2024-02-12_8b880a1fe5f53d590a9c458c5909da9a_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-12_8b880a1fe5f53d590a9c458c5909da9a_cryptolocker
Size

32KB
MD5

8b880a1fe5f53d590a9c458c5909da9a
SHA1

5cfc564aa68889b182d3eb82d8f34fce29b9d118
SHA256

79d21d596e985829daa370503e55b34035393f84cd51e4b574dd1cc7e6da8214
SHA512

b26c7e36a6743bfb2b81a3615b3b9a83ae84a11b67dc2d86a4f7e6351eb60b83e13248ad94d681fe6fa7b9ccec474e3fcf5e3dd61badc6c58349d678eb694de9
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoCt9/B1RwFtz:b7o/2n1TCraU6GD1a4Xt9bRwL

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-12_8b880a1fe5f53d590a9c458c5909da9a_cryptolocker

Files

2024-02-12_8b880a1fe5f53d590a9c458c5909da9a_cryptolocker
.exe windows:5 windows x86 arch:x86

78f4abb8610ca1c22ad9f81ecfabcc3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessage
BeginPaint
DispatchMessageA
DrawTextA
CreateWindowExA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
EndPaint
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ