7d1f2495456c45e3a2bdf589e01a76a0

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2016-May-26 14:15:29
Debug artifacts C:\Users\Win7\Documents\Visual Studio 2012\Projects\Alt\Kryptolocker\Kryptolocker\obj\Debug\Kryptolocker.pdb
FileDescription Kryptolocker
FileVersion 1.0.0.0
InternalName Kryptolocker.exe
LegalCopyright Copyright © 2016
OriginalFilename Kryptolocker.exe
ProductName Kryptolocker
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Suspicious Unusual section name found: .sdata
Info The following exploit mitigation techniques have been detected Stack Canary: disabled
SafeSEH: disabled
ASLR: enabled
DEP: enabled
Malicious VirusTotal score: 12/56 (Scanned on 2016-06-06 21:34:10) Baidu: Win32.Trojan.WisdomEyes.151026.9950.9999
Symantec: Trojan.Cryptolocker
Avast: Win32:Malware-gen
Kaspersky: Trojan-Ransom.MSIL.Agent.gfo
TrendMicro: Ransom_CRYPHERBST.A
McAfee-GW-Edition: BehavesLike.Win32.Backdoor.ct
AegisLab: Troj.W32.Gen.lWNU
AhnLab-V3: Trojan/Win32.Ransom
McAfee: Artemis!7D1F2495456C
VBA32: Trojan.MSIL.gen.18
Fortinet: W32/Herbst.A!tr
Qihoo-360: HEUR/QVM03.0.Malware.Gen

Hashes

MD5 7d1f2495456c45e3a2bdf589e01a76a0
SHA1 d96c1b25685da01a97a55f9e7c99be73b6316634
SHA256 18605f7a5a47ac16f722e3ec8a42121035bb95f731aaad5090c5e11104fc3185
SHA3 38d9b9b041763d5e391e747ad99050600a37f8386fb5395a6f57765d767bb1e0
SSDeep 768:q1pIbARNCFWm3LUQjUuvdT5MvNarTEvHHi1wc5cccXtYUc5ODYvhgTCcqK97LJ+:amb6YYUjUDYKWcqOZPBsl
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2016-May-26 14:15:29
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 11.0
SizeOfCode 0x2e400
SizeOfInitializedData 0x3400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x3030e (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x32000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x3a000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 3239224c485b3db99e17fef466c85edb
SHA1 1032d9c3bbc4725f16d001502e5d2ea09760cd83
SHA256 689da5bb7d48a0b23ef6b7bae7f87d0c7d215e715cbeb30d9e7fe0142a8f946f
SHA3 9dd77684b5c17926a7210f821397967516b5628d7b94465bee0a2b016814dfe7
VirtualSize 0x2e314
VirtualAddress 0x2000
SizeOfRawData 0x2e400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.969

.sdata

MD5 334d2f0d992e54403d4c032ba91d688e
SHA1 2c0d23fd5be8f66abe854727491568743e695102
SHA256 8f77fd60153d0b3ecf99714f58325bcdd6a38cca7dacfaac7ffaa4d4f52cec88
SHA3 2ed4b8a709120589c3228db0d2fefb04f93b1113e51d7c77a69e929334e932bc
VirtualSize 0x138
VirtualAddress 0x32000
SizeOfRawData 0x200
PointerToRawData 0x2e800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.33217

.rsrc

MD5 994598450e46db75fa2b42fba007ae8e
SHA1 d4cc3420ec7976a58be4028ad76521de51c8611b
SHA256 1f34c809ae8f8ed238986cce63f196473b55df78a2e8c12e4f25bc639e19069c
SHA3 eb95292269e29b4c2f3c29c550451c3b00a7f122a8d2d9e480b592f93b0bae46
VirtualSize 0x2e70
VirtualAddress 0x34000
SizeOfRawData 0x3000
PointerToRawData 0x2ea00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.30092

.reloc

MD5 0811b3db3451c0f340dde193e5c45c59
SHA1 61a85fdf80a1c80ed7b9383fe9e44c7b4bfffb52
SHA256 bc7d2a42ab5bc07a369d68b2bb83a1696070fdaaa1d0d4e0aa9daf75f02f30ab
SHA3 3709ef6cc96aaf7ca60bc245e55e0f406ae65f62e7da2a416914a64488fa6d2d
VirtualSize 0xc
VirtualAddress 0x38000
SizeOfRawData 0x200
PointerToRawData 0x31a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0815394

Imports

mscoree.dll _CorExeMain

Delayed Imports

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x128
Entropy 2.0843
MD5 105b81bd721715275df5b229be68f074
SHA1 d9f82fd4974afb06297b803c70381d79bed90f9a
SHA256 478fe62e420007abb1a697a24cb1b80ced0a8e0a335d6ce68606efe71c4afaa2
SHA3 3f9ad53a103317e467ca649fa4358d1ba57b90f2fb4fe35235b0516654a0519d

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x568
Entropy 1.04772
MD5 f3018f2b932e0949bf386acd81aea508
SHA1 2515ef70721a15a20410f44b2c6fd724b7a2e07f
SHA256 abdc6eaa0ea69a1c506edf070a07fb12071453e08ecf3c6e35f1397d3422051f
SHA3 92e5f8fbd21f34a6c632e59594661834c8128d0d746e091a253d8c3a3a1a9dd9

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
Entropy 2.76148
MD5 52b71dd210ac5cf0fe97a3f9ba9a3896
SHA1 ed8632d87b02c7ab7dceb17bac85c8d23982f82b
SHA256 dc2a1f63c0882b33321345f27c07ef9f8bdb87aa687f075a474be430a1135982
SHA3 07dfab28079f9fc5fa163e90a4bd89ac3293670acb7236c8edaa9af93fdfe843

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x2e8
Entropy 1.71396
MD5 14dff9b6c56d206aca6add232d20b50a
SHA1 d0b685483ff7225729d953638fb65f7d72f333de
SHA256 accfee1287c9f7dc25ecb19548ed246ceae1652fef5ad532914d5bb9dc9299ef
SHA3 0867217a4c7b907e83af59423b59e0a6975c919ea8f1f547be25f869dd1d26be

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a8
Entropy 1.72071
MD5 a81075dd2b656f081e035280f17e7a93
SHA1 2e05cabb4904b309c79c221eb187ac41c53183de
SHA256 b76fc9f2130962dfc25029a639848894feee7e9eb1a0fe5c680e3a90671741b1
SHA3 38e83ce1344b63a9b2e861a900782c4a6598f6377326deb24b76bb2f2aab68ec

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
Entropy 2.72257
MD5 8eb389e5fd517774f26c9d113315365d
SHA1 16a2a3489eb31857dff142f6ccbbe110e2b3a90b
SHA256 b0a40090c9bfdfdd8d2f77b68d7052d1eeceb41dc5ab2eaa9c85e15104984ef1
SHA3 4ead04e043803217c1e1aa5dabdef41e7d513171012a14ca8d9e4b0dacf5bd23

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5a
Entropy 2.71964
Detected Filetype Icon file
MD5 a29f9f54be50b15d74257a197464bfdc
SHA1 85107c8039c33fa53c80003ea45b9081ea1bcf1a
SHA256 05507c3c1ae2629aec59c1d7c14944b8aa1492eee696d1c825c5407c929ed1e1
SHA3 2e275fe31acf5ec0c4b55b7dedb688a492ffcd1acfe22485cf35b44dd806055b

1

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
Entropy 5.00112
MD5 a19a2658ba69030c6ac9d11fd7d7e3c1
SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650
SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
SHA3 770a4320336495b7f07f0711380cc7dde1965bafc8765ba2aa981bfc87020d72

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
FileDescription Kryptolocker
InternalName Kryptolocker.exe
LegalCopyright Copyright © 2016
OriginalFilename Kryptolocker.exe
ProductName Kryptolocker
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2016-May-26 14:15:29
Version 0.0
SizeofData 284
AddressOfRawData 0x3201c
PointerToRawData 0x2e81c
Referenced File C:\Users\Win7\Documents\Visual Studio 2012\Projects\Alt\Kryptolocker\Kryptolocker\obj\Debug\Kryptolocker.pdb

TLS Callbacks

Load Configuration

RICH Header

Errors