2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker | Triage

Sharing

General

Target

2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker
Size

36KB
MD5

ccdc921d12fee1153e1cda9cf601621f
SHA1

46a45eb7e24e28cf878f7a2a4efe7d90a9c8cabc
SHA256

7e88f797010987e59d7d7f88e2b6c348afd71e27a83a3d2a41001a926410290f
SHA512

c646ac93285fd383cff5336da7c9f59998975a48d74de4c717f284f18e6bc5d2fb6706673551ec338f563e4e188e8eed985775cf320f00fb77fc31a0b875f917
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B0qZvv2:btB9g/WItCSsAGjX7r3BTZvv2

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource yara_rule

sample CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker

Files

2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker
.exe windows:5 windows x86 arch:x86

a2bfa209044e11b72a41f731968fdff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
PostQuitMessage
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ