2024-05-16_bfcfc1a1b3b910650106befeedf2d9ef_cryptolocker | Triage

Sharing

General

Target

2024-05-16_bfcfc1a1b3b910650106befeedf2d9ef_cryptolocker
Size

36KB
MD5

bfcfc1a1b3b910650106befeedf2d9ef
SHA1

2ba35228aaf77ef91120b1fe68cbd8acd28a6016
SHA256

86691f3b46fe679f2a20d61d268d131707290ebe73c5e87951e3524b4b2e7b11
SHA512

ebe87a8d5e803382c781e8a1546867c213aac3eac6d3e09020d168578394a474a5f73afade9ecf055a1b85741c8bf5bf1dfb332b27a64a195cb3fe2716230580
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6c3l8Sz960SPluRi9Y:bAvJCYOOvbRPDEgXRc3SSz3SPE1

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-16_bfcfc1a1b3b910650106befeedf2d9ef_cryptolocker

Files

2024-05-16_bfcfc1a1b3b910650106befeedf2d9ef_cryptolocker
.exe windows:5 windows x86 arch:x86

5a4767bc6f06914cff6e249c178e3b95

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DispatchMessageA
DrawTextA
EndPaint
BeginPaint
PostQuitMessage
ShowWindow
UpdateWindow
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ