global | ptcAAAD[.]exe

Resubmissions

10/09/2026, 12:49

260910-p2cxtaxtfv10

09/09/2026, 21:52

260909-1rdxxa1fkd10

09/09/2026, 21:50

260909-1qah4a1fje10

09/09/2026, 21:45

260909-1l86vss1gx10

Sharing

Copy URL Twitter E-mail

General

Target
ptcAAAD.exe
Size 234KB
Sample260910-p2cxtaxtfv
SHA256 9fb468a79f88d9a250180749bfae97d4f310c8510f1f98cae359d95c2a62b4af
MD5 20417846820741fa84c4571affb40e9c
SHA1 854fa9ff956936259d77081d692296aced766a61
SHA512 93fe69c9ccb8d344c03b25c1ef79d3ab31c3c1bc7060223d42ce56b791c9257ad8f6304ab978de41d7d5e6342b65d5948126a0ca7f40fa8d8635d144849e10c9
SSDEEP 6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H:MQQBMLEi+AVT/H
TLSH
T15B347C30BBD28431F5B75A721979A7764C3E38270B31D6CFA790096AED306C18B35B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware global

Malware Config

Signatures

Family: Global
Global is a Windows ransomware written in Golang.
ransomware global

Detects Global Ransomware 1 IoCs

resource	yara_rule
sample	family_global

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ptcAAAD.exe

File Explorer

ptcAAAD.exe

.exe 234KB

ptcAAAD.exe

IMPHASH 934cf7ece072cb192e6f1696c5852040
SHA256 9fb468a79f88d9a250180749bfae97d4f310c8510f1f98cae359d95c2a62b4af
MD5 20417846820741fa84c4571affb40e9c
SHA1 854fa9ff956936259d77081d692296aced766a61
SHA512 93fe69c9ccb8d344c03b25c1ef79d3ab31c3c1bc7060223d42ce56b791c9257ad8f6304ab978de41d7d5e6342b65d5948126a0ca7f40fa8d8635d144849e10c9
SSDEEP 6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H:MQQBMLEi+AVT/H
TLSH
T15B347C30BBD28431F5B75A721979A7764C3E38270B31D6CFA790096AED306C18B35B66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Global Ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

BackupEventLogW CloseEventLog OpenEventLogW OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx GetTokenInformation ImpersonateLoggedOnUser RevertToSelf LookupPrivilegeValueW CloseServiceHandle ClearEventLogW DeleteService OpenSCManagerA OpenSCManagerW OpenServiceW QueryServiceStatusEx StartServiceW RegCloseKey RegCreateKeyExW RegSetValueExW SetThreadToken OpenThreadToken DuplicateToken ControlService CryptGenRandom

user32

wsprintfW

shell32

SHChangeNotify

ws2_32

inet_addr WSAStartup InetNtopW WSACleanup inet_ntop

iphlpapi

IcmpSendEcho IcmpCloseHandle IcmpCreateFile GetAdaptersAddresses

netapi32

NetApiBufferFree NetShareEnum

mpr

WNetAddConnection2W WNetCancelConnection2W

winspool.drv

WritePrinter EndDocPrinter StartDocPrinterW OpenPrinterW EnumPrintersW StartPagePrinter EndPagePrinter ClosePrinter

secur32

GetUserNameExW

dnsapi

DnsFree DnsQuery_W

activeds

ord3

ole32

CoInitialize CoUninitialize

oleaut32

VariantInit VariantClear

ntdll

NtRemoveIoCompletion NtSetIoCompletion NtDelayExecution RtlUnwind

kernel32

GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetStringTypeW GetConsoleMode GetConsoleOutputCP FlushFileBuffers LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx ReadConsoleW HeapSize SetEnvironmentVariableW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess GetStdHandle SetStdHandle CreateFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW GetFileAttributesW GetFileSizeEx GetLogicalDriveStringsW ReadFile SetFileAttributesW SetFilePointerEx WriteFile DebugBreak CloseHandle GetLastError Sleep GetCurrentProcess CreateProcessW SetPriorityClass GetLocalTime GetTickCount64 GetNativeSystemInfo GetModuleFileNameW GetModuleHandleW lstrcmpW lstrcmpiW lstrcpyW lstrcatW lstrlenW MoveFileExW WideCharToMultiByte FreeConsole WriteConsoleW GetComputerNameExW GetComputerNameW SetFileInformationByHandle GetEnvironmentVariableW LoadLibraryW GetProcAddress OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW GetTempPathW GetLogicalDrives FormatMessageW WaitForSingleObject GetTickCount CopyFileW MultiByteToWideChar GetCurrentThread HeapAlloc HeapFree GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW LoadLibraryExW FreeLibrary RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree DecodePointer

Name

.text

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.config

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ptcAAAD.exe

advapi32

user32

shell32

ws2_32

iphlpapi

netapi32

mpr

winspool.drv

secur32

dnsapi

activeds

ole32

oleaut32

ntdll

kernel32

generic