Static task
static1
Behavioral task
behavioral1
Sample
avlines3.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
avlines3.exe
Resource
win10v2004-20230703-en
General
-
Target
avlines3.exe
-
Size
1.2MB
-
MD5
026d233b4084a7be2571a0c566f91bc0
-
SHA1
25beca9a135f5d78bd9edcb9bff0174de97432bd
-
SHA256
abfc33383c6c5253f0031520e194be4a5d87de5af11da8ac39066e84f85c0bc9
-
SHA512
ae166320d4cc34f28143a5628f0582b958651a91a6c7f18871156bf0cbbc95c7edc0a922acd01ca9dbcd369522687d0d5ee52df1990d4568674eed698a8b7549
-
SSDEEP
24576:xm4g00a50iRlkS7R2YSFaCDD5i+FxvVEaMA8WvGhp4RKZK:xm4gDa5DRV2lFaCD1jFxvVEab8WvGh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource avlines3.exe
Files
-
avlines3.exe.exe windows x64
b7cddf0ee12a4e860c1aede80e9c9702
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
libssl-1_1-x64
SSL_set_bio
SSL_ctrl
SSL_write
SSL_CTX_new
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_ctrl
SSL_CTX_free
SSL_new
SSL_CTX_set_options
SSL_free
OPENSSL_init_ssl
TLS_method
SSL_set_accept_state
SSL_CTX_check_private_key
SSL_shutdown
SSL_get_error
SSL_read
SSL_do_handshake
libcrypto-1_1-x64
BIO_write
BIO_free
BIO_ctrl_pending
ERR_print_errors_fp
ERR_get_error
BIO_read
ERR_clear_error
ERR_error_string
BIO_new_bio_pair
kernel32
SetLastError
VirtualFree
VirtualProtect
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
FreeLibrary
VirtualQuery
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
RaiseException
InitializeSListHead
IsDebuggerPresent
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
GetLastError
SetEvent
WaitForSingleObjectEx
CloseHandle
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThreadId
Sleep
GetSystemInfo
GetModuleFileNameA
GetStdHandle
SetConsoleMode
GetConsoleMode
SetUnhandledExceptionFilter
HeapFree
GetCurrentProcess
GetCurrentThread
HeapReAlloc
HeapAlloc
CreateDirectoryA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentDirectoryA
GetModuleHandleW
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCaptureStackBackTrace
GetCurrentProcessId
CreateFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocalTime
OutputDebugStringA
FileTimeToSystemTime
InitOnceExecuteOnce
GetSystemTimeAsFileTime
GetFileAttributesA
libaio
aio_accept_start
aio_accept_stop
aio_socket_create
aio_socket_destroy
aio_socket_accept
aio_client_connect
aio_client_send
aio_client_recv
aio_client_destroy
aio_client_settimeout
aio_client_create
aio_connect
aio_transport_create
aio_timeout_start
aio_timeout_process
aio_timeout_stop
aio_transport_set_timeout
aio_transport_destroy
aio_transport_recv
aio_transport_create2
aio_transport_send_v
aio_socket_process
aio_socket_recvfrom
aio_worker_init
aio_worker_clean
aio_client_send_v
ws2_32
ntohl
getnameinfo
inet_pton
__WSAFDIsSet
WSASend
select
connect
recv
WSACleanup
WSAStartup
WSAIoctl
getsockopt
WSASendTo
sendto
WSAGetLastError
setsockopt
freeaddrinfo
htons
inet_ntop
ntohs
socket
getsockname
listen
ioctlsocket
bind
closesocket
getaddrinfo
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
iphlpapi
GetBestInterfaceEx
GetAdaptersAddresses
GetAdaptersInfo
dbghelp
MiniDumpWriteDump
SymCleanup
SymSetOptions
SymInitialize
SymGetOptions
SymGetLineFromAddr64
SymFromAddr
vcruntime140
memmove
strchr
__CxxFrameHandler3
__std_terminate
_purecall
__std_type_info_compare
strrchr
strstr
__std_exception_destroy
__std_exception_copy
memcpy
longjmp
memset
__C_specific_handler
__intrinsic_setjmp
_CxxThrowException
__C_specific_handler_noexcept
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
__RTDynamicCast
memchr
memcmp
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
calloc
realloc
_callnewh
api-ms-win-crt-stdio-l1-1-0
feof
getc
fread
freopen
_fseeki64
fopen
__stdio_common_vfprintf
__acrt_iob_func
__p__commode
_set_fmode
ftell
fseek
__stdio_common_vsscanf
_ftelli64
fwrite
ferror
__stdio_common_vsprintf
fclose
fflush
api-ms-win-crt-string-l1-1-0
isalnum
_stricmp
_strdup
tolower
strncmp
strcat_s
strcspn
strlen
strcmp
strncpy_s
strcpy_s
strcoll
strspn
strpbrk
_strnicmp
isalpha
isdigit
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_c_exit
_beginthreadex
__p___argv
__p___argc
_initialize_narrow_environment
_initialize_onexit_table
_exit
_register_onexit_function
exit
_errno
_initterm_e
_initterm
_crt_atexit
_get_initial_narrow_environment
_cexit
_seh_filter_exe
strerror
terminate
_invalid_parameter_noinfo_noreturn
abort
_register_thread_local_exe_atexit_callback
_set_app_type
api-ms-win-crt-convert-l1-1-0
atof
strtol
strtod
atoi
strtoul
strtoull
api-ms-win-crt-utility-l1-1-0
rand
srand
rand_s
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_mktime64
_time64
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-math-l1-1-0
sqrt
log10
lrint
sin
fmod
pow
floor
__setusermatherr
cos
ldexp
asin
frexp
advapi32
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
ole32
CoCreateGuid
Sections
.text Size: 889KB - Virtual size: 888KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 242KB - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 47KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ