avav[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

avav.exe
Size

19KB
MD5

4b775760e5792439e7a119c0ca2b1228
SHA1

d58eae34616e6b2ae7062da1e6ef8b3f71bc6db7
SHA256

99325896d59a5d042fb25e7a6c7ad3254967379b5bfb1323d3d91a4c3bb112a5
SHA512

78bf48a6019dcef88948fe9e4001d569f82cbb31c22872b5a839d7e12d2e126e70f5884116e1cfb498515b088e5c101b6d30ec0d377f8a8e3b9154e523fec7d5
SSDEEP

384:ykXGlITNVE+ryHyJDSC7Ri6fPDS9QJUjBPHmV:ylITNq+rrDh7Ri6f7JUjdHm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
avav.exe

Files

avav.exe
.exe windows:6 windows x64

08ac329836d0c3cd418a6ae2dbaa17d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

OpenProcess
CreateToolhelp32Snapshot
GetTempPathA
GetTickCount64
K32GetModuleFileNameExA
GetLastError
Process32NextW
CreateFileA
Process32FirstW
GetCurrentDirectoryA
GetSystemInfo
DeleteCriticalSection
GetCurrentProcessId
GlobalMemoryStatusEx
GetComputerNameA
OutputDebugStringW
InitializeSListHead
FindClose
InitializeCriticalSectionEx
FindNextFileA
K32GetModuleFileNameExW
DeviceIoControl
FindFirstFileA
CloseHandle
Sleep
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

RegCloseKey
RegQueryValueExA
GetUserNameA
RegOpenKeyExA
RegOpenKeyExW
RegEnumValueA
RegEnumKeyA

shell32

SHGetFolderPathA

netapi32

NetWkstaGetInfo

vcruntime140

__C_specific_handler
memset
__current_exception_context
__current_exception

api-ms-win-crt-time-l1-1-0

_difftime64
_time64

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fclose
__stdio_common_vsprintf_s
__p__commode
_set_fmode
__stdio_common_vfprintf
fopen

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode

api-ms-win-crt-string-l1-1-0

strcat_s

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_configure_narrow_argv
terminate
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_exit
_set_app_type
_register_onexit_function
exit
_seh_filter_exe
_cexit
_crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08ac329836d0c3cd418a6ae2dbaa17d4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

netapi32

vcruntime140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 648B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 48B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 648B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 48B