Static task
static1
Behavioral task
behavioral1
Sample
levislocker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
levislocker.exe
Resource
win10v2004-20240802-en
General
-
Target
levislocker.exe
-
Size
914KB
-
MD5
f20c3ceba1ac2530208c3e7b9f954286
-
SHA1
8bae89f6d3b8376048643397408e63942fd66f27
-
SHA256
ef2dfff6121e80e3fa88f86da7941f3e9a613f1ed43188be1d8df0a9b39c33cd
-
SHA512
8a7a63da9ac92469f8c2f1114693777e46836a6e2caeca255c21d49c385af58dad7f43264c14cc62aa65affbe0b2e528a9989129cc476b1d7d5c44c80616202c
-
SSDEEP
12288:/ki2FP/G3f+GaDXyorqp0PpKQVABcku/xiwxwZKX/2S2/4FStGNzziY9PsR88xLZ:ARmDNp0P5pP5aPGpziOVK9tRmE
Malware Config
Signatures
Files
-
levislocker.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
5a:aa:4c:b4:fb:ee:e6:89:47:9f:ba:39:f6:f7:af:a8Certificate
IssuerCN=THUNDER-DEDICAT\\AdministratorNot Before11/12/2016, 18:52Not After12/12/2017, 00:52SubjectCN=THUNDER-DEDICAT\\Administrator81:c9:35:8e:9c:37:c6:cd:e0:c9:6d:14:cc:de:c3:8f:ce:20:6c:3a:a0:16:a9:f5:c9:d0:a6:58:c5:b4:fe:25Signer
Actual PE Digest81:c9:35:8e:9c:37:c6:cd:e0:c9:6d:14:cc:de:c3:8f:ce:20:6c:3a:a0:16:a9:f5:c9:d0:a6:58:c5:b4:fe:25Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
c:\users\administrator.thunder-dedicat\documents\visual studio 2015\Projects\WindowsApplication1\WindowsApplication1\obj\Debug\Levis Locker.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 735KB - Virtual size: 734KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ