2024-05-27_084a55c8ca49e23c5a82949286fd5a4f_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-27_084a55c8ca49e23c5a82949286fd5a4f_cryptolocker
Size

36KB
MD5

084a55c8ca49e23c5a82949286fd5a4f
SHA1

79fe2ab9503a2f9cd1d4309db6bc8e544cec2e23
SHA256

b8664506d8dfb733dc53a597418dbed6b50b055abe76a65d7054d5edcc479017
SHA512

396c7062e79c6fb0df97afbb956819f5c26b6eb9dcbdf3f4bdb472965760e8261a59f9ae582c6f28f4dd2ee0bc118a853825a6f2e35a45d02a3f350bc5b19909
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B0qvoLUZ6R:btB9g/WItCSsAGjX7r3BTmUQR

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-27_084a55c8ca49e23c5a82949286fd5a4f_cryptolocker

Files

2024-05-27_084a55c8ca49e23c5a82949286fd5a4f_cryptolocker
.exe windows:5 windows x86 arch:x86

a2bfa209044e11b72a41f731968fdff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
PostQuitMessage
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
GetMessageA
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ