2024-04-11_df5a390eb3e19ba7b15887a8a0606dce_cryptolocker | Triage

Sharing

General

Target

2024-04-11_df5a390eb3e19ba7b15887a8a0606dce_cryptolocker
Size

62KB
MD5

df5a390eb3e19ba7b15887a8a0606dce
SHA1

059ad1dd2345b5bc9370dc2fe2b100ae59791628
SHA256

c37d011756c1870fadc3e3556ff7760717cc80dcce0fb4f941ae6cc5acb44f42
SHA512

bf4fa4b895adea624011bf413192ff472a7aa9e2e730a3589189a520875f4fe0033d843c06c33667cf0f854f5918f4195a064985b6c4f8034cbf72fa6aa4e429
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHa+:btng54SMLr+/AO/kIhfoKMHdc

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-11_df5a390eb3e19ba7b15887a8a0606dce_cryptolocker

Files

2024-04-11_df5a390eb3e19ba7b15887a8a0606dce_cryptolocker
.exe windows:5 windows x86 arch:x86

a2bfa209044e11b72a41f731968fdff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
PostQuitMessage
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ