2024-04-15_d96b6690d22c5e3109e1340d29399ef6_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-15_d96b6690d22c5e3109e1340d29399ef6_cryptolocker
Size

62KB
MD5

d96b6690d22c5e3109e1340d29399ef6
SHA1

159102787a446ccc2d4d66f6fb3d051cbd8d73a3
SHA256

b540077c057c5be66106058da6d083984b37701826112b660f27e506d46cbc95
SHA512

24c50a09d2ba474c02e09488ec7df4a528a0f024015e569f5e897b318284440cd4767e19f33c03511cf494909f95e44ef0cef66de3d156c518e06d45440ed3de
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHaxf:btng54SMLr+/AO/kIhfoKMHdPf

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-15_d96b6690d22c5e3109e1340d29399ef6_cryptolocker

Files

2024-04-15_d96b6690d22c5e3109e1340d29399ef6_cryptolocker
.exe windows:5 windows x86 arch:x86

a2bfa209044e11b72a41f731968fdff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
PostQuitMessage
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ