locker[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
locker.exe
Size 677KB
Sample260919-phkhjsz1ew
SHA256 21b68a41377903e8b87a6de8fcfd1d75fef827fa960c204b55e28503f1fe50fd
MD5 8e8847b337ed66f537973e029d3642c1
SHA1 16a087709c17e1d7653aeeacaced98d49233a9ba
SHA512 1f5dae8e29f45152d1a10d587b0422cd949f2bede39f805594707ca17aa83b3b259854bbc8fbdc950c568f745a11e35bbdbaec46062a3d1bf15d29243ed0dce4
SSDEEP 6144:++t5qHW9Km7+jVgLUNvG04mZeuXACtH14N86GdJ5ukTe86BBHUWq+9yN86IpKIGY:QWkV/XACt+N+KfSHd6fXQFSmrQ0e
TLSH
T124E4D543269B1DBADDD32F7861DB233AAB35FD608BBA4A6B8544C2314C131D06D2FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
locker.exe

File Explorer

locker.exe

.exe 677KB

locker.exe

IMPHASH a456c12a23a7e2ea687226f7dd6ebae2
SHA256 21b68a41377903e8b87a6de8fcfd1d75fef827fa960c204b55e28503f1fe50fd
MD5 8e8847b337ed66f537973e029d3642c1
SHA1 16a087709c17e1d7653aeeacaced98d49233a9ba
SHA512 1f5dae8e29f45152d1a10d587b0422cd949f2bede39f805594707ca17aa83b3b259854bbc8fbdc950c568f745a11e35bbdbaec46062a3d1bf15d29243ed0dce4
SSDEEP 6144:++t5qHW9Km7+jVgLUNvG04mZeuXACtH14N86GdJ5ukTe86BBHUWq+9yN86IpKIGY:QWkV/XACt+N+KfSHd6fXQFSmrQ0e
TLSH
T124E4D543269B1DBADDD32F7861DB233AAB35FD608BBA4A6B8544C2314C131D06D2FB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges GetUserNameW LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExW RegOpenKeyW RegSetValueExW

kernel32

CloseHandle DeleteCriticalSection EnterCriticalSection FormatMessageA GetConsoleWindow GetCurrentProcess GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetThreadId InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _initterm _onexit _wsystem abort calloc exit fprintf fputc fputs free fwrite getenv localeconv malloc memchr memcmp memcpy memmove memset realloc signal strchr strcmp strerror strlen strncmp strtoul vfprintf wcslen _read

user32

FindWindowW ShowWindow

Name

.text

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

925B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

locker.exe

advapi32

kernel32

msvcrt

user32

generic