Private-Ransomware[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Private-Ransomware.exe
Size

550KB
MD5

d26c44d264629645032d351b2b11dc47
SHA1

ffb6c8045d86eb19adde84e790728346a36348c3
SHA256

543dabece7b51ee80e81ebb4a7652173915842e6c5dc37bcafd080b3b82e2d3c
SHA512

10ab037dfd3392ac5f2f88d11fbc1ef837cbbd7da4d4dc4258b8b77e62b668b48bac34f2483638061b16f652d5803a1d609b2d872591e3e49ec1d40b9cbd3ec4
SSDEEP

12288:8FTVBrXrqacRP1SopnUbVtysORvOKG7mFMgp/y:eTbTr5y1kbVtcvOKGSFMl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Private-Ransomware.exe

Files

Private-Ransomware.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SimpleRansomwareBuilder.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ