2024-02-23_665023443443eab5bdc1b182da65e17a_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-23_665023443443eab5bdc1b182da65e17a_cryptolocker
Size

44KB
MD5

665023443443eab5bdc1b182da65e17a
SHA1

08b4038dcb0dcc3461d96d4a1b159be5e1a689fe
SHA256

ca3c1108e32b038cce1c3a4a97ea54e515ea43443989c7f9f25eb2f895ebfb58
SHA512

db493fb10826d9091cf946a4d72f209972e8b50df7c266bc5cd92a97e01274d9c3243a779793ac35d19fac19aca75297fb78f3de623c418a072f7f1c3c0cfd8c
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMRqmz4kmmIPo3:bc/y2lkF0+BjjIIm

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-23_665023443443eab5bdc1b182da65e17a_cryptolocker

Files

2024-02-23_665023443443eab5bdc1b182da65e17a_cryptolocker
.exe windows:5 windows x86 arch:x86

78f4abb8610ca1c22ad9f81ecfabcc3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessage
BeginPaint
DispatchMessageA
DrawTextA
CreateWindowExA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
EndPaint
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ