2024-01-26_3d00dbf9a09700ae5a046865508a0c57_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-26_3d00dbf9a09700ae5a046865508a0c57_cryptolocker
Size

43KB
MD5

3d00dbf9a09700ae5a046865508a0c57
SHA1

14cec1998d3dc45b1588e678316568a1f7b9ee9c
SHA256

d4cf79ee18b9c48f2f4f29e1aa5da1011446b78e1e02ab1d2b8b8d77ffc6f6d0
SHA512

25f25b06d0760baf8655ec251364484d5e33f9b75227f30e65df09c1c4a5209f7d1408fd9bcf01c3a4cdf9395c1f5e892c66a7fd380c18a65d48e3ac5fad04ec
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6D8jnPxBIGJu:bIDOw9a0Dwo3P1ojvUSD4PXIG8

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-26_3d00dbf9a09700ae5a046865508a0c57_cryptolocker

Files

2024-01-26_3d00dbf9a09700ae5a046865508a0c57_cryptolocker
.exe windows:5 windows x86 arch:x86

0bcae7989ef60f5550a7f5735f53a2aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EndPaint
GetMessageA
DispatchMessageA
ShowWindow
UpdateWindow
BeginPaint
TranslateMessage
MoveWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadCursorA
LoadIconA
PostQuitMessage
GetWindowRect

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
FindClose
FindNextFileA
DeleteFileA
CloseHandle
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 506B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ