locky[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
locky.zip
Size 103KB
Sample260701-1csshsgw2z
SHA256 24fc03300a98d5bc902c757f25e8ae6486970ed3e774f2ad5930465a33c9c3ee
MD5 cb2f34b320ce719eef4e0496fb9c155d
SHA1 23af7f831efc757bf3abc411210caf0ecbbf9fc1
SHA512 f228bc211b879c1c87def5472b17256d08b9056c72ac20a9b31f0d9da161f29c9fe66e2d3604868ce8fd2c7ecd678954b2d5a99df48065887e3362e73e6f24a3
SSDEEP 1536:/KQ38lv9+V2y4TkMbOGjlgcNRYiQV+SEYAZo/WdPp3xiMYDDqJYtd6:/Y+Vqg1GjuOlYAJbk9CJGc
TLSH
T1C5A3128591FC9DA14A0462DBE1CEF59F2C9F1C49BC130AB5AC3687B386409C46FCE0B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc

File Explorer

locky.zip

.zip 103KB
49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc

.exe 159KB

locky.zip

SHA256 24fc03300a98d5bc902c757f25e8ae6486970ed3e774f2ad5930465a33c9c3ee
MD5 cb2f34b320ce719eef4e0496fb9c155d
SHA1 23af7f831efc757bf3abc411210caf0ecbbf9fc1
SHA512 f228bc211b879c1c87def5472b17256d08b9056c72ac20a9b31f0d9da161f29c9fe66e2d3604868ce8fd2c7ecd678954b2d5a99df48065887e3362e73e6f24a3
SSDEEP 1536:/KQ38lv9+V2y4TkMbOGjlgcNRYiQV+SEYAZo/WdPp3xiMYDDqJYtd6:/Y+Vqg1GjuOlYAJbk9CJGc
TLSH
T1C5A3128591FC9DA14A0462DBE1CEF59F2C9F1C49BC130AB5AC3687B386409C46FCE0B9
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc

IMPHASH 14f0cd9612d8e8836a786e6c13265809
SHA256 49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc
MD5 b66eb4bcb2860ef48afbc1378e1ae545
SHA1 a2fcbf6e175afcee58344e6ee0f551fc2fff8d27
SHA512 49c07ccc11d71c8fcb83cc9462ce1ba961ff0b22906deb558c9cd4628bd9e458f534b252e066e0ac6d0f220908cf5d046c923db33b10bf7027f52eda809c1a4d
SSDEEP 3072:j9UJ3gySjKLkEfwoZaNEP3N2QdW4BVa7NnnFRdqDGowa9:j61NSjVmaN63NiL4Di
TLSH
T191F35B03BF592E92D02E0E3100B90F5AA355E9153B164FAB2519BA79EDFF2C22F113D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

29926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateProcessW CompareStringA LeaveCriticalSection DeleteFileW LoadLibraryW FindFirstFileW SetStdHandle EnumSystemLocalesA OpenThread VirtualQueryEx FindResourceExW GetTickCount GetStdHandle WideCharToMultiByte GetOEMCP LCMapStringW GlobalMemoryStatus GetModuleHandleW SetConsoleCtrlHandler VirtualFree RtlUnwind GetTimeFormatA Process32FirstW GetProcessHeap ExitProcess SystemTimeToFileTime ProcessIdToSessionId WritePrivateProfileStringW SizeofResource CreateMutexW InterlockedDecrement GetDateFormatA CreateFileW GetStartupInfoA FindNextFileW IsProcessorFeaturePresent GetCurrentThreadId FlushFileBuffers GetCommandLineW GetLocaleInfoA OpenFileMappingW SetFilePointer GetFileType GetTempFileNameW GetACP CloseHandle MoveFileExW Process32NextW DeleteCriticalSection MultiByteToWideChar LoadLibraryExW QueryPerformanceCounter RemoveDirectoryW ExpandEnvironmentStringsW SetHandleCount GetProcAddress TerminateProcess GetLocaleInfoW GetStartupInfoW TlsFree SetUnhandledExceptionFilter GetVolumeInformationW WriteFile HeapReAlloc GetPrivateProfileSectionW HeapSize FlushInstructionCache CreateEventW GetPrivateProfileSectionNamesW GetVersionExW SetLastError LoadResource LCMapStringA GetCPInfo GetSystemTimeAsFileTime GetEnvironmentStringsW DeviceIoControl MapViewOfFile InterlockedIncrement EnterCriticalSection GetDiskFreeSpaceExW CreateFileA TlsGetValue ReadFile GetFileAttributesW GetCurrentProcess IsValidCodePage GetCurrentThread RaiseException FatalAppExitA LoadLibraryA lstrlenA GetUserDefaultLCID GetDriveTypeW SetEnvironmentVariableA LocalFree HeapCreate GetPrivateProfileStringW UnmapViewOfFile HeapDestroy GetEnvironmentVariableW GlobalAddAtomA CancelWaitableTimer VirtualProtectEx OpenWaitableTimerA OpenWaitableTimerW AddAtomW CancelIo LoadLibraryExA GetVersion GlobalAddAtomW AreFileApisANSI lstrlenW InitializeCriticalSection InitializeCriticalSectionAndSpinCount FindResourceW SetEndOfFile LockResource HeapFree GetConsoleCP CreateThread VirtualAlloc InterlockedExchange GetConsoleOutputCP IsDebuggerPresent GetCurrentProcessId ReadProcessMemory GetStringTypeW TlsAlloc GetModuleHandleA GetLastError GetModuleFileNameA GetTempPathW GetModuleFileNameW Sleep UnhandledExceptionFilter GetConsoleMode CreateFileMappingW GetTimeZoneInformation HeapAlloc InterlockedCompareExchange GetStringTypeA WaitForSingleObject IsValidLocale lstrcmpiW GetPrivateProfileIntW WriteConsoleA CreateToolhelp32Snapshot CompareStringW SetEvent FreeEnvironmentStringsW TlsSetValue GetFileSize ExitThread GetLocalTime FreeLibrary Module32FirstW CreateDirectoryW GetLogicalDrives OpenProcess GetFileSizeEx WriteConsoleW Module32NextW

user32

DrawTextW DispatchMessageW GetCursorPos LoadStringA KillTimer GetMenuItemCount SetWindowTextW CharNextW EnumChildWindows ShowWindow SetFocus TranslateMessage SetWindowPos DefWindowProcW SetTimer GetMonitorInfoW SetCursor LoadImageW MonitorFromPoint PtInRect ScreenToClient GetFocus GetMenuItemInfoW GetWindowTextW GetWindow UpdateLayeredWindow AppendMenuW PostQuitMessage LoadStringW MessageBeep SendMessageW RemoveMenu TrackMouseEvent GetWindowDC CallWindowProcW DestroyCursor UnregisterClassA GetWindowRect EnumWindows TranslateAcceleratorW CreatePopupMenu GetParent GetClientRect PostMessageW MonitorFromWindow LoadCursorW GetMessageW GetWindowThreadProcessId SetForegroundWindow LoadIconA CharUpperA wsprintfW GetForegroundWindow GetDesktopWindow IsWindowVisible TrackPopupMenuEx GetWindowLongW GetClassNameW DestroyMenu InvalidateRect IsWindow LoadMenuW PeekMessageW SetWindowLongW ReleaseDC MapWindowPoints

gdi32

SaveDC GetBitmapBits RestoreDC DeleteDC CreateFontW CreateCompatibleBitmap DeleteObject CreateDIBSection CreateCompatibleDC SelectObject SetTextColor SetBkMode SetBitmapBits

advapi32

CreateProcessAsUserW RegDeleteValueW RegOpenKeyW AllocateAndInitializeSid OpenProcessToken GetNamedSecurityInfoW RegCloseKey RegSetValueExW FreeSid DeleteService SetTokenInformation ControlService OpenSCManagerW RegEnumValueW RegQueryInfoKeyW AdjustTokenPrivileges LookupPrivilegeValueW RegDeleteKeyW RegQueryValueExW CreateServiceW RevertToSelf SetEntriesInAclW OpenServiceW RegCreateKeyExW QueryServiceStatus StartServiceW RegOpenKeyExW CloseServiceHandle RegEnumKeyExW DuplicateTokenEx SetNamedSecurityInfoW

shell32

SHGetMalloc SHFileOperationW SHGetSpecialFolderPathW

ole32

CoInitializeSecurity CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoSetProxyBlanket CoCreateGuid CoTaskMemFree CoCreateInstance CoInitialize

oleaut32

SysAllocStringByteLen SetErrorInfo VariantInit VariantClear SysFreeString VarUI4FromStr SysStringLen GetErrorInfo SysAllocString VariantChangeType CreateErrorInfo

winhttp

WinHttpReceiveResponse WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpSetOption WinHttpQueryHeaders WinHttpReadData WinHttpSendRequest WinHttpOpenRequest

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW StrStrIW PathAppendW PathIsDirectoryW PathRemoveExtensionW PathFileExistsW SHDeleteKeyW PathFindFileNameW PathGetDriveNumberW PathStripPathW PathRemoveFileSpecW

msimg32

AlphaBlend GradientFill

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

iphlpapi

GetIpForwardTable

oledlg

ord8

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

psapi

QueryWorkingSet GetModuleInformation GetProcessMemoryInfo GetModuleFileNameExW

msvcrt

exit _CIsin _except_handler3 __set_app_type

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock