RANSOM[.]exe | Triage™

Resubmissions

09/09/2026, 11:40

260909-ns7kdswtct

09/09/2026, 11:36

260909-nqvstaej9t8

Sharing

Copy URL Twitter E-mail

General

Target
RANSOM.exe
Size 1.5MB
Sample260909-ns7kdswtct
SHA256 c12acb81a96a13ce59d075291c65e012d7539b345c623ea2e9417c324db11696
MD5 7e62be28fa6ce1ee3eaf7bc5149e7116
SHA1 40119b125d99dc88a3dda4ddd4683f21e9c25c87
SHA512 7cb2196f9d71969f63bb41a0f5afc2624e53629cd4831ff71a528440c9d1d2697a9717be8ab9a5e61a76cf7d0894e0d6ed52210658b3f897a7121907f4b3ad22
SSDEEP 12288:rLMHbHIw97Dg0jFHi6Cr2l2SFM1lN+COQ7kGkAWRu3SHN6fNQFiGYjbsaU1Vu:PcbHT9HgwHnCrwFSlYSuWGYjbsaU1Vu
TLSH
T19D75F682B2D6ACF3DAA7933915C7A2355335BE618B6ACB179104C5390C137C33E6EB85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RANSOM.exe

File Explorer

RANSOM.exe

.exe 1.5MB

RANSOM.exe

IMPHASH 15d282d86ce1d50b7c70931b63899a72
SHA256 c12acb81a96a13ce59d075291c65e012d7539b345c623ea2e9417c324db11696
MD5 7e62be28fa6ce1ee3eaf7bc5149e7116
SHA1 40119b125d99dc88a3dda4ddd4683f21e9c25c87
SHA512 7cb2196f9d71969f63bb41a0f5afc2624e53629cd4831ff71a528440c9d1d2697a9717be8ab9a5e61a76cf7d0894e0d6ed52210658b3f897a7121907f4b3ad22
SSDEEP 12288:rLMHbHIw97Dg0jFHi6Cr2l2SFM1lN+COQ7kGkAWRu3SHN6fNQFiGYjbsaU1Vu:PcbHT9HgwHnCrwFSlYSuWGYjbsaU1Vu
TLSH
T19D75F682B2D6ACF3DAA7933915C7A2355335BE618B6ACB179104C5390C137C33E6EB85
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteValueW RegOpenKeyExW RegSetValueExA RegSetValueExW

gdi32

CreateFontA CreatePen CreateSolidBrush DeleteObject GetStockObject LineTo MoveToEx SelectObject SetBkMode SetTextColor

kernel32

Beep CloseHandle CopyFileA CopyFileW CreateDirectoryW CreateEventA CreateMutexW CreateProcessA CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FormatMessageA GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LocalFree OpenProcess OutputDebugStringA Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _fileno _read _setmode _write fflush fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _stricmp memset strcmp strlen strncmp strnlen wcslen wcsnlen

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

rand rand_s srand

ole32

CoCreateInstance CoInitialize CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

SHGetFolderPathW

user32

BeginPaint CallNextHookEx CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA DrawTextA EnableMenuItem EndPaint FillRect FindWindowA GetAsyncKeyState GetClientRect GetForegroundWindow GetSystemMenu GetSystemMetrics GetWindowTextA InvalidateRect IsWindow LoadCursorA MessageBoxA PeekMessageA PostQuitMessage RegisterClassExA SetFocus SetForegroundWindow SetTimer SetWindowPos SetWindowsHookExA ShowWindow TranslateMessage UnhookWindowsHookEx

Name

.text

Size

230KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

259KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

913B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

RANSOM.exe

advapi32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

oleaut32

shell32

user32

generic