Trojan[.]Ransom[.]Petya[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Trojan.Ransom.Petya.zip
Size 182KB
Sample260915-sd8alaal3s
SHA256 01ee80fae9882c4905390a2927895e6bdcf74b1a5662c7577ab185b3c826b64b
MD5 089dcd9480fa127da76645e445c3e909
SHA1 404fa8d1eb068452b0ee18a22cea2716d156bd10
SHA512 16850e2a2972ba31830661f19edfbea9e72ae7081d27b517e3e707ba0b2ae80e4128c0e99b41c3104f1ac3d4904d8b1fd78f184b56eaf368b8a5b050e88d554c
SSDEEP 3072:9Or8kHWEtPc8h8tMQ97IVlQHWNmQf9X+P7uWYimpGUDky4BwratiparfdsEXhb:9W93e2IYf9k7pYim4UZ4BEGHV
TLSH
T1620423EA536CD4548DADB010F913A93AAF3BC5E87F46AD8A94F0B90D0B3281547FDD42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/eefa052da01c3faa1d1f516ddfefa8ceb8a5185bb9b5368142ffdf839aea4506

File Explorer

Trojan.Ransom.Petya.zip

.zip 182KB
eefa052da01c3faa1d1f516ddfefa8ceb8a5185bb9b5368142ffdf839aea4506

.exe 328KB

Trojan.Ransom.Petya.zip

SHA256 01ee80fae9882c4905390a2927895e6bdcf74b1a5662c7577ab185b3c826b64b
MD5 089dcd9480fa127da76645e445c3e909
SHA1 404fa8d1eb068452b0ee18a22cea2716d156bd10
SHA512 16850e2a2972ba31830661f19edfbea9e72ae7081d27b517e3e707ba0b2ae80e4128c0e99b41c3104f1ac3d4904d8b1fd78f184b56eaf368b8a5b050e88d554c
SSDEEP 3072:9Or8kHWEtPc8h8tMQ97IVlQHWNmQf9X+P7uWYimpGUDky4BwratiparfdsEXhb:9W93e2IYf9k7pYim4UZ4BEGHV
TLSH
T1620423EA536CD4548DADB010F913A93AAF3BC5E87F46AD8A94F0B90D0B3281547FDD42
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

eefa052da01c3faa1d1f516ddfefa8ceb8a5185bb9b5368142ffdf839aea4506

IMPHASH 4f7e80b12e14587fc3c198bdef27ceee
SHA256 eefa052da01c3faa1d1f516ddfefa8ceb8a5185bb9b5368142ffdf839aea4506
MD5 8ed9a60127aee45336102bf12059a850
SHA1 b649b9bc9436d373fd09a89ed71840aa7ac5ec54
SHA512 95a0d62f02b29a48b1988cba6610b6410327f52ef918fd83fe2565d3767ab202d2a9aef6bcf47234c7c7200c49b71b80cd0430a7b6e55885f7a4b54a69e0dc2e
SSDEEP 6144:wDeUVJuo0tl4VJLofrFD68Y7LE8DO11bEVUNNa:IuFl4VJ4D68YUQO1tEV
TLSH
T1C0648E213795F83DDA6204348FE78B6E52FEF1A5E43A1D87E3C40A1B5E76C41812EB19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98639

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_AGGRESIVE_WS_TRIM IMAGE_FILE_32BIT_MACHINE

PDB paths

I:\VS70Builds\3077\vsbuilt\retail\Bin\i386\opt\mdm.pdb

ole32

CoRevokeClassObject CoRegisterClassObject CoTaskMemAlloc CoTaskMemRealloc StringFromGUID2 CoDisconnectObject CoUninitialize CoRevertToSelf CoInitializeSecurity CoCreateGuid CLSIDFromString CoGetClassObject CoGetCallContext StringFromIID CoCreateInstance CoSetProxyBlanket CoInitializeEx CoImpersonateClient CoQueryProxyBlanket StringFromCLSID CoTaskMemFree

oleaut32

SysFreeString SysAllocStringLen SysAllocString SafeArrayDestroy SafeArrayUnaccessData SafeArrayAccessData VarBstrCat VariantClear VariantInit VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysStringByteLen SysAllocStringByteLen SafeArrayCreate

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

rpcrt4

RpcStringFreeA RpcBindingFromStringBindingA RpcStringBindingComposeA NdrClientCall RpcBindingSetAuthInfoA

shlwapi

PathFindExtensionA

advapi32

RegOpenKeyExW QueryServiceStatus LookupAccountSidA PrivilegeCheck IsValidSecurityDescriptor DuplicateTokenEx AddAce GetSecurityDescriptorLength GetUserNameA InitializeSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorSacl MakeAbsoluteSD SetSecurityDescriptorDacl MakeSelfRelativeSD InitializeAcl AddAccessAllowedAce AddAccessDeniedAce AllocateAndInitializeSid FreeSid RegConnectRegistryA RegSetKeySecurity LookupAccountNameA GetAclInformation GetAce DuplicateToken GetSidLengthRequired InitializeSid GetSidSubAuthority AccessCheck GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorSacl EqualSid GetSecurityDescriptorControl GetLengthSid CopySid IsValidSid LookupAccountSidW RegCreateKeyA RegEnumValueA RegQueryValueExA StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA ControlService DeleteService SetThreadToken RegDeleteKeyA RegCloseKey RegOpenKeyExA RegEnumKeyA SetServiceStatus AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueA GetTokenInformation OpenThreadToken RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryInfoKeyA RegEnumKeyExA DeregisterEventSource ReportEventA RegisterEventSourceA CloseServiceHandle ChangeServiceConfigA OpenServiceA CreateServiceA OpenSCManagerA RegQueryValueExW

kernel32

HeapFree VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery RtlUnwind IsBadWritePtr HeapSize GetOEMCP GetCPInfo HeapReAlloc WriteFile GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsFree TlsSetValue TlsGetValue HeapDestroy HeapCreate VirtualFree LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr SetStdHandle FlushFileBuffers SetEndOfFile GetProcessHeap GetSystemTimeAsFileTime GetLastError FreeLibrary GetProcAddress LoadLibraryW InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA MultiByteToWideChar WideCharToMultiByte RaiseException InitializeCriticalSection DeleteCriticalSection GetVersion lstrcmpiA lstrlenW lstrlenA CloseHandle OpenProcess CompareStringA CompareStringW HeapAlloc InterlockedIncrement InterlockedDecrement LoadLibraryA GetModuleHandleA WaitForSingleObject CreateEventA SetEvent TerminateThread CreateThread GetCurrentThreadId EnterCriticalSection LeaveCriticalSection GetComputerNameA LocalFree GetCurrentProcess GetCurrentThread lstrcpynA lstrcpyA GetModuleFileNameA lstrcatA IsDBCSLeadByte FormatMessageA GetFileAttributesA SizeofResource LoadResource FindResourceA LoadLibraryExA SetUnhandledExceptionFilter GetCommandLineA GetCurrentProcessId SetErrorMode GetProcessTimes GetPrivateProfileStringA TerminateProcess GetPrivateProfileSectionA GetPrivateProfileIntA CreateFileA GetProfileStringA CreateDirectoryA WritePrivateProfileStringA WriteProfileStringA GetPrivateProfileSectionNamesA GetTickCount LocalAlloc LockResource CreateProcessA InterlockedCompareExchange SetEnvironmentVariableA GetSystemDirectoryA Sleep GetModuleHandleW LocalSize ReadFile SetFilePointer SetLastError ReadProcessMemory FindClose FindFirstFileA FindResourceExA UnmapViewOfFile DuplicateHandle GetModuleFileNameW MapViewOfFile CreateFileMappingA CreateMutexA ReleaseMutex GetExitCodeProcess CreateProcessW GetStartupInfoA ExitProcess QueryPerformanceCounter

user32

wsprintfA wsprintfW EnumWindows GetWindowThreadProcessId IsWindowVisible GetWindowTextA DispatchMessageA MessageBoxA LoadStringA CharNextA PeekMessageA SetTimer GetMessageA KillTimer PostThreadMessageA CharUpperA