popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis
BlackMatter Ransomware PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
ARCHIVE s1_win7_x6402 Oct. 13, 2023, 12:58 a.m. Oct. 13, 2023, 12:59 a.m.

Archive LBB.exe @ LBB_AEV-iledefrance.fr_05A8F2993F873622_12.08.23_aev_iledefrance.zip

Summary

Size 159.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 58ea73145bc83846a9beccfb54ef3b02
SHA1 69c34967b32e0f70e0f13b0b1a75ebded31f7621
SHA256 003aebec57fc45e6a04b9701fca7a082850445f36738addb6969c65bf778967f
SHA512
b6d27e14c2076e1d6c57e0dcec56a5c390d17fbcb05feb7b6288e3456a51a9a8e28e5d6eae5df7d5f9d4f3e48d829b392a3a36a6dacaf3489498e8cef806305b
CRC32 97DAF411
ssdeep 3072:nuJ9OlKolUa1U197bzhVsmftsF0v8VQi5nw13lA7i:nufj0zi1dNVsmftRG/nw87i
Yara
  • BlackMatter_Ransomware_IN - BlackMatter Ransomware
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .itext
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3064
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f90000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02120000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3064
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02121000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3064
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02125000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02136000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02137000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7750f000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0000a000', u'virtual_address': u'0x0001b000', u'entropy': 7.987164132297354, u'name': u'.data', u'virtual_size': u'0x0000adc0'} entropy 7.9871641323 description A section with a high entropy has been found
section {u'size_of_data': u'0x00004000', u'virtual_address': u'0x00026000', u'entropy': 7.932838445380543, u'name': u'.pdata', u'virtual_size': u'0x00003e37'} entropy 7.93283844538 description A section with a high entropy has been found
entropy 0.353312302839 description Overall entropy of this PE file is high