HEUR-Trojan-Ransom.Win32.Generic-150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc.7z
- SHA256 d83723f572e06c97ba7b1d51ca8c63b95d633cef13c426abdb2d4782b36ab339
Password
infected
Behavioral task
behavioral1
Sample
HEUR-Trojan-Ransom.Win32.Generic-150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc.7z
Resource
win10v2004-20250314-en
windows10-2004-x64
19 signatures
120 seconds
General
- Target HEUR-Trojan-Ransom.Win32.Generic-150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc.7z
- Size 1.3MB
- Sample250315-vtpjjaywbv
- SHA256 d83723f572e06c97ba7b1d51ca8c63b95d633cef13c426abdb2d4782b36ab339
- MD5 98e7aa73bc953854d53454484e26ca0c
- SHA1 2e842b7293158af9b62c8a8f8200ac2113a57601
- SHA512 7c62887161b8921c14c928b1ccad3a76d785c827b45143e708d50fe74e6bbe0bf01f3ac162a3261b3272f1bd9c5a4ae8adb0b50e8877a61e4601aa123efbb958
- SSDEEP 24576:FkGHJ+rZRWGcmOoyOk7fhQQfugQbhtTynAJXCvPBBLGwCv2mIJOHc03uKKYCtLqV:FtHJAQvmryZ7fhlabyLnBBLiv2mIJ8c4
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/HEUR-Trojan-Ransom.Win32.Generic-150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/HEUR-Trojan-Ransom.Win32.Generic-150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc.exe unpack002/out.upx
File Explorer
-
HEUR-Trojan-Ransom.Win32.Generic-150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc.7z.7z 1.3MB
-
HEUR-Trojan-Ransom.Win32.Generic-150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc.exe.exe 1.3MB
-
out.upx.exe 2.9MB
HEUR-Trojan-Ransom.Win32.Generic-150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc.exe
- SHA256 150200c3b5cd1afd87110cc2ce0002bc3bb1590cf91bbc17e2ade2824e38d0cc
- MD5 b5fcddeec6422bec63cbd59d4d0aaeab
- SHA1 2fb1cbec471ba7f0859e2a804e4cd51fb6b0be54
- SHA512 825706455bcfcbfe9186f9030229f8d6aa64555803ff2f0ff8723f05b50511e9d889e4a8ebc2bbffff573930b07fe6b41b577d43262490032646d01d47918c55
- SSDEEP 24576:XN4EfsPHd9VbyiKSnKMnsNneRWrN2jHwTxbMmgCyq3eca44zpRPtHS:9z0/0iKSnKYsNn4WZ2LwQNGeca4aPl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
3072272
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=16, id=259, version=27412,
count=187, id=261, version=27412,
count=22, id=260, version=27412,
count=19, id=260, version=30034,
count=24, id=259, version=30034,
count=81, id=261, version=30034,
count=21, productName=Unmarked objects (old),
count=496, id=260, productName=VS2019 v16.10.0 build 30037, version=30037,
count=17, id=257, version=27412,
count=223, id=1, productName=Unmarked objects,
count=7, id=265, version=30037,
count=1, id=255, productName=VS2019 v16.10.0 build 30037, version=30037,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.10.0 build 30037, version=30037,
out.upx
- SHA256 a0873b816a4ac3638e70cbb21e9c689300da529a71cc1bbd69e1603a39896a4b
- MD5 f8154730d56b6ec2c9a5e9f4974a2195
- SHA1 0e8c9f3a37d914123e9e16ffb74e356562ab2797
- SHA512 a0cce6fc7a30b03c7f0621869451d829194a3874b1818c4df2bc9a698653856fc32b0bb9dcc2abe2814c9b6bb8ac4ab7955ff27c1815c7a2e07c1c080598dc0e
- SSDEEP 49152:WlXKIBGbilHHE2dnVCRLeftPy7/UbwkQcDUA9w6wHx8dCQh8uaUMaf6:WlXnGeHddnV3fA7/U05cRnMx8dtn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1060237
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
391KB
Virtual Size
391KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=187, id=261, version=27412,
count=22, id=260, version=27412,
count=19, id=260, version=30034,
count=24, id=259, version=30034,
count=81, id=261, version=30034,
count=21, productName=Unmarked objects (old),
count=496, id=260, productName=VS2019 v16.10.0 build 30037, version=30037,
count=17, id=257, version=27412,
count=223, id=1, productName=Unmarked objects,
count=7, id=265, version=30037,
count=1, id=255, productName=VS2019 v16.10.0 build 30037, version=30037,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.10.0 build 30037, version=30037,