winlocker[.]exe | Triage™

General

Target
winlocker.exe
Size 178KB
Sample261026-xtqspsbg47
SHA256 4df0a028d07d42406ff4faa6525a821307121a91cef33b04f53a51e2a1644f9d
MD5 cd45922a62492810ad9ff4f143271785
SHA1 2998b35d96b1acd8cc1a6d8c3c3bf69df1ebdf7f
SHA512 94ab2f1b79aeba51098c547488abc04a6224e2f6f6e3bc6f17361cb4469bd7f0d312f8cc9f21ccb1ba27622d507d6bd428495d0f228c8562d181662d2829b017
SSDEEP 3072:qvrGQpUYXWzzihtL83zYnb6i0FfZIXRMX5AtRNRTBdMoZyC/TfoC:qvCQp5XmiqzS0F9etRNVv
TLSH
T1A9047C1573A500F9E0B79139C9A26606F7B3781507709AEF03A447B69F636D0AD3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winlocker.exe

File Explorer

winlocker.exe

.exe 178KB

winlocker.exe

IMPHASH fbac258ad675b2b8c06e0736b0e9746c
SHA256 4df0a028d07d42406ff4faa6525a821307121a91cef33b04f53a51e2a1644f9d
MD5 cd45922a62492810ad9ff4f143271785
SHA1 2998b35d96b1acd8cc1a6d8c3c3bf69df1ebdf7f
SHA512 94ab2f1b79aeba51098c547488abc04a6224e2f6f6e3bc6f17361cb4469bd7f0d312f8cc9f21ccb1ba27622d507d6bd428495d0f228c8562d181662d2829b017
SSDEEP 3072:qvrGQpUYXWzzihtL83zYnb6i0FfZIXRMX5AtRNRTBdMoZyC/TfoC:qvCQp5XmiqzS0F9etRNVv
TLSH
T1A9047C1573A500F9E0B79139C9A26606F7B3781507709AEF03A447B69F636D0AD3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

20756

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassExW CreateWindowExW DestroyWindow SetProcessDPIAware EnumDisplayMonitors GetMonitorInfoW LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetParent SetWindowLongPtrW InflateRect FillRect ShowCursor MessageBoxW GetClientRect GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetForegroundWindow DrawTextW GetSystemMetrics EnableWindow KillTimer SetTimer GetAsyncKeyState GetFocus SetFocus SetWindowDisplayAffinity SetWindowPos GetMessageW

gdi32

SetTextColor SetBkMode SetBkColor SelectObject RoundRect GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptGenRandom BCryptDeriveKeyPBKDF2 BCryptFinishHash

kernel32

LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc GetProcessHeap SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW RtlCaptureContext HeapFree GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess LoadLibraryExW FreeLibrary TlsFree GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW ReadFile WriteFile Beep CloseHandle CreateThread GetLocalTime GetTickCount64 GetModuleHandleW GetProcAddress MultiByteToWideChar WideCharToMultiByte RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TlsSetValue RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue

Name

.text

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

winlocker.exe

user32

gdi32

bcrypt

kernel32

generic