ransom[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ransom.exe
Size 952KB
Sample260620-bzbebady9t
SHA256 1e201b302e3020259d91a23abf8ddad08d2ae188cf565783f8d242e66e95b6ed
MD5 e6eacd4edb47efd89e9d89ee997b9a8c
SHA1 b4f35a4b0a25b0eedc32a0bb749e3e5fe680ac39
SHA512 264327da7b709c48ae315355fc596bfc11c43a785227f3fec63f5c0393e8b40c5a24edec9250ea5de2077e806de0d5625dbc6ca3fa6b3488cfdfd96264b433ac
SSDEEP 12288:ilJUx6gwP5KnKjMEQHzz6dycFD9/5dW1c4C2ByAGmm4M:ijUxChKnKjMEQHX6dycyByA+5
TLSH
T11A252B1BE2A345ECC52BD07487629772BE70B46A01347E6F1EE4D7321F21E609F5AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ransom.exe

File Explorer

ransom.exe

.exe 952KB

ransom.exe

IMPHASH 288f2848b6e116b492f1cfdaa845505d
SHA256 1e201b302e3020259d91a23abf8ddad08d2ae188cf565783f8d242e66e95b6ed
MD5 e6eacd4edb47efd89e9d89ee997b9a8c
SHA1 b4f35a4b0a25b0eedc32a0bb749e3e5fe680ac39
SHA512 264327da7b709c48ae315355fc596bfc11c43a785227f3fec63f5c0393e8b40c5a24edec9250ea5de2077e806de0d5625dbc6ca3fa6b3488cfdfd96264b433ac
SSDEEP 12288:ilJUx6gwP5KnKjMEQHzz6dycFD9/5dW1c4C2ByAGmm4M:ijUxChKnKjMEQHX6dycyByA+5
TLSH
T11A252B1BE2A345ECC52BD07487629772BE70B46A01347E6F1EE4D7321F21E609F5AB24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext RegCloseKey RegOpenKeyExA RegSetValueExA

kernel32

CloseHandle CreateFileA CreateFileMappingA CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FindClose FindFirstFileA FindNextFileA FormatMessageA GetCurrentProcess GetDriveTypeA GetEnvironmentVariableA GetFileAttributesA GetFileSize GetLastError GetLogicalDrives GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessId GetSystemTimeAsFileTime GetThreadId GetTickCount GetTickCount64 InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent K32GetModuleFileNameExA K32GetModuleInformation LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MapViewOfFile Module32First Module32Next MoveFileA MultiByteToWideChar Process32First Process32Next RaiseException ReadFile ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFilePointer SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualProtectEx VirtualQuery WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory lstrcmpiA

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fstat64 _get_osfhandle _initterm _lock _lseeki64 _onexit _stricmp _unlock _wfopen abort calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv iswctype localeconv malloc memchr memcmp memcpy memmove memset rand realloc setlocale setvbuf signal srand strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm tolower towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _write _read _fileno _fdopen

shell32

SHGetFolderPathA

user32

SystemParametersInfoA

ws2_32

WSACleanup WSAStartup freeaddrinfo getaddrinfo

Name

.text

Size

759KB

Virtual Size

759KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ransom.exe

advapi32

kernel32

msvcrt

shell32

user32

ws2_32

generic