2024-05-23_1a48301d327cd0824157f0f3fe0c87a5_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-23_1a48301d327cd0824157f0f3fe0c87a5_cryptolocker
Size

35KB
MD5

1a48301d327cd0824157f0f3fe0c87a5
SHA1

415904b625358d8e3876a2c7826f72173065ca80
SHA256

ce47303ed010b7238bba9d2b7354a218ee8b994169fae29327ac8f33935f21af
SHA512

5cf2baebb41cc8bd53d70c4bf48db74253708d42d482156a5106631318a219ab2f4774c7b662a0d9405abcbd6b39770c637d4e9a2a1134ab532c2ed0c9c8a8cc
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6ckJp0qAgmEzXKxA+T9rrL:bAvJCYOOvbRPDEgXRc+BAILiJrL

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-23_1a48301d327cd0824157f0f3fe0c87a5_cryptolocker

Files

2024-05-23_1a48301d327cd0824157f0f3fe0c87a5_cryptolocker
.exe windows:5 windows x86 arch:x86

5a4767bc6f06914cff6e249c178e3b95

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DispatchMessageA
DrawTextA
EndPaint
BeginPaint
PostQuitMessage
ShowWindow
UpdateWindow
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ