CryptoLocker | 00abc3fd15b5

Classifications

Ransomware

Threat Names

CryptoLocker

Dynamic Analysis Report

Created on 2024-02-12T13:17:47+00:00

misid.exe

Windows Exe (x86-32)

Filters:

File Name	Category	Type	Verdict	Actions

C:\Users\OqXZRaykm\Desktop\misid.exe

Sample File

Binary

MIME Type	application/vnd.microsoft.portable-executable
File Size	100.25 KB
MD5	ff942995e53fcd3d97d2ee0379f8b605
SHA1	fad1dbc522c54867202b273d86394d2b2edbc80b
SHA256	00abc3fd15b57cf398ee6a4606e09b6f1fe4adb0d9c23ca315125a7dab66cbfe
SSDeep	768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRiWjzUNu5L:i5nkFGMOtEvwDpjNbwQEIikgNi
ImpHash	e021c9fc2c12265365fad587d43783fe

File Reputation Information

Verdict

Malicious

PE Information

Image Base	0x00500000
Entry Point	0x0050A0DF
Size Of Code	0x00002E00
Size Of Initialized Data	0x00006200
File Type	IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem	IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type	IMAGE_FILE_MACHINE_I386
Compile Timestamp	2013-10-02 12:54 (UTC)

Sections (3)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.MPRESS1	0x00501000	0x00009000	0x00002A00	0x00000200	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	7.53
.MPRESS2	0x0050A000	0x0000038E	0x00000400	0x00002C00	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.88
.rsrc	0x0050B000	0x00003248	0x00003400	0x00003000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.78

Imports (3)

KERNEL32.DLL (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetModuleHandleA	-	0x0050A050	0x0000A050	0x00002C50	0x00000000
GetProcAddress	-	0x0050A054	0x0000A054	0x00002C54	0x00000000

user32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
EndPaint	-	0x0050A05C	0x0000A05C	0x00002C5C	0x00000000

gdi32.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateFontIndirectA	-	0x0050A064	0x0000A064	0x00002C64	0x00000000

Memory Dumps (1)

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	YARA	Actions
misid.exe	1	0x00010000	0x0001EFFF	First Execution		32-bit	0x0001A0DF		... Actions Go to Process Go to YARA Match Download Dump

YARA Matches (1)

Rule Name	Rule Description	Classification	Score	Actions
CryptoLocker_rule2	CryptoLocker ransomware	Ransomware	5/5	... Actions Show Ruleset Show Match

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".

Before

After

WHOIS Domain Information

Screenshot

There are no files for this filter

There are no files in this analysis

Classifications

Threat Names

Before

After

WHOIS Domain Information