ransomware_clr_unhook_fixed[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ransomware_clr_unhook_fixed.exe
Size 949KB
Sample260620-btnsfsdy8s
SHA256 e4b6294b3edb902c667da70c0144381bd4850c0fee8bda1c211ceb87bed64bad
MD5 8b3b66c1717ca521a86b18e7055b4506
SHA1 529f9a7f2042748d1b188414a0b6eb4a8e89f17e
SHA512 7bf5c3fef31fa05d547597b5648f8311b1a71eb88a36a881083b509cf134c7da5a000b4026f8cd0e2dcecdda64fef813752c4e0baa83c39c7d0eb61865734db2
SSDEEP 12288:Jo6RHFgfvYOLQlmGw1HnDXY/repKW4QsBZ8KMjBmDJBX:JvRHSvNLQlmGw1HDXY/rP3Mj6B
TLSH
T1E2252B1BE2A345E8C52FD0748796D772BE70B86A01347D6F1DA4E7321F20E609F5AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ransomware_clr_unhook_fixed.exe

File Explorer

ransomware_clr_unhook_fixed.exe

.exe 949KB

ransomware_clr_unhook_fixed.exe

IMPHASH 288f2848b6e116b492f1cfdaa845505d
SHA256 e4b6294b3edb902c667da70c0144381bd4850c0fee8bda1c211ceb87bed64bad
MD5 8b3b66c1717ca521a86b18e7055b4506
SHA1 529f9a7f2042748d1b188414a0b6eb4a8e89f17e
SHA512 7bf5c3fef31fa05d547597b5648f8311b1a71eb88a36a881083b509cf134c7da5a000b4026f8cd0e2dcecdda64fef813752c4e0baa83c39c7d0eb61865734db2
SSDEEP 12288:Jo6RHFgfvYOLQlmGw1HnDXY/repKW4QsBZ8KMjBmDJBX:JvRHSvNLQlmGw1HDXY/rP3Mj6B
TLSH
T1E2252B1BE2A345E8C52FD0748796D772BE70B86A01347D6F1DA4E7321F20E609F5AB24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext RegCloseKey RegOpenKeyExA RegSetValueExA

kernel32

CloseHandle CreateFileA CreateFileMappingA CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FindClose FindFirstFileA FindNextFileA FormatMessageA GetCurrentProcess GetDriveTypeA GetEnvironmentVariableA GetFileAttributesA GetFileSize GetLastError GetLogicalDrives GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessId GetSystemTimeAsFileTime GetThreadId GetTickCount GetTickCount64 InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent K32GetModuleFileNameExA K32GetModuleInformation LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MapViewOfFile Module32First Module32Next MoveFileA MultiByteToWideChar Process32First Process32Next RaiseException ReadFile ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFilePointer SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualProtectEx VirtualQuery WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory lstrcmpiA

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fstat64 _get_osfhandle _initterm _lock _lseeki64 _onexit _stricmp _unlock _wfopen abort calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv iswctype localeconv malloc memchr memcmp memcpy memmove memset rand realloc setlocale setvbuf signal srand strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm tolower towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _write _read _fileno _fdopen

shell32

SHGetFolderPathA

user32

SystemParametersInfoA

ws2_32

WSACleanup WSAStartup freeaddrinfo getaddrinfo

Name

.text

Size

756KB

Virtual Size

756KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ransomware_clr_unhook_fixed.exe

advapi32

kernel32

msvcrt

shell32

user32

ws2_32

generic