whitelock | sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
sample.bin
Size 5.5MB
Sample260107-th25tabx7b
SHA256 a501583bca532c4ea11b56780a13a865b609d6a0fcd92b9c9b522f1edcc49c29
MD5 9e35477130cd2731755a35e8b4c0429b
SHA1 28811b212449cd4b23042770b437b98acb3f9c47
SHA512 cc1d894c58e9209c0d9569ea8f4a1b0a2519df1cef6703fe2648ecafa2586be194f52c3c1a037b9d34df90b8d95d06279aa0d995b2f8a19d60c641cc75060c46
SSDEEP 49152:dXMpGtlqibVwASODzFOgNju/+cw3Qsh3mlZm9FHnuswfB479lx14Q6od8oWK6KyM:Ol2cJyznus1R1RBEAEz2/W+fZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

whitelock

Malware Config

Signatures

Detects WhiteLock Ransomware 1 IoCs

resource	yara_rule
sample	family_whitelock

Whitelock family
whitelock

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sample.bin

File Explorer

sample.bin

.exe 5.5MB

sample.bin

IMPHASH 276b585931177b412d30ddfcefb1da5d
SHA256 a501583bca532c4ea11b56780a13a865b609d6a0fcd92b9c9b522f1edcc49c29
MD5 9e35477130cd2731755a35e8b4c0429b
SHA1 28811b212449cd4b23042770b437b98acb3f9c47
SHA512 cc1d894c58e9209c0d9569ea8f4a1b0a2519df1cef6703fe2648ecafa2586be194f52c3c1a037b9d34df90b8d95d06279aa0d995b2f8a19d60c641cc75060c46
SSDEEP 49152:dXMpGtlqibVwASODzFOgNju/+cw3Qsh3mlZm9FHnuswfB479lx14Q6od8oWK6KyM:Ol2cJyznus1R1RBEAEz2/W+fZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects WhiteLock Ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3783772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

shutdown closesocket socket setsockopt sendto recvfrom select getservbyname getservbyport gethostbyname gethostbyaddr inet_ntoa inet_addr htons htonl WSASetLastError WSAStartup inet_pton getsockname getnameinfo ntohs getpeername send recv freeaddrinfo getsockopt WSAPoll WSAGetLastError connect ioctlsocket WSASocketW getaddrinfo WSACleanup

advapi32

RegCreateKeyExW RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegLoadKeyW RegSetValueExW RegUnLoadKeyW OpenSCManagerW OpenServiceW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CloseServiceHandle ControlService RegEnumKeyExW

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertGetCertificateContextProperty CertCloseStore CertOpenSystemStoreW CertFindCertificateInStore CertDuplicateCertificateContext CertOpenStore

user32

SendMessageTimeoutW IsWindowVisible GetWindowThreadProcessId EnumWindows MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetWindow ExitWindowsEx

iphlpapi

GetAdaptersInfo

shell32

SHGetFolderPathA

shlwapi

PathFileExistsW

kernel32

CreateThread ExitThread FreeLibraryAndExitThread GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetFileSizeEx FlushFileBuffers SetStdHandle HeapReAlloc IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetTimeZoneInformation HeapSize SetConsoleCtrlHandler ExitProcess ReadFile LoadLibraryExW RtlUnwindEx RaiseException RtlPcToFileHeader WriteConsoleW Sleep GetCPInfo CompareStringEx FindFirstFileW FindNextFileW GetLastError FindClose GetLogicalDrives GetModuleFileNameW MoveFileExW GetCurrentProcess CloseHandle ExpandEnvironmentStringsW OpenProcess WaitForSingleObject CreateProcessW GetExitCodeProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadLibraryW GetProcAddress FreeLibrary FormatMessageA FormatMessageW WideCharToMultiByte LocalFree VirtualFree SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetFileType WriteFile GetModuleHandleW MultiByteToWideChar RtlVirtualUnwind GetModuleHandleExW GetCurrentProcessId GetSystemTimeAsFileTime GetSystemDirectoryA LoadLibraryA RtlUnwind GetEnvironmentVariableW GetACP InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA SwitchToFiber DeleteFiber CreateFiberEx GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime ConvertFiberToThread ConvertThreadToFiberEx InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead GetStringTypeW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetEndOfFile SetFileInformationByHandle SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx QueryPerformanceFrequency InitializeCriticalSectionEx InitOnceBeginInitialize InitOnceComplete EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree