Static task
static1
Behavioral task
behavioral1
Sample
encrypt.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
encrypt.exe
Resource
win10v2004-20240802-en
General
-
Target
encrypt.exe
-
Size
36.4MB
-
MD5
f4e6341b526a52b0cb57d3ab4aea6bcb
-
SHA1
0468450f2f4e714fb3fab5a32668ed24f9e55aa7
-
SHA256
53fa999aa50a5275a4c3362cfb858f5d1cdc9bc4d2120163ed9c8f6ac85ee991
-
SHA512
b5605ea3425ffe737bd2914baa0cc191aaf4f6f0cb23597bfc3a82dbea77087e278873d99f48b4d50d1804bc7b1a47d60fbc25c1335eb4932b51ff757042748c
-
SSDEEP
786432:XpwDVrlamZoOJ/GBJNgyRbqySLvKCedtA/iQlK7W:+1yBJm8bDSLvtedlMK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource encrypt.exe
Files
-
encrypt.exe.exe windows:6 windows x86 arch:x86
9daf09813962b4ab9a514b4c81972820
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
ReleaseDC
advapi32
LookupPrivilegeValueA
ole32
CoInitializeEx
winmm
PlaySoundA
Sections
.text Size: - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.!q< Size: - Virtual size: 30.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.0KX Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.x^c Size: 36.4MB - Virtual size: 36.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ