ransom[.]exe | Triage™

General

Target
ransom.exe
Size 7.8MB
Sample240709-x2s8ss1blj
SHA256 102276ae1f518745695fe8f291bf6e69856b91723244881561bb1a2338d54b12
MD5 648bd793d9e54fc2741e0ba10980c7de
SHA1 f5d0c94b2be91342dc01ecf2f89e7e6f21a74b90
SHA512 d1428b934a360d7f3651947d11081892c93c7cd29a17dc38190cbb46c95939928ac6f805adf586be2937e27fc20aec8bd1fc2c782c681e7e94e9e8d33b8ebf15
SSDEEP 98304:9+v9K8MgmB4oIWcCJ3ZZVL8oYi5lTkZkmla1DXL:S4uWcCT9Gzl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ransom.exe

File Explorer

ransom.exe

.exe 7.8MB

ransom.exe

IMPHASH f032b4cc0eb4f2eac3f528efe4c73962
SHA256 102276ae1f518745695fe8f291bf6e69856b91723244881561bb1a2338d54b12
MD5 648bd793d9e54fc2741e0ba10980c7de
SHA1 f5d0c94b2be91342dc01ecf2f89e7e6f21a74b90
SHA512 d1428b934a360d7f3651947d11081892c93c7cd29a17dc38190cbb46c95939928ac6f805adf586be2937e27fc20aec8bd1fc2c782c681e7e94e9e8d33b8ebf15
SSDEEP 98304:9+v9K8MgmB4oIWcCJ3ZZVL8oYi5lTkZkmla1DXL:S4uWcCT9Gzl
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4999

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

EndPaint GetWindowLongW PostMessageW SetWindowPos EndDialog GetSystemMetrics ShowWindow OpenClipboard GetDlgItemTextA SetTimer DrawTextA CloseClipboard EmptyClipboard MessageBoxA LoadBitmapW SetClipboardData wsprintfW GetDlgItem SetRect KillTimer SystemParametersInfoW DialogBoxParamW FindWindowA LoadImageW InvalidateRect BeginPaint MessageBoxW

gdi32

BitBlt CreateFontA SelectObject CreateCompatibleDC DeleteDC SetTextColor SetBkMode GetObjectW DeleteObject

shell32

SHGetFolderPathA

kernel32

GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileSizeEx FreeEnvironmentStringsW MultiByteToWideChar LCMapStringW CompareStringW SetEnvironmentVariableW GetStringTypeW GetProcessHeap FlushFileBuffers WriteConsoleW HeapSize HeapReAlloc WideCharToMultiByte SetUnhandledExceptionFilter HeapFree GetLastError SizeofResource FindFirstFileW FindNextFileW WriteFile WaitForMultipleObjects GetTempPathW FindClose CreateFileW GetSystemDirectoryW FreeResource Sleep LockResource GlobalAlloc CloseHandle CreateThread LoadResource FindResourceW GlobalLock GetModuleHandleW GetConsoleWindow GlobalUnlock GetDriveTypeW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter DecodePointer GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess HeapAlloc RaiseException RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer SetEndOfFile SetFilePointerEx DeleteFileW ReadFile GetConsoleMode ReadConsoleW GetFileType GetConsoleOutputCP ExitProcess GetModuleHandleExW QueryPerformanceFrequency GetStdHandle GetModuleFileNameW GetCommandLineA GetCommandLineW SetStdHandle

Resubmissions

Sharing