LockApp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

LockApp.exe
Size

10.8MB
MD5

0c599d4b2be1fad4e890a8e5ce71eee7
SHA1

b483256691d603e88f468dc01614020e75adeb2f
SHA256

297d6626d5fa3b4e7dd22ce72b56f61e8f8c44deeb89700e68f1c54de33927a3
SHA512

3302defa5d13113ca8e978787834c67fbb29cd8b51aff6649bcf18babd961fcbfb03f630ff823aa7f112fec6b6114780d34de286500ae4ba2fd225d448e8708f
SSDEEP

98304:M0l9S+73bfY4cKy6OqjTACCqtf2d2aAU6W8IcRzK:M0l9D73bA4nHnVlxasW8hK

Score

1^/10

Malware Config

Signatures

Files

LockApp.exe
.exe windows:10 windows x64 arch:x64

948d6376bc3c7380b9cc4a02581b3e7d

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:88:82:80:cd:dc:8b:b6:60:f4:e9:8e:a7:37:b6:99:94:27:94:b9:48:44:7d:df:43:1c:77:b8:09:3a:91:0f
Signer

Actual PE Digest

00:88:82:80:cd:dc:8b:b6:60:f4:e9:8e:a7:37:b6:99:94:27:94:b9:48:44:7d:df:43:1c:77:b8:09:3a:91:0f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

lockapp.pdb

Imports

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventActivityIdControl
EventUnregister

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
GetUserDefaultLocaleName
FormatMessageW
ResolveLocaleName

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoTaskMemFree
CoGetApartmentType
CoMarshalInterThreadInterfaceInStream
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetInterfaceAndReleaseStream
CoTaskMemRealloc
CoGetObjectContext
PropVariantClear

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceComplete
Sleep
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

CreateEventW
ReleaseSemaphore
ReleaseSRWLockShared
CreateEventExW
CreateMutexExW
InitializeCriticalSection
DeleteCriticalSection
OpenSemaphoreW
CreateSemaphoreExW
InitializeCriticalSectionEx
AcquireSRWLockShared
ResetEvent
ReleaseMutex
AcquireSRWLockExclusive
EnterCriticalSection
SetEvent
WaitForSingleObject
LeaveCriticalSection
ReleaseSRWLockExclusive
WaitForSingleObjectEx

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait

api-ms-win-core-string-l1-1-0

GetStringTypeW
GetStringTypeExW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsConcatString
WindowsGetStringLen
WindowsDeleteString
WindowsCreateString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
SetRestrictedErrorInfo
RoFailFastWithErrorContext

d2d1

ord1

api-ms-win-core-featurestaging-l1-1-0

GetFeatureEnabledState
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
RecordFeatureError
SubscribeFeatureStateChangeNotification

api-ms-win-core-featurestaging-l1-1-1

GetFeatureVariant

msvcrt

_get_errno
_wsetlocale
__crtLCMapStringW
__crtCompareStringW
_wcsdup
abort
memcmp
___lc_collate_cp_func
calloc
__pctype_func
___lc_codepage_func
___lc_handle_func
setlocale
_callnewh
malloc
memmove
memcpy
??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
_wcsicmp
memset
_set_errno
_commode
__getmainargs
_fmode
_acmdln
_amsg_exit
_XcptFilter
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_initterm
__setusermatherr
_onexit
__C_specific_handler
_ismbblead
_cexit
__dllonexit
_unlock
_lock
wcsrchr
_errno
wcsstr
realloc
strchr
free
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
_wtof
___mb_cur_max_func
_vsnprintf_s
swprintf_s
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
difftime
time
_vscwprintf
_vsnprintf
?terminate@@YAXXZ
__ExceptionPtrCreate
__ExceptionPtrCurrentException
__ExceptionPtrRethrow
__ExceptionPtrCopy
__ExceptionPtrDestroy
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
_purecall
memcpy_s
_vsnwprintf
__CxxFrameHandler4
memmove_s
_exit
exit
wcslen
__set_app_type
wcstol

wincorlib

?GetCmdArguments@Details@Platform@@YAPEAPEA_WPEAH@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?__abi_FailFast@@YAXXZ
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z
?Equals@Object@Platform@@QE$AAA_NPE$AAV12@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?Equals@Enum@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@ValueType@Platform@@QE$AAA_NPE$AAVObject@2@@Z
??0Exception@Platform@@QE$AAA@HPE$AAVString@1@@Z
?GetHashCode@Object@Platform@@QE$AAAHXZ
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?ToString@Guid@Platform@@QEAAPE$AAVString@2@XZ
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
??0ChangedStateException@Platform@@QE$AAA@XZ
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@XZ
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0InvalidArgumentException@Platform@@QE$AAA@XZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K@Z
??0Delegate@Platform@@QE$AAA@XZ
??0DisconnectedException@Platform@@QE$AAA@XZ
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
??0NotImplementedException@Platform@@QE$AAA@XZ
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
?GetType@Object@Platform@@QE$AAAPE$AAVType@2@XZ
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
??0Object@Platform@@QE$AAA@XZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z

shcore

ord190

policymanager

PolicyManager_GetPolicyInt

winbio

WinBioGetEnrolledFactors

ext-ms-win-dwmapi-ext-l1-1-0

DwmSetWindowAttribute

api-ms-win-core-winrt-error-l1-1-1

RoReportUnhandledError

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 9.5MB - Virtual size: 9.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 759KB - Virtual size: 758KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 215KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

948d6376bc3c7380b9cc4a02581b3e7d

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

00:88:82:80:cd:dc:8b:b6:60:f4:e9:8e:a7:37:b6:99:94:27:94:b9:48:44:7d:df:43:1c:77:b8:09:3a:91:0fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

d2d1

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-featurestaging-l1-1-1

msvcrt

wincorlib

shcore

policymanager

winbio

ext-ms-win-dwmapi-ext-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-stateseparation-helpers-l1-1-0

Exports

Exports

Sections

.text Size: 9.5MB - Virtual size: 9.5MB

.rdata Size: 759KB - Virtual size: 758KB

.data Size: 215KB - Virtual size: 222KB

.pdata Size: 336KB - Virtual size: 335KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 55KB - Virtual size: 54KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

00:88:82:80:cd:dc:8b:b6:60:f4:e9:8e:a7:37:b6:99:94:27:94:b9:48:44:7d:df:43:1c:77:b8:09:3a:91:0f
Signer

.text
Size: 9.5MB - Virtual size: 9.5MB

.rdata
Size: 759KB - Virtual size: 758KB

.data
Size: 215KB - Virtual size: 222KB

.pdata
Size: 336KB - Virtual size: 335KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 55KB - Virtual size: 54KB