2024-02-21_78a25b3525cb8bc9e147fa963200d53e_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-21_78a25b3525cb8bc9e147fa963200d53e_cryptolocker
Size

39KB
MD5

78a25b3525cb8bc9e147fa963200d53e
SHA1

ecec2b5667e8d720eb7fb62b9d8fd7084fa23179
SHA256

129daa9cfb16f029e1bd8fca91f2285206c704cf7f9648e6b8efecb7106dd449
SHA512

b4a6a7ce19e02fec9d42d48c575e49d5f3f730e6ee5674e7af2e29ca6b4b92f777e504dbd7000dc72a3a2ac6e3624c5e849fb1cffb7069431ef4e824e4258db6
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMRYtk:bc/y2lkF0+Bl6

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-21_78a25b3525cb8bc9e147fa963200d53e_cryptolocker

Files

2024-02-21_78a25b3525cb8bc9e147fa963200d53e_cryptolocker
.exe windows:5 windows x86 arch:x86

78f4abb8610ca1c22ad9f81ecfabcc3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessage
BeginPaint
DispatchMessageA
DrawTextA
CreateWindowExA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
EndPaint
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ