2024-05-11_64832bfc33a2196551b48bf40a38ee40_cryptolocker | Triage

Sharing

General

Target

2024-05-11_64832bfc33a2196551b48bf40a38ee40_cryptolocker
Size

44KB
MD5

64832bfc33a2196551b48bf40a38ee40
SHA1

9964181b5d8cfb9d9acffbbed2d5d0d560ab7a71
SHA256

f0baae59cfa3a0fab8b6d25b60e10d767f8705f13de26cf9962c395ac59d55ec
SHA512

e828900fa2339a21d24008bccc04b10b48c5311215e4187df5ed368ca8c21839667007701200398575f0175099d6047803fc63387a52b8893311621b2933cde9
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunrkwIxZWQpyk:btB9g/WItCSsAGjX7e9N0hunrknljKrE

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-11_64832bfc33a2196551b48bf40a38ee40_cryptolocker

Files

2024-05-11_64832bfc33a2196551b48bf40a38ee40_cryptolocker
.exe windows:5 windows x86 arch:x86

a2bfa209044e11b72a41f731968fdff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
PostQuitMessage
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ