2024-04-28_89772d6ed6e527d4dc2c88c9410bd6f4_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-28_89772d6ed6e527d4dc2c88c9410bd6f4_cryptolocker
Size

37KB
MD5

89772d6ed6e527d4dc2c88c9410bd6f4
SHA1

452c6cfff6df3ad006900943852d5ccadaf82c33
SHA256

152a27ed5aa15ab8d17c69a7a03e84ed83b098774a942ddf739388ecb44b8aab
SHA512

e9b2643c08f3200fe440701835aa58cf45099ae0efeae63444293d4c7564a646b8cfcbe3804c50d310dbab8242f3b951551b632909bc62ee1dcd539a52452c1a
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunRSyHmYvV8H:btB9g/WItCSsAGjX7e9N0hunRvGIV8H

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-28_89772d6ed6e527d4dc2c88c9410bd6f4_cryptolocker

Files

2024-04-28_89772d6ed6e527d4dc2c88c9410bd6f4_cryptolocker
.exe windows:5 windows x86 arch:x86

a2bfa209044e11b72a41f731968fdff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
PostQuitMessage
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ