2024-06-07_d2aa8945123024489e75a00de4e442eb_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-07_d2aa8945123024489e75a00de4e442eb_cryptolocker
Size

38KB
MD5

d2aa8945123024489e75a00de4e442eb
SHA1

19bfad0bbae3ef0d6f40b8a90f9fc578e033e01d
SHA256

4e806a861aaacaecbcd34bb3ecac64668f2b8145e064b47fce0c75022d1b7c63
SHA512

8ec450ba641b0fda85c929ba22c2c979519142e173d95590ac0cd5b5324f86ca5583c7f828af225f657ac16a68511d67db8d9a9a58bf4a018c88874deb5cc752
SSDEEP

768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3HC:bA6YcA/X6G0W143i

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-07_d2aa8945123024489e75a00de4e442eb_cryptolocker

Files

2024-06-07_d2aa8945123024489e75a00de4e442eb_cryptolocker
.exe windows:5 windows x86 arch:x86

021d5e7849e90fdf4c65d3045c109483

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

UpdateWindow
LoadCursorA
ShowWindow
PostQuitMessage
GetMessageA
EndPaint
DispatchMessageA
BeginPaint
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
GetWindowRect
SetWindowPos

kernel32

GetCurrentThreadId
CreateFileA
GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
GetCurrentDirectoryA
FindClose
GetFileSize
FindNextFileA
DeleteFileA
CloseHandle
GetCurrentProcessId
GetCurrentProcess

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ