5334b3ffc7256b19783fd5f6049eec85970bdd2511fd9d5176282d5a15d1104d.zip
- SHA256 224344c4d1c71b2fc9fe76fbef2635f60aa0244d9d2080dca870a9cb6da10d9d
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Petya.A.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 5334b3ffc7256b19783fd5f6049eec85970bdd2511fd9d5176282d5a15d1104d.zip
- Size 131KB
- Sample261005-vptbxsybpg
- SHA256 224344c4d1c71b2fc9fe76fbef2635f60aa0244d9d2080dca870a9cb6da10d9d
- MD5 a02d88b96633be70919d920f1ef8f694
- SHA1 3ef064f647ac663217358cd4c321ee86b73cd3bc
- SHA512 f708f49f3618ae3beb6fec94f57d18c55859b37e4eb6e451a11d709ac9b205d7f023097b3284dd09bd32b604bc9bb962ee0ee16a421dfea179068cce951527d3
- SSDEEP 1536:gvk53jQ+fzzGh71AIqXcSkR6XOpfV+dssx8LZwrpF0G7IcbE2rmHppC1ztKpICMF:gWAnLsJ+pfVWbx0aEXDVC1RKxMeb1gzf
- TLSH T10CD312C23660D7EAC4C6DE87B991C8BB94F05AE6683BD4513906FE5C7C30B0EB6D4602
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Petya.A.exe
File Explorer
-
5334b3ffc7256b19783fd5f6049eec85970bdd2511fd9d5176282d5a15d1104d.zip.zip 131KB
-
5334b3ffc7256b19783fd5f6049eec85970bdd2511fd9d5176282d5a15d1104d.zip.zip 130KB
-
Petya.A.exe.exe 225KB
5334b3ffc7256b19783fd5f6049eec85970bdd2511fd9d5176282d5a15d1104d.zip
- SHA256 5334b3ffc7256b19783fd5f6049eec85970bdd2511fd9d5176282d5a15d1104d
- MD5 d6690d957a86036b1b723758f38b3bd9
- SHA1 b7e09e42cc33fcc18f85d497c8da281347159a5e
- SHA512 ff51c59af26f96fcd68d6eef5ac4e071410e6e04bb37b28e8f1587582f5763876954f57024915e37ec5a7031f41c8b699ab46e80edda2bd3f957f8b947e6cef5
- SSDEEP 3072:uD8TpWkoVEBpBkIG48h7zJbMWAHaCKUkkC8l2Vlj0LqelKb:A8TpxppBkI6zJbMWBPUltclOYb
- TLSH T187D312A90FF217019C59EA46C34737AB7F93C7B053E67C4610CA62CE834C84F9E96698
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Petya.A.exe
- IMPHASH 1a63922d5931d1bb8ca5188313f78eaa
- SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
- MD5 af2379cc4d607a45ac44d62135fb7015
- SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
- SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
- SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
- TLSH T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
94575
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
GoogleCrashHandler_unsigned.pdb
kernel32
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CreateSemaphoreW
FreeLibrary
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
LCMapStringW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
LocalFree
CreateDirectoryW
DeleteFileW
GetCurrentThread
WaitForMultipleObjects
LoadLibraryW
WaitForSingleObject
GetExitCodeProcess
DuplicateHandle
ReleaseMutex
GetEnvironmentVariableW
lstrcmpiW
VirtualQuery
GetTempPathW
GetLocalTime
OutputDebugStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcmpW
lstrlenW
SetFilePointer
CreateMutexW
InitializeCriticalSection
TryEnterCriticalSection
SetEvent
ResetEvent
GetFileAttributesExW
SetLastError
VerifyVersionInfoW
VerSetConditionMask
MoveFileExW
GetFileTime
ReadFile
DeviceIoControl
SetProcessWorkingSetSize
OpenProcess
CreateProcessW
ReadProcessMemory
lstrcpynW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CreateThread
DebugActiveProcess
GetThreadContext
DebugActiveProcessStop
VirtualQueryEx
GetProcessId
GetSystemInfo
ContinueDebugEvent
WaitForDebugEvent
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
GetCommandLineW
EncodePointer
LeaveCriticalSection
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
RtlCaptureContext
ReleaseSemaphore
EnterCriticalSection
OutputDebugStringW
DeleteCriticalSection
DecodePointer
HeapSize
GetProcAddress
GetLastError
RaiseException
HeapDestroy
InitializeCriticalSectionAndSpinCount
GetProcessHeap
GetModuleHandleW
HeapFree
IsDebuggerPresent
GetUserDefaultLangID
GetSystemDefaultLangID
GetComputerNameExW
GetOverlappedResult
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
UnregisterWait
GetProcessTimes
UnregisterWaitEx
RegisterWaitForSingleObject
VirtualProtect
VirtualAlloc
HeapAlloc
RemoveDirectoryW
HeapReAlloc
user32
SetClipboardData
EmptyClipboard
OpenClipboard
GetProcessWindowStation
CloseDesktop
CloseClipboard
CharUpperW
CharLowerW
PostThreadMessageW
DispatchMessageW
GetMessageW
PeekMessageW
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
SetThreadDesktop
CreateWindowStationW
CloseWindowStation
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
wvsprintfW
wsprintfW
MessageBoxW
advapi32
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorDacl
AddAce
InitializeAcl
GetAclInformation
InitializeSecurityDescriptor
MakeAbsoluteSD
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetAce
MakeSelfRelativeSD
GetSecurityDescriptorLength
EqualSid
SetNamedSecurityInfoW
ConvertStringSidToSidW
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
ConvertSidToStringSidW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SetSecurityDescriptorSacl
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
SetTokenInformation
ole32
CoCreateGuid
StringFromGUID2
shell32
SHGetFolderPathW
netapi32
NetApiBufferFree
NetWkstaGetInfo
rpcrt4
UuidCreate
shlwapi
PathRemoveExtensionW
PathRemoveFileSpecW
PathStripPathW
PathCanonicalizeW
PathIsRelativeW
SHQueryValueExW
PathAppendW
userenv
UnloadUserProfile
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
Name
.text
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=73, id=225, productName=VS2013 build 21005, version=21005,
count=30, id=223, productName=VS2013 build 21005, version=21005,
count=201, id=224, productName=VS2013 build 21005, version=21005,
count=2, id=225, version=20806,
count=4, id=206, version=65501,
count=33, id=203, version=65501,
count=468, id=1, productName=Unmarked objects,
count=101, id=229, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,