2024-02-23_1e847ebf91e4ea2a3b7885aaf2715111_cryptolocker | Triage

Sharing

General

Target

2024-02-23_1e847ebf91e4ea2a3b7885aaf2715111_cryptolocker
Size

35KB
MD5

1e847ebf91e4ea2a3b7885aaf2715111
SHA1

a21717fbec5758bdf1b01a1f0300383c9f3a5a94
SHA256

0783b1bf74ab5db97215562392e2cb3cd449068f2ff3e85624c4e38182ed3c12
SHA512

e6dce55784cdc52cdca5b3cfb1cf130fb8a9b70182775f2c8def245443acee4eb28903642b45e5200ffba68aa4fe0877f2bc6851655c29571afdf452cc16cecc
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSzn1KkZQYfR:b/yC4GyNM01GuQMNXw2PSj1POU

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-23_1e847ebf91e4ea2a3b7885aaf2715111_cryptolocker

Files

2024-02-23_1e847ebf91e4ea2a3b7885aaf2715111_cryptolocker
.exe windows:5 windows x86 arch:x86

ad86a1414a0514f4c041167365378f70

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EndPaint
GetMessageA
DrawTextA
ShowWindow
UpdateWindow
DispatchMessageA
BeginPaint
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
GetWindowRect
LoadCursorA
PostQuitMessage
SetWindowPos

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
GetCurrentDirectoryA
FindClose
FindNextFileA
DeleteFileA
CloseHandle
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ