chaos | Yashma ransomware builder v1[.]2[.]exe | Triage

Sharing

General

Target

Yashma ransomware builder v1.2.exe
Size

825KB
MD5

5120e2ada300c2eef255957dde5b84b0
SHA1

dfb5c0b29fb235d34e851de234535474705be356
SHA256

b24d58cd8d600431702b67fb815a92f465147553303c0f8a1867af77214dba75
SHA512

958f089a7060188213dd00f6d73bbd625a89f98ccc0b5bf7b5963a3ef40677846e03a33866b79cec92fd29709ff8f0bd9a753397ef07f25779aedb02884d9f8c
SSDEEP

6144:aMPUfX5X2onFLfFLzFL6FL6aGMVFLQ+FWD/:aLJX8QD

Score

10^/10

chaos

Malware Config

Signatures

Chaos Ransomware 1 IoCs

resource	yara_rule
sample	family_chaos

Chaos family
chaos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Yashma ransomware builder v1.2.exe

Files

Yashma ransomware builder v1.2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 718KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ