DotNetRuntimeDebugHeader
Static task
static1
Behavioral task
behavioral1
Sample
Encloak.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Encloak.exe
Resource
win10v2004-20240802-en
General
-
Target
Encloak.exe
-
Size
38.9MB
-
MD5
146ad22d65d04f9b5496f2556263eb80
-
SHA1
042420d607e5128831683d40e5efe187e818819e
-
SHA256
545ef834835eb7314878853a482c63cd3feebf6c5c3b595fef4d11c710a114b5
-
SHA512
94df0912556dc95c955f6c8131ccfd8141b8101810d48fd14dcb6f04723ee7f8aac9d91e82f6eaababe6b1f96e03f4f4f9189568fee37d90776bcf54e16a990a
-
SSDEEP
786432:p6YMDrF9AVs1PzD6YICypdWphmSq0zrG:pmF9geP6CmAhmS3zrG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Encloak.exe
Files
-
Encloak.exe.exe windows:6 windows x64 arch:x64
09f927dbf84bb0ffa458894140f1fc0b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegCloseKey
bcrypt
BCryptGenRandom
crypt32
CertNameToStrW
iphlpapi
GetAdaptersAddresses
kernel32
RtlPcToFileHeader
ncrypt
NCryptOpenKey
ole32
CoTaskMemFree
secur32
GetUserNameExW
ws2_32
GetAddrInfoW
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 742KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.managed Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 442KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 269KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.*}' Size: - Virtual size: 26.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.%hG Size: 1024B - Virtual size: 552B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
./"/ Size: 38.8MB - Virtual size: 38.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ