2024-02-17_30dcd08f3a0ffb9a78db9bc78f2ab2d4_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-17_30dcd08f3a0ffb9a78db9bc78f2ab2d4_cryptolocker
Size

35KB
MD5

30dcd08f3a0ffb9a78db9bc78f2ab2d4
SHA1

d82ea3d3ff5a48f9668a28bc9d1d735689431ef1
SHA256

3e868f8584f38352f3374b0fbc05a82d55b00c31ea218f247e5661fd588b1dac
SHA512

598ed8b78fdfa301b449b0d58c143baea649286ed4a0b3524e5bbfbe61a313fa717e0807319e7122e7a3b8f7e2084c4f4090d885dfb50ac001682c7e1448db6b
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSzn1KkZ1a2:b/yC4GyNM01GuQMNXw2PSj1Prz

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-17_30dcd08f3a0ffb9a78db9bc78f2ab2d4_cryptolocker

Files

2024-02-17_30dcd08f3a0ffb9a78db9bc78f2ab2d4_cryptolocker
.exe windows:5 windows x86 arch:x86

ad86a1414a0514f4c041167365378f70

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EndPaint
GetMessageA
DrawTextA
ShowWindow
UpdateWindow
DispatchMessageA
BeginPaint
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
GetWindowRect
LoadCursorA
PostQuitMessage
SetWindowPos

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
GetCurrentDirectoryA
FindClose
FindNextFileA
DeleteFileA
CloseHandle
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ