28cc4a9984a25cfa560e945da3f172fbda9ad081aeee88a2ab626db8885e0776
- SHA256 28cc4a9984a25cfa560e945da3f172fbda9ad081aeee88a2ab626db8885e0776
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cerber.exe
Resource
win10-20240404-en
windows10-1703-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
cryptowall.exe
Resource
win10-20240611-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
jigsaw.exe
Resource
win10-20240404-en
windows10-1703-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
Locky.exe
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
150 seconds
General
- Target 28cc4a9984a25cfa560e945da3f172fbda9ad081aeee88a2ab626db8885e0776
- Size 15.1MB
- Sample240924-c7bwgssflm
- SHA256 28cc4a9984a25cfa560e945da3f172fbda9ad081aeee88a2ab626db8885e0776
- MD5 d97b600a067272a28d7f28ca71cc0020
- SHA1 dff7bf7fec37bc78be8ce4334aa50ca42e90378c
- SHA512 95f3ae89c24d81381a56f373b2a5c8de6885290a81e6d09eabeff53f2fa35c15f00a29b2dc28def88a7e226f2a22212adac4c0d702e4fbed6d5ff8b163699d57
- SSDEEP 393216:uy8NuYU2u4H0UMbIH8L5CmTXpz0DzhveOdEj+TYo3J8g:uy8NTHH+bSmTIUcGPRg
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack003/cerber.exe unpack005/cryptowall.bin unpack007/jigsaw unpack009/Locky
File Explorer
-
28cc4a9984a25cfa560e945da3f172fbda9ad081aeee88a2ab626db8885e0776.zip 15.1MB
-
Ransomware-Samples-main.zip.zip 15.1MB
-
Ransomware-Samples-main/Cerber/Ransomware.Cerber.zip.zip 215KB
-
cerber.exe.exe 604KB
-
Ransomware-Samples-main/Cryptowall/Ransomware.Cryptowall.zip.zip 100KB
-
cryptowall.bin.exe 240KB
-
Ransomware-Samples-main/Jigsaw/Ransomware.Jigsaw.zip.zip 239KB
-
jigsaw.exe 283KB
-
Ransomware-Samples-main/LICENSE34KB
-
Ransomware-Samples-main/Locky/Ransomware.Locky.zip.zip 125KB
-
Locky.exe 180KB
-
Ransomware-Samples-main/Mamba/Ransomware.Mamba.zip.zip 1.0MB
-
Ransomware-Samples-main/Matsnu/Ransomware.Matsnu.zip.zip 62KB
-
Ransomware-Samples-main/Petrwrap/Ransomware.Petrwrap.zip.zip 1.1MB
-
Ransomware-Samples-main/Petya/Ransomware.Petya.zip.zip 538KB
-
Ransomware-Samples-main/README.md549B
-
Ransomware-Samples-main/Radamant/Ransomware.Radamant.zip.zip 59KB
-
Ransomware-Samples-main/RedBoot/Ransomware.RedBoot.zip.zip 1.2MB
-
Ransomware-Samples-main/Rex/Ransomware.Rex.zip.zip 2.7MB
-
Ransomware-Samples-main/Satana/Ransomware.Satana.zip.zip 57KB
-
Ransomware-Samples-main/TeslaCrypt/Ransomware.TeslaCrypt.zip.zip 479KB
-
Ransomware-Samples-main/Thanos/Ransomware.Thanos.zip.zip 145KB
-
Ransomware-Samples-main/Unnamed_0/Ransomware.Unnamed_0.zip.zip 835KB
-
Ransomware-Samples-main/Vipasana/Ransomware.Vipasana.zip.zip 638KB
-
Ransomware-Samples-main/WannaCry/Ransomware.WannaCry.zip.zip 3.3MB
-
Ransomware-Samples-main/WannaCry_Plus/Ransomware.WannaCry_Plus.zip.zip 2.3MB
-
Ransomware-Samples-main/ransomware.png.png 36KB
Ransomware-Samples-main.zip
- SHA256 bab1853454ca6fdd3acd471254101db1b805b601e309a49ec7b4b1fbcfc47ad7
- MD5 e88a0140466c45348c7b482bb3e103df
- SHA1 c59741da45f77ed2350c72055c7b3d96afd4bfc1
- SHA512 2dc9682f4fb6ea520acc505bdbe7671ab7251bf9abd25a5275f0c543a6157d7fa5325b9dce6245e035641ab831d646f0e14f6649f9464f5e97431ab1bf7da431
- SSDEEP 393216:+8HaL/eOo2nfFSrjIMVePFmu/GyBSib+JYSWTmZ:LHayONnnBNmkPbDSWm
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Ransomware-Samples-main/Cerber/Ransomware.Cerber.zip
- SHA256 416774bf62d9612d11d561d7e13203a3cbc352382a8e382ade3332e3077e096c
- MD5 5c571c69dd75c30f95fe280ca6c624e9
- SHA1 b0610fc5d35478c4b95c450b66d2305155776b56
- SHA512 8e7b9a4a514506d9b8e0f50cc521f82b5816d4d9c27da65e4245e925ec74ac8f93f8fe006acbab5fcfd4970573b11d7ea049cc79fb14ad12a3ab6383a1c200b2
- SSDEEP 3072:EJk9kcytz1Qg4kViSMoq9OsLvz8L5HINY8lYdeIX8woWJQHr6LqK2fU0MwL0b06R:EUkcyVlDq8rIblYomoWnvfp0g
- MD5 SHA1 SHA512 SSDEEP
Password
infected
cerber.exe
- IMPHASH 9d6ed8d049bc10bc45b1995cb6f7f4b6
- SHA256 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
- MD5 8b6bc16fd137c09a08b02bbe1bb7d670
- SHA1 c69a0f6c6f809c01db92ca658fcf1b643391a2b7
- SHA512 b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24
- SSDEEP 6144:yYghlI5/u8f1mr+4RJ99MpDa52RX5wRDhOOU0qsR:yYKlYmDXEpDHRXP01
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
324832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetThreadLocale
GetTickCount
GetTimeFormatW
GetUserDefaultLCID
GetVersion
GetVersionExA
GetVolumeInformationW
GetWindowsDirectoryW
Heap32ListFirst
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsSystemResumeAutomatic
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MoveFileExA
MoveFileExW
MoveFileW
MultiByteToWideChar
GetEnvironmentVariableW
QueryPerformanceCounter
QueueUserAPC
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
RemoveDirectoryW
ScrollConsoleScreenBufferW
SearchPathW
SetConsoleCtrlHandler
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
SetConsoleTitleW
SetCurrentDirectoryW
SetEnvironmentVariableW
SetErrorMode
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetLocalTime
SetSystemTime
SetThreadLocale
SetUnhandledExceptionFilter
SetVolumeLabelA
SleepEx
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TransmitCommChar
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualFreeEx
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
WritePrivateProfileSectionA
_hwrite
lstrcmpW
lstrcmpiW
lstrcpyW
lstrlenW
GetEnvironmentStringsW
GetDriveTypeW
GetDiskFreeSpaceExW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetConsoleTitleW
GetConsoleScreenBufferInfo
GetConsoleOutputCP
GetConsoleMode
GetCompressedFileSizeW
GetCommandLineW
GetCPInfo
GetBinaryTypeW
GetBinaryType
FreeLibrary
FormatMessageW
FlushFileBuffers
FlushConsoleInputBuffer
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
EraseTape
EnterCriticalSection
DuplicateHandle
DeleteFileW
DeleteFileA
CreateThread
CreateProcessW
CreateFileW
CreateFileA
CreateDirectoryW
CopyFileW
CopyFileA
ConvertDefaultLocale
CompareFileTime
CloseHandle
OpenProcess
AddAtomW
user32
DefWindowProcW
DrawFocusRect
CreateWindowStationA
CreateMenu
FillRect
FindWindowW
GetMenuCheckMarkDimensions
GetProcessWindowStation
GetSysColorBrush
GetThreadDesktop
GetUpdateRgn
GetUserObjectInformationW
InflateRect
InsertMenuItemW
IsIconic
LockWindowUpdate
MessageBeep
MessageBoxW
MonitorFromWindow
OffsetRect
PostMessageW
RealGetWindowClass
SendMessageW
SetUserObjectInformationW
ShowWindow
ToUnicode
WinHelpA
LoadCursorW
GetKBCodePage
DefMDIChildProcW
CloseWindowStation
gdi32
StartPage
SetMiterLimit
SetMapperFlags
SetBitmapBits
PtVisible
OffsetClipRgn
GetViewportOrgEx
GetTextFaceW
AddFontMemResourceEx
AnimatePalette
Arc
BRUSHOBJ_pvAllocRbrush
ColorMatchToTarget
CopyEnhMetaFileA
CreatePatternBrush
DescribePixelFormat
EngFreeModule
EngTextOut
EnumFontsW
FillRgn
GdiGetPageCount
GetGlyphOutlineW
GetMiterLimit
GetOutlineTextMetricsA
advapi32
RegOpenKeyW
SaferRecordEventLogEntry
SaferIdentifyLevel
SaferComputeTokenFromLevel
SaferCloseLevel
RevertToSelf
RegSetValueW
RegSetValueExW
RegQueryValueW
RegQueryValueExW
CreateProcessAsUserW
RegOpenKeyExW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupAccountSidW
ImpersonateLoggedOnUser
GetSecurityDescriptorOwner
GetFileSecurityW
FreeSid
shell32
ShellExecuteExW
ShellExecuteA
ShellAboutA
SHIsFileAvailableOffline
SHGetSettings
CheckEscapesW
DragQueryFile
DragQueryFileAorW
ExtractIconExW
SHAppBarMessage
SHBrowseForFolderA
SHChangeNotify
SHCreateProcessAsUserW
SHEmptyRecycleBinA
SHFileOperationA
SHGetDataFromIDListA
SHGetDiskFreeSpaceA
SHGetMalloc
WOWShellExecute
shlwapi
StrCmpNW
StrStrIA
StrStrIW
StrCmpNA
StrChrIA
comctl32
ImageList_Create
msvcrt
_XcptFilter
__getmainargs
__initenv
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_adjust_fdiv
_c_exit
_cexit
_close
_controlfp
_dup
_dup2
_errno
_except_handler3
_exit
_get_osfhandle
_getch
_initterm
_iob
_open_osfhandle
_pclose
_pipe
_seh_longjmp_unwind
_setjmp3
_setmode
_snwprintf
_tell
_ultoa
_vsnwprintf
_wcsicmp
_wcslwr
_wcsnicmp
_wcsupr
_wpopen
_wtol
calloc
exit
fflush
fgets
fprintf
free
iswalpha
iswdigit
iswspace
iswxdigit
longjmp
malloc
memmove
printf
qsort
rand
realloc
setlocale
srand
swprintf
swscanf
time
towlower
towupper
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncmp
wcsncpy
wcsrchr
wcsspn
wcsstr
wcstol
wcstoul
Name
.text
Size
315KB
Virtual Size
315KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
234KB
Virtual Size
234KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=75, id=19, version=8078,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=244, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 build 21022, version=21022,
count=3, productName=Unmarked objects (old),
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Ransomware-Samples-main/Cryptowall/Ransomware.Cryptowall.zip
- SHA256 60d574055ae164cc32df9e5c9402deefa9d07e5034328d7b41457d35b7312a0e
- MD5 8710ea46c2db18965a3f13c5fb7c5be8
- SHA1 24978c79b5b4b3796adceffe06a3a39b33dda41d
- SHA512 c71de7a60e7edeedbdd7843a868b6f5a95f2718f0f35d274cf85951ee565ef3ba1e087881f12aeede686ce6d016f3fd533b7ef21d878a03d2455acc161abf583
- SSDEEP 3072:OCDc19avf1fHqOhdzVD/9Ae7RT5f6IiL+WfXS21o4D:OCD0QvlqGRlAlX+sXjo4D
- MD5 SHA1 SHA512 SSDEEP
Password
infected
cryptowall.bin
- IMPHASH edbc0337cc897a187d263d79c09c15c7
- SHA256 45317968759d3e37282ceb75149f627d648534c5b4685f6da3966d8f6fca662d
- MD5 47363b94cee907e2b8926c1be61150c7
- SHA1 ca963033b9a285b8cd0044df38146a932c838071
- SHA512 93dfaafc183360829448887a112dd49c90ec5fe50dcd7c7bbc06c1c8daa206eeea5577f726d906446322c731d0520e93700d5ff9cefd730fba347c72b7325068
- SSDEEP 3072:xkeyloECBch6ZCGBGSmHJ0y5lj6jdojK7+MGOXpXx8z3Lp7Yoq:xGlnCIwMpj6ijKfxx8z3F0V
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
13447
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
EnableMenuItem
GetDlgItem
SendDlgItemMessageA
AppendMenuA
GetWindowLongA
wvsprintfA
SetWindowPos
FindWindowA
RedrawWindow
GetWindowTextA
EnableWindow
GetSystemMetrics
IsWindow
CheckRadioButton
UnregisterClassA
SetCursor
GetSysColorBrush
DialogBoxParamA
DestroyAcceleratorTable
DispatchMessageA
TranslateMessage
LoadIconA
EmptyClipboard
SetClipboardData
SetFocus
CharUpperA
OpenClipboard
IsDialogMessageA
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
RemoveMenu
InvalidateRect
ChildWindowFromPoint
PostMessageA
DestroyCursor
CreateDialogParamA
GetWindowRect
IsMenu
GetSubMenu
SetDlgItemInt
GetWindowPlacement
CharLowerBuffA
LoadCursorA
CheckMenuRadioItem
GetSysColor
KillTimer
DestroyIcon
DestroyWindow
PostQuitMessage
GetClientRect
MoveWindow
GetSystemMenu
SetTimer
SetWindowPlacement
InsertMenuItemA
GetMenu
CheckMenuItem
SetMenuItemInfoA
SetActiveWindow
DefDlgProcA
RegisterClassA
EndDialog
SetDlgItemTextA
EnumClipboardFormats
GetClipboardData
CloseClipboard
GetClassInfoA
CallWindowProcA
SetWindowLongA
IsDlgButtonChecked
SetWindowTextA
CheckDlgButton
GetActiveWindow
MessageBoxA
wsprintfA
GetDlgItemTextA
SendMessageA
GetCursorPos
TrackPopupMenu
ClientToScreen
DestroyMenu
CreatePopupMenu
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegSetValueA
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegCloseKey
RegCreateKeyA
RegDeleteKeyA
GetUserNameA
dbghelp
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
comctl32
ImageList_Destroy
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Remove
CreateToolbarEx
ImageList_SetBkColor
ImageList_Create
kernel32
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapFree
VirtualFree
HeapCreate
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
HeapSize
LeaveCriticalSection
DeleteCriticalSection
GetLocaleInfoA
WriteFile
InterlockedDecrement
GetLastError
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
ExitProcess
GetProcAddress
Sleep
GetModuleHandleW
GlobalCompact
SetProcessWorkingSetSize
EncodePointer
OpenProcess
GlobalUnWire
GetStdHandle
IsWow64Process
GetProcessHandleCount
GetProcessHeap
FlushFileBuffers
PulseEvent
GetVersion
RtlUnwind
HeapAlloc
VirtualAlloc
HeapReAlloc
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetCommandLineA
GetProcessId
LockResource
GlobalDeleteAtom
LCMapStringA
LCMapStringW
GetModuleFileNameA
SetProcessPriorityBoost
GlobalUnfix
RequestWakeupLatency
IsProcessInJob
GetThreadTimes
GetProcessTimes
PeekNamedPipe
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
104KB
Virtual Size
51.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=149, productName=VS2008 build 21022, version=21022,
count=73, id=131, productName=VS2008 build 21022, version=21022,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=199, id=1, productName=Unmarked objects,
count=27, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Ransomware-Samples-main/Jigsaw/Ransomware.Jigsaw.zip
- SHA256 86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff
- MD5 3ad6374a3558149d09d74e6af72344e3
- SHA1 e7be9f22578027fc0b6ddb94c09b245ee8ce1620
- SHA512 21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720
- SSDEEP 3072:p7ykj3uuY4NsJD7kPdSRQLqas/pkPm9jvkEL60Uf7k2BgS6/aFybrNN5ZAdNstk7:p7ym3VNA7w8R5/rxv7O0yng0UtVw5NJ
- MD5 SHA1 SHA512 SSDEEP
Password
infected
jigsaw
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
- MD5 2773e3dc59472296cb0024ba7715a64e
- SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
- SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
- SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
319498
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
!mmUPp
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
Ransomware-Samples-main/LICENSE
- SHA256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986
- MD5 1ebbd3e34237af26da5dc08a4e440464
- SHA1 31a3d460bb3c7d98845187c716a30db81c44b615
- SHA512 d361e5e8201481c6346ee6a886592c51265112be550d5224f1a7a6e116255c2f1ab8788df579d9b8372ed7bfd19bac4b6e70e00b472642966ab5b319b99a2686
- SSDEEP 768:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7J:Fhcycsrfrnoum
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/Locky/Ransomware.Locky.zip
- SHA256 0537fa38b88755f39df1cd774b907ec759dacab2388dc0109f4db9f0e9d191a0
- MD5 b265305541dce2a140da7802442fbac4
- SHA1 63d0b780954a2bc96b3a77d9a2b3369d865bf1fd
- SHA512 af65384f814633fe1cde8bf4a3a1a8f083c7f5f0b7f105d47f3324cd2a8c9184ccf13cb3e43b47473d52f39f4151e7a9da1e9a16868da50abb74fcbc47724282
- SSDEEP 1536:6mXbzYYlSESr+LdgbfzNTBstcc6yVeHuwuY5pzl5Lypx0DIY6KQOoTFKmN9YMKW8:dbSr+Jg7lB2cV1aQ+WQVTFX9YPGQi1Mf
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Locky
- IMPHASH 0fcea3af550ad0a893e93808dccf17f4
- SHA256 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3
- MD5 b06d9dd17c69ed2ae75d9e40b2631b42
- SHA1 b606aaa402bfe4a15ef80165e964d384f25564e4
- SHA512 8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c
- SSDEEP 3072:gzWgfLlUc7CIJ1tkZaQyjhOosc8MKi6KDXnLCtyAR0u1cZ86:gdLl4wkZa/UDiD7ukst1H6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49372
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
GetSecurityDescriptorDacl
RegisterEventSourceA
RegQueryInfoKeyA
GetSidSubAuthorityCount
RegSetValueExA
RegDeleteKeyA
GetKernelObjectSecurity
RegCloseKey
RegQueryValueA
RegLoadKeyA
GetSidSubAuthority
RegConnectRegistryA
LookupPrivilegeValueA
InitiateSystemShutdownA
CreateProcessAsUserA
GetSidIdentifierAuthority
OpenThreadToken
LsaQueryInformationPolicy
RegQueryValueW
EncryptFileW
RegSetValueW
MakeAbsoluteSD
RegOpenKeyExA
RegCreateKeyExW
AddAce
SetNamedSecurityInfoW
OpenEventLogW
GetUserNameW
SetSecurityDescriptorSacl
MakeSelfRelativeSD
RegFlushKey
InitializeSecurityDescriptor
InitializeAcl
SetEntriesInAclA
GetSidLengthRequired
RegSetValueA
SetEntriesInAclW
GetAclInformation
user32
DrawIconEx
IsDialogMessageA
OffsetRect
PostThreadMessageW
DialogBoxParamA
GetLastActivePopup
GetGUIThreadInfo
DrawStateA
IsWindow
OpenClipboard
InSendMessage
FindWindowW
IsMenu
EnumDisplaySettingsA
DrawAnimatedRects
FrameRect
SetMenuDefaultItem
GrayStringW
CreateDialogIndirectParamW
ClientToScreen
GetParent
TranslateMDISysAccel
CreateDesktopW
ShowCaret
GetProcessWindowStation
TrackPopupMenu
IntersectRect
DialogBoxIndirectParamA
DefWindowProcA
ReuseDDElParam
NotifyWinEvent
SetClipboardData
CloseClipboard
DdeDisconnect
GetClassNameA
GetCaretPos
CharLowerW
GetWindowModuleFileNameA
IsWindowVisible
wvsprintfA
ModifyMenuA
SendDlgItemMessageW
SetCaretBlinkTime
LoadMenuW
GetMenuState
DrawTextExA
ChangeDisplaySettingsW
CreateWindowExW
GetCapture
CreatePopupMenu
SetMenu
CharUpperBuffW
DrawStateW
LoadImageA
GetScrollPos
GetDlgItem
GetClipboardFormatNameW
ValidateRgn
GetWindowThreadProcessId
GetClassInfoExW
DdeAccessData
ShowWindow
GetKeyboardLayout
GetClassInfoW
SetCaretPos
LoadCursorA
FillRect
LoadMenuA
mouse_event
ModifyMenuW
InvalidateRgn
GetMenuItemID
IsIconic
OemToCharA
LoadCursorFromFileW
RegisterWindowMessageA
DispatchMessageW
GetCursorPos
CharPrevA
GetWindowWord
imm32
ImmGetProperty
ImmGetCandidateListCountA
ImmGetCompositionStringA
ImmSetConversionStatus
ImmSetOpenStatus
ImmCreateContext
ImmGetOpenStatus
ImmNotifyIME
ImmInstallIMEA
ImmGetContext
ImmDestroyContext
ImmSimulateHotKey
ImmConfigureIMEA
ImmAssociateContext
rasapi32
RasDialA
RasGetProjectionInfoA
kernel32
WriteFileGather
PulseEvent
GetLongPathNameA
Name
.text
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=89, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=14, version=7299,
count=17, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=152, id=1, productName=Unmarked objects,
count=61, id=19, version=8034,
count=1, productName=Unmarked objects (old),
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
Ransomware-Samples-main/Mamba/Ransomware.Mamba.zip
- SHA256 610a52c340ebaff31093c5ef0d76032ac2acdc81a3431e68b244bf42905fd70a
- MD5 f94d1f4e2ce6c7cc81961361aab8a144
- SHA1 88189db0691667653fe1522c6b5673bf75aa44aa
- SHA512 7b7cf9a782549e75f87b8c62d091369b47c1b22c9a10dcf4a5d9f2db9a879ed3969316292d3944f95aeb67f34ae6dc6bbe2ae5ca497be3a25741a2aa204e66ad
- SSDEEP 24576:Uy0yC/fh9Dnt24GZrEXdjl3Fha3fXUkWpfnb:CyGf7TtCZrOll1svX0fb
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/Matsnu/Ransomware.Matsnu.zip
- SHA256 f73027dd665772cc94dbe22b15938260be61cbaad753efdccb61c4fa464645e0
- MD5 0a3487070911228115f3a13e9da2cb89
- SHA1 c2d57c288bc9951dee4cc289d15e18158ef3f725
- SHA512 996f839d347d8983e01e6e94d2feb48f2308ab7410c6743a72b7ecff15b34a30cd12a5764c0470c77138cf8724d5641d03dd81793e28d47fe597f315e116fa77
- SSDEEP 1536:Wtmvcv25VrNQnc+6KmmjnFcqbq6eXq8GPHTDAY:WBUNQnc+6Vmmv6e8fP
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/Petrwrap/Ransomware.Petrwrap.zip
- SHA256 cf01329c0463865422caa595de325e5fe3f7fba44aabebaae11a6adfeb78b91c
- MD5 6884a35803f2e795fa4b121f636332b4
- SHA1 527bfbf4436f9cce804152200c4808365e6ba8f9
- SHA512 262732a9203e2f3593d45a9b26a1a03cc185a20cf28fad3505e257b960664983d2e4f2b19b9ff743015310bf593810bd049eb03d0fd8912a6d54de739742de60
- SSDEEP 24576:XtZfUANeQHLqNZ2rl5zkFGPI/9+4C/BGq/Om00pN5m:XtZc+trnHkxVqQqm
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/Petya/Ransomware.Petya.zip
- SHA256 33ca487a65d38bad82dccfa0d076bad071466e4183562d0b1ad1a2e954667fe9
- MD5 e8fb95ebb7e0db4c68a32947a74b5ff9
- SHA1 6f93f85342aa3ea7dcbe69cfb55d48e5027b296c
- SHA512 a2dea77b0283f4ed987c4de8860a9822bfd030be9c3096cda54f6159a89d461099e58efbc767bb8c04ae21ddd4289da578f8d938d78f30d40f9bca6567087320
- SSDEEP 12288:h62An+lYWejkM9KIIoyoAWPPpxS8yrST5UvF50VHCJvD3DpNu7NwRUDxuJnU:hJA+BncEoyojpxS8yrSV0nvHpNu7eQxH
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/README.md
- SHA256 1e54544721a7c12cdc7e79e4212fc116f6f7b71cdc7a2b51ae142ab69e8784bc
- MD5 ec3725f86203d73125aa3070816bb4a3
- SHA1 4ebfd463e20656581f328d21ca7226d46c46da88
- SHA512 fee577aec39892858d13e26f862354755467d54137a289cf353f8a47512066a1a0be2dd575e2608422745c2a52812d5d80ce145dc41c900eabb46b154f5a96d5
- MD5 SHA1 SHA512
Ransomware-Samples-main/Radamant/Ransomware.Radamant.zip
- SHA256 3e1813da2d561157df7667cde0117fdddd883c5b1272f76d1ae85ad889c38220
- MD5 fce365d60e13df34a6843894ac9be499
- SHA1 5211ac4e7d8459f0db9aa19a03c55cb2063fee5f
- SHA512 9747c95c1a1314fd0fb462951feafa51a75c0794e56a6bbbd16d192e366907aa764bc9adbc7d8319e5d43a37b10889808ae5d619ae1202200d7dba34afa2bc1b
- SSDEEP 1536:cKmaCJ5RF2bf2mwPUv0M47ChtgxyZShQ9FttDUFQ1VkJA/:XmHJAY23iSOxygkFttQFSkJA/
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/RedBoot/Ransomware.RedBoot.zip
- SHA256 7fa2bf61405ac573a21334e34bf713dcb5d1fc0c72674e6cebc48d33a4a14d44
- MD5 51250dabf7df7832640e4a680676cb46
- SHA1 74ba41bb17af6e5638171f7a6d9d49e978d8d3b3
- SHA512 43f898d7e5752312a79138dcce94c117a20fb6efd9e522fc1ed3cc2d407d13cacf5b6f810c7c1966c4c03217aeb51fce641feb31b26620ff239756132b17f57a
- SSDEEP 24576:X55snqlV0L1X93CIhhFrJK/Hw75gIiaC+4llRCIPY7tdyPHno51SCUR:J53lV0LX5hFrswyVFlMEYSnCw
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/Rex/Ransomware.Rex.zip
- SHA256 32856e998ff1a8b89e30c9658721595d403ff0eece70dc803a36d1939e429f8d
- MD5 50188823168525455c273c07d8457b87
- SHA1 0d549631690ea297c25b2a4e133cacb8a87b97c6
- SHA512 b1a58ebcc48142fa4f79c600ea70921f883f2f23185a3a60059cb2238ed1a06049e701ccdab6e4ea0662d2d98a73f477f791aa1eec1e046b74dc1ce0a9680f70
- SSDEEP 49152:vWKde2aWpNtWWKPqd0c1OWfD6vAcxntjWPNeJ5Rf/coFN0LZkyIEsNdd:eKI2FpNtfaqGc1EAczjk41EuN0LZky9y
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/Satana/Ransomware.Satana.zip
- SHA256 4785c134b128df624760c02ad23c7e345a234a99828c3fecf58fbd6d5449897f
- MD5 82f621944ee2639817400befabedffcf
- SHA1 c183ae5ab43b9b3d3fabdb29859876c507a8d273
- SHA512 7a2257af32b265596e9f864767f2b86fb439b846f7bffa4b9f477f2e54bc3ff2bb56a39db88b72a0112972959570afc697c3202839a836a6d10409a10985031b
- SSDEEP 1536:GBfLHxIOBET2Uvk6w5yD5O92x2HtYli0kR5sJ7LNeeSLK/TJ:GBf9IOXok6DODtY40kDsjiL6F
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/TeslaCrypt/Ransomware.TeslaCrypt.zip
- SHA256 3b246faa7e4b2a8550aa619f4da893db83721aacf62b46e5863644a5249aa87e
- MD5 f755a44bbb97e9ba70bf38f1bdc67722
- SHA1 f70331eb64fd893047f263623ffb1e74e6fe4187
- SHA512 f8ce666ae273e6c5cd57447189a8cf0e53c7704cf269fa120068f21e6faf6c89e2e75f37aee43cac83f4534790c5c6f1827621684034ef3eb7e94d7ee1ac365e
- SSDEEP 6144:xQAq0svy/pQhk1NBePvxGNWeOyqYAGfr/H/h60BHtzbprAvNGTG/fi5QCIq3h11Z:LyKoUlWeOP8HXrINZ/2uJUgVu
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/Thanos/Ransomware.Thanos.zip
- SHA256 cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787
- MD5 00184463f3b071369d60353c692be6f0
- SHA1 d3c1e90f39da2997ef4888b54d706b1a1fde642a
- SHA512 baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006
- SSDEEP 3072:fn8L7y+NJQpRhkU0kbH2PNo/1GjTqOncYIOSsk:f8L7xNJQFzCo/ojTqOnYD
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/Unnamed_0/Ransomware.Unnamed_0.zip
- SHA256 690339e6d19da0b5c63406d68484a4984736f6c7159235afd9eeb2ae00cafc36
- MD5 abc651b27b067fb13cb11e00d33e5226
- SHA1 1869459025fcf845b90912236af43a5d8d0f14dd
- SHA512 4b85ae9001b9d1f11d57b6b2565ab0d468c3b8be469cad231e1203c4f6858af98d8e739b03fb849c2f3ec7b493781e88d32e7b7567c4b61cc1189daeea285bbf
- SSDEEP 12288:9nmNxspjOW6b5EVZTf2qDByG/WNGeWnwnpiVdnBQzXwBdn+TMLCAZn23dr+/TaNT:MNO1OnbElqCnwni7cXo+ECYnq2Jd4l
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/Vipasana/Ransomware.Vipasana.zip
- SHA256 1733b199a7063443c167e3caeae7dda2315f590341ea2152a9b132e1ad8e94a8
- MD5 8d2c4c192772985776bacfd77f7bc4d9
- SHA1 3b923b911d443e321e551f26c9588b16a994d52e
- SHA512 6c24f2fe498cf38e3f3d66b62915e6fbc8c2746a1d4c3c3de270f994b02e1369b9540099c12d150712574ececbe63c8c9f28877d8aa4557fbbb7890d5a0de6c1
- SSDEEP 12288:atcWK55CAyTliOve2dCbNF2NJ9lTYG6WxGc7jdw04YPghNxEvREoXIaK:k7KCP5tWiCpYj6/Cm04YPgvivRENL
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/WannaCry/Ransomware.WannaCry.zip
- SHA256 707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a
- MD5 efe76bf09daba2c594d2bc173d9b5cf0
- SHA1 ba5de52939cb809eae10fdbb7fac47095a9599a7
- SHA512 4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029
- SSDEEP 98304:vhvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRT:vhvq7Bu6EZnZN5EyBSN
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/WannaCry_Plus/Ransomware.WannaCry_Plus.zip
- SHA256 ab14c3f5741c06ad40632447b2fc10662d151afb32066a507aab4ec866ffd488
- MD5 5641d280a62b66943bf2d05a72a972c7
- SHA1 c857f1162c316a25eeff6116e249a97b59538585
- SHA512 0633bc32fa6d31b4c6f04171002ad5da6bb83571b9766e5c8d81002037b4bc96e86eb059d35cf5ce17a1a75767461ba5ac0a89267c3d0e5ce165719ca2af1752
- SSDEEP 49152:9mqR0GTCRh8C9PYUYwm79evoBD2HSypKLZ5u/KU940CwmWtSQX5ddmL6T:RA8GY3b9ev62yypKLlUVCpSSQX5ddmeT
- MD5 SHA1 SHA512 SSDEEP
Ransomware-Samples-main/ransomware.png
- SHA256 ed672ed37bfdadddb835de8c346655a17b653094197a2d6080e6777fa59785ea
- MD5 01369d5062d49b270c8dd6ab535bc403
- SHA1 39c654df64cd7386081da8108f23573f331debab
- SHA512 de704934135717cb62e4d15ef1666e78b3d43c17ff5d50b279c21a5318ac2ce0cea88ebeb17b66f4668e1ca1a8801bdd6bab0194b157b1da6bd90c71b29da08e
- SSDEEP 768:cfWDt10l7IWSENqPZxdv8aNdYjie60vLP2N4fUtbpSErCB3X:WI10loxxh8aNdWie6wb26f8m3X
- MD5 SHA1 SHA512 SSDEEP