winlocker_builder_0.6 (2).zip
- SHA256 e020b041952d6908fd1b6da03de30edb2aea1906ed9a8c317abf43c2022daba5
Overview
overview
9Static
static
3winlocker_...2).zip
windows10-2004-x64
1winlocker_...2).zip
windows11-ltsc_2024-x64
1info_winlock.txt
windows10-2004-x64
1info_winlock.txt
windows11-ltsc_2024-x64
1winlock-builder-2.png
windows10-2004-x64
1winlock-builder-2.png
windows11-ltsc_2024-x64
1winlock_builder_1.png
windows10-2004-x64
1winlock_builder_1.png
windows11-ltsc_2024-x64
1winlocker_....6.exe
windows10-2004-x64
9winlocker_....6.exe
windows11-ltsc_2024-x64
9main.pyc
windows10-2004-x64
3main.pyc
windows11-ltsc_2024-x64
3winlocker_...TA.exe
windows10-2004-x64
9winlocker_...TA.exe
windows11-ltsc_2024-x64
9main1.pyc
windows10-2004-x64
3main1.pyc
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
winlocker_builder_0.6 (2).zip
Resource
win10v2004-20260513-de
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
winlocker_builder_0.6 (2).zip
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
info_winlock.txt
Resource
win10v2004-20260513-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
info_winlock.txt
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral5
Sample
winlock-builder-2.png
Resource
win10v2004-20260513-de
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
winlock-builder-2.png
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral7
Sample
winlock_builder_1.png
Resource
win10v2004-20260513-de
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral8
Sample
winlock_builder_1.png
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
winlocker_builder_0.6.exe
Resource
win10v2004-20260513-de
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
winlocker_builder_0.6.exe
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral11
Sample
main.pyc
Resource
win10v2004-20260513-de
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral12
Sample
main.pyc
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral13
Sample
winlocker_builder_0.6_BETA.exe
Resource
win10v2004-20260513-de
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral14
Sample
winlocker_builder_0.6_BETA.exe
Resource
win11ltsc2024-20260710-de
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral15
Sample
main1.pyc
Resource
win10v2004-20260513-de
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral16
Sample
main1.pyc
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
4 signatures
900 seconds
General
- Target winlocker_builder_0.6 (2).zip
- Size 12.3MB
- Sample260719-pevjcaax8n
- SHA256 e020b041952d6908fd1b6da03de30edb2aea1906ed9a8c317abf43c2022daba5
- MD5 c3e43186b736eda81effa4ff5b927e44
- SHA1 7b4aeb2a6df3ce7323d9a082e15c95c176207644
- SHA512 565cfebeb90019b4a1d84640f87f0678a06c9ad21e37a065f16b248df6eb109c128e469b4e1735369de859c19e9c1c6433766dd3c18e36c97df83f177ab869c3
- SSDEEP 393216:URuwJiKA+UaV1GmxksbL0FmOKKcZlYcxq2:2u0TU+Gm3sFmJZTxq2
- TLSH T1D3D63358D1E0110B71AEDC2283771A815038F4B79D8B794AE16FA77A398D5D38FF2C98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 2 IoCs
resource yara_rule static1/unpack001/winlocker_builder_0.6.exe pyinstaller static1/unpack001/winlocker_builder_0.6_BETA.exe pyinstaller - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/winlocker_builder_0.6.exe unpack001/winlocker_builder_0.6_BETA.exe
File Explorer
-
winlocker_builder_0.6 (2).zip.zip 12.3MB
-
info_winlock.txt876B
-
winlock-builder-2.png.png 89KB
-
winlock_builder_1.png.png 76KB
-
winlocker_builder_0.6.exe.exe 6.2MB
-
main.pyc453B
-
winlocker_builder_0.6_BETA.exe.exe 6.2MB
-
main1.pyc470B
info_winlock.txt
- SHA256 80a58cd747090b3f559e9f3c2c2be1922cb77e3d36053e7b83420119aebf2edf
- MD5 d28009ac35ff3b4492f56da23770effd
- SHA1 bac6ed231e0e099c32ff95e23e2abface5c3b634
- SHA512 f19dda13b9994e7a24beea5b96dd309d64bae7b6dea80e2a662eb02e1f0d7b5653174eee6b09b694d42be85f2648d000bdd143c39b496b7abbc72df298b1cdc6
- TLSH T17B1149716CDB677E0710B4AB0C0A344DE7D348BE0ABB4352BABC5564677A03583798DA
- MD5 SHA1 SHA512 TLSH
winlock-builder-2.png
- SHA256 15c3b39b7d65e88fef1087a82cceea47cf553b2e515b8957f457b386a3b7e050
- MD5 afd3f55e763a9acc7ebd204c0d795e97
- SHA1 ab010d11c3db049919ee8ddc90ac7667a055b08a
- SHA512 3288d393803c133e576ce914c68e09809d456cee561ffbc684e863ed0a3de302e83fe10bf4803a43be30512012a4d2d4eb99a417c8f2b848f4b9ad8a59cd9417
- SSDEEP 1536:O0KBKasjakKinr1J+YumFm9EeLL1LuO15+ZbnY9mmC7pCbTpay:mBKarOr1gYuaeEef1r+bnY9W7pCbT
- TLSH T1B893E0A07D27C2C62EAF9C4D74F1D6C163C9A6B0E0570DF26A38D86CD09916E18DCAF4
- MD5 SHA1 SHA512 SSDEEP TLSH
winlock_builder_1.png
- SHA256 adcd4e69cbd659612995253e8e4efb5e4ee61928d0854277e6d7c2cd845d0f17
- MD5 9928b70a1270b7ef77b36f6d4431d5f4
- SHA1 3f0bc6c1894d7ed97d0ffc22e825975eba002b15
- SHA512 42027459520894a85aafd55c47b8094633be94eabf6eb06dbe7e0b68eda20c7d3d4e5822fb9aad11e4ea8385e9e55628bcee6b7ac318ff61ea370e625b234948
- SSDEEP 1536:JOZdvCliJtkbwiUCtwhBMDguIn7frkbf1qkfSDHxDWHZZXUPtdWWaL9NKQHQ:JOZhSv/UCt6Bt7nbrkJQxDW3Xwt/aLXQ
- TLSH T15973020ECCA49B146533AB92CFC623BD6EDD21F7186BE24F47A2156BB4285E81D03DD4
- MD5 SHA1 SHA512 SSDEEP TLSH
winlocker_builder_0.6.exe
- IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
- SHA256 e6fe8b2f92e4be92ac78d099793cc57d1634762599f18e1ae3def2d56eb40845
- MD5 30887d4a16764f7c14858a1049ebfcdd
- SHA1 0c3bf3ae84de1d107fc2af18e101e06a08db45fb
- SHA512 eef38362e336f91273374714abd540c7284767f39d6ca69cc03e2fba5296cbbf593a5c6256e5be4123e52a2593cdc551a58522d296c230763b5aaf0917df8cdd
- SSDEEP 196608:lVhQeZICteErowdNE+sKsXXgvk77/8wPhUL:DInEro+sKkXgs7rZk
- TLSH T14F663344A3E408DFF8B7953DC2A28620D132B4774B55D5CF53A8876A1F67AE21E32F24
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
55856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsFree
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
175KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33140,
count=12, id=260, version=33140,
count=10, id=259, version=33140,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33140,
count=159, id=1, productName=Unmarked objects,
count=27, id=260, version=35213,
count=1, id=258, version=35213,
main.pyc
- SHA256 4dbebdbe1f3795b24d5358d1182b2fe0907656c935e143c0b9ea2f005f2ff3a4
- MD5 8b8f530230a392f3e26c765cfc861bab
- SHA1 bba07bce31c2a6a12694936bdd54cb52d139e8f1
- SHA512 54c299ca1baa6d27d2e4cf22cba4f1a436ff509ff2b2da1f5e6d564d7617384a51df643b61228e453bf499583816d3e2c8af5282a5e7e4f4d0f1ac07ddec01e2
- TLSH T1EBF05CE785051996DA2962B46503A328D192521D69488806DB1CF53E1C286602934F0B
- MD5 SHA1 SHA512 TLSH
winlocker_builder_0.6_BETA.exe
- IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
- SHA256 5602aba38460053df33526cbec83a9776a7d45a0490ce7bbe757420e65759506
- MD5 48ae1e37503a9e2e3f159a5268d4b5ef
- SHA1 1cc13309a53a0e41306cb336eb6ab6be51fea42e
- SHA512 c632dd055b604ac6b3011bc5b823e65cc61ec329d639ea0b6d4429c399706d4386c417afd90fa38fbd22ef87938734bc7d190da697f6036e94dfa91d8a643e88
- SSDEEP 196608:2VhZBlBheZICteErowdNE+sKsXXgvk87+8w2hUp:ENCInEro+sKkXgs88G6
- TLSH T1FF663340A3E404DFF8B79539C2B28610E131B8779BA5D9CF53B882261F576E22F36B54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
55856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsFree
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
175KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33140,
count=12, id=260, version=33140,
count=10, id=259, version=33140,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33140,
count=159, id=1, productName=Unmarked objects,
count=27, id=260, version=35213,
count=1, id=258, version=35213,
main1.pyc
- SHA256 cea4aedbef5968ac70187036e46925148cd84b729cb8a5c65a24e82ec8994658
- MD5 436ee225839b992c8a060d8b3280e118
- SHA1 6157346aa68b2c27e9747e4fd274dd71d189287d
- SHA512 4441c5ec6f086e6ed30568eea8e7d8d7b788371e639b9d253ef56994747f3dc166c335477a8c0c8af4077cc5c51cfb03c76648dab41f8c29657bc7a7089eb7f6
- TLSH T14BF05CE780050996E96CA6F46112D734D193D7A9B849848ACA0CB43D5D196A16524F0A
- MD5 SHA1 SHA512 TLSH