Trojan-Ransom[.]Win32[.]Shade[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Trojan-Ransom.Win32.Shade.exe
Size 1.4MB
Sample260321-jepefaa14k
SHA256 51d0aaeab5478e535162cc12888d2e3e2d4f41367f9815cc4fabb5541531b299
MD5 2bf5ab2882ac2a37faed63c924ef5379
SHA1 1f6a4030e211d1268a8810efb01f1f00da3629c1
SHA512 48c1b0e489c6be28edea323299e40412b94fb2aa4dbee85ef7deecdd3d27f5ef81d91c0d4639d9c799274f0e39e08e46bdb6ad6306fd49cb149fd381b6b07e8b
SSDEEP 24576:FhJEbxUMoYHCnaXHRk0HU2DGXNpeUG0R8ex:FhJEbgYt/HUfN4d2
TLSH
T15A6512153EE32121E053F1F48D5E9D0EB224E3574A2F88A27E9C72999F505B4436BBCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Trojan-Ransom.Win32.Shade.exe

File Explorer

Trojan-Ransom.Win32.Shade.exe

.exe 1.4MB

Trojan-Ransom.Win32.Shade.exe

IMPHASH 136f0dbada6bb4a05762d95693589abf
SHA256 51d0aaeab5478e535162cc12888d2e3e2d4f41367f9815cc4fabb5541531b299
MD5 2bf5ab2882ac2a37faed63c924ef5379
SHA1 1f6a4030e211d1268a8810efb01f1f00da3629c1
SHA512 48c1b0e489c6be28edea323299e40412b94fb2aa4dbee85ef7deecdd3d27f5ef81d91c0d4639d9c799274f0e39e08e46bdb6ad6306fd49cb149fd381b6b07e8b
SSDEEP 24576:FhJEbxUMoYHCnaXHRk0HU2DGXNpeUG0R8ex:FhJEbgYt/HUfN4d2
TLSH
T15A6512153EE32121E053F1F48D5E9D0EB224E3574A2F88A27E9C72999F505B4436BBCE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

29:e8:cc:2f:db:15:b8:83:c3:56:f9:f2:b4:f7:2b:fa:b4:e0:2f:35

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

27613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetEnvironmentVariableW GetLogicalDrives GetModuleFileNameW GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress GetStartupInfoA GetSystemTimeAsFileTime GetTickCount GetVolumeInformationW GlobalAlloc InterlockedCompareExchange InterlockedExchange IsDebuggerPresent LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter ReadFile SetErrorMode SetFilePointer SetUnhandledExceptionFilter Sleep TerminateProcess UnhandledExceptionFilter lstrcmpiW lstrcpynW lstrlenW VirtualAlloc LoadLibraryA GetDriveTypeW GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize RtlUnwind HeapReAlloc HeapAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection HeapFree VirtualFree HeapCreate GetCurrentThreadId GetCurrentProcess GetCurrentProcessId FreeLibrary ExitProcess CreateFileW CopyFileW CloseHandle InterlockedDecrement SetLastError InterlockedIncrement GetCommandLineA WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree

user32

LoadIconA TrackPopupMenu SetMenuDefaultItem SetForegroundWindow SendMessageW RegisterWindowMessageW RegisterClassW PostQuitMessage MessageBoxW LoadStringW LoadImageW IsWindow InsertMenuItemW GetWindowTextW GetWindow GetMessageW GetCursorPos GetClassNameW GetAsyncKeyState FindWindowW EnumWindows EnableMenuItem DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DefWindowProcW CreateWindowExW CreatePopupMenu CharPrevW CharNextW ShowWindow

gdi32

PathToRegion GetStockObject

advapi32

RegQueryValueExW RegOpenKeyW RegDeleteValueW RegCloseKey RegOpenKeyExA

shlwapi

StrToIntW PathFileExistsW