Catware•WinLocker[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Catware•WinLocker.exe
Size

20KB
MD5

26efe944b45d1987f20069396044783f
SHA1

1459d9ba4be0981155fe4295789eb177130f48bd
SHA256

f6967c4407f545438924dbe3a7f722784df5fc710b39a7ae22216f8610c47666
SHA512

5c2d254dbce6fcf188b88dbac435ac18f6e8e1d82f46b4d835c3ca031ff714c767dec4fc0ae667051fe09dbdc6c71bc6857681e77d1f6f6bc2e63a15faab8c5f
SSDEEP

384:NH9Xqbra2ao0PPeDvfLRFqlzJJaHTAoKb4MkIdDmQ7hDFif/Hc5tfml+Y:NH96zl0HGRzT3IdDmQDFM85tfml1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Catware•WinLocker.exe

Files

Catware•WinLocker.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Adrien\source\repos\WindowsUpgradeAssistaint\WindowsUpgradeAssistaint\obj\Release\WindowsUpgradeAssistaint.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ