Static task
static1
Behavioral task
behavioral1
Sample
2024-06-14_a96335555914aba48ca2fe9a400f8891_bkransomware.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-14_a96335555914aba48ca2fe9a400f8891_bkransomware.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-14_a96335555914aba48ca2fe9a400f8891_bkransomware
-
Size
6.6MB
-
MD5
a96335555914aba48ca2fe9a400f8891
-
SHA1
a571dca458b46c83c437a7d3b7bc227cadd6b20c
-
SHA256
8ea9041e8c59344600390f19e913a6e68adc55b2ed00974dd4a3159feae9f44e
-
SHA512
aad62f221c2fe1944829c6506f8a1b9b71ecc60b793b9e72debafd5690a01a8acd482565766d403a148bf67d5b142ffa3efe26d551e87c0ff3304d7153d16f90
-
SSDEEP
196608:RWQH1sQqOwekLRZeWHrHvDH9mjFd+A1h4Vm:UQH1AOweeRgcDHSMNm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-14_a96335555914aba48ca2fe9a400f8891_bkransomware
Files
-
2024-06-14_a96335555914aba48ca2fe9a400f8891_bkransomware.exe windows:6 windows x86 arch:x86
d9c6becc5dbabc0ed6d6d62cd6297b9f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteConsoleW
SetStdHandle
LoadLibraryW
SetFilePointerEx
GetConsoleMode
FlushFileBuffers
GetStringTypeW
LCMapStringW
UnregisterWaitEx
QueryDepthSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
FreeLibraryAndExitThread
FreeLibrary
OutputDebugStringW
FreeEnvironmentStringsW
WriteFile
GetFileType
GetStdHandle
Sleep
GetSystemTime
GetThreadTimes
GetCurrentProcessId
GetModuleHandleA
GetOEMCP
GetModuleFileNameA
CreateEventW
GetACP
GetSystemDirectoryA
GetModuleFileNameW
CreateEventA
WideCharToMultiByte
GetCurrentThread
HeapFree
GetEnvironmentStringsW
SetEnvironmentVariableW
GetCurrentProcess
SetEndOfFile
GetLocaleInfoA
GetDateFormatW
GetStartupInfoW
GlobalFree
GetConsoleCP
GetCommandLineA
GetSystemTimeAsFileTime
QueryPerformanceCounter
InterlockedFlushSList
GetCommState
GetCPInfo
IsValidCodePage
CloseHandle
DuplicateHandle
WaitForSingleObject
GetCurrentThreadId
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetLastError
HeapReAlloc
GetCommandLineW
RaiseException
RtlUnwind
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
CreateThread
ExitThread
LoadLibraryExW
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
HeapSize
HeapAlloc
GetProcessHeap
IsDebuggerPresent
CreateFileW
user32
GetMessageW
ShowWindow
CreateWindowExW
SendMessageW
UpdateWindow
EndPaint
IsIconic
SetCapture
MsgWaitForMultipleObjects
GetQueueStatus
GetWindowLongA
SetScrollPos
EnableMenuItem
CreatePopupMenu
IsDlgButtonChecked
PostMessageA
SetCaretPos
SetWindowTextA
ToUnicode
ClientToScreen
GetParent
MessageBeep
DrawEdge
SetScrollRange
CreateIconIndirect
GetDC
DrawFocusRect
SetPropA
SetClassLongA
ScrollWindow
RedrawWindow
GetDesktopWindow
EnableWindow
DestroyIcon
GetSystemMetrics
gdi32
MaskBlt
SetDIBColorTable
GetEnhMetaFileHeader
CombineRgn
CreateBrushIndirect
GetCharABCWidthsW
SetTextAlign
IntersectClipRect
GetPixel
MoveToEx
Arc
PatBlt
DeleteDC
CreateBitmap
GetPaletteEntries
CreateCompatibleDC
SetPolyFillMode
GetBkColor
GetObjectW
GetTextExtentExPointA
GetStockObject
EndPage
advapi32
SetSecurityDescriptorOwner
RegOpenKeyExA
RegDeleteKeyA
OpenProcessToken
AdjustTokenPrivileges
shell32
ShellExecuteExW
Sections
.text Size: 653KB - Virtual size: 652KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ