NEAS[.]2023-09-06_cc268bd3be77cf8e09b802bfa5c46efe_cryptolocker_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-06_cc268bd3be77cf8e09b802bfa5c46efe_cryptolocker_JC.exe
Size

32KB
MD5

cc268bd3be77cf8e09b802bfa5c46efe
SHA1

fd1581b90982aa04037c21de5bfcbe4fed49973a
SHA256

65e4f3f3d41240f6d672b70c246d1113eb7a2eaee01bb9da0a9a6af854e7c329
SHA512

1a2a07a96a8f5c76d2ebba8e69858b424e744a0758e69d3b18c20a721d6ceafe8e067d80c659b6e49ef1fce2e4be148d893c1a96055b9e9799cebc220ebb2175
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4PfIJI:vj+jsMQMOtEvwDpj5HPfkI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2023-09-06_cc268bd3be77cf8e09b802bfa5c46efe_cryptolocker_JC.exe

Files

NEAS.2023-09-06_cc268bd3be77cf8e09b802bfa5c46efe_cryptolocker_JC.exe
.exe windows:5 windows x86

5c55d83b58dbc1f7154223c32a893074

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ShowWindow
PostQuitMessage
GetMessageA
EndPaint
DispatchMessageA
BeginPaint
TranslateMessage
MoveWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadCursorA
LoadIconA
UpdateWindow
GetWindowRect

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
FormatMessageA
FindClose
FindNextFileA
DeleteFileA
CloseHandle
GetCPInfo
GetACP
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 542B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ