Static task
static1
Behavioral task
behavioral1
Sample
avlines2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
avlines2.exe
Resource
win10v2004-20230703-en
General
-
Target
avlines2.exe
-
Size
1.1MB
-
MD5
01bc21030b6043042a103150ddee96ef
-
SHA1
1199bc8269efccf5dca3944aa1a9a780611e42d0
-
SHA256
1a2cc050e6af5861888e0c83f39815ae550d707badfc09adf190d20e87c2ea08
-
SHA512
497ee0fe457120c5b5b8cd889cb6aa2526155ece49325f84bddfc6ec271da36c7c77f431561d8e4c0891881c78c62706fddc0b5943e50ecd66b5ed10d851dc02
-
SSDEEP
24576:fATJewdeggr344aMn3YTCav1UjbVY4lB6qM3Kb:fATMwdngrfaAYTCaNUjbVY4X6qM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource avlines2.exe
Files
-
avlines2.exe.exe windows x64
bbf28d75dadb148242b6c7e292272101
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
libssl-1_1-x64
SSL_set_bio
SSL_ctrl
SSL_write
SSL_set_accept_state
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_ctrl
SSL_new
SSL_CTX_set_options
SSL_free
TLS_method
SSL_read
SSL_CTX_check_private_key
SSL_shutdown
SSL_get_error
OPENSSL_init_ssl
SSL_CTX_new
SSL_do_handshake
libcrypto-1_1-x64
BIO_write
BIO_free
ERR_clear_error
ERR_error_string
BIO_ctrl_pending
ERR_get_error
ERR_print_errors_fp
BIO_new_bio_pair
BIO_read
kernel32
GetProcessHeap
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
RaiseException
InitializeSListHead
IsDebuggerPresent
GetProcAddress
GetModuleHandleW
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentProcessId
CreateFileA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
VirtualQuery
GetLastError
SetEvent
WaitForSingleObjectEx
CloseHandle
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThreadId
Sleep
GetSystemInfo
GetModuleFileNameA
GetStdHandle
SetConsoleMode
GetConsoleMode
SetUnhandledExceptionFilter
GetFileAttributesA
CreateDirectoryA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentDirectoryA
FreeLibrary
GetCurrentProcess
CreateSemaphoreA
GetCurrentThread
ReleaseSemaphore
GetLocalTime
OutputDebugStringA
FileTimeToSystemTime
InitOnceExecuteOnce
GetSystemTimeAsFileTime
CreateEventW
libaio
aio_socket_create
aio_accept_stop
aio_socket_destroy
aio_socket_accept
aio_client_connect
aio_accept_start
aio_client_send
aio_client_destroy
aio_socket_recvfrom
aio_worker_init
aio_client_settimeout
aio_client_send_v
aio_transport_create
aio_timeout_start
aio_timeout_process
aio_timeout_stop
aio_transport_set_timeout
aio_transport_destroy
aio_transport_recv
aio_transport_create2
aio_transport_send_v
aio_client_create
aio_client_recv
aio_connect
aio_socket_process
ws2_32
ntohl
getnameinfo
inet_pton
__WSAFDIsSet
WSASend
select
connect
recv
WSAStartup
WSAIoctl
getsockopt
WSASendTo
sendto
WSAGetLastError
ioctlsocket
bind
closesocket
listen
getaddrinfo
getsockname
htons
ntohs
inet_ntop
socket
setsockopt
freeaddrinfo
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
iphlpapi
GetBestInterfaceEx
GetAdaptersAddresses
GetAdaptersInfo
dbghelp
MiniDumpWriteDump
vcruntime140
strchr
__CxxFrameHandler3
__std_terminate
_purecall
__std_type_info_compare
strrchr
strstr
__std_exception_destroy
__std_exception_copy
memcpy
longjmp
memcmp
memset
__C_specific_handler
__intrinsic_setjmp
_CxxThrowException
__C_specific_handler_noexcept
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
__RTDynamicCast
memchr
memmove
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
malloc
realloc
free
calloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsscanf
freopen
getc
fsetpos
_ftelli64
fwrite
ferror
__acrt_iob_func
__stdio_common_vfprintf
fputc
__stdio_common_vsprintf
ungetc
__p__commode
fflush
setvbuf
fgetc
_fseeki64
fread
_get_stream_buffer_pointers
fgetpos
feof
ftell
fopen
fclose
fseek
_set_fmode
api-ms-win-crt-string-l1-1-0
_strdup
tolower
strlen
strcmp
strncpy_s
strcpy_s
isalpha
strcspn
strcoll
isdigit
strspn
strpbrk
_stricmp
strncmp
_strnicmp
isalnum
strcat_s
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_exit
_beginthreadex
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
exit
_errno
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_invalid_parameter_noinfo_noreturn
abort
strerror
api-ms-win-crt-convert-l1-1-0
strtol
strtoull
atof
atoi
strtod
strtoul
api-ms-win-crt-utility-l1-1-0
rand_s
srand
rand
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
strftime
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-math-l1-1-0
frexp
floor
pow
cos
ldexp
fmod
__setusermatherr
sin
lrint
sqrt
asin
log10
advapi32
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
ole32
CoCreateGuid
Sections
.text Size: 824KB - Virtual size: 824KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 225KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ