2024-02-22_3f0bcaf20e5cf3d5764aa560b40cd66c_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-22_3f0bcaf20e5cf3d5764aa560b40cd66c_cryptolocker
Size

41KB
MD5

3f0bcaf20e5cf3d5764aa560b40cd66c
SHA1

801893d9e56aadb6abd93a08f35627aae781a474
SHA256

2679768628afc8f9741cace2f53ea94f28d253923487b2a145d9fd026ab6800e
SHA512

aae1ced239a8ad7dcdb9d706c2b0feeda83bf3d0f0146357ec760b0a0bf3becc98b7e6bc1d3f25e37739a38237cd6d0d27ec4f2802f94f95329d0716c4284450
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunrkwIxZdedVm:btB9g/WItCSsAGjX7e9N0hunrknQVlY

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-22_3f0bcaf20e5cf3d5764aa560b40cd66c_cryptolocker

Files

2024-02-22_3f0bcaf20e5cf3d5764aa560b40cd66c_cryptolocker
.exe windows:5 windows x86 arch:x86

a2bfa209044e11b72a41f731968fdff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
PostQuitMessage
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ