Behavioral task
behavioral1
Sample
TestServer.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
TestServer.exe
Resource
win10v2004-20241007-en
General
-
Target
TestServer.exe
-
Size
107KB
-
MD5
c133ce6541688d84cfb35186fa8ad88f
-
SHA1
67d7c34ce8548ffcd1ec4f8608beba7a06b1fb0b
-
SHA256
9b74a10d6efbf33d56285505ae702947ea333447bfc583537f14018569b62ea6
-
SHA512
81efaf9f3b580ec37d5237663cca2f0ef8d9683304ee9a679da6be2c30961adad8c7bb38b64b0f1fbd4163667927871e912e0b669de2796cb14c370ea5707d50
-
SSDEEP
384:N3Mg/bqo2W4fSpJpMDKw/+988Jrr91CvpQHACQIdQepRsva46eLrTH+33M3zJ1oL:3qo2apMDN/NUrr9Ip5epij
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
Processes:
resource yara_rule sample family_chaos -
Chaos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource TestServer.exe
Files
-
TestServer.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ