d:\programming\EngineUtils\EngineUtils\teALLdecrypt\te225decrypt\Release\te225decrypt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-10_1376814df53f9adc14bd0be71b78aa61_dma-locker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-10_1376814df53f9adc14bd0be71b78aa61_dma-locker.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-10_1376814df53f9adc14bd0be71b78aa61_dma-locker
-
Size
1.6MB
-
MD5
1376814df53f9adc14bd0be71b78aa61
-
SHA1
5feb3123cb67ce839f89a9ad5309924abafa8b09
-
SHA256
78cbd07cd3bdfd52e32deb70a431bfd939166c818df5aeeeefe8d58d5eb7db9d
-
SHA512
b7335ea9f1ce196214fdee8b3aca77f4bc1873c5d54cd5215571caf4bb04bf603a33e74f8af1613e96afe7723228b6aba149455003e986baf62c6e547a970855
-
SSDEEP
24576:k8JsjjNHZxG2ejAZRAYcxjZlgL9FNBd+CBnkiTnmvXNpjQ:GjNa2ejAzkdi9FNWiTw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-07-10_1376814df53f9adc14bd0be71b78aa61_dma-locker
Files
-
2024-07-10_1376814df53f9adc14bd0be71b78aa61_dma-locker.exe windows:5 windows x86 arch:x86
3a8157b2aa0e769e8147f69ea8e55396
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
comctl32
InitCommonControlsEx
crypt32
CryptStringToBinaryA
kernel32
GetFileSizeEx
GetModuleHandleA
GetComputerNameW
GetFileTime
GetTempPathW
Sleep
GetVolumeInformationA
CreateFileMappingW
SetConsoleMode
ReadConsoleInputA
MapViewOfFile
VirtualQuery
WideCharToMultiByte
UnmapViewOfFile
DeleteFileW
SetEndOfFile
GetLastError
GetCommandLineW
GetLogicalDrives
FlushConsoleInputBuffer
GetVersionExA
GlobalMemoryStatus
GetVersion
CreateFileA
GetDiskFreeSpaceExW
GetDriveTypeW
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
SetFileAttributesW
GetFileAttributesW
CreateThread
SetThreadPriority
WaitForMultipleObjects
GetSystemInfo
GetFileSize
GetModuleHandleW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
GetModuleFileNameW
GetSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
WriteFile
CreateFileW
SetFilePointer
ReadFile
WaitForSingleObject
CloseHandle
lstrlenW
lstrcpyW
lstrcatW
GetLocaleInfoW
lstrcmpW
WriteConsoleW
GetConsoleOutputCP
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
ExitProcess
HeapReAlloc
GetStartupInfoW
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleA
GetProcessHeap
user32
wsprintfW
DialogBoxParamW
GetDlgItem
EnableWindow
GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
MessageBoxA
EndDialog
GetClientRect
CreateWindowExW
LoadIconW
SetClassLongW
BeginPaint
FillRect
LoadBitmapW
EndPaint
SetWindowTextW
SendMessageW
MessageBoxW
SetFocus
gdi32
SetTextAlign
TextOutW
CreateCompatibleDC
SelectObject
GetMapMode
SetMapMode
GetObjectW
GetTextAlign
BitBlt
DeleteDC
DPtoLP
SetBkMode
comdlg32
GetOpenFileNameW
advapi32
CryptDuplicateKey
RegQueryValueExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CryptSetKeyParam
CryptGetKeyParam
CryptAcquireContextW
RegOpenKeyW
RegOpenKeyExA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDeriveKey
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptDecrypt
CryptImportKey
CryptDestroyKey
RegCloseKey
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
Sections
.text Size: 815KB - Virtual size: 814KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 268KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 359KB - Virtual size: 709KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ