Static task
static1
Behavioral task
behavioral1
Sample
2024-04-20_220d8213088c877ad43ef6153d4f10ff_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-20_220d8213088c877ad43ef6153d4f10ff_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-20_220d8213088c877ad43ef6153d4f10ff_cryptolocker
-
Size
102KB
-
MD5
220d8213088c877ad43ef6153d4f10ff
-
SHA1
5571f044294050102295afd0f2982501ad3624de
-
SHA256
688a5525dad13c988d323cec136962bcfc3ed2897c6f2626c4ebcd3e9671cab0
-
SHA512
ec085b53c953083ac4c8a1184b33c71ae4193d22cbae962952818906f6a941193b0ea5481fbe3dc86ed58b32611ac152dd9b5ddd1722caecb3175525d4ab99b3
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJHlv/k2NMeo9:xj+VGMOtEvwDpjubwQEIiVmkxv/Lo9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule sample CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule sample CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MPress -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-20_220d8213088c877ad43ef6153d4f10ff_cryptolocker
Files
-
2024-04-20_220d8213088c877ad43ef6153d4f10ff_cryptolocker.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 17KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE