jaffacakes118_Trojan-Ransom[.]Win32[.]Cryptor[.]bql[.]f6b7dbc3fcc9f61430e5db6e3ecc314e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.f6b7dbc3fcc9f61430e5db6e3ecc314e
Size 204KB
Sample261006-vj2fcastev
SHA256 8c317a224815928cd57d87685284baf27fc84e2e37642b26b6052d882779e0a8
MD5 f6b7dbc3fcc9f61430e5db6e3ecc314e
SHA1 3d2d0ec206ad00d3e49213805767f0a235916fea
SHA512 2ff209c5674db9ca9863b1d49f4db16fe134fd808149771997c4a1b5b478a10eb4e8cdb10d5faa953cc4ced7e8436d3ecd8bf5977beded35e08f82f4d9f01bd4
SSDEEP 3072:c+5k6qWFvYKRPPlgEOTved7vQ7/77xev+8nnkWQVlgBM1HSPH1Ya99a:753qGvYKRPdghTvOIxevznkOOFw1Yia
TLSH
T13114CFCBB801D1B4F8709531AB199EF26BB17D33C690555BF3C47F26F8B3026562A246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.f6b7dbc3fcc9f61430e5db6e3ecc314e

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.f6b7dbc3fcc9f61430e5db6e3ecc314e

.exe 204KB

jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.f6b7dbc3fcc9f61430e5db6e3ecc314e

IMPHASH 7820410a776571d1b18ff13f1c700b38
SHA256 8c317a224815928cd57d87685284baf27fc84e2e37642b26b6052d882779e0a8
MD5 f6b7dbc3fcc9f61430e5db6e3ecc314e
SHA1 3d2d0ec206ad00d3e49213805767f0a235916fea
SHA512 2ff209c5674db9ca9863b1d49f4db16fe134fd808149771997c4a1b5b478a10eb4e8cdb10d5faa953cc4ced7e8436d3ecd8bf5977beded35e08f82f4d9f01bd4
SSDEEP 3072:c+5k6qWFvYKRPPlgEOTved7vQ7/77xev+8nnkWQVlgBM1HSPH1Ya99a:753qGvYKRPdghTvOIxevznkOOFw1Yia
TLSH
T13114CFCBB801D1B4F8709531AB199EF26BB17D33C690555BF3C47F26F8B3026562A246
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8263

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree GetProcessHeap GetModuleHandleA GetEnvironmentVariableW CreateProcessW TerminateProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot CreateMutexW SetThreadExecutionState MulDiv ExitThread InterlockedExchange InterlockedExchangeAdd ReleaseMutex WideCharToMultiByte MultiByteToWideChar SetLastError SystemTimeToFileTime GetSystemTime GetVolumeNameForVolumeMountPointW GetDriveTypeW FreeLibrary GetLogicalDrives LoadLibraryW GetCommandLineW GetFileSize WaitForSingleObject GetComputerNameW GetModuleHandleW IsBadReadPtr GetGeoInfoW GetUserGeoID GetVersionExW HeapAlloc HeapReAlloc CreateThread DuplicateHandle DeleteCriticalSection QueryDosDeviceW ResetEvent EnterCriticalSection LeaveCriticalSection TerminateThread OpenProcess InitializeCriticalSection GetLogicalDriveStringsW GetCurrentProcess FindNextFileW lstrcmpiW RemoveDirectoryW GetTempPathW GetCurrentThread FindFirstFileW GetFileInformationByHandle DeleteFileW WaitForMultipleObjects CreateFileMappingW FindClose MoveFileW VirtualAlloc GetFileSizeEx GetOverlappedResult VirtualFree FlushViewOfFile SetFilePointerEx SetEndOfFile UnmapViewOfFile MapViewOfFile GetTickCount GetLastError GetFileAttributesW WriteFile SetEvent CreateDirectoryW Sleep GetVolumeInformationW SetFileAttributesW LocalFree GetCurrentProcessId ReadFile GetModuleFileNameW CreateFileW GetProcAddress CreateEventW GetSystemInfo GetUserDefaultUILanguage CloseHandle GetWindowsDirectoryW ExitProcess

user32

CharToOemW SystemParametersInfoW SetRect GetDC DrawTextW CharUpperW GetSystemMetrics ReleaseDC

advapi32

CryptExportKey GetLengthSid CryptGetHashParam CryptAcquireContextW CryptSetKeyParam CryptReleaseContext CryptGenRandom CryptImportKey CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDestroyHash CryptHashData OpenThreadToken MapGenericMask AccessCheck SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken FreeSid RevertToSelf SetEntriesInAclW AllocateAndInitializeSid ImpersonateSelf SetNamedSecurityInfoW GetFileSecurityW IsWellKnownSid

shlwapi

PathCombineW PathRemoveFileSpecW PathFindFileNameW PathFindExtensionW PathIsDirectoryW PathUnquoteSpacesW PathRemoveBackslashW PathStripToRootW PathAddExtensionW PathAddBackslashW wvnsprintfA wvnsprintfW SHDeleteValueW PathFileExistsW StrCmpNIW PathAppendW PathStripPathW

ole32

StringFromGUID2 CLSIDFromString

shell32

SHChangeNotify SHGetFolderPathW CommandLineToArgvW ShellExecuteW

crypt32

CryptDecodeObjectEx CryptStringToBinaryW CryptBinaryToStringW CryptEncodeObject CryptExportPublicKeyInfo

wininet

InternetCrackUrlA InternetCloseHandle InternetSetOptionA HttpQueryInfoA InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA InternetOpenA InternetQueryOptionA

psapi

GetMappedFileNameW

mpr

WNetCloseEnum WNetOpenEnumW WNetCancelConnection2W WNetAddConnection2W WNetEnumResourceW WNetGetConnectionW

netapi32

NetShareEnum NetApiBufferFree

gdi32

GetDIBits CreateFontW CreateCompatibleBitmap GetObjectW SelectObject DeleteObject SetBkMode GetDeviceCaps DeleteDC SetTextColor BitBlt CreateCompatibleDC

Name

.text

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.avd

Size

3KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.axa

Size

35KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.f6b7dbc3fcc9f61430e5db6e3ecc314e

kernel32

user32

advapi32

shlwapi

ole32

shell32

crypt32

wininet

psapi

mpr

netapi32

gdi32

generic