2024-02-20_487fb239e8faa25ec086f7f96d676959_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-20_487fb239e8faa25ec086f7f96d676959_cryptolocker
Size

33KB
MD5

487fb239e8faa25ec086f7f96d676959
SHA1

f937af244e07249dca2fde65907e62f33e79fc4f
SHA256

2ed4d543bacd582d5042cd4ae50b79baa579f1e76aee19a3f29aef0579a13941
SHA512

af13746e39fafed752aa13d491630d1efae00aae8deb5b10cc783f8a3bc742cf3418b97017d6f1d1f5e32b3ac8c633578d727ff3a82f032fdc87522f427fcfa5
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoCt9/B1RU3qKbJhR:b7o/2n1TCraU6GD1a4Xt9bRU6YJ

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-20_487fb239e8faa25ec086f7f96d676959_cryptolocker

Files

2024-02-20_487fb239e8faa25ec086f7f96d676959_cryptolocker
.exe windows:5 windows x86 arch:x86

78f4abb8610ca1c22ad9f81ecfabcc3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessage
BeginPaint
DispatchMessageA
DrawTextA
CreateWindowExA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
EndPaint
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ