c:\mywork\EngineUtils\teALLdecrypt\te225decrypt\Release\te225decrypt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-07_4ec17e12757e00f2ac361fcf286db82f_dma-locker.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-07_4ec17e12757e00f2ac361fcf286db82f_dma-locker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-07_4ec17e12757e00f2ac361fcf286db82f_dma-locker
-
Size
1.7MB
-
MD5
4ec17e12757e00f2ac361fcf286db82f
-
SHA1
e80ba5b2fcd2ae7e5f37e428c28be57f7ced511b
-
SHA256
ebd639a66592232bac71927b55b41a58633f1386a04c0994be4dead889bb2821
-
SHA512
df2136cab97a474bfc408b4fc89411f20b76478d709b3f896369464e0fc04bcb0c6c532c1c2e6592412798f1e3253d82e16494ea1a08dbf91c4c5f502f82fb2c
-
SSDEEP
24576:9SEjxFDhbg8eF7e3GxuKCO8513U50RiBnln2/bfx3paPX7:/xUNF7bu6u3UHn2/+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-07_4ec17e12757e00f2ac361fcf286db82f_dma-locker
Files
-
2024-09-07_4ec17e12757e00f2ac361fcf286db82f_dma-locker.exe windows:5 windows x86 arch:x86
9f995356aae7fa0299cac8c33c650045
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
comctl32
InitCommonControlsEx
crypt32
CryptStringToBinaryA
kernel32
GetFileSizeEx
GetModuleHandleA
Sleep
GetComputerNameW
GetFileTime
GetTempPathW
GetVolumeInformationA
CreateFileMappingW
SetConsoleMode
ReadConsoleInputA
MapViewOfFile
VirtualQuery
WideCharToMultiByte
UnmapViewOfFile
DeleteFileW
SetEndOfFile
GetLastError
GetCommandLineW
GetLogicalDrives
FlushConsoleInputBuffer
GetVersionExA
GlobalMemoryStatus
GetVersion
CreateFileA
GetDiskFreeSpaceExW
GetDriveTypeW
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
SetFileAttributesW
GetFileAttributesW
CreateThread
SetThreadPriority
WaitForMultipleObjects
GetSystemInfo
GetFileSize
GetModuleHandleW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
GetModuleFileNameW
GetSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
WriteFile
CreateFileW
SetFilePointer
ReadFile
WaitForSingleObject
CloseHandle
lstrlenW
lstrcpyW
lstrcatW
GetLocaleInfoW
lstrcmpW
WriteConsoleW
GetConsoleOutputCP
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetStartupInfoW
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleA
GetProcessHeap
user32
wsprintfW
DialogBoxParamW
GetDlgItem
EnableWindow
GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
MessageBoxA
EndDialog
GetClientRect
CreateWindowExW
LoadIconW
SetClassLongW
BeginPaint
FillRect
LoadBitmapW
EndPaint
SetWindowTextW
SendMessageW
MessageBoxW
SetFocus
gdi32
SetTextAlign
TextOutW
CreateCompatibleDC
SelectObject
GetMapMode
SetMapMode
GetObjectW
GetTextAlign
BitBlt
DeleteDC
DPtoLP
SetBkMode
comdlg32
GetOpenFileNameW
advapi32
CryptDuplicateKey
RegQueryValueExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CryptSetKeyParam
CryptGetKeyParam
CryptAcquireContextW
RegOpenKeyW
RegOpenKeyExA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDeriveKey
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptDecrypt
CryptImportKey
CryptDestroyKey
RegCloseKey
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
Sections
.text Size: 887KB - Virtual size: 886KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 282KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 376KB - Virtual size: 726KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ