lockfile | df30d67f1edd66174a5e760255be934d | Triage

Sharing

General

Target

df30d67f1edd66174a5e760255be934d
Size

811KB
MD5

df30d67f1edd66174a5e760255be934d
SHA1

59d231b42bcc78d58e5da34fadab7949ac7e0594
SHA256

3303a19789a73fa70a107f8e35a4ce10bb4f6a69ac041a1947481ed8ae99a11c
SHA512

6622284054277ec33baa0ba590b0d45b0b0f8f66428408b6ff24382ba9ef09efe62753c19b32ed0d1a43763c1bb069e4da5ae0772379f81d33bb286c0bb105f3
SSDEEP

12288:CwTjz4QwaGdWYgeWYg955/155/ybxq1yg4bP0Xrh57rXoMkZGs:CwHcQwBPxq1KbSh57rXhkMs

Score

10^/10

lockfile

Malware Config

Signatures

Detect LockFile payload 1 IoCs

resource	yara_rule
sample	family_lockfile

Lockfile family
lockfile

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df30d67f1edd66174a5e760255be934d

Files

df30d67f1edd66174a5e760255be934d
.exe windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 391KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 245KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ