MatrixRansomware[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
MatrixRansomware.bin
Size 1.2MB
Sample240922-vv9abs1cpp
SHA256 242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95
MD5 a93bd199d34d21cc9102600c6ce782cf
SHA1 31b50d84aa1af4f0e76a523382caba476f6e45dc
SHA512 642e0cacf80a54ffa8f1bdeebb2a9b9449bb062bc331924ff8b6c93853ade68cdbd23928081d7c5da7bce944f5c553b0c4b05bd90fda525f017415bd891534c2
SSDEEP 24576:NykKxXJdZiDTrfJR5ez1888K0aNE1eXTBoAlK/u95ByxXEfui:N8bcLK+KzlK/udyh/i
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MatrixRansomware.bin

File Explorer

MatrixRansomware.bin

.exe 1.2MB

MatrixRansomware.bin

IMPHASH ca3b1af31abe1beced65a635aa0c47a3
SHA256 242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95
MD5 a93bd199d34d21cc9102600c6ce782cf
SHA1 31b50d84aa1af4f0e76a523382caba476f6e45dc
SHA512 642e0cacf80a54ffa8f1bdeebb2a9b9449bb062bc331924ff8b6c93853ade68cdbd23928081d7c5da7bce944f5c553b0c4b05bd90fda525f017415bd891534c2
SSDEEP 24576:NykKxXJdZiDTrfJR5ez1888K0aNE1eXTBoAlK/u95ByxXEfui:N8bcLK+KzlK/udyh/i
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

907860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit GetErrorInfo

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey OpenThreadToken OpenProcessToken GetUserNameA GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority FreeSid EqualSid AllocateAndInitializeSid CryptGenRandom CryptReleaseContext CryptAcquireContextW

user32

MessageBoxA CharNextW LoadStringW PeekMessageW MsgWaitForMultipleObjects MessageBoxW GetSystemMetrics CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW VirtualQuery GetTickCount GetSystemInfo GetVersion CompareStringW IsDBCSLeadByteEx IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetConsoleOutputCP GetConsoleCP GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess ExitThread SwitchToThread GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile SetFilePointer SetEndOfFile ReadFile GetFileType GetFileSize CreateFileW GetStdHandle CloseHandle LoadLibraryA TlsSetValue TlsGetValue LocalFree LocalAlloc WaitForSingleObject WaitForMultipleObjects VirtualQueryEx VirtualProtect VerSetConditionMask VerifyVersionInfoW SuspendThread SizeofResource SetThreadPriority SetLastError SetFileAttributesW SetEvent SetErrorMode ResumeThread ResetEvent ReleaseMutex QueryPerformanceFrequency QueryPerformanceCounter OpenMutexW MoveFileExW LockResource LoadResource LoadLibraryW HeapFree HeapDestroy HeapCreate HeapAlloc GetVolumeInformationW GetVersionExW GetUserDefaultLangID GetUserDefaultLCID GetThreadTimes GetThreadPriority GetThreadLocale GetSystemTimes GetSystemDefaultLangID GetSystemDefaultLCID GetProcessTimes GetLocalTime GetFullPathNameW GetFileAttributesW GetExitCodeThread GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThread GetCurrentProcessId GetCurrentProcess GetComputerNameA GetCPInfoExW GetCPInfo FreeResource InterlockedCompareExchange FormatMessageW FindResourceW FindNextFileW ExpandEnvironmentStringsW EnumSystemLocalesW EnumCalendarInfoW DeleteFileW CreateProcessW CreateMutexW CreateEventW

ole32

CoUninitialize CoInitialize

shell32

SHGetSpecialFolderPathW

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

878KB

Virtual Size

878KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

250B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MatrixRansomware.bin

oleaut32

advapi32

user32

kernel32

ole32

shell32

wsock32

netapi32

generic