Ransomware[.]Jigsaw[.]zip

General

Target
Ransomware.Jigsaw.zip
Size 239KB
Sample260221-bxjynsb16d
SHA256 86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff
MD5 3ad6374a3558149d09d74e6af72344e3
SHA1 e7be9f22578027fc0b6ddb94c09b245ee8ce1620
SHA512 21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720
SSDEEP 3072:p7ykj3uuY4NsJD7kPdSRQLqas/pkPm9jvkEL60Uf7k2BgS6/aFybrNN5ZAdNstk7:p7ym3VNA7w8R5/rxv7O0yng0UtVw5NJ
TLSH
T1263423121BD13B4CDD6F7C19DCCFA43DD3B62D4DE08A069979AA990E0E0E0A1E9F1D06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
static1/unpack001/jigsaw	ConfuserEx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/jigsaw

File Explorer

Ransomware.Jigsaw.zip

.zip 239KB
jigsaw

.exe 283KB

Ransomware.Jigsaw.zip

SHA256 86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff
MD5 3ad6374a3558149d09d74e6af72344e3
SHA1 e7be9f22578027fc0b6ddb94c09b245ee8ce1620
SHA512 21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720
SSDEEP 3072:p7ykj3uuY4NsJD7kPdSRQLqas/pkPm9jvkEL60Uf7k2BgS6/aFybrNN5ZAdNstk7:p7ym3VNA7w8R5/rxv7O0yng0UtVw5NJ
TLSH
T1263423121BD13B4CDD6F7C19DCCFA43DD3B62D4DE08A069979AA990E0E0E0A1E9F1D06
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

jigsaw

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
MD5 2773e3dc59472296cb0024ba7715a64e
SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
TLSH
T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

319498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Ransomware.Jigsaw.zip

jigsaw

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

Ransomware.Jigsaw.zip

jigsaw

mscoree

dotnet