Behavioral task
behavioral1
Sample
2024-05-30_c3078a84451159baa5c6833e2b2eacc5_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-30_c3078a84451159baa5c6833e2b2eacc5_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-30_c3078a84451159baa5c6833e2b2eacc5_cryptolocker
-
Size
58KB
-
MD5
c3078a84451159baa5c6833e2b2eacc5
-
SHA1
affb979c050b6c3cde624f674d5b2c3869c7ec43
-
SHA256
e03d57929ee5cc4ee91899d6e8a807d7c01d67c97d714825281ee7487a029528
-
SHA512
b501af429cebc12d719115f3a8d9a5f99a29a446fbeefd08edf4fd97c3055b00d659261d72d79f9ce4997db106f29be1954597f0e83a7d46aeda57d9e8bbac73
-
SSDEEP
768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlggE33:bP9g/xtCS3Dxx0N33
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule sample CryptoLocker_rule2 -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-30_c3078a84451159baa5c6833e2b2eacc5_cryptolocker
Files
-
2024-05-30_c3078a84451159baa5c6833e2b2eacc5_cryptolocker.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 17KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE