2024-02-17_c92ca6da4f232c72566c27d432be4d04_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-17_c92ca6da4f232c72566c27d432be4d04_cryptolocker
Size

39KB
MD5

c92ca6da4f232c72566c27d432be4d04
SHA1

b7e0c53787400590bbde3cc34c2c618a1d23dd14
SHA256

14e3dcc9c8fc778172337b34de5d393234c57c9f5258d3fa977b4fa4af07640d
SHA512

b13fb62b34fd427f78a13b40092b4f53fbc02a29913feaa50145f06c0b48dea4ab0291548f6037192a37f274cffc23baa4dd288b9f8db340314a8a8afdb0dc9f
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8+Z5H:b/pYayGig5HjS3N+XH

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-17_c92ca6da4f232c72566c27d432be4d04_cryptolocker

Files

2024-02-17_c92ca6da4f232c72566c27d432be4d04_cryptolocker
.exe windows:5 windows x86 arch:x86

ad86a1414a0514f4c041167365378f70

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EndPaint
GetMessageA
DrawTextA
ShowWindow
UpdateWindow
DispatchMessageA
BeginPaint
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
GetWindowRect
LoadCursorA
PostQuitMessage
SetWindowPos

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
GetCurrentDirectoryA
FindClose
FindNextFileA
DeleteFileA
CloseHandle
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ