Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-09_2ac13a8c275ec7f180d1dab95e428829_bkransomware.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-09_2ac13a8c275ec7f180d1dab95e428829_bkransomware.exe
Resource
win10v2004-20240508-en
Target
2024-06-09_2ac13a8c275ec7f180d1dab95e428829_bkransomware
Size
2.6MB
MD5
2ac13a8c275ec7f180d1dab95e428829
SHA1
c63d8ffda9e351b8ecbc6cf4fadfaf5912799830
SHA256
4c9d7e7d8f54aa1db9f11d26356b0ef4549fb3699783ca4b44b17639fafc23ec
SHA512
dc5d973f573bc2975b9d191ce9919790c9cb4907a14ffecacb69e6cdd14387e6209d69a7a052e2c51ba9df50a204336089ef04d87c72ea7e0fa90edae19f2a35
SSDEEP
49152:9l+tWU6BQGEBKcAe8vExu1yh0egFewy35vcZKaOzVPetQQL91NtZGS1Mqak1V/JX:9l+4QnqAx9Zwy39asQDhac
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
D:\kuaiwan\build\Release\Kuaiwan.pdb
??0CDownloader@@QAE@PB_W@Z
?GetProgressRate@CDownloader@@QAEMXZ
?IsFinished@CDownloader@@QAE_NXZ
?GetDownloadState@CDownloader@@QAEHXZ
?GetDownloadURL@NetTool@@SA_NPB_WPAPAXPAJJH@Z
?SetURL@CDownloader@@QAEXPB_W00@Z
?Download@CDownloader@@QAEXXZ
?WaitThread@CDownloader@@QAEXXZ
?Abort@CDownloader@@QAEXXZ
?DownloadURL@NetTool@@SA_NPB_W0J@Z
?HttpSend@NetTool@@SA_NPBDPADH@Z
uploadStatsFile
?GetThis@CSingleHostCGI@@SAPAV1@XZ
SetDocsParam
?ConnectHost@CConnectHost@@SAXPAD@Z
?GetConnectHostStats@CConnectHost@@SAHK@Z
?SetChangeHost@CSingleHostCGI@@QAEXPAD0@Z
PostDocs
?StartChangeHost@CSingleHostCGI@@QAE_NPADI@Z
?IsStartChangeHost@CSingleHostCGI@@QAE_NXZ
?PostForm@NetTool@@SAHPB_W0PADJ@Z
?GetAddrFromHTTP@NetTool@@SAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAIAAG@Z
??1CDownloader@@QAE@XZ
?SetURL@CDownloader@@QAEXPB_W0000@Z
?PostForm@NetTool@@SA_NPB_W0PAPAXPAJJ@Z
SEH_Net_PostFileByData
?Clear@CDownloader@@QAEXXZ
?GetLastTime@CDownloader@@QAEAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
Net_SendHttpGet
GetOverlappedResult
WriteFile
OpenEventW
SetUnhandledExceptionFilter
DecodePointer
lstrcmpiW
LoadLibraryExW
SizeofResource
DeviceIoControl
GlobalAddAtomW
FlushFileBuffers
SetFilePointer
lstrcatW
Thread32First
Thread32Next
OpenThread
SuspendThread
ResumeThread
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
GetProfileIntW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetVolumeInformationW
FileTimeToSystemTime
GetDiskFreeSpaceExW
WriteProcessMemory
CreateRemoteThread
GetExitCodeThread
Module32NextW
ReadDirectoryChangesW
GetLogicalDrives
ResetEvent
GetProcessHeap
HeapFree
SetErrorMode
LocalAlloc
GlobalMemoryStatusEx
GetSystemDirectoryW
GlobalMemoryStatus
SetProcessWorkingSetSize
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetFileTime
GetFileInformationByHandle
FileTimeToLocalFileTime
GetFullPathNameW
GetFullPathNameA
CreateFileA
SetEndOfFile
WaitForMultipleObjects
InterlockedCompareExchange
UnlockFile
LockFile
GetSystemTimeAsFileTime
FormatMessageA
FormatMessageW
GetFileAttributesA
GetTempPathW
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
GetDiskFreeSpaceA
GetTempPathA
AreFileApisANSI
CopyFileW
GetCommandLineW
EncodePointer
HeapAlloc
ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
GetStartupInfoW
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
HeapSize
RtlUnwind
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
SetFilePointerEx
ReadConsoleW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
CompareStringW
LCMapStringW
SetStdHandle
WriteConsoleW
GetExitCodeProcess
CreateProcessA
SetEnvironmentVariableA
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
VirtualAlloc
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
LoadLibraryW
GetProcAddress
GetPrivateProfileSectionW
GetPrivateProfileStringW
LocalFree
SetFileAttributesW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetLogicalDriveStringsW
GetDriveTypeW
GetFileAttributesW
ReadFile
VirtualQuery
GetTickCount
CreateProcessW
lstrcpyW
GetSystemInfo
GetModuleHandleW
GetVersionExW
FindFirstFileA
DeleteFileA
FindFirstFileW
FindNextFileW
DeleteFileW
FindClose
RemoveDirectoryW
lstrcmpW
MulDiv
FindResourceW
LoadResource
LockResource
GlobalFree
GlobalHandle
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
GetSystemTime
lstrcatA
GetFileSize
GetCurrentThreadId
RaiseException
InitializeCriticalSectionAndSpinCount
GetLastError
FlushInstructionCache
GetCurrentProcess
MultiByteToWideChar
CreateFileW
CreateDirectoryW
GetFileAttributesExW
GetLocalTime
WideCharToMultiByte
InterlockedIncrement
CloseHandle
Process32NextW
Module32FirstW
CreateToolhelp32Snapshot
InterlockedDecrement
lstrlenW
Process32FirstW
GetCurrentProcessId
OpenProcess
TerminateProcess
Sleep
SetEvent
lstrlenA
OutputDebugStringW
DebugBreak
CreateThread
CreateEventW
FreeLibrary
GetModuleFileNameW
LeaveCriticalSection
TerminateThread
EnterCriticalSection
WaitForSingleObject
QueryPerformanceCounter
LoadMenuW
GetCaretPos
IsClipboardFormatAvailable
GetClipboardData
EnableMenuItem
SetLayeredWindowAttributes
OffsetRect
SetRect
DestroyCursor
InflateRect
DrawTextW
SetRectEmpty
GetCapture
UpdateWindow
EqualRect
DeleteMenu
PostThreadMessageW
EnumWindows
GetWindowDC
SetCursorPos
SystemParametersInfoW
LoadIconW
SetCursor
PtInRect
LoadImageW
TrackMouseEvent
IntersectRect
SetWindowRgn
DestroyIcon
PrivateExtractIconsW
RegisterHotKey
UnregisterHotKey
EnableWindow
GetMenuState
SetWindowContextHelpId
EndDialog
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
UpdateLayeredWindow
GetWindowThreadProcessId
SetMenuItemInfoW
GetMenuItemInfoW
GetSystemMetrics
GetForegroundWindow
WindowFromPoint
MessageBoxW
LoadStringW
GetMenuStringW
GetMenuItemID
GetKeyState
DrawIconEx
GetIconInfo
CreateIconIndirect
CreateMenu
AppendMenuW
CreatePopupMenu
CharNextW
SetTimer
KillTimer
IsWindow
SendMessageW
SetWindowLongW
GetWindowLongW
GetMenuItemCount
IsMenu
SetParent
ModifyMenuW
PrintWindow
EnumChildWindows
DestroyMenu
GetSubMenu
wsprintfW
TrackPopupMenu
IsDialogMessageW
GetCursorPos
FindWindowW
SetActiveWindow
IsWindowVisible
CharUpperW
WaitForInputIdle
FindWindowExW
CharLowerW
RegisterDeviceNotificationW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ExitWindowsEx
MapDialogRect
CopyRect
GetWindowRect
SetForegroundWindow
ShowWindow
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
GetDlgItem
GetClassNameW
GetSysColor
SetWindowPos
RedrawWindow
DestroyWindow
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
GetClientRect
InvalidateRgn
InvalidateRect
GetDC
ReleaseDC
GetDesktopWindow
DestroyAcceleratorTable
DialogBoxIndirectParamW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
PostMessageW
wsprintfA
GetActiveWindow
UnregisterClassW
CallWindowProcW
DefWindowProcW
PostQuitMessage
CryptReleaseContext
RegRestoreKeyW
RegSaveKeyExW
RegOpenKeyW
RegEnumKeyW
RegCreateKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetFileSecurityW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CoGetClassObject
CLSIDFromProgID
OleUninitialize
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CoSetProxyBlanket
StringFromCLSID
CoTaskMemRealloc
CoCreateGuid
CoUninitialize
CoInitialize
OleInitialize
CLSIDFromString
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
Shell_NotifyIconW
DragAcceptFiles
DragQueryFileW
SHFileOperationW
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantClear
OleCreateFontIndirect
SysAllocStringLen
VarUI4FromStr
VariantChangeType
SysAllocString
VariantInit
GetErrorInfo
SysFreeString
PathFileExistsW
PathIsDirectoryW
ord17
InitCommonControlsEx
_TrackMouseEvent
ord16
SelectClipRgn
GetClipBox
ExtTextOutW
SetBkColor
PatBlt
SetWindowOrgEx
SetMapMode
SetROP2
UnrealizeObject
CreateRectRgnIndirect
CreatePatternBrush
CreateBitmap
Ellipse
Rectangle
Polygon
LineTo
MoveToEx
CreatePen
SetTextColor
SetBkMode
SetDIBits
SetRectRgn
GetPixel
CreateRoundRectRgn
SetViewportOrgEx
GetDeviceCaps
GetObjectW
GetStockObject
DeleteDC
BitBlt
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
CreateDIBSection
CreateRectRgn
RealizePalette
SelectPalette
GetDIBits
CreateDCW
CombineRgn
CreateFontIndirectW
GetTextExtentPoint32W
AlphaBlend
WSAGetLastError
gethostbyname
closesocket
ntohl
htonl
recv
sendto
select
__WSAFDIsSet
ioctlsocket
recvfrom
connect
socket
WSACleanup
WSAStartup
htons
send
ntohs
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
GetOpenFileNameW
GetSaveFileNameW
GetProcessMemoryInfo
GdipDrawImagePointsRectI
GdipAlloc
GdipFree
GdipLoadImageFromFile
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromFile
GdipCreateFromHDC
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFillRectangleI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipMeasureString
GdipDrawString
GdipCreateBitmapFromHICON
GdipCreateHBITMAPFromBitmap
GdipGetImageWidth
GdipGetImageHeight
GdipBitmapGetPixel
GdipCreateFromHWND
GdipImageSelectActiveFrame
GdipSetSolidFillColor
GdipDrawImageRectRectI
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipCreatePen1
GdipDeletePen
GdipDrawLineI
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectI
GdipGetGenericFontFamilySansSerif
GdipTranslateWorldTransform
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipSetStringFormatTrimming
GdipGetDC
GdipReleaseDC
GdipDrawRectangleI
GdipSetPenColor
GdipCreatePath
GdipDeletePath
GdipStartPathFigure
GdipAddPathArcI
GdipAddPathLineI
GdipClosePathFigure
GdipFillPath
GdipDrawPath
GdipSetPenDashStyle
?CopyTo@TiXmlElement@@QBEXPAV1@@Z
??0TiXmlDocument@@QAE@XZ
??1TiXmlDocument@@UAE@XZ
?LoadFile@TiXmlDocument@@QAE_NPBDW4TiXmlEncoding@@@Z
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?SaveFile@TiXmlDocument@@QBE_NPBD@Z
?Print@TiXmlElement@@UBEXPAU_iobuf@@H@Z
?Parse@TiXmlElement@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?ToDocument@TiXmlNode@@UAEPAVTiXmlDocument@@XZ
?ToDocument@TiXmlNode@@UBEPBVTiXmlDocument@@XZ
?ToElement@TiXmlElement@@UAEPAV1@XZ
?ToElement@TiXmlElement@@UBEPBV1@XZ
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?Clone@TiXmlElement@@UBEPAVTiXmlNode@@XZ
?Accept@TiXmlElement@@UBE_NPAVTiXmlVisitor@@@Z
?StreamIn@TiXmlElement@@MAEXPAV?$basic_istream@DU?$char_traits@D@std@@@std@@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?SetAttribute@TiXmlElement@@QAEXPBDH@Z
?SetAttribute@TiXmlElement@@QAEXPBD0@Z
?GetText@TiXmlElement@@QBEPBDXZ
??1TiXmlElement@@UAE@XZ
??0TiXmlElement@@QAE@PBD@Z
?RemoveChild@TiXmlNode@@QAE_NPAV1@@Z
?InsertBeforeChild@TiXmlNode@@QAEPAV1@PAV1@ABV1@@Z
?LinkEndChild@TiXmlNode@@QAEPAV1@PAV1@@Z
?Value@TiXmlNode@@QBEPBDXZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
MiniDumpWriteDump
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW
PlaySoundW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ