2024-10-17_2db3761c5930f51cecd6ee219f1e2a41_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-17_2db3761c5930f51cecd6ee219f1e2a41_bkransomware
Size

283KB
MD5

2db3761c5930f51cecd6ee219f1e2a41
SHA1

5ca116769936e75bd6ecb26c43a8f990d665efc4
SHA256

af306b52b4dd16d250a2004dcb74a318d62052ece9277211004b97b7d2a576c3
SHA512

f7bf8cdcb20e3ddc76a79c4cc1bb37518490fa362658a10ef5255716359c5ab9425741492db52dd0bdf47a5966f455b6e7cdf32c28bef170f2a15d3bb6d71a5e
SSDEEP

6144:/BwdozMBHYmTHu/Y/Z+YR2Kh3PfcKrKywnbY:5wdo46mju/3KpdGyMbY

Score

1^/10

Malware Config

Signatures

Files

2024-10-17_2db3761c5930f51cecd6ee219f1e2a41_bkransomware
.exe windows:5 windows x86 arch:x86

d96394d4f5bb9ce709d08f7d2d61d8fc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:7c:62:c3:62:54:e4:bb:1c:4b:ad:2c:84:cb:1b:ff
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

19/10/2016, 00:00

Not After

13/06/2017, 23:59

Subject

CN=Yongli Li,OU=Individual Developer,O=No Organization Affiliation,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:56:6e:4b:59:d3:7e:ce:69:e6:ba:8f:c1:5d:fa:f2:24:51:08:f7
Signer

Actual PE Digest

06:56:6e:4b:59:d3:7e:ce:69:e6:ba:8f:c1:5d:fa:f2:24:51:08:f7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\workspace\3461B02E-043F-4C21-9CBF-35459A4CB3FB\src\obj-i686-pc-mingw32\toolkit\mozapps\update\updater\updater.pdb

Imports

kernel32

LocalFree
FormatMessageW
GetPrivateProfileStringW
CopyFileW
MoveFileExW
WideCharToMultiByte
LocalAlloc
SetLastError
GetCurrentProcess
FreeLibrary
GetDriveTypeW
WriteFile
DeleteFileW
MoveFileW
GetTimeZoneInformation
OpenProcess
LCMapStringW
CompareStringW
OutputDebugStringW
FlushFileBuffers
GetFullPathNameW
SetEnvironmentVariableA
SetFilePointerEx
HeapSize
TlsFree
TlsSetValue
WaitForSingleObject
CreateProcessW
GetLastError
CloseHandle
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetTempFileNameW
GetLongPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
MultiByteToWideChar
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleFileNameW
Sleep
SetDllDirectoryW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
WriteConsoleW
GetSystemDirectoryW
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadConsoleW
RtlUnwind
GetConsoleMode
RaiseException
LoadLibraryExA
GetCommandLineW
HeapFree
HeapAlloc
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileType
PeekNamedPipe
FileTimeToSystemTime
IsDebuggerPresent
IsProcessorFeaturePresent
GetFileAttributesExW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
SetStdHandle
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
CreateThread
GetCurrentThreadId
ExitThread
ReadFile
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetProcessHeap
GetStdHandle
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
GetConsoleCP

user32

GetClientRect
wsprintfW
LoadIconW
GetParent
GetDesktopWindow
SetWindowLongW
SendMessageW
OffsetRect
CopyRect
ScreenToClient
GetWindowRect
GetWindowLongW
SetWindowTextW
ReleaseDC
GetDC
DrawTextW
SetTimer
GetDlgItem
EndDialog
DialogBoxParamW
SetWindowPos

gdi32

SelectObject

advapi32

QueryServiceStatusEx
QueryServiceConfigW
OpenServiceW
OpenSCManagerA
CloseServiceHandle
LookupPrivilegeValueA
GetTokenInformation
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
CreateProcessAsUserW
StartServiceW

wintrust

WinVerifyTrust

shell32

ShellExecuteExW

shlwapi

PathRemoveFileSpecW
PathCommonPrefixW
PathAppendW
PathStripToRootW
PathUnquoteSpacesW

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d96394d4f5bb9ce709d08f7d2d61d8fc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

08:7c:62:c3:62:54:e4:bb:1c:4b:ad:2c:84:cb:1b:ffCertificate

Extended Key Usages

Key Usages

06:56:6e:4b:59:d3:7e:ce:69:e6:ba:8f:c1:5d:fa:f2:24:51:08:f7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

wintrust

shell32

shlwapi

Sections

.text Size: 128KB - Virtual size: 127KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 8KB - Virtual size: 21KB

.rsrc Size: 95KB - Virtual size: 95KB

.reloc Size: 7KB - Virtual size: 6KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

08:7c:62:c3:62:54:e4:bb:1c:4b:ad:2c:84:cb:1b:ff
Certificate

06:56:6e:4b:59:d3:7e:ce:69:e6:ba:8f:c1:5d:fa:f2:24:51:08:f7
Signer

.text
Size: 128KB - Virtual size: 127KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 8KB - Virtual size: 21KB

.rsrc
Size: 95KB - Virtual size: 95KB

.reloc
Size: 7KB - Virtual size: 6KB