General

Malware Config

Signatures

Files

• Ransomware.Locky.zip

  .zip

  Password: infected

• Locky

  .exe windows:4 windows x86

  Password: infected

  0fcea3af550ad0a893e93808dccf17f4

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  GetSecurityDescriptorDacl

  RegisterEventSourceA

  RegQueryInfoKeyA

  GetSidSubAuthorityCount

  RegSetValueExA

  RegDeleteKeyA

  GetKernelObjectSecurity

  RegCloseKey

  RegQueryValueA

  RegLoadKeyA

  GetSidSubAuthority

  RegConnectRegistryA

  LookupPrivilegeValueA

  InitiateSystemShutdownA

  CreateProcessAsUserA

  GetSidIdentifierAuthority

  OpenThreadToken

  LsaQueryInformationPolicy

  RegQueryValueW

  EncryptFileW

  RegSetValueW

  MakeAbsoluteSD

  RegOpenKeyExA

  RegCreateKeyExW

  AddAce

  SetNamedSecurityInfoW

  OpenEventLogW

  GetUserNameW

  SetSecurityDescriptorSacl

  MakeSelfRelativeSD

  RegFlushKey

  InitializeSecurityDescriptor

  InitializeAcl

  SetEntriesInAclA

  GetSidLengthRequired

  RegSetValueA

  SetEntriesInAclW

  GetAclInformation

  user32

  DrawIconEx

  IsDialogMessageA

  OffsetRect

  PostThreadMessageW

  DialogBoxParamA

  GetLastActivePopup

  GetGUIThreadInfo

  DrawStateA

  IsWindow

  OpenClipboard

  InSendMessage

  FindWindowW

  IsMenu

  EnumDisplaySettingsA

  DrawAnimatedRects

  FrameRect

  SetMenuDefaultItem

  GrayStringW

  CreateDialogIndirectParamW

  ClientToScreen

  GetParent

  TranslateMDISysAccel

  CreateDesktopW

  ShowCaret

  GetProcessWindowStation

  TrackPopupMenu

  IntersectRect

  DialogBoxIndirectParamA

  DefWindowProcA

  ReuseDDElParam

  NotifyWinEvent

  SetClipboardData

  CloseClipboard

  DdeDisconnect

  GetClassNameA

  GetCaretPos

  CharLowerW

  GetWindowModuleFileNameA

  IsWindowVisible

  wvsprintfA

  ModifyMenuA

  SendDlgItemMessageW

  SetCaretBlinkTime

  LoadMenuW

  GetMenuState

  DrawTextExA

  ChangeDisplaySettingsW

  CreateWindowExW

  GetCapture

  CreatePopupMenu

  SetMenu

  CharUpperBuffW

  DrawStateW

  LoadImageA

  GetScrollPos

  GetDlgItem

  GetClipboardFormatNameW

  ValidateRgn

  GetWindowThreadProcessId

  GetClassInfoExW

  DdeAccessData

  ShowWindow

  GetKeyboardLayout

  GetClassInfoW

  SetCaretPos

  LoadCursorA

  FillRect

  LoadMenuA

  mouse_event

  ModifyMenuW

  InvalidateRgn

  GetMenuItemID

  IsIconic

  OemToCharA

  LoadCursorFromFileW

  RegisterWindowMessageA

  DispatchMessageW

  GetCursorPos

  CharPrevA

  GetWindowWord

  imm32

  ImmGetProperty

  ImmGetCandidateListCountA

  ImmGetCompositionStringA

  ImmSetConversionStatus

  ImmSetOpenStatus

  ImmCreateContext

  ImmGetOpenStatus

  ImmNotifyIME

  ImmInstallIMEA

  ImmGetContext

  ImmDestroyContext

  ImmSimulateHotKey

  ImmConfigureIMEA

  ImmAssociateContext

  rasapi32

  RasDialA

  RasGetProjectionInfoA

  kernel32

  WriteFileGather

  PulseEvent

  GetLongPathNameA

  Sections

  .text

  Size: 48KB - Virtual size: 44KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 8KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 16KB - Virtual size: 3.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 104KB - Virtual size: 100KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ