2024-06-12_2ce48f5a9883f06c981a3151ac9c0bb3_crysis_dharma

General

Target
2024-06-12_2ce48f5a9883f06c981a3151ac9c0bb3_crysis_dharma
Size 92KB
Sample240612-3dphlavdqc
SHA256 b7f3e9aa802967b204893d8fb7150b4e12830e25e483c69059dcb5fec85ee6d2
MD5 2ce48f5a9883f06c981a3151ac9c0bb3
SHA1 bbf9978bfc2e22e0aa31e9592e6210b72c7821ea
SHA512 e9c1e235c81e509e908686d31123fc7a9caf8a50a8e1faedc825d30d14c3e4be70ae39c9f26542d99961ba3f6f3991c024ec19ecc6a29f238ec00dab128fa6da
SSDEEP 1536:GBwl+KXpsqN5vlwWYyhZ9S4AhXcOETSbSox1OYwN1qg5Hxr7Al:ww+asqN5aW/hSbMlMSox1ODNcaHx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detects win.dharma. 1 IoCs

resource	yara_rule
sample	win_dharma_auto

Identifies DHARMA ransomware 4 IoCs

resource	yara_rule
sample	Windows_Ransomware_Dharma_aa5eefed
sample	Windows_Ransomware_Dharma_b31cac3f
sample	Windows_Ransomware_Dharma_e9319e4a
sample	Windows_Ransomware_Dharma_942142e3

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-12_2ce48f5a9883f06c981a3151ac9c0bb3_crysis_dharma

SHA256 b7f3e9aa802967b204893d8fb7150b4e12830e25e483c69059dcb5fec85ee6d2
MD5 2ce48f5a9883f06c981a3151ac9c0bb3
SHA1 bbf9978bfc2e22e0aa31e9592e6210b72c7821ea
SHA512 e9c1e235c81e509e908686d31123fc7a9caf8a50a8e1faedc825d30d14c3e4be70ae39c9f26542d99961ba3f6f3991c024ec19ecc6a29f238ec00dab128fa6da
SSDEEP 1536:GBwl+KXpsqN5vlwWYyhZ9S4AhXcOETSbSox1OYwN1qg5Hxr7Al:ww+asqN5aW/hSbMlMSox1ODNcaHx
MD5 SHA1 SHA512 SSDEEP

Minor OS version

1

Major OS version

5

Entry point

43472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths