Static task
static1
Behavioral task
behavioral1
Sample
avlines-LOG.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
avlines-LOG.exe
Resource
win10v2004-20230220-en
General
-
Target
avlines-LOG.exe
-
Size
1.2MB
-
MD5
6a635f77492e6038723e5d7694b4106f
-
SHA1
d046276df6ce7fe6f9e001e4a643cc6e98c69870
-
SHA256
dc6372bc79f67886bac6c01ac6a88b50a20b4e044eb87b6d6c46b3bf14726509
-
SHA512
a95c711dc2ddab6d2f48511d299807103e2580142e95e86c4cb2932012d7cd986db53a6f254ca33d7cf488612391caf353db27d94c2bf02adb66cad775a15661
-
SSDEEP
24576:J/WIa10vu9lfMwo72Cb0bHCtOcjeJMVW9r5fQ2a6Kl:JeIa10vu3fJCgbHCtdjeJMVW9VfQ2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource avlines-LOG.exe
Files
-
avlines-LOG.exe.exe windows x64
6e89635b95aa80eefa1e026f96380519
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
libssl-1_1-x64
SSL_set_bio
SSL_ctrl
SSL_write
SSL_CTX_new
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_ctrl
SSL_CTX_free
SSL_new
SSL_CTX_set_options
SSL_free
SSL_do_handshake
OPENSSL_init_ssl
SSL_read
SSL_set_accept_state
SSL_CTX_check_private_key
SSL_shutdown
SSL_get_error
TLS_method
libcrypto-1_1-x64
BIO_write
BIO_free
BIO_ctrl_pending
ERR_print_errors_fp
ERR_get_error
BIO_read
ERR_clear_error
ERR_error_string
BIO_new_bio_pair
kernel32
SetLastError
VirtualFree
VirtualProtect
VirtualAlloc
FlushInstructionCache
SetThreadContext
FreeLibrary
VirtualQuery
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
RaiseException
InitializeSListHead
IsDebuggerPresent
GetProcAddress
GetModuleHandleW
ResetEvent
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
GetLastError
SetEvent
WaitForSingleObjectEx
CloseHandle
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThreadId
Sleep
GetSystemInfo
GetModuleFileNameA
GetStdHandle
SetConsoleMode
GetConsoleMode
SetUnhandledExceptionFilter
HeapFree
GetCurrentProcess
GetCurrentThread
HeapReAlloc
HeapAlloc
CreateDirectoryA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentDirectoryA
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetThreadContext
RtlCaptureStackBackTrace
ResumeThread
SuspendThread
GetCurrentProcessId
CreateFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocalTime
OutputDebugStringA
FileTimeToSystemTime
InitOnceExecuteOnce
GetSystemTimeAsFileTime
GetFileAttributesA
libaio
aio_accept_start
aio_accept_stop
aio_socket_create
aio_socket_destroy
aio_socket_accept
aio_client_connect
aio_client_send
aio_client_recv
aio_client_destroy
aio_client_settimeout
aio_socket_recvfrom
aio_client_send_v
aio_transport_create
aio_timeout_start
aio_timeout_process
aio_timeout_stop
aio_transport_set_timeout
aio_transport_destroy
aio_transport_recv
aio_transport_create2
aio_transport_send_v
aio_worker_init
aio_worker_clean
aio_socket_process
aio_connect
aio_client_create
ws2_32
ntohl
getnameinfo
inet_pton
__WSAFDIsSet
WSASend
select
connect
recv
WSACleanup
WSAStartup
WSAIoctl
getsockopt
WSASendTo
closesocket
setsockopt
freeaddrinfo
htons
inet_ntop
ntohs
socket
getsockname
getaddrinfo
listen
ioctlsocket
sendto
WSAGetLastError
bind
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
iphlpapi
GetBestInterfaceEx
GetAdaptersAddresses
GetAdaptersInfo
dbghelp
SymGetLineFromAddr64
SymCleanup
SymInitialize
SymFromAddr
SymGetOptions
MiniDumpWriteDump
SymSetOptions
vcruntime140
memmove
strchr
__CxxFrameHandler3
__std_terminate
_purecall
__std_type_info_compare
strrchr
strstr
__std_exception_destroy
__std_exception_copy
memcpy
longjmp
memcmp
__C_specific_handler
__intrinsic_setjmp
_CxxThrowException
__C_specific_handler_noexcept
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
__RTDynamicCast
memchr
memset
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
calloc
realloc
api-ms-win-crt-stdio-l1-1-0
ferror
getc
freopen
fflush
fwrite
_ftelli64
fread
_fseeki64
__stdio_common_vsscanf
ftell
__acrt_iob_func
fopen
_set_fmode
fclose
fseek
feof
__stdio_common_vfprintf
__stdio_common_vsprintf
__p__commode
api-ms-win-crt-string-l1-1-0
tolower
strcspn
strcat_s
_strdup
isalnum
isalpha
strlen
_stricmp
strcmp
strncpy_s
strcpy_s
_strnicmp
strcoll
strpbrk
isdigit
strspn
strncmp
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
terminate
_invalid_parameter_noinfo_noreturn
_beginthreadex
_c_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
exit
_errno
_register_thread_local_exe_atexit_callback
_set_app_type
_get_initial_narrow_environment
_initterm_e
abort
_exit
strerror
__p___argc
__p___argv
_initialize_narrow_environment
_initterm
api-ms-win-crt-convert-l1-1-0
atof
strtoul
strtol
strtod
strtoull
atoi
api-ms-win-crt-utility-l1-1-0
rand
srand
rand_s
api-ms-win-crt-time-l1-1-0
_gmtime64
strftime
_mktime64
_localtime64_s
_time64
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-math-l1-1-0
frexp
asin
sqrt
log10
lrint
pow
__setusermatherr
sin
cos
floor
fmod
ldexp
advapi32
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
ole32
CoCreateGuid
Sections
.text Size: 889KB - Virtual size: 889KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 242KB - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 47KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ