General

Malware Config

Signatures

Files

• 2024-06-19_79d41e803ff07bb5a9cbe4171a4fd09d_bkransomware

  .exe windows:5 windows x86 arch:x86

  d18cde94cdc6e930f022e2819d39a2bd

  
  

  Code Sign

  01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  19-09-2018 00:00

  Not After

  28-01-2028 12:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  15-06-2016 00:00

  Not After

  15-06-2024 00:00

  Subject

  CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageOCSPSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:01:26:d6:3e:13:eb:63:f8:2b:0d:4e

  Certificate

  Issuer

  CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

  Not Before

  19-08-2019 11:26

  Not After

  19-08-2020 11:26

  Subject

  SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  9b:39:c1:85:15:48:13:79:50:82:73:89:7f:c3:2c:27:34:dd:d8:67:17:10:21:3d:ff:6d:99:be:23:ff:51:b8

  Signer

  Actual PE Digest

  9b:39:c1:85:15:48:13:79:50:82:73:89:7f:c3:2c:27:34:dd:d8:67:17:10:21:3d:ff:6d:99:be:23:ff:51:b8

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  PDB Paths

  C:\bamboo-build\LAUN-WCC177-JOB1\3rdParty\wix\wix3.10.4-sources\build\ship\x86\burn.pdb

  Imports

  advapi32

  OpenProcessToken

  GetTokenInformation

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCloseKey

  RegOpenKeyExW

  CreateWellKnownSid

  InitializeAcl

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetSecurityDescriptorOwner

  SetNamedSecurityInfoW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegCreateKeyExW

  RegDeleteKeyW

  RegDeleteValueW

  RegEnumKeyExW

  RegEnumValueW

  RegQueryInfoKeyW

  RegQueryValueExW

  RegSetValueExW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  InitiateSystemShutdownExW

  GetUserNameW

  DecryptFileW

  SetEntriesInAclW

  ChangeServiceConfigW

  CloseServiceHandle

  ControlService

  OpenSCManagerW

  OpenServiceW

  QueryServiceStatus

  SetEntriesInAclA

  SetSecurityDescriptorGroup

  CryptDestroyHash

  CryptHashData

  CryptCreateHash

  CryptGetHashParam

  CryptReleaseContext

  CryptAcquireContextW

  QueryServiceConfigW

  user32

  PeekMessageW

  PostMessageW

  IsWindow

  WaitForInputIdle

  MessageBoxW

  GetMessageW

  MsgWaitForMultipleObjects

  PostThreadMessageW

  GetMonitorInfoW

  MonitorFromPoint

  IsDialogMessageW

  LoadCursorW

  LoadBitmapW

  SetWindowLongW

  GetWindowLongW

  GetCursorPos

  CreateWindowExW

  UnregisterClassW

  RegisterClassW

  DefWindowProcW

  DispatchMessageW

  TranslateMessage

  PostQuitMessage

  oleaut32

  SysFreeString

  SysAllocString

  VariantInit

  VariantClear

  gdi32

  StretchBlt

  SelectObject

  DeleteObject

  DeleteDC

  CreateCompatibleDC

  GetObjectW

  shell32

  SHGetFolderPathW

  CommandLineToArgvW

  ShellExecuteExW

  ole32

  CoUninitialize

  CoInitializeEx

  CoInitialize

  StringFromGUID2

  CoCreateInstance

  CoTaskMemFree

  CoInitializeSecurity

  CLSIDFromProgID

  kernel32

  TerminateProcess

  InitializeCriticalSectionAndSpinCount

  SetUnhandledExceptionFilter

  IsValidCodePage

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  GetStartupInfoW

  GetFileType

  GetACP

  GetOEMCP

  GetCPInfo

  UnhandledExceptionFilter

  LoadLibraryExW

  GetStdHandle

  DecodePointer

  EncodePointer

  SetLastError

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetCommandLineW

  SystemTimeToFileTime

  CloseHandle

  CreateFileW

  GetProcAddress

  LocalFree

  HeapSetInformation

  GetLastError

  GetModuleHandleW

  FormatMessageW

  lstrlenA

  lstrlenW

  MultiByteToWideChar

  WideCharToMultiByte

  LCMapStringW

  Sleep

  GetLocalTime

  GetModuleFileNameW

  RtlUnwind

  GetTempPathW

  GetTempFileNameW

  CreateDirectoryW

  GetFullPathNameW

  CompareStringW

  GetCurrentProcess

  GetVersionExW

  GetCurrentProcessId

  WriteFile

  SetFilePointer

  LoadLibraryW

  GetSystemDirectoryW

  CreateFileA

  HeapAlloc

  HeapReAlloc

  HeapFree

  HeapSize

  GetProcessHeap

  FindClose

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  RemoveDirectoryW

  SetFileAttributesW

  GetFileAttributesW

  DeleteFileW

  FindFirstFileW

  FindNextFileW

  MoveFileExW

  FreeLibrary

  GlobalAlloc

  GlobalFree

  GetFileSizeEx

  ReadFile

  SetFilePointerEx

  SetFileTime

  CopyFileW

  GetCurrentThreadId

  InitializeCriticalSection

  DeleteCriticalSection

  ReleaseMutex

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  CreateProcessW

  VerSetConditionMask

  EnterCriticalSection

  LeaveCriticalSection

  GetSystemTime

  GetNativeSystemInfo

  GetModuleHandleExW

  GetWindowsDirectoryW

  GetSystemWow64DirectoryW

  GetComputerNameW

  VerifyVersionInfoW

  GetVolumePathNameW

  GetDateFormatW

  GetSystemDefaultLangID

  GetUserDefaultLangID

  GetStringTypeW

  DuplicateHandle

  InterlockedExchange

  InterlockedCompareExchange

  CreateEventW

  ProcessIdToSessionId

  OpenProcess

  GetProcessId

  WaitForSingleObject

  ConnectNamedPipe

  SetNamedPipeHandleState

  CreateNamedPipeW

  CreateThread

  GetExitCodeThread

  SetEvent

  WaitForMultipleObjects

  InterlockedIncrement

  InterlockedDecrement

  ResetEvent

  SetEndOfFile

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  CompareStringA

  GetExitCodeProcess

  SetThreadExecutionState

  CopyFileExW

  MapViewOfFile

  UnmapViewOfFile

  CreateMutexW

  CreateFileMappingW

  GetThreadLocale

  GetTimeZoneInformation

  SystemTimeToTzSpecificLocalTime

  OutputDebugStringW

  GetConsoleCP

  GetConsoleMode

  SetStdHandle

  WriteConsoleW

  ExpandEnvironmentStringsW

  GetSystemTimeAsFileTime

  VirtualFree

  VirtualAlloc

  GetModuleHandleA

  ExitProcess

  LoadLibraryExA

  RaiseException

  FlushFileBuffers

  rpcrt4

  UuidCreate

  Sections

  .text

  Size: 282KB - Virtual size: 281KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 118KB - Virtual size: 118KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 158KB - Virtual size: 157KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .zero

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ