2024-06-13_e57943678e423d4bcb83e19f4a65882c_bkransomware

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-13_e57943678e423d4bcb83e19f4a65882c_bkransomware
Size

303KB
MD5

e57943678e423d4bcb83e19f4a65882c
SHA1

49e72778a7620706ff408f8d8e46dd9dca91af04
SHA256

6a19c053f1b25573ce2d2f015e25803e4316c58187c9b3f42bf5918359a0b6c8
SHA512

1d6b3d2d94cee5b7f98f3c976110673271b79ee4a834a80a9bd47625082d7ab51b834643c87cc92adcf52fe8d318f7c5cf11019ee59b93573fd4f05351957e12
SSDEEP

6144:jQuj9lrh+cZ8zhlugAO9Mx8mLX1gggggyV0:jQunezhMggLi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-13_e57943678e423d4bcb83e19f4a65882c_bkransomware

Files

2024-06-13_e57943678e423d4bcb83e19f4a65882c_bkransomware
.exe windows:5 windows x86 arch:x86

44dc7b9017bd08346bc0744797e8171b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\buildslave\csgo_pcbeta_win32\build\src\utils\height2ssbump\Release\height2ssbump.pdb

Imports

tier0

StackToolsNotify_LoadedLibrary
ReleaseThreadHandle
?DevWarning@@YAXPBDZZ
?Lock@CThreadMutex@@QAEXXZ
?Unlock@CThreadMutex@@QAEXXZ
?Set@CThreadEvent@@QAE_NXZ
Warning
g_pMemAlloc
Error
ThreadInterlockedAssignIf64
Plat_IsInDebugSession
CommandLine
InstallProgressReportHandler
GetCPUInformation
ThreadJoin
CreateSimpleThread
ReportProgress
GetThreadedLoadLibraryFunc

vstdlib

g_pThreadPool

kernel32

CreateFileMappingA
WaitForSingleObject
CreateFileW
CloseHandle
WriteConsoleW
SetStdHandle
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
RaiseException
EncodePointer
DecodePointer
GetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
GetCommandLineA
GetDriveTypeW
GetFullPathNameA
IsProcessorFeaturePresent
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetStdHandle
WriteFile
GetModuleFileNameW
FreeLibrary
LoadLibraryExW
GetProcessHeap
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapAlloc
GetStringTypeW
GetCurrentDirectoryW
RtlUnwind
OutputDebugStringW
HeapSize
HeapReAlloc
LoadLibraryExA

Exports

Exports

CreateInterface

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44dc7b9017bd08346bc0744797e8171b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

tier0

vstdlib

kernel32

Exports

Exports

Sections

.text Size: 167KB - Virtual size: 166KB

.rdata Size: 78KB - Virtual size: 78KB

.data Size: 12KB - Virtual size: 122KB

_RDATA Size: 34KB - Virtual size: 33KB

.rsrc Size: 1024B - Virtual size: 776B

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 167KB - Virtual size: 166KB

.rdata
Size: 78KB - Virtual size: 78KB

.data
Size: 12KB - Virtual size: 122KB

_RDATA
Size: 34KB - Virtual size: 33KB

.rsrc
Size: 1024B - Virtual size: 776B

.reloc
Size: 9KB - Virtual size: 9KB