C:\Jenkins\workspace\OC3.X\OC\Release\OCPacker.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-01_44957f8d779bfa17d168f7aecc3e17f8_bkransomware.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-01_44957f8d779bfa17d168f7aecc3e17f8_bkransomware.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-01_44957f8d779bfa17d168f7aecc3e17f8_bkransomware
-
Size
985KB
-
MD5
44957f8d779bfa17d168f7aecc3e17f8
-
SHA1
a4c3d19fd6e35dc78e508bac82830853ec4918c7
-
SHA256
938f395fe32050e6fa56adb4627249d8ef439dc03780068e7ba17eaa23d9e901
-
SHA512
fc11adc1895a7b998473bc93b974d654968ce3ea7777e420a6509f704be0f7e4d419b8eec977015c1283f791e45d0da3364843816097c2f059fff30047fa09b9
-
SSDEEP
24576:K9uhVQAW41Abo7xCXj9tRROy0+DS24XBzh582PdW6o08BvdI9hShiqxLjS35m:EIyd4LU90Nu+BzP82ylBvmjShhjIm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-01_44957f8d779bfa17d168f7aecc3e17f8_bkransomware
Files
-
2024-09-01_44957f8d779bfa17d168f7aecc3e17f8_bkransomware.exe windows:5 windows x86 arch:x86
240f3c8b5073e1eaae9777885f76451b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WriteFile
WideCharToMultiByte
ReadFile
CreateFileW
MultiByteToWideChar
GetCurrentDirectoryW
GetFileType
CloseHandle
LocalFree
FormatMessageW
GetSystemTimeAsFileTime
SetCurrentDirectoryW
SetFileAttributesW
GetFileAttributesW
LoadLibraryW
GetProcAddress
FreeLibrary
OutputDebugStringW
GetLastError
DeleteFileW
MoveFileW
MoveFileExW
FindResourceW
LoadResource
SizeofResource
GetTempPathW
GetTempFileNameW
GetCommandLineW
GetModuleHandleW
RemoveDirectoryW
GetCurrentThreadId
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
LockResource
SetFileTime
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DeleteCriticalSection
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
RtlUnwind
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
FlushFileBuffers
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetStringTypeW
CreateDirectoryW
GetCurrentProcess
SystemTimeToFileTime
SetFilePointer
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStartupInfoW
TlsFree
FindResourceExW
DosDateTimeToFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
user32
wsprintfW
LoadIconW
PostQuitMessage
SetForegroundWindow
GetWindowThreadProcessId
GetForegroundWindow
IsWindowVisible
EndPaint
BeginPaint
DefWindowProcW
MessageBoxW
CreateWindowExW
RegisterClassExW
GetSysColorBrush
LoadCursorW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
LoadStringW
SendMessageW
AttachThreadInput
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
CommandLineToArgvW
ShellExecuteExW
SHFileOperationW
SHGetFolderPathAndSubDirW
ole32
CoTaskMemFree
shlwapi
PathFileExistsW
comctl32
InitCommonControlsEx
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 844KB - Virtual size: 843KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ