Static task
static1
Behavioral task
behavioral1
Sample
2024-09-13_dc8e317ffa7df18762046dc52806fb11_bkransomware.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-13_dc8e317ffa7df18762046dc52806fb11_bkransomware.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-13_dc8e317ffa7df18762046dc52806fb11_bkransomware
-
Size
562KB
-
MD5
dc8e317ffa7df18762046dc52806fb11
-
SHA1
816487bd24eeaa1e4075572f2ce4f27164ab922e
-
SHA256
8c7d2aa2be60265bd03ff8b33cd470e7996f923ac6e3059cce307f8b9227cf63
-
SHA512
5756fc018c4cca1322e01df291ead9cf7094d99e3bb098280fbe44b3a1bd8e3cf090d84b2dc1776d44d704e51ddd0ec71f1b10bc7f9592ca9a53a8b3b22564e8
-
SSDEEP
12288:U28HqKPrylV6IXD7xvKdTYLrGjpEbAToX7hhROGp3TwjNHjMt:k7GlVD7xvocL6jpEbATI7v3SAt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-13_dc8e317ffa7df18762046dc52806fb11_bkransomware
Files
-
2024-09-13_dc8e317ffa7df18762046dc52806fb11_bkransomware.exe windows:5 windows x86 arch:x86
566caf1546d4e44063d0a6cfa2defcc5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetRandomRgn
GetTextAlign
GetNearestColor
GetNearestPaletteIndex
GetStretchBltMode
GetMapMode
GetTextCharacterExtra
GetClipRgn
GetTextColor
SetTextCharacterExtra
GetSystemPaletteUse
SetTextColor
SetTextAlign
GetGraphicsMode
SetTextJustification
GetBkColor
UpdateColors
GetTextCharsetInfo
GetPixelFormat
GetDCBrushColor
GetObjectType
GetTextCharset
GetFontLanguageInfo
GetFontUnicodeRanges
GetDCPenColor
GetMetaRgn
SetSystemPaletteUse
SetPixel
GetPolyFillMode
user32
GetMenuItemID
GetDC
BeginPaint
CheckDlgButton
MoveWindow
GetMenuItemCount
GetCursor
SendMessageA
EndPaint
GetQueueStatus
GetWindowLongA
SetFocus
GetWindowDC
GetPropA
GetDlgItemInt
CallWindowProcA
IsWindowUnicode
WindowFromDC
RemovePropA
SetDlgItemTextA
EnableWindow
PostMessageA
DrawTextA
IsWindowEnabled
EndDialog
SetWindowTextA
GetInputState
GetForegroundWindow
GetKeyboardType
GetScrollPos
GetDlgItem
ShowWindow
LoadIconA
kernel32
SetEndOfFile
ReadConsoleW
ReadFile
CreateFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapSize
WriteConsoleW
SetFilePointerEx
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetFileAttributesExW
GetFullPathNameW
CreatePipe
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableW
SetEnvironmentVariableA
SetStdHandle
GetStringTypeW
RaiseException
GetModuleHandleA
GetProcAddress
GetTickCount
LocalFlags
SizeofResource
FindClose
IsDebuggerPresent
GlobalSize
LockResource
LoadResource
GetFileType
CloseHandle
IsProcessorFeaturePresent
MoveFileA
GlobalFlags
GetFileTime
GetLastError
GlobalHandle
GetProcessHeap
GetCurrentThreadId
FlushFileBuffers
GetCurrentProcess
GetDriveTypeA
GetCurrentProcessId
FindResourceA
GlobalAlloc
QueryPerformanceCounter
DeleteFileA
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
HeapReAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetLocalTime
GetTimeZoneInformation
DuplicateHandle
CreateProcessA
GetCommandLineA
GetStdHandle
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
FatalAppExitA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CreateSemaphoreW
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCurrentThread
GetFullPathNameA
Sections
.text Size: 509KB - Virtual size: 509KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE