DeriaLock[.]zip | Triage™

General

Target
DeriaLock.zip
Size 214KB
Sample260930-fw8mvsvxht
SHA256 3127f9577370a86f4494ebc9d03cdf4d31efbf828649367ffa01df220bb5751b
MD5 85467a1dfe53d742654125a4452c4e38
SHA1 8d66d1ec37c29bb82938f06e54acb2cdf689738c
SHA512 2105606279e8c99ae8ba4eb12976b6fdd86facdfb8e1b62ab02705be6dc4745c2551f7336cd801da0adb6475ca02ec3690d6528703d013c453ebf118d12fc34b
SSDEEP 6144:fV6PsunGd4+CbkJmh3zYWnlIeByVJNQZDAf0:0Un9mh3Rn9ByjN+DAc
TLSH
T1CA24220EC3C5625DE2B19C9D2597131538F9E77CBAC2D81DEA994B3499790BB0E3BE00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DeriaLock.exe

File Explorer

DeriaLock.zip

.zip 214KB
DeriaLock.exe

.exe 484KB

DeriaLock.zip

SHA256 3127f9577370a86f4494ebc9d03cdf4d31efbf828649367ffa01df220bb5751b
MD5 85467a1dfe53d742654125a4452c4e38
SHA1 8d66d1ec37c29bb82938f06e54acb2cdf689738c
SHA512 2105606279e8c99ae8ba4eb12976b6fdd86facdfb8e1b62ab02705be6dc4745c2551f7336cd801da0adb6475ca02ec3690d6528703d013c453ebf118d12fc34b
SSDEEP 6144:fV6PsunGd4+CbkJmh3zYWnlIeByVJNQZDAf0:0Un9mh3Rn9ByjN+DAc
TLSH
T1CA24220EC3C5625DE2B19C9D2597131538F9E77CBAC2D81DEA994B3499790BB0E3BE00
MD5 SHA1 SHA512 SSDEEP TLSH

DeriaLock.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
MD5 0a7b70efba0aa93d4bc0857b87ac2fcb
SHA1 01a6c963b2f5f36ff21a1043587dcf921ae5f5cd
SHA512 2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14
SSDEEP 6144:lqHKx3YCgy8HmmjJpnVhvLqCO3bLinIz1wASx:lqHoyHNj/nVhvLcyII
TLSH
T1A2B43B3671E1A920DB4A7D31062C911E6664F8FEB5F2B56028C6217BCD5388BC7FA533
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

329086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows.old\Users\ArizonaCode\Documents\Visual Studio 2013\Projects\LOGON\LOGON\obj\Debug\LOGON.pdb

DeriaLock.zip

DeriaLock.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

DeriaLock.zip

DeriaLock.exe

mscoree

dotnet