WinLocker[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WinLocker.exe
Size

50KB
MD5

e243335cd96a1d384fb10f08e3e4da65
SHA1

f7217ec98b157c1581a992d6b869437c765709d7
SHA256

ea73d591d1b8904ce65b24af17970c80958883d08eee4935c741efc840c9008d
SHA512

312f96718bcc37bce7ea72218d528dad5a4f50ec0774c97a3992dbb33b48f28364d64ec1e6fe53532fa411c9756af33c522a338b01d91198ad1f4d13d13a9302
SSDEEP

384:44kqWFgkNIOjUfVOI7ELTmCfCprNXyu3bWCrWPWlR+ehoAi6gs:2FgkeOsScNXyurWiWPWlR+Or+s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinLocker.exe

Files

WinLocker.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ