
SetFilePointerEx
SizeofResource
FlushFileBuffers
GetLastError
TerminateProcess
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
CreateDirectoryW
QueryPerformanceCounter
OutputDebugStringW
GetFileTime
SetStdHandle
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapSize
GetFileType
GetConsoleCP
GetProcessHeap
GetModuleHandleExW
ExitProcess
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
HeapReAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadConsoleW
GetConsoleMode
RtlUnwind
RaiseException
ExitThread
HeapFree
HeapAlloc
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadResource
FindResourceExW
FreeLibrary
LoadLibraryExW
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
WriteConsoleW
SetEndOfFile
user32
LoadIconW
RegisterClassExW
MessageBeep
DispatchMessageW
PostQuitMessage
SetCursor
DefWindowProcW
ChildWindowFromPoint
LoadImageW
GetDlgItemTextW
DialogBoxParamW
EnableMenuItem
EndDialog
GetSystemMenu
SetActiveWindow
LoadCursorW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
GetDlgItem
SetFocus
UpdateWindow
SendDlgItemMessageW
CheckMenuItem
GetMenu
CheckMenuRadioItem
SetDlgItemTextW
LoadAcceleratorsW
MessageBoxA
DestroyIcon
LoadStringW
MessageBoxW
CharUpperBuffW
PostMessageW
ShowWindow
EnableWindow
SendMessageW
CreateDialogParamW
gdi32
GetStockObject
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
shell32
DragFinish
DragQueryFileW
DragQueryPoint
SHGetFolderPathW
ole32
CreateStreamOnHGlobal
oleaut32
VariantCopy
VariantClear
VariantInit
Sections
.text Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE