Behavioral task
behavioral1
Sample
411c3b13f7935bc7642b8bd7753fdf50f5b00c050c1414b20d6fbf9ebb073611.exe
Resource
win10ltsc2021-20250207-en
General
-
Target
411c3b13f7935bc7642b8bd7753fdf50f5b00c050c1414b20d6fbf9ebb073611
-
Size
52KB
-
MD5
79fd2935ef3c0b0475e327bad7af4488
-
SHA1
d0519f94decb16df28f6554c81eff1fd988bf9e8
-
SHA256
411c3b13f7935bc7642b8bd7753fdf50f5b00c050c1414b20d6fbf9ebb073611
-
SHA512
84047e5f30e89b0a748052e5ae5ba208e60e6f82c4bb77ed6d69a9a66b084ab780e2ad6e49d87717d2035081709e3ad322c300cb9c72aa89718e7a641be229d2
-
SSDEEP
768:5nJz+RAP+ptC7j/zz6GGGqoBEr3e8aDPIz87qXQnasy6T6JnymVqmp9us2:XaI0ty2XGh0a7TqXkNOym
Malware Config
Signatures
-
Detected Netwalker Ransomware 1 IoCs
Detected unpacked Netwalker executable.
resource yara_rule sample netwalker_ransomware -
Netwalker family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 411c3b13f7935bc7642b8bd7753fdf50f5b00c050c1414b20d6fbf9ebb073611
Files
-
411c3b13f7935bc7642b8bd7753fdf50f5b00c050c1414b20d6fbf9ebb073611.exe windows:6 windows x86 arch:x86
7665bcb93a6a9bef0f1ee054e123a1fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcpyW
lstrcatW
CreateFileW
GetFileAttributesW
GetFileSizeEx
ReadFile
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
WriteFile
CloseHandle
MoveFileW
FindClose
HeapFree
FindNextFileW
GetLogicalDriveStringsW
SetErrorMode
WaitForMultipleObjects
ExitProcess
CreateThread
LoadResource
LockResource
SizeofResource
lstrcmpW
lstrcmpiW
FindResourceA
GetFileSize
DeleteFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessHeap
HeapReAlloc
FindFirstFileW
HeapAlloc
user32
CheckDlgButton
IsDlgButtonChecked
EnableWindow
GetSystemMetrics
UpdateWindow
SetActiveWindow
SetWindowTextA
CreateWindowExW
SetWindowPos
GetWindowRect
MessageBoxW
LoadCursorW
RegisterClassW
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW
ShowWindow
GetWindowTextW
DestroyWindow
PostQuitMessage
DefWindowProcW
SetWindowTextW
SendMessageW
gdi32
CreateFontW
comdlg32
GetOpenFileNameW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
mpr
WNetOpenEnumW
WNetAddConnection2W
WNetCloseEnum
WNetEnumResourceW
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ