Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
ransomware.exe
Resource
win10v2004-20240508-en
General
-
Target
ransomware.exe
-
Size
15KB
-
MD5
ac6b23f341c93a5deb6692d8fed6f6a4
-
SHA1
6466c45b8c8dd60f03392614063d1c490231bf03
-
SHA256
cb84c85fb50de9ac3bc4763c504ca87067680bc129d44c256570f7e1449ab9c5
-
SHA512
d4483be2b241c12da57785d861018e88d75fbda736e51900872d105f11309474393c8381d654c4cf74242a7f138e070983ace9836806232afda9dee30e3dd29f
-
SSDEEP
192:1XiJtJHunl2T7IeLX/LnG8dcIbNbqiv8Fums5oglkr5i7amD2Ayqfiq1T5Fx/TAU:1Cul2nIePG2vVCZ87ThT1n
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ransomware.exe
Files
-
ransomware.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ