Behavioral task
behavioral1
Sample
devilransom.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
devilransom.exe
Resource
win10v2004-20240802-en
General
-
Target
devilransom.exe
-
Size
240KB
-
MD5
b834c44a3e5298a3f23a1355409d2578
-
SHA1
ba9fc22891f7480c49ee9e4d9409f833fc9484d8
-
SHA256
a6ddcbca65d8fdd771f1d9e271a42e601fcebb5e6f6c49ec30113e930b2cd790
-
SHA512
dad2007f6ffdae861cd7eec928a0b1dacf6058595bb9d33e1cd08701c721e347a04921e177e8639fef6e80e3fe29885f7067448f978921075b1e7490b40c0ad3
-
SSDEEP
6144:UeLttJ+VSjv6S0qhH6NAw497/WBzzcT22sW6fvyENEb1HwoS:HLttJ+VSeS0e6N697/+zca2sFf6wtoS
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource devilransom.exe
Files
-
devilransom.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 764KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 237KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE