t��"�VV'ʉ8r�nn��0��D=���йW����҈E�<�"��V���8�х��Y�e�^.��&������F;149?MfMO�&����=�7��6����P�L�EXa'��0�a��2� 0'�\ⳕ �ƃ"7ˍ�m�B��=Lv$p_���Cl�v��3�"/�פb�?�7k��h)'�.��՞tևÄ�KF�����Se��aᖡ�f�& J������[��Gf6�*���L���V�M%M�i�b%Yjn>� p_[��u�SϾ�=���� �\5��@��IDyƎ�_�5� -w{<�&�V!b�u���i[ �?���v�q� c���GV%8+���!a��t�+�ÉG-�����~ ���)S�5m��9�m���#��-#�Kuոi����[4��7�# ENK�fIN��T�+diG3�#�R�5[ή-4���k��*�M��/k&���r8�X���tG|�"��=.�Z!�Ӄ���[i�i��FeX����%�C�az�5:O"�N?!-�7�� ��i�C�BF�}��u��H���l�L���e���=�^�z$��g3���V�dJe�����a�`��@ �1J�N�I#�v��� /Z[Fo�QJk�]T(�q�ԉ���/���&,��.��ӵ���r�����Sb����;�]��>�^��aDW8#�_ ��[C�a���V�C��vV�����/��K=a�N7q�U?[��&�O��Y������8��(�Ĉ~濉���O�^��m��M����6\�*e��}�w���RNxX� 4���N�T|u�Hb�(�`�8���k��\�)�!N�D��B���l��'j� fn��H¶��J���\to��45��V{X{be3��9&�� ��i��i�R;'��t�`ܾ��]�J�\� �(.n"$"\�ݛշ�u�dn��Ŗ,_������D��C!,�RN����'��� �#RJ؞�>����fH�W��N�eD������U����#���((�}�+�f�d�`�A�1�N<�}ȉi(۷�km[��r��Nu��a$S�@��ˀ����ݾ{��*����p!`�B#��Skà�ǽvP� ��er��L��v��)����^>�}��:�[݄ ��O�L����v�AwϢ�}O�K��H���lY*�6`�Ӌ�1s�ެ�U�D�=5��#År,�Hȴwk� ��6�y����r+������=�u����}� Ԉ��p>&IH���{0G���u}m��s�pM��xdH��D��F$Ӡ��m���y������g�}E2��ؗSֻ�ic��;�=���X�q�2ճ}H�� �(���A ��SS����;3�߱��O�� ���G�� ��/znl8�|�IJ��o_rE�����O�/w���! ��L���P�S� >��w|�zắc���6/(*��m�w�|��"�kx���`�ϲ�VY��~��/�����O <q֥T}�5�=�G��)۬ �$*���6��*��TSq��t�{M��E���4�J������xW�4ɼH��M��@�Ā6�Nc��Ny�ѹ�O������ �l�K[��JEl�K��x�Q7cwYA��A��7���� 4lsS>8?0d�Z���px5����ť2�B0Z�36<œ���P��!?�.x����89UP��a�p�~Ȱ����J�eU���ꎣ�_�m�yߜ�����d0lR��@(�i[����c� �-)b�kv��E<��(��u>�fz z9@����F}���\'��hkDX�h�"oH<GWH��%�b�7ng�3o�H�p���Z���Q����5���l�e�$�u�<��n���\i ��j���� ��*`y�a&����yr�~�X7��[ �Z[�|O�������%V�(j��d2����@Ps���aCJdGM~�d��sƧp��U�,�wb��(r�������C���l�\�9l���[���j�ގ�}�vB+Wx#I�'���7�6�0��Rc�Gw���]Q���.=��`�h��7��k�X��@��F�/�� rw�~`��zE���p�A��j]����)4|- �҂v�u_�$��hh���\E�;�HV[H��>�i�p��5��N�A5a��]�7�_�`D55ʃќ������jM��J��[P�Q�&�@ubJŗ���sq���e���N1�L��~���Ef�4՜y=���*�Q�̑H�䁵B���\q��\�V�LZ+g}�+1r ��6̫W~f��<y�A�R�LS������w(�n�V��C�����'\)��$к������� ��eQ�(����%� &,��s�R�UӅ�ͬ00eE����H�콺�ll�m�?Lo,�F(�@ǙQ���'���h��� ��ϘS����Q����0Ԫ���~��':�fK����ǁ�W�X�PHØb�(ii���`���[Q^�.%CJ�+h�:�b/�~�J�@���X짌>�5�8&ޖ0HfW���+YI��|��bE����d:���E���%�և8���Ҷ��8E���.��^�ád-uiz��PP���-�����kE��|\�.��K��,���������������]�?��C��]kZ�����)<��������3��mϊl�a '�m+|�\�����:��1m('r^�f��<��Y���dC<51��}zd�������)7E�Y�x|��� \�#D��k��f��d�ط~���|���I�����gU>�3ћ�5#�$�:�^�1qU%ڴgH��"�ӛ�eC�����{����x��t��a�*���[�����)�� � ~c��I��6�L���%>־j�OƜڏ���zp85�Ęd~�|BM��S���l��c��xu�ֳFЖ�� �zߍ��do�@ё@u��QU�e���I���x$�y�"e%��43���Q�`���U�Y#��b6�ѫ+� ��"�~��l�k�a�g��L=EŸ�M�9����wX�?k�f����AW�mE��f=N�!��Z*�]�dAM��KQ9C����C��RD�gI�ޢ���dYf��|�ӧ�lt�^�S���������,�d��"o��7��p������cU�`�׃m��W-O[���YwB�7���>�0��M ��x���z#�b�糊��F�3�X�}��l0-����0��M�&�c���vadeRש���6(:��c�/����ї���n��{�0��Hn��7�Dh��P��a��!�ϐ���W9�@���բ �*Qj����ϷП��c��A����ϥG� �6ғ��l�T��
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_612cd64f45e78b9249e9312b8464c6e7_cryptolocker.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-03-12_612cd64f45e78b9249e9312b8464c6e7_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_612cd64f45e78b9249e9312b8464c6e7_cryptolocker
-
Size
2.4MB
-
MD5
612cd64f45e78b9249e9312b8464c6e7
-
SHA1
8df34c3ae33d8cebdfab0c35cff830c43e4a49c6
-
SHA256
ddfba8919f838735d9c21136174e6826c98e36eeadd4f156d5812d5ea553db23
-
SHA512
59cde7818ea77ad5f009370627925613d62308102c28d42d40e57d8fe9af6987be2f3da296ccf57044db51d953965b82b07fb1a932a741f54935c75951df8d0b
-
SSDEEP
49152:2bcowBO3mXpCf7SCfZXbF+9JcbbMb0ltIXB9MWzTetObH8BBuQwoFP:2Pw03hfOmZXbEc3tgR9Xz2ObcvXFP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule sample CryptoLocker_rule2 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-12_612cd64f45e78b9249e9312b8464c6e7_cryptolocker
Files
-
2024-03-12_612cd64f45e78b9249e9312b8464c6e7_cryptolocker.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE