2024-05-24_e9c563c8d4aa533f98bdf89d5c8cc289_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-24_e9c563c8d4aa533f98bdf89d5c8cc289_cryptolocker
Size

41KB
MD5

e9c563c8d4aa533f98bdf89d5c8cc289
SHA1

597c2dc66d0c61c07558818805e67119002def45
SHA256

970a079a3417f0dfc0562b9f8d694db57f3b9ea45f6029740850a6d557954b2c
SHA512

fc1fd556e1debafb72288bf6aeaec3994a467e9a88e4c231c001d9ae2740be761ce339a3086c7a99059439ff1060bbabecb5a0f10f91ac81c5a650df03e55026
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunKzH15U/Ey/e:btB9g/WItCSsAGjX7e9N0hunKLYNOZf

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_e9c563c8d4aa533f98bdf89d5c8cc289_cryptolocker

Files

2024-05-24_e9c563c8d4aa533f98bdf89d5c8cc289_cryptolocker
.exe windows:5 windows x86 arch:x86

a2bfa209044e11b72a41f731968fdff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
PostQuitMessage
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ