a2da290ceb5ee131943b46f343b13a660589e14cd644f8c3a9ebab641636dd20
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2017-Jan-28 06:03:44 |
| Detected languages |
English - United States
|
| Comments | This Program Coded By Mehdi-RaTo |
| CompanyName | Cyber Security Team |
| ProductName | CS Desktop Locker |
| FileVersion | 1.00 |
| ProductVersion | 1.00 |
| InternalName | CS Desktop Locker |
| OriginalFilename | CS Desktop Locker.exe |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual Basic v5.0/v6.0
Microsoft Visual Basic v5.0 - v6.0 Microsoft Visual Basic v6.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Malicious | VirusTotal score: 12/72 (Scanned on 2025-06-01 14:59:49) |
APEX:
Malicious
AhnLab-V3: PUP/Win.ScreenLocker.C5745634 CrowdStrike: win/malicious_confidence_60% (W) Cylance: Unsafe DeepInstinct: MALICIOUS ESET-NOD32: a variant of Win32/LockDown.B potentially unsafe Kingsoft: malware.kb.a.726 MaxSecure: Trojan.Malware.300983.susgen McAfeeD: ti!A2DA290CEB5E Rising: PUA.LockDown!8.19E07 (CLOUD) Trapmine: malicious.high.ml.score TrellixENS: Artemis!409F53D72713 |
Hashes
| MD5 | 409f53d72713f6d9e16cedb8dbd67295 🔍 |
|---|---|
| SHA1 | a35d34b44a275935f38a0cb019739ac61ddb5bbe 🔍 |
| SHA256 | a2da290ceb5ee131943b46f343b13a660589e14cd644f8c3a9ebab641636dd20 🔍 |
| SHA3 | f0ccbf77744b4313ee81e385354aa1d946cbf937b00d9f8bd3f8d54576784756 🔍 |
| SSDeep | 768:/6Msl5mecRQ80W8CeHfD/i3ktR7r//qxA+RkYsc1Epsl:/65mOi8CeHfD/i3ktR7r//cA+Rxs+Ec 🔍 |
| Imports Hash | 7dfd52c73dad385e9e29dc7ffaa2ebec 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xb8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2017-Jan-28 06:03:44 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x8000 |
| SizeOfInitializedData | 0x4000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001440 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x9000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 1.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xd000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0xd702 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | cccdc5cf0ddbaf0e90ee7f36e90955bb 🔍 |
|---|---|
| SHA1 | 0ec6aebcf4048bc4800d72f55b97e820ae6b3887 🔍 |
| SHA256 | 2a4ff33e791ce014e047d1b575312fa6d58e0e0e5e0386d74385a4012d7ec74c 🔍 |
| SHA3 | 57f03c91b449532122a64eed6d38cd7aa6cdd9d9af98ce7aa2a8ad39a9403058 🔍 |
| VirtualSize | 0x7784 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x8000 |
| PointerToRawData | 0x1000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.93536 |
.data
| MD5 | 620f0b67a91f7f74151bc5be745b7110 🔍 |
|---|---|
| SHA1 | 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d 🔍 |
| SHA256 | ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7 🔍 |
| SHA3 | a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563 🔍 |
| VirtualSize | 0xa7c |
| VirtualAddress | 0x9000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x9000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
.rsrc
| MD5 | 00e9e13fc36f0931f33b9a8bb9d6636c 🔍 |
|---|---|
| SHA1 | 2964e3514e2f791658e71d08534eb61711ec993b 🔍 |
| SHA256 | 48970b55ec8fb20a368f6e2b7c86d85d31add1e9da746c26dfbb2d0abe0395d1 🔍 |
| SHA3 | b51909d68cd48501b216c7e195e11c09d29f89b31941e802ba4d72f02fb521d9 🔍 |
| VirtualSize | 0x2064 |
| VirtualAddress | 0xa000 |
| SizeOfRawData | 0x3000 |
| PointerToRawData | 0xa000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 2.18612 |
Imports
| MSVBVM60.DLL |
__vbaStrI2
_CIcos _adj_fptan __vbaFreeVar __vbaLenBstr __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 __vbaStrCat __vbaVarCmpNe __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaObjSet #595 __vbaOnError _adj_fdiv_m16i _adj_fdivr_m16i __vbaBoolVarNull _CIsin __vbaChkstk __vbaFileClose EVENT_SINK_AddRef #528 __vbaGenerateBoundsError __vbaStrCmp DllFunctionCall __vbaVarOr _adj_fpatan __vbaFixstrConstruct EVENT_SINK_Release _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler #711 __vbaStrToUnicode __vbaPrintFile __vbaInputFile #712 _adj_fprem _adj_fdivr_m64 __vbaFPException __vbaStrVarVal __vbaVarCat _CIlog __vbaErrorOverflow __vbaFileOpen __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r #100 #610 __vbaStrToAnsi __vbaVarDup #612 _CIatan __vbaStrMove __vbaAryCopy _allmul _CItan _CIexp __vbaFreeStr __vbaFreeObj |
|---|
Delayed Imports
30001
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Unicode (UTF 16LE) |
| Size | 0x1ca8 |
| TimeDateStamp | 2017-Jan-28 06:03:44 |
| Entropy | 2.74684 |
| MD5 | 2a192da7131652433d63a09ceb464d46 🔍 |
| SHA1 | f3a0f8dca0a3ea8b57bb0fdadfeac80badffcfe2 🔍 |
| SHA256 | b874aa4dc80d8d89772ec5e18c00635d4a6538d656b24cde66ee2f300be37bba 🔍 |
| SHA3 | d3be09f4a62e925cfe4c883a7ce914f5c7ea8b2350d242ea43112c0c3bb41c14 🔍 |
1
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Unicode (UTF 16LE) |
| Size | 0x14 |
| TimeDateStamp | 2017-Jan-28 06:03:44 |
| Entropy | 2.32322 |
| Detected Filetype | Icon file |
| MD5 | 8c07912a9ca7659ca24602ca2ef8b42d 🔍 |
| SHA1 | 669d4286c19b5c263fbcd36de69c2569faf429a2 🔍 |
| SHA256 | 0f43307311e9e7bc79d67e1b1ec408f281a1d832c6238341f376ebd1205ca86f 🔍 |
| SHA3 | a0fa6ffdd58d4c0498f77ecdc82fb053a3954d39bf5a5734c8fa88a9f7f8f153 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | Unicode (UTF 16LE) |
| Size | 0x2b8 |
| TimeDateStamp | 2017-Jan-28 06:03:44 |
| Entropy | 3.30974 |
| MD5 | 7127d3802cf19662c8a611fb1bf5a02a 🔍 |
| SHA1 | 6ca56a642955765f5b108bbc9852453f65278b41 🔍 |
| SHA256 | b00ff0aa58482d13a63aea9f479478bd62adaab4d4dc82d0086ae3331a6663bc 🔍 |
| SHA3 | 276d316171e79947858b2513598de46f65daa4f271dd7cd307cefbc311eb76cb 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| Comments | This Program Coded By Mehdi-RaTo |
| CompanyName | Cyber Security Team |
| ProductName | CS Desktop Locker |
| FileVersion (#2) | 1.00 |
| ProductVersion (#2) | 1.00 |
| InternalName | CS Desktop Locker |
| OriginalFilename | CS Desktop Locker.exe |
| Resource LangID | English - United States |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x8897ebcb |
|---|---|
| Unmarked objects | 0 |
| 14 (7299) | 1 |
| 9 (8041) | 1 |
| 13 (8169) | 1 |
Errors
Leave a comment
No comments yet.