Static task
static1
Behavioral task
behavioral1
Sample
2024-08-03_052eb321c9ac2a9b32fbebc74c965c9d_bkransomware.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-03_052eb321c9ac2a9b32fbebc74c965c9d_bkransomware.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-03_052eb321c9ac2a9b32fbebc74c965c9d_bkransomware
-
Size
6.7MB
-
MD5
052eb321c9ac2a9b32fbebc74c965c9d
-
SHA1
e32d82551f6ac0f6c71ce4020fbdb955f6912a11
-
SHA256
1797647add6abf118f118c8def15fb004575ffdef141df6cb177095f3711cd8a
-
SHA512
35f033b30ae7154a81cbaa010820dbb8e50cc76ae203d4c9c6fedb778c79997094a7196df5abcb2ac83d6ca3d71ff316218d3642d405eb86c922dde02dcbb3a9
-
SSDEEP
98304:VYjx+LPlMbsyw9sRfoN50+3vJVLsA4wgnwMAb4BtRPaDjwIQo2ra3TUaWx:Cx6Bx9S3iB4wnmzRPaDNR6a3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-03_052eb321c9ac2a9b32fbebc74c965c9d_bkransomware
Files
-
2024-08-03_052eb321c9ac2a9b32fbebc74c965c9d_bkransomware.exe windows:6 windows x86 arch:x86
782350074f92bee1ba1d18a566721ad8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualQuery
FreeLibrary
SetDllDirectoryW
EnumCalendarInfoW
QueryPerformanceCounter
HeapFree
GetModuleHandleExW
GetUserDefaultLCID
WaitForSingleObject
SignalObjectAndWait
GetLogicalDrives
SetCommBreak
WaitForSingleObjectEx
GetTickCount
GetCurrentThread
VirtualFree
ExpandEnvironmentStringsA
GetPrivateProfileStringW
ClearCommBreak
VirtualQueryEx
SetCommState
GetCommandLineA
SetCommTimeouts
WideCharToMultiByte
IsValidLocale
Sleep
SizeofResource
GetSystemTimeAdjustment
HeapDestroy
LeaveCriticalSection
IsProcessorFeaturePresent
Beep
GetFileAttributesW
MulDiv
TerminateProcess
FileTimeToSystemTime
GetModuleFileNameW
GetOverlappedResult
ExitThread
SetThreadPriority
GetStartupInfoW
WritePrivateProfileStringW
GlobalUnlock
RaiseException
GetPrivateProfileIntW
VerifyVersionInfoW
IsDBCSLeadByteEx
SetLastError
IsValidCodePage
FindClose
LoadLibraryA
GetFileType
DeviceIoControl
CreatePipe
EnumResourceTypesW
GetThreadPriority
GetModuleHandleA
FindNextFileW
VirtualProtect
WinExec
TlsAlloc
UnmapViewOfFile
FileTimeToLocalFileTime
DeleteFileW
OpenFileMappingA
LocalFree
GetSystemTime
TlsFree
lstrcpyW
ExpandEnvironmentStringsW
CreateFileW
LoadLibraryW
ReadConsoleW
WriteConsoleW
SetStdHandle
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
VirtualAlloc
GetVersionExW
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
FreeEnvironmentStringsW
GetCurrentProcessId
WriteFile
GetStdHandle
GetOEMCP
GetACP
IsDebuggerPresent
GetProcessHeap
HeapSize
GetLocaleInfoW
LCMapStringW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SwitchToThread
SetEvent
CreateTimerQueue
RtlCaptureContext
GetFileSize
CreateFileA
ExitProcess
GetFullPathNameW
DeleteFileA
SuspendThread
EnumSystemLocalesW
GetWindowsDirectoryW
GetUserDefaultUILanguage
GetStringTypeW
GetSystemInfo
QueryDosDeviceW
RemoveDirectoryW
CreateEventW
GetExitCodeThread
CreateFileMappingA
GetDiskFreeSpaceW
EnterCriticalSection
CreateNamedPipeA
GetLastError
GetThreadLocale
GetTempPathW
lstrcpynW
GetTimeZoneInformation
HeapCreate
CreateEventA
InitializeCriticalSectionAndSpinCount
OpenProcess
TlsSetValue
GetUserDefaultLangID
GetEnvironmentStringsW
GetCurrentProcess
GetCommState
SystemTimeToTzSpecificLocalTime
LoadResource
GetLocaleInfoA
SetFilePointer
FindFirstFileW
GetDateFormatW
CloseHandle
EncodePointer
HeapAlloc
LoadLibraryExW
CreateThread
CreateSemaphoreW
GetProcAddress
GetModuleHandleW
TlsGetValue
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
RtlUnwind
GetCommandLineW
HeapReAlloc
MultiByteToWideChar
DeleteCriticalSection
DecodePointer
DuplicateHandle
GetCurrentThreadId
GetSystemTimeAsFileTime
user32
ValidateRgn
DestroyMenu
GetMenuItemCount
GetDlgItemInt
DestroyAcceleratorTable
GetMessageW
CharNextW
RegisterWindowMessageW
IsIconic
GetSubMenu
AttachThreadInput
GetMenuItemInfoW
ModifyMenuW
EnumWindows
CreateDialogIndirectParamA
SetDlgItemInt
CheckMenuRadioItem
GetWindowLongW
SystemParametersInfoW
GetClassNameW
MonitorFromWindow
SetWindowLongW
DestroyCursor
ShowWindow
GetSysColorBrush
CreateWindowExW
MessageBoxW
SendMessageW
UpdateWindow
GetDlgCtrlID
ToUnicode
DestroyIcon
DrawFrameControl
GetMonitorInfoW
CheckMenuItem
CopyRect
GetWindowThreadProcessId
GetWindow
EndPaint
DrawIconEx
LoadStringA
GetWindowInfo
CharLowerBuffW
GetDC
DrawFocusRect
GetMenu
GetWindowTextW
DrawStateW
CharUpperW
GetDesktopWindow
DrawMenuBar
MessageBoxA
gdi32
Arc
ExtFloodFill
SetTextColor
CreateHatchBrush
Polygon
GetEnhMetaFileHeader
GetRegionData
PlayEnhMetaFile
ExtCreateRegion
SetPolyFillMode
StretchDIBits
GetObjectW
GetCharABCWidthsW
CreateEnhMetaFileW
SetWindowExtEx
GetRgnBox
CombineRgn
CreateBitmapIndirect
GetNearestPaletteIndex
SetWinMetaFileBits
CreatePolygonRgn
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegCloseKey
ControlService
RegDeleteValueA
ChangeServiceConfigW
StartServiceW
RegOpenKeyExA
RegDeleteKeyA
OpenServiceW
RegSetValueExW
AdjustTokenPrivileges
RegOpenKeyExW
QueryServiceStatus
RegGetKeySecurity
SetSecurityDescriptorDacl
OpenSCManagerW
RegUnLoadKeyW
shell32
Shell_NotifyIconW
SHGetFileInfoW
ShellExecuteExW
ExtractIconExW
ShellExecuteW
ole32
CoTaskMemFree
CoInitialize
oleaut32
SafeArrayGetUBound
SafeArrayPtrOfIndex
VariantChangeType
SysAllocStringLen
SafeArrayCreate
VariantClear
SafeArrayGetLBound
SysReAllocStringLen
Sections
.text Size: 718KB - Virtual size: 718KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.IYN Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ