New folder (2).7z
- SHA256 d418ca84ca4bb7db72d2b00f8d6225a57909e02f712c7b0e2d9cefb2e18d0737
Overview
overview
10Static
static
10020db58e3c...4c.exe
windows7-x64
1006cbef0e90...f8.exe
windows7-x64
9083c5b43df...fb.exe
windows7-x64
1015cb04fa5c...4f.exe
windows7-x64
922a1f50db9...85.exe
windows7-x64
924cb5e44b6...8d.exe
windows7-x64
1027c9f44e0c...d6.exe
windows7-x64
102c2aa8458f...3d.exe
windows7-x64
72e9e18954a...d1.exe
windows7-x64
102ebb2a34dd...c6.exe
windows7-x64
102fff52aa0c...21.exe
windows7-x64
1037ca1cfa1f...60.exe
windows7-x64
1038cd67a044...4c.exe
windows7-x64
93d4f84e20d...96.exe
windows7-x64
49cff73125...4b.exe
windows7-x64
104c0153b979...a5.exe
windows7-x64
104ded976d2e...5a.exe
windows7-x64
34ee95ee627...68.exe
windows7-x64
105b439daac4...d7.exe
windows7-x64
1067df6d4554...78.exe
windows7-x64
36b3bf710cf...2e.exe
windows7-x64
66df64a0a92...fe.exe
windows7-x64
1075b45fea60...34.exe
windows7-x64
1082e6b71b99...5a.exe
windows7-x64
108a6aa9e5d5...47.exe
windows7-x64
108bcfb60733...fd.exe
windows7-x64
108bf1319fd0...6c.exe
windows7-x64
108d76a9a577...20.exe
windows7-x64
108dd283ca01...4c.exe
windows7-x64
108edaee2550...e7.exe
windows7-x64
109bff71afad...75.exe
windows7-x64
109d7fb7050c...20.exe
windows7-x64
10Static task
static1
16 signatures
Behavioral task
behavioral1
Sample
020db58e3c552ead23b18bb04bb75781e51347dab4868d1fc55e2854a6647d4c.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral2
Sample
06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
1200 seconds
Behavioral task
behavioral3
Sample
083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb.exe
Resource
win7-20240705-en
windows7-x64
20 signatures
1200 seconds
Behavioral task
behavioral4
Sample
15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral5
Sample
22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral6
Sample
24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d.exe
Resource
win7-20240708-en
windows7-x64
19 signatures
1200 seconds
Behavioral task
behavioral7
Sample
27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6.exe
Resource
win7-20240704-en
windows7-x64
19 signatures
1200 seconds
Behavioral task
behavioral8
Sample
2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral9
Sample
2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1.exe
Resource
win7-20240704-en
windows7-x64
14 signatures
1200 seconds
Behavioral task
behavioral10
Sample
2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6.exe
Resource
win7-20240708-en
windows7-x64
18 signatures
1200 seconds
Behavioral task
behavioral11
Sample
2fff52aa0c2fac4e53008cdf0bbea4ade2243bf42418330a03d5ce6f0d598421.exe
Resource
win7-20240705-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral12
Sample
37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe
Resource
win7-20240705-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral13
Sample
38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c.exe
Resource
win7-20240705-en
windows7-x64
17 signatures
1200 seconds
Behavioral task
behavioral14
Sample
3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral15
Sample
49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b.exe
Resource
win7-20240704-en
windows7-x64
24 signatures
1200 seconds
Behavioral task
behavioral16
Sample
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral17
Sample
4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
1200 seconds
Behavioral task
behavioral18
Sample
4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168.exe
Resource
win7-20240704-en
windows7-x64
24 signatures
1200 seconds
Behavioral task
behavioral19
Sample
5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral20
Sample
67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
1200 seconds
Behavioral task
behavioral21
Sample
6b3bf710cf4a0806b2c5eaa26d2d91ca57575248ff0298f6dee7180456f37d2e.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
1200 seconds
Behavioral task
behavioral22
Sample
6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
1200 seconds
Behavioral task
behavioral23
Sample
75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734.exe
Resource
win7-20240704-en
windows7-x64
20 signatures
1200 seconds
Behavioral task
behavioral24
Sample
82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a.exe
Resource
win7-20240708-en
windows7-x64
19 signatures
1200 seconds
Behavioral task
behavioral25
Sample
8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347.exe
Resource
win7-20240705-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral26
Sample
8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd.exe
Resource
win7-20240704-en
windows7-x64
24 signatures
1200 seconds
Behavioral task
behavioral27
Sample
8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
1200 seconds
Behavioral task
behavioral28
Sample
8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720.exe
Resource
win7-20240705-en
windows7-x64
19 signatures
1200 seconds
Behavioral task
behavioral29
Sample
8dd283ca012e7a70a2673d2cc211c6a616ff23bc5bd3599a1da077ba946a044c.exe
Resource
win7-20240708-en
windows7-x64
16 signatures
1200 seconds
Behavioral task
behavioral30
Sample
8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Resource
win7-20240704-en
windows7-x64
20 signatures
1200 seconds
Behavioral task
behavioral31
Sample
9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral32
Sample
9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920.exe
Resource
win7-20240704-en
windows7-x64
19 signatures
1200 seconds
General
- Target New folder (2).7z
- Size 13.3MB
- Sample240713-lvbvdsyapd
- SHA256 d418ca84ca4bb7db72d2b00f8d6225a57909e02f712c7b0e2d9cefb2e18d0737
- MD5 300907600633b7aacc130b724aec7fe2
- SHA1 4191d63dc42b2c3f866dca771b595c249b7eb6e9
- SHA512 be6bdb6824b03d4749189d8eb5f9cb5b45b0a74c2ae347570acb0c5e8dd5442ee9a5359cf888cbf24da5f597c718a3db605355929d55dbbc3d93bee83523ce3e
- SSDEEP 393216:NKJ8US7afzdQRNspruRNL0EMuGMjFVWz9:NKm3KQAr1P9
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackcat family
- Chaos Ransomware 16 IoCs
resource yara_rule static1/unpack001/24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d.exe family_chaos static1/unpack001/27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6.exe family_chaos static1/unpack001/2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1.exe family_chaos static1/unpack001/2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6.exe family_chaos static1/unpack001/37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe family_chaos static1/unpack001/49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b.exe family_chaos static1/unpack001/4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168.exe family_chaos static1/unpack001/5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7.exe family_chaos static1/unpack001/6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe.exe family_chaos static1/unpack001/75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734.exe family_chaos static1/unpack001/82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a.exe family_chaos static1/unpack001/8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347.exe family_chaos static1/unpack001/8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd.exe family_chaos static1/unpack001/8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720.exe family_chaos static1/unpack001/9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275.exe family_chaos static1/unpack001/9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920.exe family_chaos - Chaos family
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb.exe disable_win_def static1/unpack001/8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe disable_win_def - Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule static1/unpack001/8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe family_mafiaware666 - Detect Neshta payload 3 IoCs
resource yara_rule static1/unpack001/49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b.exe family_neshta static1/unpack001/4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168.exe family_neshta static1/unpack001/8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd.exe family_neshta - Detected LegionLocker ransomware 1 IoCs
Sample contains strings associated with the LegionLocker family.
resource yara_rule static1/unpack001/6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe.exe family_legionlocker - Detects Zeppelin payload 1 IoCs
resource yara_rule static1/unpack001/4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a.exe family_zeppelin - Legionlocker family
- Mafiaware666 family
- ModiLoader Second Stage 1 IoCs
resource yara_rule static1/unpack001/8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe modiloader_stage2 - Modiloader family
- Neshta family
- Zeppelin family
- Unsigned PE 32 IoCs
Checks for missing Authenticode signature.
resource unpack001/020db58e3c552ead23b18bb04bb75781e51347dab4868d1fc55e2854a6647d4c.exe unpack001/06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe unpack001/083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb.exe unpack001/15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe unpack001/22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585.exe unpack001/24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d.exe unpack001/27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6.exe unpack001/2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe unpack001/2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1.exe unpack001/2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6.exe unpack001/2fff52aa0c2fac4e53008cdf0bbea4ade2243bf42418330a03d5ce6f0d598421.exe unpack001/37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe unpack001/38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c.exe unpack001/3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096.exe unpack001/49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b.exe unpack001/4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe unpack001/4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a.exe unpack001/4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168.exe unpack001/5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7.exe unpack001/67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe unpack001/6b3bf710cf4a0806b2c5eaa26d2d91ca57575248ff0298f6dee7180456f37d2e.exe unpack001/6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe.exe unpack001/75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734.exe unpack001/82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a.exe unpack001/8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347.exe unpack001/8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd.exe unpack001/8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe unpack001/8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720.exe unpack001/8dd283ca012e7a70a2673d2cc211c6a616ff23bc5bd3599a1da077ba946a044c.exe unpack001/8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe unpack001/9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275.exe unpack001/9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920.exe - NSIS installer 1 IoCs
resource yara_rule static1/unpack001/3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096.exe nsis_installer_2
File Explorer
-
New folder (2).7z.7z 13.3MB
-
020db58e3c552ead23b18bb04bb75781e51347dab4868d1fc55e2854a6647d4c.exe.exe 1.3MB
-
06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe.exe 147KB
-
083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb.exe.exe 353KB
-
15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe.exe 213KB
-
22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585.exe.exe 240KB
-
24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d.exe.exe 88KB
-
27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6.exe.exe 352KB
-
2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe.exe 4.2MB
-
2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1.exe.exe 283KB
-
2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6.exe.exe 241KB
-
2fff52aa0c2fac4e53008cdf0bbea4ade2243bf42418330a03d5ce6f0d598421.exe.exe 2.4MB
-
37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe.exe 953KB
-
38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c.exe.exe 1.9MB
-
3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096.exe.exe 6.3MB
-
49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b.exe.exe 2.8MB
-
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe.exe 390KB
-
4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a.exe.exe 2.6MB
-
4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168.exe.exe 2.8MB
-
5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7.exe.exe 25KB
-
67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe.exe 2.0MB
-
6b3bf710cf4a0806b2c5eaa26d2d91ca57575248ff0298f6dee7180456f37d2e.exe.exe 145KB
-
6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe.exe.exe 6.0MB
-
75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734.exe.exe 2.7MB
-
82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a.exe.exe 270KB
-
8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347.exe.exe 604KB
-
8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd.exe.exe 2.8MB
-
8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe.exe 3.3MB
-
8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720.exe.exe 128KB
-
8dd283ca012e7a70a2673d2cc211c6a616ff23bc5bd3599a1da077ba946a044c.exe.exe 131KB
-
8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe.exe 353KB
-
9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275.exe.exe 976KB
-
9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920.exe.exe 164KB
020db58e3c552ead23b18bb04bb75781e51347dab4868d1fc55e2854a6647d4c.exe
- IMPHASH cf1e67b379bc9699232c4071646dde21
- SHA256 020db58e3c552ead23b18bb04bb75781e51347dab4868d1fc55e2854a6647d4c
- MD5 ffce3f25a125b5dfcd96e92148b7d209
- SHA1 a4c2bfa23b98471ac1ea7103e194cf6488a058ac
- SHA512 7d0af9214e4cdabceab9abb2586288e0a42ef9b7a7abc1bc7f03c04cf48b6722eeeee4a476aaf2567feaacbc70fb3e6bf36aa1050b010ef68019b7e80886f823
- SSDEEP 24576:1pa1z++i/OfNbXirk1nF1qfWk3w80geAcVW9CFnBOmp7BCr/otH5LSp+7I80w:zF+BZk6FnBOmp7BCr/G7I80
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1195532
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
SetFileAttributesW
GetFileType
QueryDosDeviceW
GetACP
CloseHandle
LocalFree
GetSystemDefaultLangID
VirtualProtect
QueryPerformanceFrequency
IsDebuggerPresent
FindNextFileW
GetFullPathNameW
VirtualFree
ExitProcess
HeapAlloc
GetCPInfoExW
GetSystemTime
RtlUnwind
GetCPInfo
EnumSystemLocalesW
GetStdHandle
FileTimeToLocalFileTime
GetModuleHandleW
FreeLibrary
TryEnterCriticalSection
HeapDestroy
FileTimeToDosDateTime
ReadFile
HeapSize
GetLastError
GetModuleFileNameW
SetLastError
CreateThread
CompareStringW
MapViewOfFile
CreateMutexW
LoadLibraryA
ResetEvent
GetVolumeInformationW
GetDriveTypeW
GetVersion
RaiseException
MoveFileW
FormatMessageW
OpenProcess
SwitchToThread
GetExitCodeThread
GetCurrentThread
GetFileAttributesExW
LoadLibraryExW
TerminateProcess
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
VerLanguageNameW
GetThreadPriority
GetCurrentProcess
SetThreadPriority
VirtualAlloc
GetCommandLineW
GetSystemInfo
GetTempPathW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetLogicalDriveStringsW
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetDiskFreeSpaceW
VerSetConditionMask
FindFirstFileW
GetUserDefaultUILanguage
GetConsoleOutputCP
UnmapViewOfFile
GetConsoleCP
lstrlenW
SetEndOfFile
QueryPerformanceCounter
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
GetLocaleInfoW
CreateFileW
DeleteFileW
IsDBCSLeadByteEx
FreeConsole
GetEnvironmentVariableW
GetLocalTime
GetConsoleWindow
WaitForSingleObject
WriteFile
CreateFileMappingW
ExitThread
DeleteCriticalSection
GetDateFormatW
TlsGetValue
SetErrorMode
IsValidLocale
TlsSetValue
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
shell32
SHGetSpecialFolderPathW
ShellExecuteW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
user32
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
ShowWindow
CharLowerBuffW
LoadStringW
CharUpperW
PeekMessageW
GetSystemMetrics
MessageBoxW
oleaut32
SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate
netapi32
NetWkstaGetInfo
NetApiBufferFree
advapi32
RegSetValueExW
RegConnectRegistryW
RegEnumKeyExW
RegLoadKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegUnLoadKeyW
RegSaveKeyW
RegDeleteValueW
RegReplaceKeyW
RegFlushKey
RegQueryValueExW
RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegRestoreKeyW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
26KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
1024B
Virtual Size
658B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
153B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
32B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8
- MD5 ce4c09c4b836c31993e902adf115a54a
- SHA1 5fe984d96c4361a996c898e93dd72538614ca0c6
- SHA512 02226e2abb6616525a2431ce6f4d6c81d54d2c06f7cf4f5cb8af740b14e03df657e8fa22e71d8b83ab7e1cdb9b943868f7d3d687482b499d85b2ca7974f0140d
- SSDEEP 3072:ribQR54LZPhG1tqIFMH4zGrEV9SzjS3vqY:riI6PhGqI+YqrEV9S2q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
85374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\ConsoleApp2.pdb
mscoree
_CorExeMain
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb
- MD5 c525eb716420dc915fe574b8a3973143
- SHA1 b272f9a63aed4c5ab06e887d3ceb9854f52fa1d7
- SHA512 24ba34d78e5c295c740e2ec9d0c27c90a25dcad5f330c72929c9e98a64f36f8ab6763c7f9929bc72a31d9b52d11ab17882a3841a75b77b904f4aeb90c768177d
- SSDEEP 6144:G1/ZVevGFi0Xx6HQpNnCnoed+wBlO18eDKO3wexcXQVkcoHnqyk:WeUjNHCFkw3OCMpxcXiPoKN
- MD5 SHA1 SHA512 SSDEEP
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
385034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
)ty[?
T
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f
- MD5 3271867f57a7ddd53d2f36210f79b241
- SHA1 04ccf49f32406c6a0d61745bae090a9426a1500d
- SHA512 a0a0725b6023cab53363303db4aa0c6c1c1916a6b178b1f3a6301e779c67a2b1d68202a696ee328ffa9080f2f7236f581cbf8aadef4eadebb748ed6fcf35baa9
- SSDEEP 3072:XBkGJ8YXmHDZLWlTSMu/9laSnsBOSrXo0hL5VNWrIV9Y5cYE3vqY:uGuYXeDZW4MuVgUsBOchL5LWrIV9ugq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
153102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\ConsoleApp2.pdb
mscoree
_CorExeMain
Name
.text
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585
- MD5 598b2a2bdfb474047a6d5b5f0469c27a
- SHA1 a2d42ceb046e3bfcab1bb3dc9ef9e89f12e2bd66
- SHA512 ff6930e0dd15d7fc23f3cd62b5213863ec0c59b8ada189960e52be1832c8a1b928ddb3debf9eca65bbd5203e7b191e55d79dd2c7592bed3e197bdfb5b200ddbf
- SSDEEP 3072:PC4zn72NrvV9YhZv0FKbgx2HMdYlTYpu/EVarwBwCc45TEywugt45ZoIWpEzGVz1:Pn72NrvV9OCTE45Z1WpEKvmSx7ri
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\ConsoleApp2.pdb
mscoree
_CorExeMain
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
206KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d
- MD5 e60df2922d5ceb45856f405e41a9d6cc
- SHA1 2e438348f4ec2fbd82ce944ad3697d58771ac170
- SHA512 21eac0c509698b0b257e0f8b304204b0f29bbca8f0fafbb33aee5d93af727859ec6e2977c45c658248858cbe362ee5438c37bf566c269e4b708a89f22c87cca3
- SSDEEP 768:/qo23p8xAcr9G5eH2SU2Ip4jBqltCF0AxEjenoB69+Fx:yo2iAcr9GYH2SFHBWAxEjc+
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6
- MD5 b431bf2649aee55b729f1668a7bc4b12
- SHA1 f618c191798cd8a809120bbf6b09ff79d8877138
- SHA512 b31ac84b8d41c4d77536763acf3daa75c437b62e792329f232892e7939b35ed8731f3aaaa3e406cf1bf6121a64c920dd03df4da07847debdd2caae3dc70ed544
- SSDEEP 3072:L3kLEir9ihicEQ23lcjxXedA3MYRjuOGK2OIcVtkzuwOYHYHYN4YHYHYcSuCexyM:Ur9ikcL2mj4d6riOZ+qSHej/Kd+bN
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
176878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
186KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d
- MD5 4755656e64a4cb4ee7ae5846acc1bbc1
- SHA1 fd8f5007141ac941fcac77c6565ccb1ec86b1391
- SHA512 6aecc49f717d19425256ef0dcfe5ee8fdd47e131d91322ef8f250d92935d55130226227e0a5f8d8a1d94f1a8f31c4325f026755610a15717a05df26a4c498af5
- SSDEEP 98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4ulur:ovsJR0TW6yiIKRhzqOsr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4271134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1
- MD5 f5a0c315b535c5a65bbbad8352592221
- SHA1 97e4cff4bece35cbcea863045025645f931fce14
- SHA512 58560e1f409fb5cbd70517594d47d2e6145b17d3e64170ef6c1ae583cdf59fe670c2f1c468733ecca0a99c8ec893426a6ca9a8263be12a8845e87af3be50d335
- SSDEEP 3072:4W2W9AU+AUae0RgBhr2TLJY74vSePjxi4vLE3YKFcLhNLUt/sVZuQ5kROFz8C9uk:4jW9/+AGBOLS4cvIpNYqa6kIFzn9/x
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
196014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
183KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6
- MD5 692ea33f6b08ccd47ef8a4f8b913fc4f
- SHA1 8a2f0c6b5f422cb2125273be1eece261aa3007e0
- SHA512 df87964befe8dad825e869e4d915c46d71bb72b4f318f9c52d9a1381d391bad73aef5e555057e8189dca479359fa635b19727bb64d1876c1403057ed1e1faca7
- SSDEEP 3072:aoT9szr954q4qf8NWPr0Dp/XpoO1zDsJOFQVrFsUBTa488+6WniGxfLwxhqSEaqw:0r95wCPADpaOOwajTa65HyigEX1OeLn
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
237390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
224KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
2fff52aa0c2fac4e53008cdf0bbea4ade2243bf42418330a03d5ce6f0d598421.exe
- IMPHASH 12fcd3183e0fb67f1e38925ed5c0c47c
- SHA256 2fff52aa0c2fac4e53008cdf0bbea4ade2243bf42418330a03d5ce6f0d598421
- MD5 42935359d9ae5ab7507f082c117c0027
- SHA1 05dd7616805833497c0ec1826ffc53b7673d8191
- SHA512 f7fb318258fd7faaed95facea3b8c1ee2c11c13cb5ea239773b22ae5e270cef94a1892dfd2f60df15cf79f9f4935e4145bf5127734ff8893c3020c245d18189a
- SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCH:eEtl9mRda12sX7hKB8NIyXbacAfk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
380800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcpyA
WritePrivateProfileStringA
WriteFile
WinExec
WaitForSingleObject
VirtualQuery
VirtualAlloc
UnmapViewOfFile
Sleep
SizeofResource
SetThreadLocale
SetFilePointer
SetFileAttributesA
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
MultiByteToWideChar
MulDiv
MoveFileA
MapViewOfFile
LockResource
LocalFree
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetTempPathA
GetSystemInfo
GetSystemDirectoryA
GetStringTypeA
GetStdHandle
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetExitCodeThread
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCPInfo
GetACP
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreateFileA
CreateEventA
CopyFileA
CompareStringA
CloseHandle
Sleep
user32
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WinHelpA
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCursor
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClipboardData
SetClassLongA
SetCapture
SetActiveWindow
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterClipboardFormatA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageA
OpenClipboard
OffsetRect
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
MessageBeep
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
ExitWindowsEx
EqualRect
EnumWindows
EnumThreadWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyCursor
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
SetSecurityInfo
SetEntriesInAclA
GetSecurityInfo
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdi32
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
Rectangle
RectVisible
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPointA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
ole32
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize
CoInitialize
comctl32
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
Name
CODE
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.SCY
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60
- MD5 5fc3bd9632a02f189d81f75fc3b12ebf
- SHA1 6abbc78a6fb421adf80051365dbfaff0b3fb696b
- SHA512 cf0b9df6db5c85ebc85967dbfbdd99ada401f718445f69f258d9d0a9466f7b58a7bb2f1287cb5679988bd79b42807fa0e0e7fc419557f0af3fbb620b40b2c2af
- SSDEEP 12288:OzEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzz5:0ztQE1ov2AZ9HjkftWyq
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
878958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
850KB
Virtual Size
850KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c.exe
- IMPHASH ec97275d96db730fc038c7b7ce168314
- SHA256 38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c
- MD5 d28e88e6e9ad654f81909e605f3398c1
- SHA1 84726882c606eec6b7ed7d0ba1d9acdd13390e45
- SHA512 3e971529338ef0576ce40679b33fb763b2e1f3e7c16255b922434baf486d6569ee1e0770959ba7763b9759d89bf55b149d54546bdfa7299c41fd2c5d302ecaf7
- SSDEEP 24576:tnxLSUXY7WSIGgjvvYaxKMiZA+yH6uw1ECvGX6H7O3YpPNaG:txOUpSIZDv1xim+y6HLOO3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
399012
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
winmm
midiStreamOut
midiOutPrepareHeader
waveOutWrite
waveOutPause
waveOutReset
waveOutClose
waveOutGetNumDevs
waveOutOpen
midiOutUnprepareHeader
midiStreamOpen
midiStreamProperty
midiStreamStop
midiOutReset
midiStreamClose
midiStreamRestart
waveOutUnprepareHeader
waveOutPrepareHeader
ws2_32
WSAAsyncSelect
closesocket
WSACleanup
inet_ntoa
recvfrom
ioctlsocket
recv
accept
getpeername
kernel32
SetLastError
GetTimeZoneInformation
GetVersion
UnhandledExceptionFilter
GetACP
HeapSize
TerminateProcess
RaiseException
GetLocalTime
GetSystemTime
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
lstrcpynA
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
InterlockedDecrement
InterlockedIncrement
GetFileSize
SetFilePointer
CreateToolhelp32Snapshot
Process32First
Process32Next
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetWindowsDirectoryA
GetSystemDirectoryA
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
ReadFile
RemoveDirectoryA
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
InterlockedExchange
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
GetVersionExA
WritePrivateProfileStringA
CreateThread
CreateEventA
Sleep
ExpandEnvironmentStringsA
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathA
FindFirstFileA
FindClose
SetFileAttributesA
GetFileAttributesA
DeleteFileA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
CreateProcessA
WaitForSingleObject
CloseHandle
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
user32
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
GetSysColorBrush
CopyAcceleratorTableA
GetKeyState
TranslateAcceleratorA
IsWindowEnabled
ShowWindow
SystemParametersInfoA
LoadImageA
EnumDisplaySettingsA
ClientToScreen
EnableMenuItem
GetSubMenu
GetDlgCtrlID
CreateAcceleratorTableA
CreateMenu
ModifyMenuA
AppendMenuA
CreatePopupMenu
DrawIconEx
CreateIconFromResource
CreateIconFromResourceEx
RegisterClipboardFormatA
SetRectEmpty
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
DispatchMessageA
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
LoadStringA
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
IntersectRect
DestroyIcon
PtInRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
WaitForInputIdle
GetMessageA
WindowFromPoint
DrawEdge
DrawFrameControl
TranslateMessage
LoadIconA
GetForegroundWindow
GetDesktopWindow
GetClassNameA
GetDlgItem
GetWindowTextA
DefWindowProcA
GetClassInfoA
IsZoomed
OffsetRect
PostQuitMessage
CopyRect
UnregisterClassA
DrawFocusRect
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
gdi32
GetViewportExtEx
ExtSelectClipRgn
LineTo
MoveToEx
GetObjectA
CreatePen
PatBlt
CombineRgn
CreateRectRgn
FillRgn
CreateSolidBrush
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
PtVisible
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
CreateRectRgnIndirect
SetBkColor
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextMetricsA
SelectObject
CreateBitmap
CreateDCA
CreateCompatibleBitmap
GetPolyFillMode
GetStretchBltMode
GetROP2
GetBkColor
GetBkMode
GetTextColor
CreateRoundRectRgn
CreateEllipticRgn
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
RealizePalette
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
DeleteObject
CreatePolygonRgn
GetClipRgn
Ellipse
SelectClipRgn
SetStretchBltMode
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
advapi32
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegQueryValueA
RegCreateKeyExA
RegCloseKey
shell32
SHGetSpecialFolderPathA
ShellExecuteA
Shell_NotifyIconA
ole32
CLSIDFromString
OleUninitialize
OleInitialize
oleaut32
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
comctl32
ord17
ImageList_Destroy
comdlg32
ChooseColorA
GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
Name
.text
Size
512KB
Virtual Size
508KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=5, id=12, version=7291,
count=44, id=19, version=8022,
count=24, id=19, version=8034,
count=673, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=209, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=94, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=90, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=25, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=48, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096.exe
- SHA256 3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096
- MD5 6a7b2c486baa38a1d89e10889fc0802b
- SHA1 6b8ddf08972160a12e144e00aa8a486b3c35e5e1
- SHA512 a1d60b7113fea5c71309cb2bf49758802f73c5c8152030b7376d8ae2eb7c87d117fdb72b29f73e11c9cbc3ed17ef68a856ce56ed3d93fe4143f9085fd191f739
- SSDEEP 98304:RfrQZerQZ2cK5YOXwnS4rV340Jy9+lG498HL:Rfr2er22KIJZr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
11220
Magic Number
267
Subsystem
MAGE_SUBSYSTEM_UNKNOWN
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=5, id=9, version=8783,
count=1, id=13, version=9782,
49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b.exe
- SHA256 49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b
- MD5 4431e8c03162a470cc1c74edfded4afb
- SHA1 1fdd90a0a702447aebbd683e175c85a50acb9715
- SHA512 f006cab8488dc669b5d23e64eea14efce8f6c90cd1ab57b71967e9ecb1748f57da2d5d6bf7eb824338b6025346abd823391abb2932e9d2eb719d55404f565922
- SSDEEP 24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEC+:BSy6PX3PpM+P5IdF+
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32996
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
42KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
- IMPHASH ab8fd60b3da01515e6706e8d122c633f
- SHA256 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5
- MD5 8c64181ff0dc12c87e443aae94bf6650
- SHA1 e91d7ebd17912785caa3e71ef1571dc01b1cd854
- SHA512 4854565b054297dffc13b659a53059ee8731dca02f3027501254551cb4af20b68fb121d03e528151cf910238b49bf00a3827e74e4bb68faf85ebc50d02ad5c17
- SSDEEP 12288:ef/X4NTn/xVkNG+w+9OqFoK323qdQYKU3:EXATn/xVkNg+95vdQa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4747
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Zeus \PC\documents\visual studio 2010\Projects\Keygroup\Release\Keygroup.pdb
kernel32
GetFullPathNameA
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
ExpandEnvironmentStringsA
WriteFile
CloseHandle
HeapReAlloc
GetStringTypeW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
IsProcessorFeaturePresent
shell32
ShellExecuteA
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
362KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=171, productName=VS2010 build 30319, version=30319,
count=8, id=158, productName=VS2010 build 30319, version=30319,
count=56, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=68, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a.exe
- SHA256 4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a
- MD5 ca1e56a26f9b7b8e18a5f627bd946d53
- SHA1 80f9a9afa9a115acabd32ddbd0339a17d261e90c
- SHA512 d48549c184754f7d7e3c5b35c14aab50766aaa00eb8ce62d326a44ce9ccfc0b40bc94e33fa00c8b7594dfc0585f0c6530597d1222d8cb03edcb701de203af679
- SSDEEP 12288:jOU/d7WQvyPWa4DQFu/U3buRKlemZ9DnGAevjdMOU/d7WQvyPWa4DQFu/U3buRKO:7/JRyuN5e/JRyuN
- MD5 SHA1 SHA512 SSDEEP
-
Detects Zeppelin payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
202572
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
.text
Size
188KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168.exe
- SHA256 4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168
- MD5 aa5c75d313a98f3284d7ef52236d2d46
- SHA1 085b7906df9bb7c07b254e9f1dd3c1015b581d8b
- SHA512 0302c54bc87cc38f28e7d3b428fc51256f828831501e341e720e9b477d24241071e402675fc6e73d12daf4917f25a874a4a4b614f15b12d8d7be210e15ea19ac
- SSDEEP 24576:WS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEgl:WSy6PX3PpM+P5Idtl
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32996
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
42KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7
- MD5 d2623fa5d0ce3b4746b1803caed0fdf6
- SHA1 339883e34e0cbc23f4c7a6ddb2376b420066fa1f
- SHA512 3140427772552c53ceafa9f745f6349f170401d6b3ae72d641d3004b5b4cfca82b04c30e6734f1b1fec97dcdbc452a36d2ffca4a014eb5851ea2c0f6bf4969f7
- SSDEEP 384:a3MLWHn3kI3fcSxlR2WpOYsBNakQJgr91Czxb5fe6uaVyZK:+n3kIE69pCYgr9ixbZe6PVyk
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe
- SHA256 67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478
- MD5 eba1ad16bc2fa284adae07cbebef8f7f
- SHA1 225163dfd08838ae6bfec6e27994b92955013576
- SHA512 909a8663ee28f43e7737f36707ee1a0195cd73e441dc4d2e6497d6bd7dad67465e21cdb0dd0e07511313673c1f8847c7a85966876165d197566dbbae8f34459b
- SSDEEP 49152:iFOLMMFExN0CZb979qfWqcWMT2I9tH2gpNcjsUnlww3GJIV4p:gOIMqvTF9qf5cWMT99tH2s4sUnKoo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14973
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
412B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=65, id=1, productName=Unmarked objects,
count=4, id=265, version=28314,
count=2, id=259, productName=VS2019 v16.4.0 build 28314, version=28314,
count=1, id=258, productName=VS2019 v16.4.0 build 28314, version=28314,
6b3bf710cf4a0806b2c5eaa26d2d91ca57575248ff0298f6dee7180456f37d2e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6b3bf710cf4a0806b2c5eaa26d2d91ca57575248ff0298f6dee7180456f37d2e
- MD5 9f16d35de8c312ba0b6f9efd558487fe
- SHA1 93040ad968110a6c96c9e2f74f6902aa52b71057
- SHA512 1534d12e38937d0c9597f67540b1c849728a637eb7dcd1286e28c9bd72a463bdbc492247beffd16e47986157323134edc84eb1d1f2e857d5c4a136427fe99699
- SSDEEP 1536:6Cpb2XbbPD1c2lB4a9wL7vkYq0Hk5rR5JkVJ4y/uU/rLV9YYccquTrX7YeOzk+7J:ZyXbt4aEcTrR5OVZ/rLV9Yrcqu3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
87438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\ConsoleApp2.pdb
mscoree
_CorExeMain
Name
.text
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe.exe
- IMPHASH bcb64e67818079866efdc97c2da83d74
- SHA256 6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe
- MD5 7f97b34a113170d02ff8008c2bbc7745
- SHA1 fe00b8cfc0896d6d23ff3628af8c406a7683d707
- SHA512 a899eb8481c02d0c983c7761ca9962ffdea22354cdef6cefeadbdf0ac96d43a54c02ea72e89b8b5c2bdefed38ecdd960a8d267e3fc15545286844baf40ac9e93
- SSDEEP 49152:LwLwHt4Ihqew+96PoBjYs5ngToDEZwTFgN+1TtI1VjFF3PBTqJQkYUjeAb3WUpPb:L9fhqezRobVjFyEUqA6Sp+ZIogCxfwis
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Detected LegionLocker ransomware
Sample contains strings associated with the LegionLocker family.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8887
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryW
GetSystemTimeAdjustment
TerminateProcess
GetMailslotInfo
FillConsoleOutputCharacterW
SetLastError
GetProcAddress
VirtualAlloc
FindAtomA
GetTickCount
IsValidCodePage
GetOEMCP
GetACP
HeapSize
SetProcessShutdownParameters
GetNativeSystemInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
HeapReAlloc
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW
user32
GetRawInputBuffer
GetAltTabInfoW
RegisterRawInputDevices
GetRawInputDeviceList
ValidateRect
GetNextDlgGroupItem
EndPaint
gdi32
SetViewportOrgEx
shell32
ShellAboutW
FindExecutableA
DragQueryFileA
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=158, productName=VS2010 build 30319, version=30319,
count=39, id=171, productName=VS2010 build 30319, version=30319,
count=97, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=1, id=7868, version=8344,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=18389, version=54693,
75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734
- MD5 024f23eff975f6989dd2dc4340886961
- SHA1 d553862c0cb3ab3ad5cba7654c038c966ebc9a00
- SHA512 4c62ebc36cca4ef4ff9d59e8497047436a7f9f51d78d9dc6d29a657052b997479378d46fc5616150bc62cb7211e623c2012fdd7cca2b4e96f54e64d61975e98a
- SSDEEP 24576:s1S4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE:s1Sy6PX3PpM+P5Id
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2674446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a
- MD5 14ea366be5cb691078be2c302590f435
- SHA1 84e562bb99249a58849f6f82b29a7746dd144900
- SHA512 9be5097295010fa04e04fcae578b19ab43935b09a70d8b31a038fd1ef7ed89dcd9143b82400e8d31913bf32a7a18628557dfaa1f4d37c1e7c8062d7a7368afb9
- SSDEEP 6144:r02q9t3hysg2+00aHYHjdCoD5oa+S/dIm:Aj3hBg/00aHYDd3DCO/dI
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
277310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
263KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347
- MD5 697deef7b2ca6b79c3608ebdf9c70977
- SHA1 64fb76029f4d7b3aa06646f286182daf4de2a27a
- SHA512 18870c02d0193349748447d92eb1fd2540ad02d54b736e9ce42dbe275acee5cbaa09d4f95e188a94d29e69f9349ff0bbe60e937880a867d4573847d93f7b2f8e
- SSDEEP 12288:/g1YsKMSiS9SW35dmhqoeBsGJGKlOD4BZXu3lKG3pHLb4:/gd5QSW3rQqoeBsGJGTyG3JLk
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
96213
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd.exe
- SHA256 8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd
- MD5 7db89ef8195831eb737b0a13cfbd8c60
- SHA1 3c8d54c374bda8cc955cfc7477f9e385f24e9592
- SHA512 537ce51e4351fdd8fed8a1cc3e497097847bd84c1d7e058d6e5672c1cc419cbdfb98c5af822af167fff2761127a33070fc65f2f724116cca206b56b3e8df267f
- SSDEEP 24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEzQ:BSy6PX3PpM+P5IdYQ
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32996
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
42KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c
- MD5 acd46f88a6f90143090c342c10544ccf
- SHA1 bb90bed3b0d747feeac32536d75c6d153b34be0b
- SHA512 82e91a14b2a7bfb659a566df7caf7f8dc28b61a14c504dd6ca23166ff2bb142114a43c5a3c70309022d813f34fb3aa63d321d964f3b6178e42b650ac0e56e84f
- SSDEEP 24576:v54IAnWrfdt2Zj1vpo4ajyKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKI:CIAWjdAp1PagjLuSh3i+FtvkMzT+
- MD5 SHA1 SHA512 SSDEEP
-
Detect MafiaWare666 ransomware
-
ModiLoader Second Stage
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
75706
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\1\Downloads\EncrypterPOC-main\EncrypterPOC-main\WindowsFormsApp1\obj\Release\WindowsFormsApp1.pdb
mscoree
_CorExeMain
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
206KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720
- MD5 85db480564216a2842299723f2537f57
- SHA1 97f5a29bb43312689de4c043dbea6a424319f407
- SHA512 c413c3c7dd57abacf2ea431127ddbb89884604dcbcf0a34f74de6b78dc30036602b0c36300eda1169470583a02bd34abf0371a12a6791c300fef0154fe6708c0
- SSDEEP 768:8Jqo2zIpszlgqr91OC/ehhegFH4MkaL5PEs:8co21lgqr91OzhvH4QL5cs
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8dd283ca012e7a70a2673d2cc211c6a616ff23bc5bd3599a1da077ba946a044c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8dd283ca012e7a70a2673d2cc211c6a616ff23bc5bd3599a1da077ba946a044c
- MD5 807b3c16e4b836511f326750bd175189
- SHA1 b24792703c3f05e07a668b4c1b701799b7e6fb6b
- SHA512 844c26ecc56929ca444344d22265e6e02debe1713c99a732c80cbee3474852b48aa359567a1e3e78cc165441177dd9f8880b8213806d69aac0e8df4352cf969b
- SSDEEP 3072:KFk4WBCsljJ8lSATxHt2bFZQhdFC7UtrK:KFkNCstGwATxN2bkFC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
138766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7
- MD5 74236c89b9fcb1194bcf19cf5920f3e3
- SHA1 7954ff64d20eae792a36ca2cf10a17da35cfbf27
- SHA512 fbf08ee1017ec6a497a468a5fcfb618bddab57b9bf087f1d478187410458e3922e9d48e9bb872098a0a912bcd3c096c11075ba8142df64cf3cdaaa833504ad83
- SSDEEP 6144:G1/ZVevGFi0Xx6HQpNnCnoed+wBlO18eDKO3wexcXQVkcoHnq9Bx:WeUjNHCFkw3OCMpxcXiPoK9
- MD5 SHA1 SHA512 SSDEEP
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
385034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
)ty[?
T
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275
- MD5 52e77b6c313dccdf3e013b86a8cdd915
- SHA1 72051bf592b4da79b44d704b675a810ad387a549
- SHA512 7a9e397af4f1963e742c1125e55c9808b1e90b077c98be374638d06bccce2106e6c436e4629b6a5233f22adc451a9f351b99a8f45a2a86802a0d21c73860b4da
- SSDEEP 12288:hUFOlD+3ryYy5zOuMEXyfrznawAmcCh7axyK9E3+ez2pSqxnBPrAM+zwbRU3i+yF:/a0rbpZ7mi+y
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
937630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
908KB
Virtual Size
907KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920
- MD5 44f3a9311b23d84f336cc5b856f16682
- SHA1 45e9f3c9836926822d4164848dad0dc6d5fd22d5
- SHA512 858d16972a6fece4dd3a30b77f7415433c994a4edaa0064282b5f2b2027d8d0d31e21ac66583e270d7c0cfc42d1bd56cdd506fdf86d67994c78275be58282f6b
- SSDEEP 3072:k3kw4Rlr9i0uIYGSKrG8yaJYCZWKuzfo5dXuZRodZXJvPbtH:64Pr9i00GrtUwJj1hH
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
169614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
158KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ