49f98647df2041186d414f655f673171

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2022-Sep-09 01:27:01

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: .itext
Malicious VirusTotal score: 65/74 (Scanned on 2024-09-11 19:37:16) ALYac: Trojan.Ransom.LockBit
APEX: Malicious
AVG: Win32:Evo-gen [Trj]
AhnLab-V3: Ransomware/Win.LockBit.R521581
Alibaba: Ransom:Win32/Lockbit.a5257617
Antiy-AVL: Trojan/Win32.LockBit
Arcabit: Trojan.Ransom.PIC
Avast: Win32:Evo-gen [Trj]
Avira: BDS/ZeroAccess.Gen7
BitDefender: Trojan.Ransom.PIC
Bkav: W32.RWLockbit3LQ.Trojan
CAT-QuickHeal: Ransom.Lockbit.S28885638
CTX: malware (ai score=88)
ClamAV: Win.Ransomware.BlackMatter-9965914-0
CrowdStrike: win/malicious_confidence_100% (D)
Cybereason: malicious.7df204
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
DrWeb: Trojan.PWS.Siggen3.22687
ESET-NOD32: a variant of Win32/Filecoder.BlackMatter.O
Elastic: Windows.Ransomware.Lockbit
Emsisoft: Trojan.Ransom.PIC (B)
F-Secure: Backdoor.BDS/ZeroAccess.Gen7
FireEye: Generic.mg.49f98647df204118
Fortinet: W32/Conwise.RCE!tr
GData: Win32.Trojan-Ransom.BlackMatter.A
Google: Detected
Gridinsoft: Ransom.Win32.Qadars.oa!s1
Ikarus: Trojan-Ransom.LockBit
Jiangmin: Trojan.Crypmodng.cd
K7AntiVirus: Ransomware ( 005a74ef1 )
K7GW: Trojan ( 005b2d561 )
Kaspersky: HEUR:Trojan-Ransom.Win32.Lockbit.gen
Kingsoft: malware.kb.a.1000
Lionic: Trojan.Win32.Lockbit.tsu4
Malwarebytes: Generic.Malware.AI.DDS
MaxSecure: Trojan.Malware.300983.susgen
McAfee: BlackMatter!49F98647DF20
McAfeeD: Real Protect-LS!49F98647DF20
MicroWorld-eScan: Trojan.Ransom.PIC
Microsoft: Ransom:Win32/Lockbit.AK!ibt
NANO-Antivirus: Virus.Win32.Gen.ccmw
Paloalto: generic.ml
Panda: Trj/Genetic.gen
Rising: Ransom.LockBit!1.DFDC (CLASSIC)
Sangfor: Ransom.Win32.Save.LockBit30
SentinelOne: Static AI - Malicious PE
Skyhigh: BehavesLike.Win32.BlackMatter.cc
Sophos: Troj/Lockbit-W
Symantec: Ransom.Lockbit!g6
TACHYON: Ransom/W32.Agent.149504.C
Tencent: Trojan-Ransom.Win32.BlackMatter.b
Trapmine: malicious.high.ml.score
TrendMicro: Ransom.Win32.LOCKBIT.SMYXCJN
VBA32: TrojanRansom.Crypmodng
VIPRE: Trojan.Ransom.PIC
Varist: W32/BlackMatter.C.gen!Eldorado
ViRobot: Trojan.Win.Z.Lockbit.149504.G
VirIT: Ransom.Win32.LockBit.GEN
Yandex: Trojan.Filecoder!Rr0XixrjzqM
Zillya: Trojan.Filecoder.Win32.26912
ZoneAlarm: HEUR:Trojan-Ransom.Win32.Generic
alibabacloud: RansomWare:Win/Lockbit.x1glab
huorong: HVM:Ransom/LockFile.b

Hashes

MD5 49f98647df2041186d414f655f673171
SHA1 fb0d65c21888ab2d4d7f7988665820da2164a889
SHA256 1f0f097319469ad7d46a9ef91b223789787e2c7f94f1898e1948d7ee2352bef4
SHA3 a66b42508d2b34a13f20b4e7f91c77d278e100ec947cfbc4c1e70434044b1751
SSDeep 3072:I6glyuxE4GsUPnliByocWepXWJ0iixh6h4ej/m:I6gDBGpvEByocWe8fhhC
Imports Hash 41fb8cb2943df6de998b35a9d28668e8

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2022-Sep-09 01:27:01
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x18400
SizeOfInitializedData 0xc600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0001946F (Section: .itext)
BaseOfCode 0x1000
BaseOfData 0x1a000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x28000
SizeOfHeaders 0x400
Checksum 0x2a31f
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x400000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 cfbda2c44e51b3b0b00bcbbc767c62a2
SHA1 5d12d573caddd78d39ef56deaf9afe44636ae19b
SHA256 000a9a8b1440e44cde00fd7acc5bdda6efc34f09e404de77cff1f5298e0af369
SHA3 66f7dbc831841670efb8619f83e7ec7a8e3bc69bbd05c375f63fd26f52fc6939
VirtualSize 0x17de8
VirtualAddress 0x1000
SizeOfRawData 0x17e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.63408

.itext

MD5 6f4cd57381bb5584c0a0755384d25180
SHA1 cb11158c1015fe374692a37bd5a355d24747b5c5
SHA256 38f20ce7e2c9381f3a07f666269d4f509565f5aa40d19aa383a8afd583bf60c2
SHA3 887698b53683b372a31a2a484c47dd5016eae0459abf9111530c926eb50d585d
VirtualSize 0x546
VirtualAddress 0x19000
SizeOfRawData 0x600
PointerToRawData 0x18200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 2.93374

.rdata

MD5 bd829aa493ecd52fe5bec776d207f206
SHA1 9395632b4179a552c4f32d8e27c29dc78690d862
SHA256 ce47d70dffec241b1a8e768bc48eb91352a2275202b52ec299995bdee67a426a
SHA3 082df37f9afd3616f93a896216d2875a842a06ff61d74bdd5c45f08946fa31cb
VirtualSize 0x492
VirtualAddress 0x1a000
SizeOfRawData 0x600
PointerToRawData 0x18800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.53664

.data

MD5 6148342e383555cc2173114c1f34ed59
SHA1 be5ace2785f3a5ced83a7ed1fc954066270e8959
SHA256 4496739579ad4db37221c28d4a1fd0c666c81927e2df44d67b159e509b12cc59
SHA3 e4486e7b252a7934735aed69824604726603e4fa8ff16dd4396281abe61a9564
VirtualSize 0xadc8
VirtualAddress 0x1b000
SizeOfRawData 0xa000
PointerToRawData 0x18e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.98766

.pdata

MD5 e91c4aef960913f018a92bd6ac47db9f
SHA1 6a35866f37cb0d30a4c95e32b4b05d15a80ea1f3
SHA256 64ae9c46d38a40f7fbef6c50d9321500d7553d6233cdf410466e36ad7e31eec8
SHA3 f4b8f26ecc56b18cbf8395587bc032bcc097d4811563958a7f8c4bd9ab311f76
VirtualSize 0x813
VirtualAddress 0x26000
SizeOfRawData 0xa00
PointerToRawData 0x22e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.06901

.reloc

MD5 3f87e4c23650dfad0bee7da98889ba94
SHA1 31d4fc7c274a70cf70eaf45af1a96c4e6fffd7da
SHA256 7b8a35469d264f92e4d13f7537e5ee98d40b2776426c0ad90298326533ad9e5e
SHA3 fa1fde871e084f46a2a0e2df12f8402f9adaba1adafe65f88efa0b4b10d4cb95
VirtualSize 0xfd0
VirtualAddress 0x27000
SizeOfRawData 0x1000
PointerToRawData 0x23800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.73899

Imports

gdi32.dll SetPixel
SetDCBrushColor
SelectPalette
GetTextColor
GetDeviceCaps
CreateSolidBrush
USER32.dll DefWindowProcW
CreateMenu
EndDialog
GetDlgItem
GetKeyNameTextW
GetMessageW
GetWindowTextW
IsDlgButtonChecked
LoadImageW
LoadMenuW
DialogBoxParamW
KERNEL32.dll SetLastError
LoadLibraryW
GetTickCount
GetLastError
GetCommandLineW
GetCommandLineA
FreeLibrary

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2022-Sep-09 01:27:01
Version 0.0
SizeofData 244
AddressOfRawData 0x1a13c
PointerToRawData 0x1893c

TLS Callbacks

Load Configuration

RICH Header

Errors

<-- -->