Ransom[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Ransom.exe
Size 1.3MB
Sample260908-eb17lsch22
SHA256 f7ccd0368822c4f33febcc5a956ce0288dc6d875dbea8253b2b6b654dfc6bbdd
MD5 2aef3dde3c7f32527e6ee0d3c8518391
SHA1 0256959609cf2c952ac4eab3b914d9ac30445a48
SHA512 59f6e581d6b5904d96cfc3a098a11c66988cae67c72de81262a05ff4e999ffc7188ca10466e1a39806d3fe0d60be61cd71ba33d295f49d36779350da46af9ac0
SSDEEP 24576:iJ53LerLfP8OFqx8pXmxuzWKixmgBJ2yUV3xY9EE0ihP4V0RUMgvzClHU:I53irrvk8pXPzWKixNBJ2ZV3xY9R0lVz
TLSH
T1E655F776D7A2C86CC5EBD1B07B47C7D26579FD680635A28B028526027F0BD602FDE2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ransom.exe

File Explorer

Ransom.exe

.exe 1.3MB

Ransom.exe

IMPHASH e05d125113513cdf855f6ffaadcf45df
SHA256 f7ccd0368822c4f33febcc5a956ce0288dc6d875dbea8253b2b6b654dfc6bbdd
MD5 2aef3dde3c7f32527e6ee0d3c8518391
SHA1 0256959609cf2c952ac4eab3b914d9ac30445a48
SHA512 59f6e581d6b5904d96cfc3a098a11c66988cae67c72de81262a05ff4e999ffc7188ca10466e1a39806d3fe0d60be61cd71ba33d295f49d36779350da46af9ac0
SSDEEP 24576:iJ53LerLfP8OFqx8pXmxuzWKixmgBJ2yUV3xY9EE0ihP4V0RUMgvzClHU:I53irrvk8pXPzWKixNBJ2ZV3xY9R0lVz
TLSH
T1E655F776D7A2C86CC5EBD1B07B47C7D26579FD680635A28B028526027F0BD602FDE2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegOpenKeyExA RegSetValueExA

libcrypto-3-x64

EVP_CIPHER_CTX_free EVP_CIPHER_CTX_new EVP_CIPHER_get_iv_length EVP_EncryptFinal_ex EVP_EncryptInit_ex EVP_EncryptUpdate EVP_aes_256_cbc RAND_bytes

libcurl-4

curl_easy_cleanup curl_easy_init curl_easy_perform curl_easy_setopt curl_global_cleanup curl_global_init

kernel32

AreFileApisANSI CloseHandle CopyFileA CreateFileA CreateFileMappingW CreateFileW CreateMutexA CreateMutexW DeleteCriticalSection DeleteFileA DeleteFileW EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeLibrary GetComputerNameA GetConsoleWindow GetCurrentDirectoryA GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentVariableA GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetModuleFileNameA GetModuleHandleW GetProcAddress GetProcessHeap GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetTickCount HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter ReadFile SetEndOfFile SetFilePointer SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strrchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf fclose fflush fopen fread fseek ftell fwrite puts setvbuf

api-ms-win-crt-string-l1-1-0

memset strcmp strcspn strlen strncmp strspn

api-ms-win-crt-time-l1-1-0

_localtime64

shell32

ShellExecuteExA

user32

MessageBoxA ShowWindow

Name

.text

Size

973KB

Virtual Size

973KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Ransom.exe

advapi32

libcrypto-3-x64

libcurl-4

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

shell32

user32

generic