Behavioral task
behavioral1
Sample
2024-05-22_4b558083299f2dabad1104c7d265fb7e_cryptolocker.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-22_4b558083299f2dabad1104c7d265fb7e_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_4b558083299f2dabad1104c7d265fb7e_cryptolocker
-
Size
59KB
-
MD5
4b558083299f2dabad1104c7d265fb7e
-
SHA1
756924cb3ec2a278b2c720e843594db7057d13b2
-
SHA256
6482cf7e1590e28fe005bc5938afbc20b05e4683e714840ab56c20281666006f
-
SHA512
376be39a018f35461f302ab809723441a75bb3aa9802f500d70182b82ba9af48cd4864882ada41a218c4762d896524b71cf435aeed7ac16b05a2ff7949a1ff5a
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAPB32K:H6QFElP6n+gou9cvMOtEvwDpjCpVXY7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule sample CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule sample CryptoLocker_set1 -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-22_4b558083299f2dabad1104c7d265fb7e_cryptolocker
Files
-
2024-05-22_4b558083299f2dabad1104c7d265fb7e_cryptolocker.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 20KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE