925df629ebb876efb4dfc49bf629ea10f545f4c2dd9616f5b6fa5844439ebe4f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

925df629ebb876efb4dfc49bf629ea10f545f4c2dd9616f5b6fa5844439ebe4f
Size

38KB
MD5

b4537b19ad5e8ef27b9c20e15fd0d149
SHA1

a4781f0f0c8489122daf8f35c7bcff21331ff2b2
SHA256

925df629ebb876efb4dfc49bf629ea10f545f4c2dd9616f5b6fa5844439ebe4f
SHA512

614eee61a8822d036b6f60b2feba5c92fd6631647786e0bd76d41a5a7493244e7961c7c74cc5b89e9aa0022208b93316f3e2663bba5fc34dc8364c6c96c26710
SSDEEP

768:b7o/2n1TCraU6GD1a4Xt9bRU6zA6o36m6:bc/y2lLRU6zA6q6

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
925df629ebb876efb4dfc49bf629ea10f545f4c2dd9616f5b6fa5844439ebe4f

Files

925df629ebb876efb4dfc49bf629ea10f545f4c2dd9616f5b6fa5844439ebe4f
.exe windows:5 windows x86 arch:x86

78f4abb8610ca1c22ad9f81ecfabcc3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessage
BeginPaint
DispatchMessageA
DrawTextA
CreateWindowExA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
EndPaint
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ