2024-05-19_a213b906031c771025c1e7c604b35451_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-19_a213b906031c771025c1e7c604b35451_cryptolocker
Size

44KB
MD5

a213b906031c771025c1e7c604b35451
SHA1

ee20ca73cc2507b7300762611db2b7e704e29930
SHA256

a7d0d5d480cba030da96f24932bc2b263fe7df1d92034cd491f8badf445ac693
SHA512

b3ed7e402f34d9ab8db1c4919763085ee92e86240e5d2de93ebfe6e8d128cad1cc1728753522688b8d9fd5de086d1e110dcbf9cfa788522eeb44d833e84b6136
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAd:b/pYayGig5HjS3NPAd

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-19_a213b906031c771025c1e7c604b35451_cryptolocker

Files

2024-05-19_a213b906031c771025c1e7c604b35451_cryptolocker
.exe windows:5 windows x86 arch:x86

ad86a1414a0514f4c041167365378f70

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EndPaint
GetMessageA
DrawTextA
ShowWindow
UpdateWindow
DispatchMessageA
BeginPaint
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
GetWindowRect
LoadCursorA
PostQuitMessage
SetWindowPos

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
GetCurrentDirectoryA
FindClose
FindNextFileA
DeleteFileA
CloseHandle
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ