WinLockForKirill[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WinLockForKirill.exe
Size

443KB
MD5

b86b08e7fd6e0940d858a656d5b9742c
SHA1

01cdf1176c39179429827dd310578d73412a8faa
SHA256

8e78d4dd44e2d87e0ce02e6719c6e4216007fa274e8d19123ffee1b0aa58f340
SHA512

ade205a3b52a2fbe7924af7d56392dcc5b90af24540b883ca4919f0ae02094c1c86d43fa871978521f5c0c5d6c4752e04ba2df60380b7fc20b87f78189039f1f
SSDEEP

12288:6txZtxim7xbyl+s6Fp29dhtZKJbCVdz+btlV:wX8W6+VFw93tZKJbCVE9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinLockForKirill.exe

Files

WinLockForKirill.exe
.exe windows x86

fd091cf3211a377595fdbb9a846d8568

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

CharNextA

advapi32

RegCloseKey

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

SaveDC

ole32

CoInitialize

comctl32

ImageList_Add

shell32

SHGetFileInfoA

ntdll

RtlAdjustPrivilege
RtlSetProcessIsCritical

Sections

.MPRESS1
Size: 427KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE