2024-02-14_915a5091766449861b69a4e0c2b78022_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-14_915a5091766449861b69a4e0c2b78022_cryptolocker
Size

56KB
MD5

915a5091766449861b69a4e0c2b78022
SHA1

1aa8187f81151006202a3071ce416bdaa482ba87
SHA256

b8274b873345ffef18c31acb023f13dd23e02c4eb82affbcf38d214ec70de7de
SHA512

7c41bc8b8c3c423dc7d330a4a453b5ef34f5e19e9243622c792635771cd952aa43890a7cd4516d78c7a94c9b029bafc29ffee05b857e23d083e1b273a8fa4224
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUH7:btng54SMLr+/AO/kIhfoKMHde

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-14_915a5091766449861b69a4e0c2b78022_cryptolocker

Files

2024-02-14_915a5091766449861b69a4e0c2b78022_cryptolocker
.exe windows:5 windows x86 arch:x86

a2bfa209044e11b72a41f731968fdff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
PostQuitMessage
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ