OsLock[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

OsLock.exe
Size

333KB
MD5

3ab7076b9d3f1c88e56264a3674ac506
SHA1

5826d03105d96c4f66ce49a931bd09775e4f001a
SHA256

1d2c4940cf5068b42f4cd2f2eccecd28bb65035dcee8bf13533c6e9ba19b93f4
SHA512

15413fe7468bfad9647b262d8ab245ef6f07e78d8772c568382f4c62015cfc84fda3d3052715aee27deb602b9b018451c98276f19c5adb1598009f6c62a6f58a
SSDEEP

6144:a5H6ydPc4IvjTZlyZsDDyr3rjUD7mzUCpM69/KImQi/6ebL70:a5Plc4IrTZlyGDcy730

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OsLock.exe

Files

OsLock.exe
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ