LockBit.iso
- SHA256 91c3d9de90635f38e9ac25c69846edb2a950f52b891379e6cdd285961255fb98
Overview
overview
10Static
static
10LockBit.iso
windows11-ltsc_2024-x64
32513d6678b...44.exe
windows11-ltsc_2024-x64
10274e5ff2aa...eb2214
windows11-ltsc_2024-x64
32908589ca1...3abac6
windows11-ltsc_2024-x64
348b0a4505a...76.exe
windows11-ltsc_2024-x64
105e1f61b9c1...86.exe
windows11-ltsc_2024-x64
58f71897987...72.exe
windows11-ltsc_2024-x64
595daa771a2...7c.exe
windows11-ltsc_2024-x64
5a1539b21e5...c70335
windows11-ltsc_2024-x64
3bf4443f6db...374326
windows11-ltsc_2024-x64
3c462c6b02b...ae.exe
windows11-ltsc_2024-x64
10ca93d47bcc...8e2e25
windows11-ltsc_2024-x64
3e47032b3d1...4d.exe
windows11-ltsc_2024-x64
10eb0c1d8218...4b.exe
windows11-ltsc_2024-x64
10Behavioral task
behavioral1
Sample
LockBit.iso
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
4 signatures
600 seconds
Behavioral task
behavioral2
Sample
2513d6678b476a432af2e84fff485b44.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral3
Sample
274e5ff2aa33e7ec980700e617eb2214
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
1 signatures
600 seconds
Behavioral task
behavioral4
Sample
2908589ca1a1f5d98c7f71563a3abac6
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
1 signatures
600 seconds
Behavioral task
behavioral5
Sample
48b0a4505a96a640300e43e2af712276.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral6
Sample
5e1f61b9c1c27cad3b7a81c804ac7b86.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
8f718979876dd1050ce4f729d69e0072.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral8
Sample
95daa771a28eaed76eb01e1e8f403f7c.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral9
Sample
a1539b21e5d6849a3e0cf87a4dc70335
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
1 signatures
600 seconds
Behavioral task
behavioral10
Sample
bf4443f6dbbdee8816aa9a1098374326
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
1 signatures
600 seconds
Behavioral task
behavioral11
Sample
c462c6b02b35df2910689947c5090fae.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
13 signatures
600 seconds
Behavioral task
behavioral12
Sample
ca93d47bcc55e2e1bd4a679afc8e2e25
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
1 signatures
600 seconds
Behavioral task
behavioral13
Sample
e47032b3d1b9cbbcf77741d5d260004d.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
13 signatures
600 seconds
Behavioral task
behavioral14
Sample
eb0c1d82187ec3fe980eed2419875e4b.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
19 signatures
600 seconds
General
- Target LockBit.iso
- Size 10.0MB
- Sample261027-bentxazzcs
- SHA256 91c3d9de90635f38e9ac25c69846edb2a950f52b891379e6cdd285961255fb98
- MD5 f9f13fa9f60023201a8d1168d12c4fe7
- SHA1 7c775aa7d704c6f95cf45d68b24a513367ab0be9
- SHA512 c368386da4dffc808714e2173210f96f6b7db68af486d520a9069ced2ece52a638ea4b4701da4740e95c9d8ccc5ce76b486e97415606879e0a3c4b9399229062
- SSDEEP 98304:olMaClRvQPlsyEsSyEsgP5v6AWyEss6BsAk0Ew0e9Fwh5O0Ew0eel:oeaC0oxLHDk0Ew0M0Ew03
- TLSH T119B66B0AF31295B8C822DCF89DCBA121E3147C5C022675FAB7C05F65BE657D2A32958F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Rule to detect Lockbit 3.0 ransomware Windows payload 3 IoCs
resource yara_rule static1/unpack002/2513d6678b476a432af2e84fff485b44 family_lockbit static1/unpack002/48b0a4505a96a640300e43e2af712276 family_lockbit static1/unpack002/eb0c1d82187ec3fe980eed2419875e4b family_lockbit - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack002/8f718979876dd1050ce4f729d69e0072 - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack002/2513d6678b476a432af2e84fff485b44 unpack002/48b0a4505a96a640300e43e2af712276 unpack002/c462c6b02b35df2910689947c5090fae unpack002/e47032b3d1b9cbbcf77741d5d260004d unpack002/eb0c1d82187ec3fe980eed2419875e4b - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/5e1f61b9c1c27cad3b7a81c804ac7b86 unpack002/95daa771a28eaed76eb01e1e8f403f7c
File Explorer
-
LockBit.iso.iso 10.0MB
-
out.iso.iso 10.0MB
-
2513d6678b476a432af2e84fff485b44.exe 158KB
-
274e5ff2aa33e7ec980700e617eb2214.elf 76KB
-
2908589ca1a1f5d98c7f71563a3abac6.elf 76KB
-
48b0a4505a96a640300e43e2af712276.exe 158KB
-
5e1f61b9c1c27cad3b7a81c804ac7b86.exe 691KB
-
8f718979876dd1050ce4f729d69e0072.exe 698KB
-
95daa771a28eaed76eb01e1e8f403f7c.exe 693KB
-
a1539b21e5d6849a3e0cf87a4dc70335.elf 400KB
-
bf4443f6dbbdee8816aa9a1098374326.elf 76KB
-
c462c6b02b35df2910689947c5090fae.exe 5.0MB
-
ca93d47bcc55e2e1bd4a679afc8e2e25.elf 376KB
-
e47032b3d1b9cbbcf77741d5d260004d.exe 1.1MB
-
eb0c1d82187ec3fe980eed2419875e4b.exe 158KB
out.iso
- SHA256 91c3d9de90635f38e9ac25c69846edb2a950f52b891379e6cdd285961255fb98
- MD5 f9f13fa9f60023201a8d1168d12c4fe7
- SHA1 7c775aa7d704c6f95cf45d68b24a513367ab0be9
- SHA512 c368386da4dffc808714e2173210f96f6b7db68af486d520a9069ced2ece52a638ea4b4701da4740e95c9d8ccc5ce76b486e97415606879e0a3c4b9399229062
- SSDEEP 98304:olMaClRvQPlsyEsSyEsgP5v6AWyEss6BsAk0Ew0e9Fwh5O0Ew0eel:oeaC0oxLHDk0Ew0M0Ew03
- TLSH T119B66B0AF31295B8C822DCF89DCBA121E3147C5C022675FAB7C05F65BE657D2A32958F
- MD5 SHA1 SHA512 SSDEEP TLSH
2513d6678b476a432af2e84fff485b44
- IMPHASH 3bc510de773c954bd69d33670cb624d6
- SHA256 b33136d1d5c4b3a8192ef0090ef4e4a6f0985cee76fd6455ea48186fc4b5192f
- MD5 2513d6678b476a432af2e84fff485b44
- SHA1 298037c0ae2c8f50f7aaed55adb51f8f4f6e2020
- SHA512 0dadd00b2889dafdcf441cc5c44986aa1b6135b27b2770ccd69c6c3f022089eee25058577c9d8455dba55144bd9edfe55e77edf9a12ca36a48cace0d9edcc5f8
- SSDEEP 3072:5DDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP33686kjTRM7zT7kjwsMCOW9xW:z5d/zugZqll3OkjTeo8sMS9
- TLSH T18DF37D31B151D137CA6638F1A729B3B0739A9E2C12A9A463F6E4CF4B35738236F15847
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
111727
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap
user32
LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW
kernel32
GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
274e5ff2aa33e7ec980700e617eb2214
- SHA256 91f627056f548c5f35a93ae59459b96d7d43d5cd24e78974ffc3d709829c1bd5
- MD5 274e5ff2aa33e7ec980700e617eb2214
- SHA1 c0bfb0c35d000ebf3240c2a2c308f258e774b782
- SHA512 7e0536070a85783024cd86579eca02285decaef1935b75a575456d162d669637647331b8d22b61ba2245cfb2d50bb05077a2188ed56b80d925547746d28b07a7
- SSDEEP 1536:r2AgMun5RyBxIlJZTJ7EdULv8gPT9UMGCS17yP2smfxGa+D3e/DeQP8Y:r4JZTJ7EdULv8gPT9MFYBuqw
- TLSH T18C73D6BFCF6E516ED183B178D6DB80F7C56061BC8361015F6B04151AAB3A4E18FA932B
- MD5 SHA1 SHA512 SSDEEP TLSH
2908589ca1a1f5d98c7f71563a3abac6
- SHA256 ceedba3300715db7c323e7e23f28427b81cb73463004fa4141c7b4ba446891bd
- MD5 2908589ca1a1f5d98c7f71563a3abac6
- SHA1 e002c4d2529eb80c2a9066393f5d8fa7f725f1fd
- SHA512 1db2857f51ede1e653662ee45a2a48dfb68c30a9f43a82a2d1169a18b7e6b89b32fc6dc8296638b403f4c38bb09e66b20d773265c086a740b47f2b049180c078
- SSDEEP 1536:nFvgMun5RyBxIlJZTJ7EdULv8gPT9UMGCi17yP2smfxGa+Dde/jeQP8Y:nSJZTJ7EdULv8gPT9M1YBEKw
- TLSH T13973D6BFCF6E516ED183B178D6DB80F7C56061BC8361015F6B04151AAB3A4E18FA932B
- MD5 SHA1 SHA512 SSDEEP TLSH
48b0a4505a96a640300e43e2af712276
- IMPHASH 3bc510de773c954bd69d33670cb624d6
- SHA256 9dc03bf850b41f93331ddca0fb401d2ce08fba97ebde53b675c611583f892a80
- MD5 48b0a4505a96a640300e43e2af712276
- SHA1 3fdf2e4194d87b8c02629293f4d1da33d4cd2ae4
- SHA512 1bb2d44f153d95092802778358c80c41ff04b2249aec3f03907ebfab51cb8d41476c99247936c4018baa0b48784f7d8cd42fc5ba8de53de5aa494488b9044d6b
- SSDEEP 3072:+DDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368JfsO6RlmluE2g/Z81fW:I5d/zugZqll31UO8muhgx8
- TLSH T114F37D217152D037CA6634F2A329B3B1738A9E2C13A9A467FAD4CF4B35738236F15947
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
111727
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap
user32
LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW
kernel32
GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
5e1f61b9c1c27cad3b7a81c804ac7b86
- SHA256 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38
- MD5 5e1f61b9c1c27cad3b7a81c804ac7b86
- SHA1 c1888ba296f57e87a84411ddfce3cabc4536b142
- SHA512 cc3fb6954fe4d1754c816c9bbd05ba1ec320d2a71410993026c02137629edf5abb1d6b46ba45b6ce460f58b9d8e62214d9600785a79ef0571390db8779bc7c31
- SSDEEP 12288:0LxxJniMoRpKP9W1u19Ol9tyHDdZIYTbviWYbn8wBNsavTduK14UqMs5XRhazKj:0LIJvyHDPVXahbnNBNgfUjs5Xuz
- TLSH T129E4DFADED0699A0C453F1BCFE0BB4D053157EA44F3AB2A7781915E20A738E43A753C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
4d:74:a0:3f:76:c4:11:60:7a:63:d9:01:fc:b7:59:0d:78:19:61:f6:4b:e5:de:cc:2e:6b:a4:9f:4d:05:e5:f9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=ConocoPhillips,OU=Operations,O=ConocoPhillips,L=Brisbane,C=AU,1.2.840.113549.1.9.1=#0c176365727440636f6e6f636f7068696c6c6970732e636f6d
Chains
Oct 26, 2026
CN=ConocoPhillips,OU=Operations,O=ConocoPhillips,L=Brisbane,C=AU,1.2.840.113549.1.9.1=#0c176365727440636f6e6f636f7068696c6c6970732e636f6d
Subject
CN=ConocoPhillips,OU=Operations,O=ConocoPhillips,L=Brisbane,C=AU,1.2.840.113549.1.9.1=#0c176365727440636f6e6f636f7068696c6c6970732e636f6d
Serial Number
01
Issuer
CN=ConocoPhillips,OU=Operations,O=ConocoPhillips,L=Brisbane,C=AU,1.2.840.113549.1.9.1=#0c176365727440636f6e6f636f7068696c6c6970732e636f6d
Timespan
Sep 12, 2015 - Sep 11, 2019
Minor OS version
0
Major OS version
0
Entry point
94512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
203KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
462KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
8f718979876dd1050ce4f729d69e0072
- SHA256 3194ab5e2a174e9f859e8fb6d2a33ac7aa15dc1af0da512910cf869fb15f1ebd
- MD5 8f718979876dd1050ce4f729d69e0072
- SHA1 fda895c21e11f8af195420d5b556604e8aea466d
- SHA512 26df353b61cf3f5060c98a9dd57734960ef75c8d3d8d53199bf51e314a9aff30201ca670d5cf2d4c87732e365fc2e8199dd5f392c514f44ab811287f67eb9792
- SSDEEP 12288:4IC61NP3XxNWFAol3miH/vMnnb0jjv+RMRgSAiWYbn8wBNsavTduK14UqMs5KoQd:PLb0/Hg0hbnNBNgfUjs5KP5QrW/P
- TLSH T105E4D069ED469C60CB93A47C795AF5D05200395C9F1BA2FB7C0D09E12E738893BB1F86
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
70:ad:d6:44:be:a8:41:08:f1:42:38:83:80:cc:3e:98:e1:8f:a7:14:50:9a:f9:44:c5:f2:76:92:a6:68:c2:00
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Paccar,OU=Security,O=Paccar,L=Marseille,C=FR,1.2.840.113549.1.9.1=#0c0f63657274407061636361722e636f6d
Chains
Oct 26, 2026
CN=Paccar,OU=Security,O=Paccar,L=Marseille,C=FR,1.2.840.113549.1.9.1=#0c0f63657274407061636361722e636f6d
Subject
CN=Paccar,OU=Security,O=Paccar,L=Marseille,C=FR,1.2.840.113549.1.9.1=#0c0f63657274407061636361722e636f6d
Serial Number
01
Issuer
CN=Paccar,OU=Security,O=Paccar,L=Marseille,C=FR,1.2.840.113549.1.9.1=#0c0f63657274407061636361722e636f6d
Timespan
Oct 23, 1991 - Oct 22, 1992
Minor OS version
0
Major OS version
0
Entry point
97632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
209KB
Virtual Size
209KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
463KB
Virtual Size
462KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
95daa771a28eaed76eb01e1e8f403f7c
- SHA256 7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82
- MD5 95daa771a28eaed76eb01e1e8f403f7c
- SHA1 cdd5717fd3bfd375c1c34237c24073e92ad6dccc
- SHA512 cb7258f8c7d5e77be30df63f73a16667be839a51613509012a41d90cd8456400c237c681d1cdae10213b83e2e2315760c2f4acee02e55f1430c0e90bc69eb35c
- SSDEEP 12288:q/tJbVY7R6CCJ5RqRhoS2KMPKZb8VEtiWYbn8wBNsavTduK14UqMs5+p6uaYwsjE:q/XuwyZAVEEhbnNBNgfUjs5+8RsXsx
- TLSH T1D0E4D0ADFD4A8960D553F5BCBE1EB49153017AB80F39A2B7740925E10E738D83AB13C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
6a:2b:28:a7:ef:40:f5:71:b4:e0:75:ca:f1:dc:9c:b1:45:f4:ff:dd:42:fc:c5:e7:a6:21:21:eb:33:de:78:32
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=BorgWarner,OU=Engineering,O=BorgWarner,L=Clementi,C=SG,1.2.840.113549.1.9.1=#0c136365727440626f72677761726e65722e636f6d
Chains
Oct 26, 2026
CN=BorgWarner,OU=Engineering,O=BorgWarner,L=Clementi,C=SG,1.2.840.113549.1.9.1=#0c136365727440626f72677761726e65722e636f6d
Subject
CN=BorgWarner,OU=Engineering,O=BorgWarner,L=Clementi,C=SG,1.2.840.113549.1.9.1=#0c136365727440626f72677761726e65722e636f6d
Serial Number
01
Issuer
CN=BorgWarner,OU=Engineering,O=BorgWarner,L=Clementi,C=SG,1.2.840.113549.1.9.1=#0c136365727440626f72677761726e65722e636f6d
Timespan
Jun 19, 1993 - Jun 18, 1996
Minor OS version
0
Major OS version
0
Entry point
99728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
206KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
462KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
a1539b21e5d6849a3e0cf87a4dc70335
- SHA256 90b06f07eb75045ea3d4ba6577afc9b58078eafeb2cdd417e2a88d7ccf0c0273
- MD5 a1539b21e5d6849a3e0cf87a4dc70335
- SHA1 561db92000409fe7093964452143ec371f930681
- SHA512 abec982850df65ca1d4d357a8bf78fe0082a5363afe3de5a6d99d2f7a925346f4f43478d3e7ba78bc1e9f36ae4a125130b87962ae4c91f45fc7fd3a26f7a9a04
- SSDEEP 6144:9/D84JsDWucUi+qEg4SRg/zRJNT26aflCbt:dD8Ss8lsAyfF4du
- TLSH T1A6944907A2A320FCCEC3C4322FAB3163527BBD4D231BBEE1379A5621659BA711761745
- MD5 SHA1 SHA512 SSDEEP TLSH
bf4443f6dbbdee8816aa9a1098374326
- SHA256 50855b7b0397025da43e6d79a45f8d6bafc4752b30b5c4658c5b733040669178
- MD5 bf4443f6dbbdee8816aa9a1098374326
- SHA1 befcb29ff5c904e9c840f45ae149e7a99e4b778f
- SHA512 b63fd549f2ad78990ff5ad2d1818f35d4c54c2c12fa6ec13638ec1325e6180b6caf80a268b442028a0c2582e2406ed17326f7f31023d3b5efd9a0f0bc4d64a7a
- SSDEEP 1536:q7jlMun5RyBxIlJZTJ7EdULv8gPT9UMGCZ17yP2sGfxGa+UyTsDeQP:q5JZTJ7EdULv8gPT9MOYaItw
- TLSH T17373E6BFCF6E516ED183B178D6DB40F7C56061BC8361016F6B04151AAB3A4E18FA932B
- MD5 SHA1 SHA512 SSDEEP TLSH
c462c6b02b35df2910689947c5090fae
- SHA256 8dacc9ed62ced2922ae89b4fc4c99ed5242b3eb8abb8cabd9a8dac08b699b026
- MD5 c462c6b02b35df2910689947c5090fae
- SHA1 5b14cec6279e1f14e6d7270049ea6a220ac60682
- SHA512 2afe3485ba5be2c2465b9c3cd664a5ed371c57c1a3587413e1f1e6c6684ea87c7418678262172b129a6d7ae3727269fc04b24a12eb9f97f90715c6ffaf9d62d4
- SSDEEP 24576:BjsFMuOmHEw0UxI38mhK5XE3qZvGID29Q:Bjs60Ew0Ux68miEo
- TLSH T14936C60AF35196E8CC36DDF988CAA520E3147C58016579FAA7C05F65BF587C2A31A8CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
0
Entry point
970112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ca93d47bcc55e2e1bd4a679afc8e2e25
- SHA256 4dc06ecee904b9165fa699b026045c1b6408cc7061df3d2a7bc2b7b4f0879f4d
- MD5 ca93d47bcc55e2e1bd4a679afc8e2e25
- SHA1 41e1e094c19fffde494c24ef4cab0d7577d5a025
- SHA512 cb21b5cc6992327741e173a69ebe79283fbd665a35ce6e6d489626946873c0097c19fa66252507236213c2a7e03258c6660a8fa61813108843efd0932fdfb861
- SSDEEP 6144:UIUFThyET/ZOhh5++4hg3nTBiHnqAHDYpzKaN7arPSnSURUd:3UFsmZOhh5+TWkCz6zunc
- TLSH T18A845A07A29320FCCEC385322FAB3113626BBE4E271EBED1379A9621758B6711771751
- MD5 SHA1 SHA512 SSDEEP TLSH
e47032b3d1b9cbbcf77741d5d260004d
- SHA256 b3651b3d1a93b9033f62e3e930a747ef291787957d2dcbef237b6811e52977c5
- MD5 e47032b3d1b9cbbcf77741d5d260004d
- SHA1 93b4dcdc5f9368bc8a75a992b64cf7ba833fd377
- SHA512 521b74b49e1c50281516e8296033d6adde0cffb2369602ef570fd8f11208374491f423e7d067846e417033d01d8af7ba228e37b3582d892052aa2e8e15d7d337
- SSDEEP 12288:BVQuU5FMuw8vgp4oaEw0UxI3DKP0SqnhK5vPszr3hYpexmVvGIA+V18k2BTFi2:BjsFMuOmHEw0UxI38mhK5XE3qZvGID2
- TLSH T1B835B60AF35196E8CC36DDF988CAA520E3147C58016579FAA7C05F65BF587C2A31A8CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
0
Entry point
970112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
eb0c1d82187ec3fe980eed2419875e4b
- IMPHASH 3bc510de773c954bd69d33670cb624d6
- SHA256 cd4756e895e0ac4878d5914365577f752094d8cb507b69dd0649dc9cbc41bbcc
- MD5 eb0c1d82187ec3fe980eed2419875e4b
- SHA1 f9e95b6e84024c3c900c563b2600b4ab6db0c3b3
- SHA512 155f4e0b023c1576021348198a62ef5df259aa522b13e7679ed2ee9ac6b8b94f2b98c6084ec18fe189e1a24422ce061384e4ec923442f50daeb27fc1f780abe3
- SSDEEP 3072:JDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368DXl6axtwVi8SsnnEHA8W:D5d/zugZqll3vX9xOY6nEH
- TLSH T1E1F37D217112D137CA6738F2A729B3B073899E2C12A9A467F6E4CF4B35738236F15947
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
111727
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap
user32
LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW
kernel32
GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ