2024-02-03_276684a82c7fcaf74b20f6cf9feec464_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-03_276684a82c7fcaf74b20f6cf9feec464_cryptolocker
Size

33KB
MD5

276684a82c7fcaf74b20f6cf9feec464
SHA1

39fc6dff195d1bc504f20366f6edadef0a3f0806
SHA256

cd60902c16c2ff8f9f136a408b6f070004d3654b34819a5f1361111b609ff2e4
SHA512

bc4ea47f2e0e82e3b089458a5986b7eed6ed6b0d281705d95a2f7e6030a04e6c383604caa325552b9f54b52ba1deb0d0447edd7415557fa3ce7dea5dd661e7a3
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzu02lOQAd:b/yC4GyNM01GuQMNXw2PSjHC02ltAd

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-03_276684a82c7fcaf74b20f6cf9feec464_cryptolocker

Files

2024-02-03_276684a82c7fcaf74b20f6cf9feec464_cryptolocker
.exe windows:5 windows x86 arch:x86

ad86a1414a0514f4c041167365378f70

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EndPaint
GetMessageA
DrawTextA
ShowWindow
UpdateWindow
DispatchMessageA
BeginPaint
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
GetWindowRect
LoadCursorA
PostQuitMessage
SetWindowPos

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
GetCurrentDirectoryA
FindClose
FindNextFileA
DeleteFileA
CloseHandle
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ