2024-05-24_c64439b70315fce8e646d03ad7d5dc5f_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-24_c64439b70315fce8e646d03ad7d5dc5f_cryptolocker
Size

63KB
MD5

c64439b70315fce8e646d03ad7d5dc5f
SHA1

322c70d0ee4ce7a3b642ff2b87336f3bbd175a73
SHA256

f62c8e0b1d470a211de882b55fc5e410761e79b910f2f0b2cfd60ec3c5b0d313
SHA512

149e4e9783becc0b95591d3bae6c10a25de31166aaf0ff00426f8861407c2b6f7c52accea9d1e2eb12e979474f53e56dd8400e569be85f7f8e06ee097ed7cf2d
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnr:btng54SMLr+/AO/kIhfoKMHdar

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_c64439b70315fce8e646d03ad7d5dc5f_cryptolocker

Files

2024-05-24_c64439b70315fce8e646d03ad7d5dc5f_cryptolocker
.exe windows:5 windows x86 arch:x86

a2bfa209044e11b72a41f731968fdff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
PostQuitMessage
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ