2024-06-25_b91bfa99939a79823abb7d982197acad_bkransomware_karagany_metamorfo

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-25_b91bfa99939a79823abb7d982197acad_bkransomware_karagany_metamorfo
Size

522KB
MD5

b91bfa99939a79823abb7d982197acad
SHA1

dee71816ebae63376bb8329b052dbc9717a626f9
SHA256

615e7bd4a3360607b414f49cc803dfedebfa959dd67b7496f6dc5858559f1625
SHA512

30e3f846eca070f8e1842bc6e50b84c6db0839b35be1ee89542d158a9aa91a82ff73f5975d8906edb77ee789fec46b899d2fe3a9d6d3e74b20f3f0f563ad5c65
SSDEEP

6144:npmfS/8hJjSPwKIurdkbbT5ZR32rZdKsDrt0StUe:npKS/8hJjSPhfkHT5irZsqB3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-25_b91bfa99939a79823abb7d982197acad_bkransomware_karagany_metamorfo

Files

2024-06-25_b91bfa99939a79823abb7d982197acad_bkransomware_karagany_metamorfo
.exe windows:5 windows x86 arch:x86

9f197fcc42196309bee9011444f5f6ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Code_NoKb\Release\msgapp.pdb

Imports

kernel32

FindResourceExW
GetLastError
LoadResource
LockResource
SizeofResource
CreateFileW
WriteFile
FlushFileBuffers
CloseHandle
GetModuleFileNameW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
SetLastError
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
RtlUnwind
OutputDebugStringW
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
GetConsoleCP
WriteConsoleW

shell32

SHGetFolderPathW
ShellExecuteW

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 454KB - Virtual size: 454KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f197fcc42196309bee9011444f5f6ca

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 454KB - Virtual size: 454KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 454KB - Virtual size: 454KB

.reloc
Size: 3KB - Virtual size: 3KB