3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795.zip
- SHA256 6f4265cbcc928d9a8dab5d6fe62042dd65dfcefa609b61f8c80ce29d35da7fa8
Password
infected
Behavioral task
behavioral1
Sample
3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795.exe
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target 3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795.zip
- Size 107KB
- Sample261024-vgetkaa15y
- SHA256 6f4265cbcc928d9a8dab5d6fe62042dd65dfcefa609b61f8c80ce29d35da7fa8
- MD5 d2ed1554eb08b2d3e74b20732d58f937
- SHA1 d2ac7710b6ecf9dbf26e99b44a448b6a989f14ed
- SHA512 65a216d19cb96f936e1e1acccdfd0720cd1a4aef750cbbead05bc226eee5fc1e40ede39dff87ab73b60e92ed89141ff394955709eb808c91915e24e5bd7c0691
- SSDEEP 3072:lIGOkGLiB1FWCn85cntEJ0nbqtfbEp7YOSGNv4QWqNM91O:lRuiBiCWcntO0yjo7TS4QQ1q9s
- TLSH T1B7B312178AF77D60E30B13F8139783DEE0635B64690BE6094BD91603E522F129F5FA89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: BallerWare
BallerWare is a Windows ransomware written in C++.
- Detects BallerWare ransomware 1 IoCs
resource yara_rule static1/unpack001/3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795.exe family_ballerware - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795.exe
File Explorer
-
3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795.zip.zip 107KB
-
3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795.exe.exe 466KB
3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795.exe
- IMPHASH 82ba05beab8826c673d9acbdaf9e7b68
- SHA256 3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795
- MD5 93088380940f6812fc2721f9540e1b10
- SHA1 23b4b0e6c81e6ec04da72aded5d490660c600175
- SHA512 cf47aa691a152fc42b95b653a71c9a3ece64d5bce396bf4db2451b96a15159cee10252c4e5fc8106a039ff7e570285d6d3ad59dbee833edac1801298176728a5
- SSDEEP 12288:lpBgd9d4dSdSXEiDxHPB4w6IXSuw9R1Vi:lpBgd9d4dSdnZR1Vi
- TLSH T166A4F9932ACF4CF6EDC22B3879C75239973AFDA4CF694B5B8544D1302843AC46D6A781
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BallerWare ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
ClearEventLogA
CloseEventLog
CloseServiceHandle
CreateServiceA
CryptAcquireContextA
CryptDestroyKey
CryptEncrypt
CryptGenRandom
CryptImportKey
CryptReleaseContext
OpenEventLogA
OpenSCManagerA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
StartServiceA
libgcc_s_seh-1
_Unwind_Resume
kernel32
CloseHandle
CopyFileA
CreateFileA
CreateMutexA
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
GetFileSizeEx
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetTickCount
InitializeCriticalSection
IsDBCSLeadByte
LeaveCriticalSection
MoveFileExA
Process32First
Process32Next
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WriteFile
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_fmode
_initterm
_vscprintf
_vsnprintf
atexit
abort
calloc
exit
fflush
fprintf
free
malloc
memcmp
memcpy
memmove
memset
rand
setvbuf
signal
sscanf_s
strcmp
strlen
strncmp
strstr
system
vfprintf
netapi32
NetApiBufferFree
NetShareEnum
libwinpthread-1
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
shell32
SHGetFolderPathA
libstdc++-6
_ZNKSi6gcountEv
_ZNKSt9basic_iosIcSt11char_traitsIcEE3eofEv
_ZNKSt9basic_iosIcSt11char_traitsIcEE5rdbufEv
_ZNKSt9basic_iosIcSt11char_traitsIcEEcvbEv
_ZNSi4readEPcx
_ZNSo5writeEPKcx
_ZNSolsEPFRSt8ios_baseS0_E
_ZNSolsEd
_ZNSolsEi
_ZNSolsEm
_ZNSt13random_device7_M_finiEv
_ZNSt13random_device7_M_initERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZNSt13random_device9_M_getvalEv
_ZNSt14basic_ifstreamIcSt11char_traitsIcEE5closeEv
_ZNSt14basic_ifstreamIcSt11char_traitsIcEE7is_openEv
_ZNSt14basic_ifstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode
_ZNSt14basic_ifstreamIcSt11char_traitsIcEEC1ERKNSt7__cxx1112basic_stringIcS1_SaIcEEESt13_Ios_Openmode
_ZNSt14basic_ifstreamIcSt11char_traitsIcEED1Ev
_ZNSt14basic_ofstreamIcSt11char_traitsIcEE5closeEv
_ZNSt14basic_ofstreamIcSt11char_traitsIcEEC1ERKNSt7__cxx1112basic_stringIcS1_SaIcEEESt13_Ios_Openmode
_ZNSt14basic_ofstreamIcSt11char_traitsIcEED1Ev
_ZNSt15basic_streambufIcSt11char_traitsIcEE5sgetcEv
_ZNSt15basic_streambufIcSt11char_traitsIcEE6sbumpcEv
_ZNSt6thread15_M_start_threadESt10unique_ptrINS_6_StateESt14default_deleteIS1_EEPFvvE
_ZNSt6thread20hardware_concurrencyEv
_ZNSt6thread4joinEv
_ZNSt6thread6_StateD2Ev
_ZNSt6thread6detachEv
_ZSt17__throw_bad_allocv
_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base
_ZSt19__throw_logic_errorPKc
_ZSt20__throw_length_errorPKc
_ZSt20__throw_system_errori
_ZSt21__glibcxx_assert_failPKciS0_S0_
_ZSt28__throw_bad_array_new_lengthv
_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_
_ZSt9terminatev
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVNSt6thread6_StateE
_ZdlPvy
_Znwy
__cxa_begin_catch
__cxa_end_catch
__cxa_rethrow
__gxx_personality_seh0
user32
MessageBoxA
SystemParametersInfoA
wininet
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
ws2_32
WSAStartup
closesocket
connect
gethostname
htons
inet_pton
ioctlsocket
select
socket
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
672B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1024B
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/97
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
512B
Virtual Size
509B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ