2024-01-27_322c0ffce98e1754a2e1d447f04d3500_cryptolocker | Triage

Sharing

General

Target

2024-01-27_322c0ffce98e1754a2e1d447f04d3500_cryptolocker
Size

39KB
MD5

322c0ffce98e1754a2e1d447f04d3500
SHA1

a6a77190e4d1ed20272ee29b03e97b6e69080fcd
SHA256

e37ad1335e6b19b7cd0bb22d41fde2f191117c965e3cb808ab5f67cdf9fa9079
SHA512

8142f8e9831f706068722a0cba47c0e70973a534b71e4320a5e2652ca50f862b11abc370f2267a21eb2c99ff5f18634420723794e940498b9f2a1fc7c940cd80
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAK:b/pYayGig5HjS3NPAK

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-27_322c0ffce98e1754a2e1d447f04d3500_cryptolocker

Files

2024-01-27_322c0ffce98e1754a2e1d447f04d3500_cryptolocker
.exe windows:5 windows x86 arch:x86

ad86a1414a0514f4c041167365378f70

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EndPaint
GetMessageA
DrawTextA
ShowWindow
UpdateWindow
DispatchMessageA
BeginPaint
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
GetWindowRect
LoadCursorA
PostQuitMessage
SetWindowPos

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
GetCurrentDirectoryA
FindClose
FindNextFileA
DeleteFileA
CloseHandle
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ