2024-06-10_e3acb1638596f6d744707d0c5c45625a_cryptolocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-10_e3acb1638596f6d744707d0c5c45625a_cryptolocker
Size

39KB
MD5

e3acb1638596f6d744707d0c5c45625a
SHA1

4737e7f819437fdca875617f6c13dcc83f2aa52a
SHA256

a5d2709354ba205fd9c1b9fcb0a8b12c6d52f882d1385f0b42815a220a912ec5
SHA512

cc968eb16418748727b2c842e166ee1d4f08a8c6098a3c9c3c89446500e559081b56fa3c6e9502ec40e2e9e8c92ab273ed3a7d996ba240f10ed73e141e98c670
SSDEEP

768:b7o/2n1TCraU6GD1a4Xt9bRU6zA6o36mK:bc/y2lLRU6zA6qK

Score

10^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
sample	CryptoLocker_rule2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-10_e3acb1638596f6d744707d0c5c45625a_cryptolocker

Files

2024-06-10_e3acb1638596f6d744707d0c5c45625a_cryptolocker
.exe windows:5 windows x86 arch:x86

78f4abb8610ca1c22ad9f81ecfabcc3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessage
BeginPaint
DispatchMessageA
DrawTextA
CreateWindowExA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
DestroyWindow
LoadIconA
LoadCursorA
SetWindowPos
GetWindowRect
EndPaint
DialogBoxParamA

kernel32

GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
GetCurrentProcess
CreateFileA

gdi32

CreateFontIndirectA

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ