Behavioral task
behavioral1
Sample
_)01( noci.scr
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
_)01( noci.scr
Resource
win10v2004-20240704-en
General
-
Target
_)01( noci.scr
-
Size
262KB
-
MD5
e15358f77cb2d9a8f36300cd621cc68a
-
SHA1
168edfcabe08c67c7741d14a7f0cf926d846478b
-
SHA256
e8ca6295f91a857411273eea2fcf03989fc93f13f84c3cf2180bf556c89436d0
-
SHA512
debe87f0305ffcfae37d15edaa18287ec7ecd77a72bd585edf914bd9390db6dafe51c48beca6f1e6eef15f57967083516a250e1352c4746c704bab32d4fc86d1
-
SSDEEP
3072:HCk4Tq9ml9Zbgb1B+i1GlCdE4SrC1OMSn0vJAnR7Nn7ILJPopnWaGR8lJnHwCBF4:HJ4Tq9uPghIDN4unQ59P8WaomJBhnod
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource _)01( noci.scr
Files
-
_)01( noci.scr.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ