deadlock | c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c

General

Target
c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c
Size 257KB
Sample260626-kjg2laax4n
SHA256 c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c
MD5 4374eb7807fbcb767ae3a6202b4dd8f8
SHA1 2204d64b82765db4598714fe8bc6e71a24958a7f
SHA512 52eeddc5804f61c0b6a46c4d271dcbc3693f2ef9ddcb4be7e927773994c8b1f007246310e81bb1170d0e1adbbdde668752e191d8c2b7744b0d4c5dcc117efb65
SSDEEP 6144:pLO0NQZAKgQg1fQDKGK05DZBHNZ94p9OeyEMlne:pLO0NQSKJJtK0tfNZuLyEM
TLSH
T13C447D41FDC65CF5D58B0CBC242E536AC638A8405736C993E7A0AE41D8FFF31A5AA50A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware deadlock

Malware Config

Signatures

Family: DeadLock
DeadLock is a Windows ransomware.
ransomware deadlock

Detects DeadLock ransomware 1 IoCs

resource	yara_rule
sample	family_deadlock

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c

File Explorer

c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c

.exe 257KB

c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c

IMPHASH 78bfd47d06d8448796808abae8235133
SHA256 c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c
MD5 4374eb7807fbcb767ae3a6202b4dd8f8
SHA1 2204d64b82765db4598714fe8bc6e71a24958a7f
SHA512 52eeddc5804f61c0b6a46c4d271dcbc3693f2ef9ddcb4be7e927773994c8b1f007246310e81bb1170d0e1adbbdde668752e191d8c2b7744b0d4c5dcc117efb65
SSDEEP 6144:pLO0NQZAKgQg1fQDKGK05DZBHNZ94p9OeyEMlne:pLO0NQSKJJtK0tfNZuLyEM
TLSH
T13C447D41FDC65CF5D58B0CBC242E536AC638A8405736C993E7A0AE41D8FFF31A5AA50A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects DeadLock ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

129882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery VirtualProtect VirtualAlloc GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GetModuleHandleExW RtlUnwind GetCurrentThreadId TerminateProcess GetCurrentProcess CreateWaitableTimerW WaitForSingleObjectEx RaiseException GetCurrentDirectoryW ExpandEnvironmentStringsW MoveFileExW HeapAlloc ExitProcess SetFilePointerEx CreateFileW GetFullPathNameW GetModuleFileNameW GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter Sleep SetWaitableTimer GetCurrentThread CreateThread SetLastError GetModuleHandleA GetConsoleOutputCP GetConsoleMode GetStdHandle WriteConsoleW MultiByteToWideChar GetLastError HeapReAlloc HeapFree GetProcessHeap GetCurrentProcessId FreeLibrary GetCommandLineW GetFileInformationByHandle GetProcAddress InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent WaitForSingleObject SwitchToThread

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

msvcrt

_fmode __set_app_type _msize __getmainargs _control87 _errno __p__commode __p___argv __p___argc _initterm free floor ceil _amsg_exit memcmp memset memmove memcpy ?_set_new_mode@@YAHH@Z ?terminate@@YAXXZ realloc _XcptFilter _environ __CxxFrameHandler

Sharing