WinLocker[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
WinLocker.exe
Size 3.0MB
Sample261017-ryjmasvxex
SHA256 4ef5d27b5f41341698d3a27e4cca6526dafcafa300cf5ac4dc050227ae69f5fb
MD5 ce3678888a5212a6a508a9d025b0681e
SHA1 e55ab28b42148b91a81da3b6484cae01d25a2df8
SHA512 75d870da969827d2ac21b43f1abdf42e3e20320dce58952204cd2f38d7afa28d66a646d7dccba2a648d3c3c68a31092427cc79f1db7411a06573104fb17d5da3
SSDEEP 49152:+/6ASCp9av0vf4dr4sKIxDJJzRncR1Q+Bj3KevGEEre:Oav0vf4dBDjzRncR1Vt3KevGEEre
TLSH
T18BE5194369DB0CE5CED26BB465D71335A734FD72CA291F3BAA08C2316D636C4AD1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinLocker.exe

File Explorer

WinLocker.exe

.exe 3.0MB

WinLocker.exe

IMPHASH 32377613dc6cfce405f8cc6e88d07f00
SHA256 4ef5d27b5f41341698d3a27e4cca6526dafcafa300cf5ac4dc050227ae69f5fb
MD5 ce3678888a5212a6a508a9d025b0681e
SHA1 e55ab28b42148b91a81da3b6484cae01d25a2df8
SHA512 75d870da969827d2ac21b43f1abdf42e3e20320dce58952204cd2f38d7afa28d66a646d7dccba2a648d3c3c68a31092427cc79f1db7411a06573104fb17d5da3
SSDEEP 49152:+/6ASCp9av0vf4dr4sKIxDJJzRncR1Q+Bj3KevGEEre:Oav0vf4dBDjzRncR1Vt3KevGEEre
TLSH
T18BE5194369DB0CE5CED26BB465D71335A734FD72CA291F3BAA08C2316D636C4AD1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegDeleteValueW RegOpenKeyExW RegSetValueExW

gdi32

CreateFontW CreatePen CreateSolidBrush DeleteObject GetStockObject Rectangle SelectObject SetBkMode SetTextColor

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromStream GdipCreateFromHDC GdipDeleteGraphics GdipDisposeImage GdipDrawImageRectI GdipFree GdipGetImageHeight GdipGetImageWidth GdipSetInterpolationMode GdiplusShutdown GdiplusStartup

kernel32

AddVectoredExceptionHandler Beep CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateMutexW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FindResourceW FormatMessageA GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesW SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fdopen _fileno _fmode _fstat64 _get_osfhandle _initterm _ismbblead _localtime64 _lseeki64 _onexit _read _setjmp _strdup _time64 _ultoa _wfopen _write abort calloc exit fclose fflush fopen fprintf fputc free fwrite getenv iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset printf realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CreateStreamOnHGlobal

shell32

ShellExecuteW

user32

BeginPaint CallNextHookEx CreateWindowExW DefWindowProcW DispatchMessageW DrawTextW EndPaint ExitWindowsEx FillRect GetAsyncKeyState GetClientRect GetMessageW GetSystemMetrics InvalidateRect PostQuitMessage RegisterClassW SetTimer SetWindowsHookExW ShowWindow TranslateMessage UnhookWindowsHookEx UpdateWindow

Name

.text

Size

824KB

Virtual Size

823KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

619B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

WinLocker.exe

advapi32

gdi32

gdiplus

kernel32

msvcrt

ole32

shell32

user32

generic