2024-06-25_0c6799330ae167dd2c9e08af52ff539e_bkransomware

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-25_0c6799330ae167dd2c9e08af52ff539e_bkransomware
Size

279KB
MD5

0c6799330ae167dd2c9e08af52ff539e
SHA1

45290a0399d7fc759163a21bbfa741089e482aac
SHA256

f157d65df18a7bcfbf1cdf6f3e300c9f07a10cbd28dd89b45b5d95d75007cded
SHA512

3371519aaac7ec317006272a4af907da3cc559a28105299fd9002f24c1a2e443e00d65d1f47be20d1fb681c5057324bb45c7144d362b3965ab05d42595307b57
SSDEEP

6144:iX6trqn940OtwZ45SD5AjZMx2E7ZNrdD7rH7GL:iKten9401dA62EXrZrH7GL

Score

1^/10

Malware Config

Signatures

Files

2024-06-25_0c6799330ae167dd2c9e08af52ff539e_bkransomware
.exe windows:5 windows x86 arch:x86

061c85279b0b5eb088bbb3ffade47114

Code Sign

04:14:da:82:38:58:b7:11:c8:81:32:24:9e:4a:38:e9
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-05-2014 00:00

Not After

06-09-2017 12:00

Subject

CN=Psiphon Inc.,O=Psiphon Inc.,L=Toronto,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:64:01:46:e9:80:e0:0e:60:a1:4d:8f:44:4a:59:58
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20-05-2014 00:00

Not After

03-06-2015 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e8:c0:41:fd:c5:f3:3d:64:87:ac:05:85:bc:47:a4:62:68:a0:de:4a
Signer

Actual PE Digest

e8:c0:41:fd:c5:f3:3d:64:87:ac:05:85:bc:47:a4:62:68:a0:de:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Adam\Code\psiphon\polipo\Release\polipo.pdb

Imports

ws2_32

getpeername
ioctlsocket
connect
htonl
select
shutdown
socket
__WSAFDIsSet
closesocket
accept
WSAStartup
setsockopt
bind
listen
gethostname
gethostbyaddr
ntohl
WSAGetLastError
htons
ntohs
recv
gethostbyname
send

kernel32

DeleteFileW
DuplicateHandle
SetEndOfFile
SetEnvironmentVariableA
CreateFileW
GetFileAttributesExW
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualFree
VirtualAlloc
GetSystemTimeAsFileTime
Sleep
FreeConsole
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
GetTempPathA
GetCurrentProcessId
GetCommandLineA
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
RaiseException
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetFileType
RtlUnwind
GetConsoleCP
GetConsoleMode
CloseHandle
GetTimeZoneInformation
FlushFileBuffers
SetFilePointerEx
ReadFile
ReadConsoleW
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
HeapSize

Sections

.text
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

061c85279b0b5eb088bbb3ffade47114

Code Sign

04:14:da:82:38:58:b7:11:c8:81:32:24:9e:4a:38:e9Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

06:64:01:46:e9:80:e0:0e:60:a1:4d:8f:44:4a:59:58Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

e8:c0:41:fd:c5:f3:3d:64:87:ac:05:85:bc:47:a4:62:68:a0:de:4aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

Sections

.text Size: 203KB - Virtual size: 202KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 35KB - Virtual size: 43KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 11KB - Virtual size: 11KB

04:14:da:82:38:58:b7:11:c8:81:32:24:9e:4a:38:e9
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

06:64:01:46:e9:80:e0:0e:60:a1:4d:8f:44:4a:59:58
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

e8:c0:41:fd:c5:f3:3d:64:87:ac:05:85:bc:47:a4:62:68:a0:de:4a
Signer

.text
Size: 203KB - Virtual size: 202KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 35KB - Virtual size: 43KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 11KB - Virtual size: 11KB