Static task
static1
Behavioral task
behavioral1
Sample
2024-08-07_95f8bfe83b7d2ed8f14f8e6f29f65bc5_bkransomware.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-07_95f8bfe83b7d2ed8f14f8e6f29f65bc5_bkransomware.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-07_95f8bfe83b7d2ed8f14f8e6f29f65bc5_bkransomware
-
Size
3.3MB
-
MD5
95f8bfe83b7d2ed8f14f8e6f29f65bc5
-
SHA1
3db93c44b3ddce1ae141fe8430dccdf8170e4c6a
-
SHA256
87d3f1367918bafe4f5363eb7d79b3ed791ca2e16287a25b107374bc2da62cab
-
SHA512
ec2df9f573bf06977feb8cd1326c7eb78a3beee779eeb2fcf44bc2c8b1bf3d77d79c1cdf61918bce49f33ea43ef8b0371635c527ff59fed5acc8604f1e43b0f7
-
SSDEEP
49152:9DHybUPJ7QwoihINOnaLM1nlv26z+zJFWe+ZoJ5yUV9SC0C3f1vsIL0MD:fwQa8B26qHWPYsIL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-07_95f8bfe83b7d2ed8f14f8e6f29f65bc5_bkransomware
Files
-
2024-08-07_95f8bfe83b7d2ed8f14f8e6f29f65bc5_bkransomware.exe windows:6 windows x86 arch:x86
c3755624e82b17384929c193b526e7a5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
GetSystemInfo
GetLastError
ReadProcessMemory
Module32Next
Module32First
GetTickCount
GetCurrentDirectoryW
GetWindowsDirectoryA
SetEndOfFile
SetEnvironmentVariableA
CreateProcessA
GetExitCodeProcess
WriteConsoleW
HeapReAlloc
SetStdHandle
MultiByteToWideChar
FindClose
FindFirstFileA
GetCurrentProcess
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualFree
GetVersionExW
LoadLibraryW
UnregisterWaitEx
InitializeSListHead
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
GetFileAttributesExW
FlushFileBuffers
GetOEMCP
GetACP
IsValidCodePage
GetModuleFileNameW
GetStdHandle
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
CreateSemaphoreW
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
GetFileType
GetCPInfo
LoadLibraryExW
RtlUnwind
RaiseException
CreateTimerQueue
UnregisterWait
RegisterWaitForSingleObject
SetThreadPriority
GetProcessAffinityMask
GetNumaHighestNodeNumber
GetModuleHandleW
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
HeapAlloc
HeapFree
IsDebuggerPresent
VirtualAlloc
ExitThread
OpenThread
GetCurrentThreadId
CreateThread
Sleep
ExitProcess
GetCurrentProcessId
LoadLibraryA
VirtualProtect
GetProcAddress
GetModuleHandleA
GetCommandLineA
Process32Next
CloseHandle
SetFileAttributesA
FindNextFileA
GetCurrentDirectoryA
lstrlenA
GetPrivateProfileStringA
DeleteFileA
CreateDirectoryW
GlobalFree
GetModuleFileNameA
AreFileApisANSI
GetModuleHandleExW
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
DecodePointer
EncodePointer
GetStringTypeW
DuplicateHandle
GetSystemTimeAsFileTime
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalUnlock
GlobalLock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
ReadFile
OutputDebugStringA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
GetTempPathA
CreateDirectoryA
GlobalAlloc
SetThreadAffinityMask
TerminateProcess
Process32First
GetStartupInfoW
CreateToolhelp32Snapshot
user32
GetMessageA
LoadCursorA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
LoadStringA
GetKeyState
SystemParametersInfoA
SetWindowPos
LoadIconA
ScreenToClient
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
InvalidateRect
FindWindowA
GetSystemMetrics
ReleaseCapture
MessageBoxA
SetCapture
SetCursorPos
AdjustWindowRectEx
SetCursor
GetMenu
GetCapture
ShowWindow
RegisterClassA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
LoadImageA
DestroyCursor
ShowCursor
ChangeDisplaySettingsA
gdi32
CreateFontIndirectA
GetCharABCWidthsFloatW
EnumFontFamiliesExA
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
CreateDIBSection
TextOutA
GetStockObject
CreateSolidBrush
DeleteObject
StretchBlt
GetTextExtentPoint32A
GetTextExtentPoint32W
ole32
CoInitializeEx
OleUninitialize
OleInitialize
CoGetClassObject
OleSetContainedObject
CoUninitialize
CoInitialize
CoCreateInstance
winmm
timeGetDevCaps
timeGetTime
timeBeginPeriod
timeEndPeriod
d3d8
Direct3DCreate8
python27
PyImport_AddModule
PyRun_StringFlags
Py_Finalize
Py_Initialize
Py_BuildValue
PyErr_SetString
PyExc_RuntimeError
PyTuple_GetItem
PyInt_AsLong
PyList_New
PyString_FromString
PyList_Append
Py_InitModule4
PyModule_AddIntConstant
PyArg_ParseTuple
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyLong_FromLongLong
PyTuple_New
PyDict_New
PyDict_SetItemString
PyTuple_SetItem
PyInt_FromLong
PyDict_Size
PyDict_Next
PyLong_AsLongLong
PyImport_ImportModule
PyModule_AddStringConstant
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
Py_SetProgramName
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
devil
ilConvertImage
ilGetInteger
ilLoad
ilOriginFunc
ilEnable
ilBindImage
ilGenImages
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilCopyPixels
ilDeleteImages
imm32
ImmSetCompositionStringW
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmGetIMEFileNameA
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
granny2
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
mss32
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_WAV_info@8
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_last_error@0
_AIL_allocate_3D_sample_handle@4
_AIL_mem_free_lock@4
speedtreert
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
dinput8
DirectInput8Create
ws2_32
inet_addr
htons
WSACleanup
WSAStartup
WSAGetLastError
socket
select
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
gethostbyname
send
ddraw
DirectDrawCreate
advapi32
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
shell32
SHGetSpecialFolderPathA
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 480KB - Virtual size: 479KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 154KB - Virtual size: 439KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 302KB - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ