Static task
static1
Behavioral task
behavioral1
Sample
ClearLock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ClearLock.exe
Resource
win10v2004-20240508-en
General
-
Target
VirusShare_b7abe9bf93b51f7cdfcc932da2c7565f
-
Size
382KB
-
MD5
b7abe9bf93b51f7cdfcc932da2c7565f
-
SHA1
49e76e7bd6bfc1c0dd272d34c4030b6eb72f2af9
-
SHA256
eafc9e2a37d22bb2012a0680c42bcaee2fc58799954904698a24f5862729ca4d
-
SHA512
f1c9e71362fad4548debab164d93ba54db5ec8440ec09ea7545189413bb8d3119031c4f8131122be18c72dcd332b8400e0cff53240ec18f22c8647554b6cbf47
-
SSDEEP
6144:v/XrnBpwTq6+OGnfzVxslCkHO9Kscju2EzVnEyKXQqp2WXEjr6xvdOjKqlqFJjLb:nXzw2NOONkHZ1ju2oVnCXnp2WXEP6xvz
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/ClearLock.exe autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ClearLock.exe
Files
-
VirusShare_b7abe9bf93b51f7cdfcc932da2c7565f.7z
-
ClearLock.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 512KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ