winloscker[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

winloscker.exe
Size

336KB
MD5

a161bb62752c4f69bba6fff127fbb46b
SHA1

fe99a246a4fa58641034e517153c0d70dac92110
SHA256

e2cf8c9be8449bc0ff4c4c1cc84d00fe0d2fc1a1233b8d25e492444c4b7a5ed3
SHA512

6a71adaad9f93de2f05ed5279194b0d083e7385fe103bb66be31151b3f26181804658a8349a47c81af3647df1810c17dc7359c7ab529684ef78862e39967a1a9
SSDEEP

6144:tIs1ydPc4IvjTZlyZsDDyr3rXUR3AzUCpM69/KImQi/6ebo:Ojlc4IrTZlyGDco3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winloscker.exe

Files

winloscker.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ