test.zip
- SHA256 41cbd0bc2fbb865cb1717137883fedcdd0a723d6943fc3395e58e8a80da796a9
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
test.zip
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
16 signatures
600 seconds
Behavioral task
behavioral2
Sample
alpushka-ransomlab.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
10 signatures
600 seconds
General
- Target test.zip
- Size 471KB
- Sample260620-159lqsaz21
- SHA256 41cbd0bc2fbb865cb1717137883fedcdd0a723d6943fc3395e58e8a80da796a9
- MD5 ba82a526efaad214a43acf3298cfa5d0
- SHA1 91f2a15a9f0dc3a44bc348eecf4d863112199384
- SHA512 f9676a626946bbeb2f603e84d91acd99cde0fa60aedb0730172aa71a11f088613dd2520b2fc3b7d0f30ccd2c2a011729f087f8e0ff552d63511d8e4e2713bb87
- SSDEEP 12288:KiRwxr4zKWI2vOBHHtgIMqIO/N/Dz7bAEfvNxQ:KRk+VzBHHtBYOFf7bAQxQ
- TLSH T1BEA4234BFE4AD3D937F204F64F18D65C24A250A05F9FA446FC572E982BDAC072BC4992
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/alpushka-ransomlab.exe
File Explorer
-
test.zip.zip 471KB
-
alpushka-ransomlab.exe.exe 1.2MB
alpushka-ransomlab.exe
- IMPHASH 317154ad5d49111759aa62d253845b4e
- SHA256 e1745a9a67903c13fce7b39090039ca538aefcf8d801d0e7fbfff545156c135a
- MD5 756279abed3a42389ec11caf1dc0b13c
- SHA1 2d0d19d0189af096735d9cf542285c39cfe9dd67
- SHA512 0f946ec03c8ad5420a39bd75560ff005c64e257339ab4589bcac4f8690253ded88e858bd1c8c4fdc80f0bdf2c2b48d7bc7073b858df0f5d11bb2401a2888201a
- SSDEEP 24576:UsUwQCTp2CC38WsPAY8VqhtUqGAhnyg+1p:UsBQCTp2CCBWAY8eSqGAhnyg+1p
- TLSH T1A3555B62A5895AAED303D03981A7963A753532C92333BFB31D9DDE306F82DC54F2531A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
advapi32
SystemFunction036
bcrypt
BCryptGenRandom
kernel32
AddVectoredExceptionHandler
CancelIo
CloseHandle
CompareStringOrdinal
CopyFileExW
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreatePipe
CreateProcessW
CreateSymbolicLinkW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerExW
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimePreciseAsFileTime
GetTempPathW
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSection
InitializeProcThreadAttributeList
LeaveCriticalSection
LockFileEx
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReadFileEx
RemoveDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetCurrentDirectoryW
SetEnvironmentVariableW
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFile
UnmapViewOfFile
UpdateProcThreadAttribute
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFileEx
__C_specific_handler
lstrlenW
msvcrt
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_fpreset
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf
ntdll
NtCreateFile
NtCreateNamedPipeFile
NtOpenFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError
userenv
GetUserProfileDirectoryW
ws2_32
GetHostNameW
WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSARecv
WSASend
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
Name
.text
Size
660KB
Virtual Size
659KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ