Behavioral task
behavioral1
Sample
739e1ab9e63ec4da436b2861c3c23111a823676896b6f2f40cf0051bf5c0e951.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
739e1ab9e63ec4da436b2861c3c23111a823676896b6f2f40cf0051bf5c0e951.exe
Resource
win10v2004-20241007-en
General
-
Target
739e1ab9e63ec4da436b2861c3c23111a823676896b6f2f40cf0051bf5c0e951.exe
-
Size
388KB
-
MD5
d313cf4e6bf5e9dcb2ed3e722984bc8e
-
SHA1
21a28a94e0de60603ad1664a843717a8aeba30c9
-
SHA256
739e1ab9e63ec4da436b2861c3c23111a823676896b6f2f40cf0051bf5c0e951
-
SHA512
2a0d479f8b299370bb67ce34f4dfb58b52c70e7edcfa1f9cb6c40a6162455b77aad70bfd1f619dda327d969852eb1c20c7768f1c4247450740c203521f37ff34
-
SSDEEP
6144:fr9Sqdd/nDTCKm1ussOaOYNmJL2gGYBppgnvufOKvNbq7a+0blRIJ6Af:Dd1nDTC11utmSfqppmvufOgY7a+oRd
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
Processes:
resource yara_rule sample family_chaos -
Chaos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 739e1ab9e63ec4da436b2861c3c23111a823676896b6f2f40cf0051bf5c0e951.exe
Files
-
739e1ab9e63ec4da436b2861c3c23111a823676896b6f2f40cf0051bf5c0e951.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 269KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ