Behavioral task
behavioral1
Sample
PasswordLock.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PasswordLock.exe
Resource
win10v2004-20230220-en
General
-
Target
c0042.zip
-
Size
1.1MB
-
MD5
b01d1c3d3ffb9b34c04125e2c73f2700
-
SHA1
69b3935cf2b7eabaadbf5f06180aa6f0ff034447
-
SHA256
9a1979f27e3bec4cbbd3124ff06b25c7bfbf1820b7ea899f9d4eec84c5877f93
-
SHA512
61fce81729af2dd63146ae1b908424700403fdb7a34280272321b42799703160b2288d725b266b442e612f317c5d574c2ff6221420cac5b9d7a99dc7defcae86
-
SSDEEP
24576:EdL9WQ10YfwofyMcX5KpJTGS1citNaYxPa9rwIP69rSCI612p:EbWQR/aMtzuYo9LPAup6U
Malware Config
Signatures
-
resource yara_rule static1/unpack001/PasswordLock.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PasswordLock.exe
Files
-
c0042.zip.zip
Password: infected
-
PasswordLock.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 380KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE