Static task
static1
Behavioral task
behavioral1
Sample
2024-03-18_b38bb21c5d954a3651e1779a5edc7074_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-18_b38bb21c5d954a3651e1779a5edc7074_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-18_b38bb21c5d954a3651e1779a5edc7074_cryptolocker
-
Size
66KB
-
MD5
b38bb21c5d954a3651e1779a5edc7074
-
SHA1
95ecf76fec93056de5ebc4379b58905985658184
-
SHA256
cb0ad5118f425817d8699c57a36ef2c0dd4a727b271a8cfe9a28ce52593dc992
-
SHA512
25d3ffc2ae8e8cf174e2c14290c516ec6e2adf464b64eee86de989fdf74d92bae72658cba61f932e6c7c60dd27cf70e5c6a3f4a2bf65a197d471a457fed916ff
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUI4v+m:i5nkFGMOtEvwDpjNbwQEI8Usm
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule sample CryptoLocker_rule2 -
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-18_b38bb21c5d954a3651e1779a5edc7074_cryptolocker
Files
-
2024-03-18_b38bb21c5d954a3651e1779a5edc7074_cryptolocker.exe windows:5 windows x86 arch:x86
e021c9fc2c12265365fad587d43783fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
EndPaint
gdi32
CreateFontIndirectA
Sections
.MPRESS1 Size: 10KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 1024B - Virtual size: 910B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE