2024-09-06_a2f9367bfa7099616b390806ee3d8b2d_ngrbot_wannacry | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-06_a2f9367bfa7099616b390806ee3d8b2d_ngrbot_wannacry
Size

924KB
MD5

a2f9367bfa7099616b390806ee3d8b2d
SHA1

4ece6cfd1f26189cb20d4667d4d44204ff737d33
SHA256

ff4fa5a48f23562f4cdd1d35ef3f0514b9253801af22c498ea20cdc6fc7dd545
SHA512

175fd97ca42d4619af1786c11c0f3c7855b05aaec509b7f582f9ce0a375ac290a75879bbda403df83c5a84f7768848a12d0a60c2dac835455ad060803601de6c
SSDEEP

24576:F8m657w6ZBLmkitKqBCjC0PDgM5AH5DTS:pVV1BCjBEDT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-06_a2f9367bfa7099616b390806ee3d8b2d_ngrbot_wannacry

Files

2024-09-06_a2f9367bfa7099616b390806ee3d8b2d_ngrbot_wannacry
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\ConsoleApp2.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 853KB - Virtual size: 852KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ