2024-03-02_bdeee13c6bf7ec1095a900d901cccc4e_cryptolocker

Sharing

Copy URL Twitter E-mail

General

Target
2024-03-02_bdeee13c6bf7ec1095a900d901cccc4e_cryptolocker
Size 399KB
Sample240302-vxg9mafd2w
SHA256 0790af18f7f7501939c42e06a96bb0dae193fc8cb1f9e4020b975d831ddbe836
MD5 bdeee13c6bf7ec1095a900d901cccc4e
SHA1 2d73924e966f5d088a070d2851517dffb444b1e1
SHA512 b8528da5e4fe701c6f84f6160a4d4435a30e59b4c36f22ab80b43dec9139dde92938524990194c6e96c38cc303a746feb1eaf32a2a8bbfc2e798bcb95a6a213e
SSDEEP 6144:DWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvCRlIQ3ARJa:DWkEuCaNT85I2vCMX5l+ZRvOKQ3ARJa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-02_bdeee13c6bf7ec1095a900d901cccc4e_cryptolocker

File Explorer

2024-03-02_bdeee13c6bf7ec1095a900d901cccc4e_cryptolocker

.exe 399KB

2024-03-02_bdeee13c6bf7ec1095a900d901cccc4e_cryptolocker

IMPHASH 7e8ad4139efc6cbcf31df3bc4b291dd8
SHA256 0790af18f7f7501939c42e06a96bb0dae193fc8cb1f9e4020b975d831ddbe836
MD5 bdeee13c6bf7ec1095a900d901cccc4e
SHA1 2d73924e966f5d088a070d2851517dffb444b1e1
SHA512 b8528da5e4fe701c6f84f6160a4d4435a30e59b4c36f22ab80b43dec9139dde92938524990194c6e96c38cc303a746feb1eaf32a2a8bbfc2e798bcb95a6a213e
SSDEEP 6144:DWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvCRlIQ3ARJa:DWkEuCaNT85I2vCMX5l+ZRvOKQ3ARJa
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_except_handler3 memcpy memmove _vsnprintf _vsnwprintf _purecall memset

kernel32

LoadLibraryW FreeLibrary GetProcAddress WideCharToMultiByte MultiByteToWideChar lstrcmpA GlobalLock GlobalAlloc GlobalUnlock GlobalFree CreateMutexW ReleaseMutex FindResourceExW LoadResource SizeofResource LockResource CreateProcessW SetFilePointerEx FindNextFileW SystemTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetSystemTime GetDateFormatW GetTimeFormatW GetCurrentThreadId HeapReAlloc HeapAlloc HeapFree GetProcessHeap GetEnvironmentVariableW CopyFileExW GetUserDefaultUILanguage DeleteCriticalSection FindClose FindFirstFileW DeleteFileW GetFileTime SetLastError GetFileSizeEx FlushFileBuffers ReadFile WriteFile SetFileTime ResumeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSection QueryPerformanceCounter SetFileAttributesW CreateFileW GetFileAttributesW Sleep GetTickCount MoveFileExW ExpandEnvironmentStringsW GetVolumeInformationW GetDiskFreeSpaceExW WaitForMultipleObjects ResetEvent GetTempPathW GetLogicalDrives GetDriveTypeW LocalFree CloseHandle CreateEventW GetLastError GetHandleInformation SetThreadPriority GetModuleFileNameW GetCurrentThread GetModuleHandleW SetEvent GetComputerNameW WaitForSingleObject SetErrorMode GetCommandLineW ExitProcess CreateThread

user32

MessageBoxIndirectW InSendMessage ClientToScreen GetWindowLongW GetClassNameW GetCaretPos TrackPopupMenu AppendMenuW GetCursorPos CreatePopupMenu SetMenuDefaultItem DestroyMenu LoadIconW CloseClipboard EmptyClipboard OpenClipboard SetClipboardData SystemParametersInfoW ScrollWindowEx GetSystemMetrics UpdateWindow SetScrollInfo MessageBoxW EndPaint ScreenToClient GetWindowRect DrawTextW GetParent GetClientRect IsDialogMessageW DestroyWindow BeginPaint DrawFocusRect IntersectRect GetDlgItem SendMessageW GetDlgCtrlID SetWindowTextW MoveWindow GetDC ReleaseDC CharLowerW PostQuitMessage MsgWaitForMultipleObjects TranslateMessage PeekMessageW DispatchMessageW SetTimer PostMessageW SetFocus RegisterClassExW FlashWindowEx InvalidateRect GetWindowTextW MonitorFromWindow SetWindowPos ShowWindow GetForegroundWindow AdjustWindowRectEx IsWindowVisible GetMonitorInfoW DefWindowProcW DialogBoxParamW SetWindowLongW EndDialog CreateDialogParamW MonitorFromPoint UnregisterClassW SetForegroundWindow GetKeyState ReplyMessage GetScrollInfo CreateWindowExW

advapi32

CryptAcquireContextW RegSetValueExW RegEnumKeyExW RegFlushKey CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptImportKey CryptEncrypt CryptGenKey CryptDestroyKey CryptDecrypt CryptGetHashParam CryptCreateHash CryptDestroyHash CryptHashData RegCreateKeyExW RegCloseKey CryptExportKey RegQueryValueExW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW

shell32

SHGetFileInfoW SHGetFolderPathW ShellExecuteExW CommandLineToArgvW

uxtheme

SetWindowTheme

gdi32

GetDeviceCaps CreateSolidBrush GetObjectW CreateCompatibleDC SelectObject DeleteObject SetBkMode SetBkColor DeleteDC SetTextColor GetObjectA CreateFontIndirectW

comctl32

InitCommonControlsEx ord413 ord410

shlwapi

StrCmpW StrCmpNW StrCmpIW PathMatchSpecW PathRemoveBackslashW PathAddBackslashW ord12 PathFindFileNameW PathRemoveFileSpecW PathUnquoteSpacesW StrChrW PathQuoteSpacesW

msimg32

AlphaBlend

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpQueryHeaders WinHttpWriteData WinHttpOpenRequest WinHttpReadData WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen

gdiplus

GdipAlloc GdipDisposeImage GdipCreateHBITMAPFromBitmap GdipCloneImage GdiplusStartup GdipDeleteBrush GdipCreateBitmapFromStream GdipCreateFontFromLogfontA GdipSetStringFormatLineAlign GdipDeleteFont GdipDeleteGraphics GdipDrawImageRectI GdipSetStringFormatAlign GdipCreateSolidFill GdipDrawString GdipCreateFromHDC GdipSetStringFormatHotkeyPrefix GdipCreateStringFormat GdipDeleteStringFormat GdipCreateFontFromDC GdipGetImageHeight GdipGetImageWidth GdiplusShutdown GdipFree GdipCloneBrush

ole32

CoInitializeEx CoUninitialize CoTaskMemFree StringFromGUID2

crypt32

CryptImportPublicKeyInfo CryptStringToBinaryA CryptDecodeObjectEx

Name

.text

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

248KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

bNjkolJu

Size

15KB

Virtual Size

14KB

Characteristics

Name

HkWrsSce

Size

512B

Virtual Size

89B

Characteristics

Name

EYQJMSXQ

Size

10KB

Virtual Size

9KB

Characteristics

Name

BihCcQAU

Size

13KB

Virtual Size

12KB

Characteristics

Name

shnVCvLS

Size

23KB

Virtual Size

22KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2024-03-02_bdeee13c6bf7ec1095a900d901cccc4e_cryptolocker

msvcrt

kernel32

user32

advapi32

shell32

uxtheme

gdi32

comctl32

shlwapi

msimg32

winhttp

gdiplus

ole32

crypt32

generic