2024-08-08_ac06188f2334f44dc9c87133b6b64894_bkransomware_floxif

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-08_ac06188f2334f44dc9c87133b6b64894_bkransomware_floxif
Size

2.0MB
MD5

ac06188f2334f44dc9c87133b6b64894
SHA1

ded503d63354181f3298f59d7f3aef8e773800b0
SHA256

0a318e071458b3df7762b820772ddd100177ce17a44f7d53432958c697c2d15d
SHA512

4a5d330cd98b457bead5e3b905c44d7f93e47c84952448d5a66cfe1fcbe6dda5e03ee00e6de3e10ab5a9acc8f28da350dac4feb2aa8fcbd875a5a4cd8f291c40
SSDEEP

49152:Qplx9XZEuh3Gbi1YtzxTPN+NNFtK5kcafo4KSEF2rUpJ5LkHl1:mTEU3GbiCtVTk3FtK5dafZKSEFCUpJ2

Score

1^/10

Malware Config

Signatures

Files

2024-08-08_ac06188f2334f44dc9c87133b6b64894_bkransomware_floxif
.exe windows:6 windows x86 arch:x86

7aef345b425cfb25e5aa9f357a1d79da

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/05/2019, 00:00

Not After

23/05/2022, 23:59

Subject

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a6:a5:6b:8a:23:0e:d8:09:4d:05:7e:a0:0d:4d:8d:16:25:f2:28:cc:7a:6c:f0:26:b9:81:5d:b9:36:f1:09:1c
Signer

Actual PE Digest

a6:a5:6b:8a:23:0e:d8:09:4d:05:7e:a0:0d:4d:8d:16:25:f2:28:cc:7a:6c:f0:26:b9:81:5d:b9:36:f1:09:1c

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\_Dev\CGS2020\RegisterCGS\CGS Release\RegisterCGS.pdb

Imports

shell32

DragQueryFileW
DragFinish
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHAppBarMessage
SHBrowseForFolderW
ShellExecuteW
SHGetFileInfoW

kernel32

TerminateProcess
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetUnhandledExceptionFilter
OutputDebugStringW
GetDriveTypeW
WriteConsoleW
SetEnvironmentVariableA
GetStartupInfoW
GetStdHandle
GetFileType
SetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
ExitThread
CreateThread
UnhandledExceptionFilter
FreeEnvironmentStringsW
SetFilePointerEx
GetEnvironmentStringsW
GetCurrentProcess
MultiByteToWideChar
GetLastError
GetModuleHandleExW
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
FindResourceExW
VirtualProtect
Sleep
GetProfileIntW
GetTickCount
SearchPathW
GetWindowsDirectoryW
GetTempFileNameW
VerifyVersionInfoW
lstrcpyW
VerSetConditionMask
SetErrorMode
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryW
GlobalGetAtomNameW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToSystemTime
FindNextFileW
FileTimeToLocalFileTime
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
FreeResource
GetCurrentProcessId
GlobalAddAtomW
WritePrivateProfileStringW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
ResumeThread
SetThreadPriority
WaitForSingleObject
LoadLibraryA
GetModuleHandleA
DuplicateHandle
CloseHandle
OutputDebugStringA
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GetVersionExW
GetCurrentThreadId
GetCurrentThread
WideCharToMultiByte
SetLastError
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
InitializeCriticalSectionAndSpinCount
CopyFileW
LoadLibraryW
GetTempPathW
CreateDirectoryW
DecodePointer
HeapSize
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
LocalFree
FormatMessageW
DeleteFileW
LockResource
DeleteCriticalSection
InitializeCriticalSectionEx
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
FreeLibrary

user32

GetComboBoxInfo
GetWindowRgn
SubtractRect
GetUpdateRect
IsClipboardFormatAvailable
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
MapVirtualKeyExW
IsCharLowerW
GetIconInfo
GetDoubleClickTime
GetKeyNameTextW
PostThreadMessageW
FrameRect
CopyIcon
ModifyMenuW
RegisterClipboardFormatW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetClassLongW
LockWindowUpdate
SetParent
SetRect
SetCursorPos
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
MapVirtualKeyW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
DrawIconEx
DrawFocusRect
DrawFrameControl
DrawEdge
ReuseDDElParam
UnpackDDElParam
LoadImageW
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
MonitorFromPoint
UnionRect
EnableScrollBar
DestroyMenu
UpdateLayeredWindow
IsMenu
IsRectEmpty
SetMenuDefaultItem
GetMenuDefaultItem
GetMenuItemInfoW
CreatePopupMenu
NotifyWinEvent
OffsetRect
MessageBeep
SetWindowRgn
GetSystemMenu
LoadMenuW
GetAsyncKeyState
IsZoomed
TrackMouseEvent
IntersectRect
InflateRect
SendDlgItemMessageA
EnumDisplayMonitors
SetRectEmpty
SetLayeredWindowAttributes
DestroyIcon
KillTimer
SetTimer
RealChildWindowFromPoint
DeleteMenu
SystemParametersInfoW
MapDialogRect
WindowFromPoint
ReleaseCapture
SetCapture
WaitMessage
LoadCursorW
GetSysColorBrush
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
GetWindow
GetTopWindow
GetClassLongW
SetWindowLongW
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
IsChild
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
CharNextW
LoadIconW
SendMessageW
IsIconic
GetSystemMetrics
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
PtInRect
GetWindowRect
GetSysColor
ScreenToClient
ClientToScreen
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
TabbedTextOutW
GrayStringW
DestroyCursor
InvertRect
HideCaret
GetNextDlgGroupItem
CreateMenu
CopyImage
CharUpperBuffW
GetClientRect
DrawIcon
EnableWindow
MessageBoxW
UnregisterClassW
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
PostMessageW
PostQuitMessage
CharUpperW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
GetParent
LoadBitmapW
ShowOwnedPopups
SetCursor
IsWindowEnabled
GetWindowLongW
GetWindowThreadProcessId
GetLastActivePopup
DrawStateW
UpdateWindow
InvalidateRect
FillRect
GetClassNameW
IsWindow
DestroyWindow
CreateDialogIndirectParamW
EndDialog
GetDlgItem
GetNextDlgTabItem
SetActiveWindow
GetDesktopWindow
DrawTextW
DrawTextExW

gdi32

OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateCompatibleBitmap
CreateDIBitmap
CreateFontIndirectW
CreateRectRgnIndirect
EnumFontFamiliesW
GetTextCharsetInfo
GetTextMetricsW
GetTextExtentPoint32W
CombineRgn
PatBlt
SetRectRgn
DPtoLP
CreateRoundRectRgn
CreateDIBSection
CreateEllipticRgn
Ellipse
GetBkColor
GetTextColor
CreatePolygonRgn
Polygon
Polyline
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
GetRgnBox
OffsetRgn
SetWindowOrgEx
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
EnumFontFamiliesExW
SetPixelV
GetTextFaceW
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
CreateSolidBrush
CreateBitmap
GetDeviceCaps
CreateDCW
CopyMetaFileW
Rectangle
DeleteDC
SetTextAlign
SetTextColor
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
GetObjectW
GetStockObject
DeleteObject

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW

shlwapi

PathRemoveFileSpecW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
StrFormatKBSizeW

uxtheme

IsAppThemed
GetThemePartSize
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetWindowTheme

ole32

CreateStreamOnHGlobal
DoDragDrop
CoInitializeEx
CoDisconnectObject
CoCreateGuid
ReleaseStgMedium
OleLockRunning
OleRun
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CoUninitialize
CoInitialize
OleDuplicateData

oleaut32

SysFreeString
SysAllocString
VarUI4FromStr
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayRedim
SafeArrayCreate
SafeArrayLock
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType
LoadTypeLi
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantCopy
VarBstrFromDate
GetErrorInfo

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageI

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 324KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7aef345b425cfb25e5aa9f357a1d79da

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4aCertificate

Key Usages

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

a6:a5:6b:8a:23:0e:d8:09:4d:05:7e:a0:0d:4d:8d:16:25:f2:28:cc:7a:6c:f0:26:b9:81:5d:b9:36:f1:09:1cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

oleacc

imm32

winmm

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 324KB - Virtual size: 324KB

.data Size: 24KB - Virtual size: 54KB

.rsrc Size: 114KB - Virtual size: 113KB

.reloc Size: 118KB - Virtual size: 118KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

a6:a5:6b:8a:23:0e:d8:09:4d:05:7e:a0:0d:4d:8d:16:25:f2:28:cc:7a:6c:f0:26:b9:81:5d:b9:36:f1:09:1c
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 324KB - Virtual size: 324KB

.data
Size: 24KB - Virtual size: 54KB

.rsrc
Size: 114KB - Virtual size: 113KB

.reloc
Size: 118KB - Virtual size: 118KB