Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2025-03-21_ef9f90bcf23e05a669a3be094b800c1d_nefilim_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-21_ef9f90bcf23e05a669a3be094b800c1d_nefilim_wannacry.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-21_ef9f90bcf23e05a669a3be094b800c1d_nefilim_wannacry
-
Size
28KB
-
MD5
ef9f90bcf23e05a669a3be094b800c1d
-
SHA1
99b58cb81142a2edca23e042e8a2128307cdbcfd
-
SHA256
bfd22a73a2cc7182b089ad9a38bf8da7a4a773b0a16c88119818842e2b7b6845
-
SHA512
e238fb522453fca87aaab676af4c1979f06141cd6728d6c90f28b80324a39ceab15068de2d88085f0b8d9d4e27c99cec2657732db3f76d467ab1e3224a40926e
-
SSDEEP
384:zXsE9x6/+iTvHPPwSDD37+1dBthRt+GN3eNstwsNdS5NeqPyLa63W90N2gi+:zXh9+RsnENLR636F+
Malware Config
Signatures
-
Nefilim family
-
Nefilim ransomware executable 1 IoCs
File contains patterns typical of Nefilim samples.
resource yara_rule sample nefilim_ransomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-21_ef9f90bcf23e05a669a3be094b800c1d_nefilim_wannacry
Files
-
2025-03-21_ef9f90bcf23e05a669a3be094b800c1d_nefilim_wannacry.exe windows:5 windows x86 arch:x86
35f7171c074e35f1274e48a67e3185dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
FindFirstFileW
lstrlenA
GetDriveTypeW
HeapAlloc
SetFilePointerEx
HeapFree
WaitForSingleObject
GetLogicalDrives
GetProcessHeap
WriteFile
Sleep
ReadFile
CreateFileW
GetFileSizeEx
GetLastError
SetLastError
MoveFileW
FindClose
lstrcmpiW
lstrcatW
FindNextFileW
CloseHandle
lstrcpyW
CreateThread
GetTempPathW
GetProcAddress
LoadLibraryA
CreateMutexA
GetCommandLineW
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ