2024-07-10_b8b41baa5eeb1a3af03a4def68c95892_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-10_b8b41baa5eeb1a3af03a4def68c95892_bkransomware
Size

3.5MB
MD5

b8b41baa5eeb1a3af03a4def68c95892
SHA1

c96291b1250b969ee3fbdea3196d099abb56a73f
SHA256

f4d8c8993f367fde68c8c86aab54221e54a4368466afc365be97f0f187712c9f
SHA512

8ad8c86874e78b9bc5faa599ce542229a48a72c4ccb57a57f9d065fd00cd38f4fd9e56162384e31b60cfdb08ebd9aef0db84d08faf0a76151e3b21c5e277f3f5
SSDEEP

98304:tdziH2+PEdXKpQzh1+Gbv4uWBBR8QXzGbd:HkQ7ymQXzGbd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-10_b8b41baa5eeb1a3af03a4def68c95892_bkransomware

Files

2024-07-10_b8b41baa5eeb1a3af03a4def68c95892_bkransomware
.exe windows:5 windows x86 arch:x86

eb9f7e780c43959a40109f73f5843d9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\安全接入客户端\Client\sv_tray\release\SV_Tray.pdb

Imports

kernel32

GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileInformationByHandle
PeekNamedPipe
SetEnvironmentVariableA
FindFirstFileExW
OutputDebugStringW
SetConsoleCtrlHandler
GetStringTypeW
GetCPInfo
ReadConsoleInputA
lstrlenA
FlushConsoleInputBuffer
GetVersionExA
GlobalMemoryStatus
LCMapStringW
GetOEMCP
GetACP
IsValidCodePage
TerminateProcess
SetUnhandledExceptionFilter
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
SetConsoleMode
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStartupInfoW
SetStdHandle
HeapQueryInformation
ExitProcess
RtlUnwind
AreFileApisANSI
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
ExitThread
CreateThread
VirtualQuery
VirtualAlloc
GetSystemInfo
GetProfileIntW
SearchPathW
GetWindowsDirectoryW
VerifyVersionInfoW
VerSetConditionMask
GetCurrentDirectoryW
SetErrorMode
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FindResourceExW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GlobalFlags
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
SetThreadPriority
GetPrivateProfileIntW
CompareStringA
lstrcmpA
GetCurrentThread
FileTimeToSystemTime
FindNextFileW
FileTimeToLocalFileTime
GlobalGetAtomNameW
GetThreadLocale
lstrcmpiW
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
FindFirstFileW
FindClose
VirtualProtect
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetCurrentThreadId
EncodePointer
GetModuleHandleA
FreeResource
OutputDebugStringA
SetLastError
FormatMessageW
MulDiv
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
InterlockedDecrement
GetSystemPowerStatus
SetThreadExecutionState
CreateMutexW
ReleaseMutex
OpenMutexW
CreateDirectoryW
GetCommandLineW
LocalFree
DecodePointer
HeapSize
RaiseException
HeapReAlloc
GetTickCount
lstrcpyW
GetTempFileNameW
GetTempPathW
WaitForSingleObject
OpenEventW
GetSystemDirectoryW
GetSystemWow64DirectoryW
ProcessIdToSessionId
GetCurrentProcessId
TerminateThread
GetVersionExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WinExec
GetFileSize
CreateFileW
CopyFileW
MoveFileExW
GetVersion
InitializeCriticalSection
DeleteFileW
GetCurrentProcess
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
CreateProcessW
GlobalFree
CloseHandle
Sleep
WideCharToMultiByte
WritePrivateProfileStringW
GetModuleFileNameW
HeapFree
GetProcessHeap
HeapAlloc
MultiByteToWideChar
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetLastError
EnterCriticalSection
SizeofResource
LeaveCriticalSection
DeleteCriticalSection
GetPrivateProfileStringW
FindResourceW
LoadResource
LockResource
GetDriveTypeW

user32

ShowOwnedPopups
TranslateMessage
GetMessageW
SetWindowContextHelpId
GetWindowThreadProcessId
SystemParametersInfoW
MessageBeep
IsZoomed
PostQuitMessage
CharUpperW
MapDialogRect
GetAsyncKeyState
ClientToScreen
EndPaint
BeginPaint
GetWindowDC
SendDlgItemMessageA
MapVirtualKeyW
GetKeyNameTextW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
PtInRect
EqualRect
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
ScrollWindow
RedrawWindow
ValidateRect
GetForegroundWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
IsDialogMessageW
NotifyWinEvent
GetFocus
GetDlgCtrlID
CloseClipboard
CheckDlgButton
IsMenu
PostThreadMessageW
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
EnableWindow
SendMessageW
SetCursor
SetWindowPos
MoveWindow
ShowWindow
GetWindow
GetWindowTextLengthW
GetWindowTextW
GetScrollPos
SetScrollPos
SetFocus
GetParent
SetActiveWindow
IsWindowEnabled
GetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
IsWindow
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMenuStringW
FillRect
GetMenuItemInfoW
InflateRect
IntersectRect
GetSysColorBrush
RealChildWindowFromPoint
CopyImage
WaitMessage
SetCapture
ReleaseCapture
WindowFromPoint
BringWindowToTop
LoadAcceleratorsW
TranslateAcceleratorW
CreatePopupMenu
InsertMenuItemW
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
SetWindowRgn
OffsetRect
SetRectEmpty
DestroyIcon
LoadImageW
UnpackDDElParam
ReuseDDElParam
SetParent
MonitorFromPoint
SetLayeredWindowAttributes
EnumDisplayMonitors
IsChild
OpenClipboard
LoadCursorW
GetIconInfo
GetDC
GetClientRect
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
GetWindowRect
GetDesktopWindow
GetSysColor
LoadIconW
ReleaseDC
SetTimer
KillTimer
LoadStringW
MessageBoxW
UnregisterClassW
IsIconic
GetSystemMetrics
DrawIcon
SetWindowLongW
GetWindowLongW
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
EnumChildWindows
DeleteMenu
GetCursorPos
SetForegroundWindow
GetSubMenu
PostMessageW
LoadMenuW
ModifyMenuW
InvalidateRect
CopyRect
SetClipboardData
EmptyClipboard
DrawStateW
IsRectEmpty
TrackMouseEvent
GetSystemMenu
RegisterClipboardFormatW
LockWindowUpdate
SetClassLongW
CharNextW
InvalidateRgn
SetRect
GetNextDlgGroupItem
GetMenuDefaultItem
DrawFocusRect
DrawIconEx
GetWindowRgn
DestroyCursor
CreateMenu
GetDoubleClickTime
GetComboBoxInfo
GetUpdateRect
SubtractRect
MapVirtualKeyExW
IsCharLowerW
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
IsClipboardFormatAvailable
FrameRect
CopyIcon
SetMenuDefaultItem
UpdateLayeredWindow
CharUpperBuffW
SetCursorPos
DrawFrameControl
DrawEdge
UnionRect
InvertRect
HideCaret
EnableScrollBar
SetWindowTextW

gdi32

GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextExtentPoint32W
GetMapMode
SetRectRgn
CreateDCW
GetTextMetricsW
EnumFontFamiliesExW
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetDIBits
RealizePalette
SetPixel
StretchBlt
GetRgnBox
CreatePalette
GetPaletteEntries
GetSystemPaletteEntries
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
Rectangle
RoundRect
ExtFloodFill
SetPaletteEntries
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetTextFaceW
CopyMetaFileW
SetBrushOrgEx
GetBkMode
GetTextColor
GetBkColor
GetBrushOrgEx
CreatePatternBrush
SetPixelV
GetBitmapDimensionEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
CreateCompatibleBitmap
CombineRgn
OffsetRgn
CreateRoundRectRgn
CreateRectRgn
CreatePen
CreateFontW
CreateFontIndirectW
CreateSolidBrush
CreateDIBSection
GetObjectW
CreateCompatibleDC
SetDIBColorTable
SelectObject
GetClipBox
ExcludeClipRect
CreateHatchBrush
PatBlt
CreateRectRgnIndirect
CreateBitmap
SetTextColor
SetBkColor
GetNearestPaletteIndex
GetDeviceCaps
DeleteDC
DPtoLP
BitBlt
DeleteObject

msimg32

AlphaBlend
TransparentBlt

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegisterEventSourceA
DeregisterEventSource
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegDeleteKeyW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExW
RegEnumKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
ReportEventA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteW
Shell_NotifyIconW
SHGetFileInfoW
DragQueryFileW
DragFinish
SHAppBarMessage
SHGetMalloc
SHGetFolderPathW
SHGetDesktopFolder
SHBrowseForFolderW

comctl32

ImageList_Draw
InitCommonControlsEx

shlwapi

StrStrW
StrStrIW
UrlEscapeW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
PathFindFileNameW
PathRemoveFileSpecW
StrFormatKBSizeW

uxtheme

DrawThemeParentBackground
DrawThemeText
DrawThemeBackground
IsThemeBackgroundPartiallyTransparent
OpenThemeData
CloseThemeData
GetThemePartSize
IsAppThemed
GetThemeColor
GetCurrentThemeName
GetThemeSysColor
GetWindowTheme

ole32

CreateILockBytesOnHGlobal
RegisterDragDrop
StgCreateDocfileOnILockBytes
CoGetClassObject
CreateStreamOnHGlobal
CoDisconnectObject
CoInitialize
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
ReleaseStgMedium
OleDuplicateData
CoLockObjectExternal
IsAccelerator
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
OleGetClipboard
OleLockRunning
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
CoTaskMemFree
CoTaskMemAlloc
RevokeDragDrop
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoInitializeEx
CoRevokeClassObject
CoRegisterMessageFilter
StgOpenStorageOnILockBytes

oleaut32

VariantChangeType
LoadTypeLi
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantInit
VariantClear
VariantCopy
VarBstrFromDate
OleCreateFontIndirect
SysAllocStringLen
SysFreeString
SysAllocString

oledlg

OleUIBusyW

gdiplus

GdipGetImageGraphicsContext
GdipDisposeImage
GdipFree
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdiplusStartup
GdipCreateBitmapFromStream
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipDrawImageI
GdiplusShutdown
GdipDeleteGraphics

wininet

InternetConnectW
InternetOpenW
InternetCloseHandle
HttpQueryInfoW
InternetErrorDlg
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetOptionW
InternetGetConnectedStateExW
InternetQueryOptionW

rasapi32

RasEnumEntriesW

iphlpapi

GetIfTable
GetAdaptersInfo

crypt32

CertOpenSystemStoreW
CertEnumCertificatesInStore
CryptHashCertificate
CertCloseStore

ws2_32

WSAGetLastError
shutdown
recvfrom
freeaddrinfo
getaddrinfo
ntohs
recv
send
connect
closesocket
sendto
WSACleanup
socket
htons
WSAStartup
htonl
inet_ntoa
gethostbyname
inet_addr
WSASetLastError

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

Exports

Exports

??0CBase64@@QAE@ABV0@@Z
??0CBase64@@QAE@XZ
??1CBase64@@UAE@XZ
??4CBase64@@QAEAAV0@ABV0@@Z
??_7CBase64@@6B@
?DecodeBase64@CBase64@@QAEHPBDPAEH@Z
?DecryptString@CBase64@@QAEXPAD0H@Z
?EncodeBase64@CBase64@@QAEHPBEPADHH@Z
?EncryptString@CBase64@@QAEXPAD0HH@Z
?GetMainBoardSerialByWMI@CBase64@@AAEXPADAAH@Z

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 627KB - Virtual size: 626KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb9f7e780c43959a40109f73f5843d9a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

wininet

rasapi32

iphlpapi

crypt32

ws2_32

oleacc

imm32

winmm

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 627KB - Virtual size: 626KB

.data Size: 72KB - Virtual size: 113KB

.rsrc Size: 93KB - Virtual size: 92KB

.reloc Size: 160KB - Virtual size: 159KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 627KB - Virtual size: 626KB

.data
Size: 72KB - Virtual size: 113KB

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 160KB - Virtual size: 159KB