jaffacakes118_Trojan-Ransom[.]Win32[.]SageCrypt[.]dqs[.]bb320b7f121f0c7392a0f205686ce064

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dqs.bb320b7f121f0c7392a0f205686ce064
Size 300KB
Sample261016-ev3jsag19l
SHA256 a281cd08289794f2ef8973316f22d6ec9d844da22faffde36b9c53a1cff0207b
MD5 bb320b7f121f0c7392a0f205686ce064
SHA1 f5f4ef498fc082e161afdaebf771735a9c4692b0
SHA512 7315e799d7c50aa91745b486f475812d810f9ec01c78efc2fbd261d1bd97cdb4a58675103c6fcffa5480895930430ec606d4449d35c7998dc25014e7652f9f84
SSDEEP 6144:+M1bR5erR7vwO4SF/DQMT1HgMJXXZbeVvc4dwxBEXJL7pOtNHGgH7Jv:+MNRYmErQwgGXJipc4dwxBEXJL7pOtN1
TLSH
T12B64F681B620DC7AE9A750F8C771CDF09A473F60C8628957A14C3EAF76B2D5739231A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dqs.bb320b7f121f0c7392a0f205686ce064

File Explorer

jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dqs.bb320b7f121f0c7392a0f205686ce064

.exe 300KB

jaffacakes118_Trojan-Ransom.Win32.SageCrypt.dqs.bb320b7f121f0c7392a0f205686ce064

IMPHASH 7c0ee929c18d8f3e0dd0ad21dcacb22a
SHA256 a281cd08289794f2ef8973316f22d6ec9d844da22faffde36b9c53a1cff0207b
MD5 bb320b7f121f0c7392a0f205686ce064
SHA1 f5f4ef498fc082e161afdaebf771735a9c4692b0
SHA512 7315e799d7c50aa91745b486f475812d810f9ec01c78efc2fbd261d1bd97cdb4a58675103c6fcffa5480895930430ec606d4449d35c7998dc25014e7652f9f84
SSDEEP 6144:+M1bR5erR7vwO4SF/DQMT1HgMJXXZbeVvc4dwxBEXJL7pOtNHGgH7Jv:+MNRYmErQwgGXJipc4dwxBEXJL7pOtN1
TLSH
T12B64F681B620DC7AE9A750F8C771CDF09A473F60C8628957A14C3EAF76B2D5739231A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comdlg32

PrintDlgW

msvcrt

_except_handler3 _controlfp _onexit _kbhit atof _strnicoll wcsstr fgetwc wcsrchr _mbsncpy _mbsinc _yn __dllonexit _beginthreadex _fpreset __set_app_type _iob _strncoll _adj_fdiv_m32 _osver _locking iswascii _wcsupr __RTtypeid is_wctype _exit _XcptFilter exit _acmdln __getmainargs __p__fmode __p__commode _adjust_fdiv _initterm __setusermatherr

odbc32

SQLGetConnectAttrA SQLAllocConnect SQLForeignKeysW SQLSetConnectOptionW SQLExtendedFetch SQLErrorW SQLGetTypeInfoW SQLFreeStmt SQLRowCount SQLBrowseConnectW SQLBrowseConnectA SQLDriversA SQLEndTran SQLTablePrivilegesW SQLSetDescFieldA ODBCGetTryWaitValue SQLDataSourcesW VFreeErrors SQLGetDescFieldW SQLForeignKeysA SQLSetConnectAttrA SQLSpecialColumnsW SQLProceduresW SQLGetInfoW

ole32

CoMarshalInterThreadInterfaceInStream

activeds

ADsFreeEnumerator SecurityDescriptorToBinarySD

xolehlp

DtcGetTransactionManagerC DtcGetTransactionManagerExA

gdi32

PlayMetaFile SetBoundsRect SetTextAlign StrokeAndFillPath GetPixel RealizePalette SetBkColor SetPolyFillMode ResizePalette

kernel32

SetThreadPriority SetEvent CloseHandle GetProcAddress OpenEventW VirtualAlloc SetFilePointer PeekConsoleInputA SetConsoleScreenBufferSize SetFilePointerEx Process32FirstW ReadConsoleA SetHandleInformation GetModuleHandleA lstrcpynW GetModuleHandleA LoadLibraryA GetStartupInfoA