2024-06-08_b27eec745746a44dd191693602aea99e_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-08_b27eec745746a44dd191693602aea99e_bkransomware
Size 672KB
Sample240608-lepfjsbf26
SHA256 0ddcbdf8879ecb850b4d2da7dcaa4419259ac84b4f5ff8ff682471d25b3eea47
MD5 b27eec745746a44dd191693602aea99e
SHA1 20287011a406ebf2ff947cf2fc1c44688969eb52
SHA512 61183f0451955b8356440f280f8603dd012742b433fcb3e6dfc6041439292ee4083f998c83e0119247cc69d8037454db735e4cdb3657465065837e5cc7750c55
SSDEEP 12288:BAMsQnOhFIwZ1KUcZdKRlMVyRgjAzJGfm7qHSLLbj8zWOcDZvO7f0x+Hkl4:BAMGkrZ8lniAFGfWqHSHbj85cDczxka
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-08_b27eec745746a44dd191693602aea99e_bkransomware

.exe 672KB

2024-06-08_b27eec745746a44dd191693602aea99e_bkransomware

IMPHASH 24be2bba3730b7a442e3b62a0767065e
SHA256 0ddcbdf8879ecb850b4d2da7dcaa4419259ac84b4f5ff8ff682471d25b3eea47
MD5 b27eec745746a44dd191693602aea99e
SHA1 20287011a406ebf2ff947cf2fc1c44688969eb52
SHA512 61183f0451955b8356440f280f8603dd012742b433fcb3e6dfc6041439292ee4083f998c83e0119247cc69d8037454db735e4cdb3657465065837e5cc7750c55
SSDEEP 12288:BAMsQnOhFIwZ1KUcZdKRlMVyRgjAzJGfm7qHSLLbj8zWOcDZvO7f0x+Hkl4:BAMGkrZ8lniAFGfWqHSHbj85cDczxka
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

6c:08:17:18:3d:ef:c1:42:04:c5:a3:cc:62:be:6a:04:e2:a1:05:c9

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Ruifeng Network Technology Co.\, Ltd.,O=Ruifeng Network Technology Co.\, Ltd.,L=Jintan,ST=Jiangsu,C=CN

Chains

Feb 15, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Ruifeng Network Technology Co.\, Ltd.,O=Ruifeng Network Technology Co.\, Ltd.,L=Jintan,ST=Jiangsu,C=CN

Serial Number

2a:da:11:49:d6:6c:3d:d3:e7:d5:fa:9f:4f:8a:06:49

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Jan 14, 2015 - Jan 14, 2016

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 15, 2013 - Aug 15, 2023

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Serial Number

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Jul 9, 1999 - Jul 9, 2019

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Serial Number

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Aug 8, 2009 - Aug 8, 2024

Minor OS version

Major OS version

Entry point

86795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVersionExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetProcAddress CreateFileMappingW MapViewOfFile UnmapViewOfFile ExitProcess CreateToolhelp32Snapshot Process32FirstW GetCurrentProcess TerminateProcess Process32NextW GetModuleFileNameW lstrcpyW lstrcatW CreateMutexW SetCurrentDirectoryW LoadLibraryW GetTempPathW MoveFileW DeleteFileW CreateFileW GetFileType ReadFile SystemTimeToFileTime GetCurrentDirectoryW DosDateTimeToFileTime LocalFree lstrlenA WriteConsoleW FlushFileBuffers SetStdHandle LCMapStringW DeviceIoControl EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW LoadLibraryExW FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx RtlUnwind GetCurrentThreadId GetCPInfo GetOEMCP GetACP IsValidCodePage GetStartupInfoW GetModuleHandleW WaitForMultipleObjects DeleteFileA CreateProcessA GetTickCount InitializeCriticalSection SetEndOfFile CreateFileA CreateDirectoryA GetTempPathA Sleep WriteFile SetFilePointer WaitForSingleObject CreateThread InterlockedDecrement CloseHandle GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc InterlockedExchange DecodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount GetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter GetStdHandle AreFileApisANSI GetModuleHandleExW GetCommandLineW ResumeThread ExitThread IsProcessorFeaturePresent EncodePointer VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo OutputDebugStringW IsDebuggerPresent RaiseException

user32

GetSystemMetrics RegisterClassExW LoadIconW LoadCursorW BeginPaint EndPaint DefWindowProcW SetRectEmpty CopyRect GetDC FillRect GetSubMenu GetCursorPos TrackPopupMenu PostQuitMessage SetWindowPos IsWindow DrawTextA SetCursor ReleaseDC ShowWindow SetWindowTextA LoadMenuW DestroyWindow TranslateMessage DispatchMessageW GetMessageW MessageBoxW SetRect PtInRect CreateWindowExW SendMessageW PostMessageW

gdi32

CreateCompatibleDC FrameRgn TextOutA SetTextColor GetTextExtentPoint32A CreateSolidBrush CreateRoundRectRgn SetBkMode EnumFontsW CreateFontW GetDIBColorTable StretchBlt CreateCompatibleBitmap GetObjectW SetDIBColorTable SelectObject DeleteObject CreateDIBSection BitBlt DeleteDC

advapi32

RegSetValueExA RegCreateKeyExA RegCloseKey

shell32

SHGetPathFromIDListA Shell_NotifyIconW ShellExecuteA SHGetPathFromIDListW ord165 SHGetSpecialFolderLocation

ole32

CoUninitialize CoInitialize CoCreateInstance CreateStreamOnHGlobal

oleaut32

SysFreeString GetErrorInfo SysAllocString VariantClear

ws2_32

setsockopt gethostbyname inet_ntoa socket htons inet_addr connect recv closesocket WSAStartup send

shlwapi

PathAppendW PathIsDirectoryW PathRemoveFileSpecW PathFileExistsW

gdiplus

GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageI GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCloneImage GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDisposeImage

msimg32

AlphaBlend TransparentBlt

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

urlmon

URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-08_b27eec745746a44dd191693602aea99e_bkransomware

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

gdiplus

msimg32

iphlpapi

setupapi

urlmon

generic