2024-04-26_113235a007b9271835bbd3719a30d574_avoslocker_floxif

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-26_113235a007b9271835bbd3719a30d574_avoslocker_floxif
Size

1.8MB
MD5

113235a007b9271835bbd3719a30d574
SHA1

39ad49e56aeeb9afd9519b13dd0f6840acdaacb6
SHA256

7b3e283d858d91b9eaa02363173d77c34f29ff4a22828f90e43f6592eb87757e
SHA512

df68a5a130dd05936bc4eb90d1d6182606c95603de8eecba71c2d324940bffb564e8b07abe76c4c2ffd6c4618a38af020dc263a89146c77fbdfbc14d44d76e48
SSDEEP

49152:Q6Rjg4BRQRwk9nqi8gjrXxEfOrv97nkEEToYRJTpZIaH2c:Q6RjBRQbB3jyf297kEETolaWc

Score

1^/10

Malware Config

Signatures

Files

2024-04-26_113235a007b9271835bbd3719a30d574_avoslocker_floxif
.exe windows:5 windows x86 arch:x86

cccacbc4a2a95dce94582ed01bf1b00e

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:cc:b9:96:71:cf:ce:0e:de:b3:2a:e3:4d:0a:2c:1f
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

30/03/2023, 00:00

Not After

29/03/2024, 23:59

Subject

SERIALNUMBER=HE 391725,CN=QCL QUAD CODE CY LIMITED,O=QCL QUAD CODE CY LIMITED,L=Limassol,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:08:ae:b5:d5:b6:5c:50:d8:de:5e:65:d9:a2:e1:9a:65:14:24:82:7c:e7:94:f8:09:e2:2b:8a:9f:91:4e:e2
Signer

Actual PE Digest

a7:08:ae:b5:d5:b6:5c:50:d8:de:5e:65:d9:a2:e1:9a:65:14:24:82:7c:e7:94:f8:09:e2:2b:8a:9f:91:4e:e2

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\jenkins\workspace\client.utility.updater\build\update-service\Release\IQOptionUpdater.pdb

Imports

user32

WaitForInputIdle

shell32

CommandLineToArgvW
SHGetFolderPathW

advapi32

CryptDestroyHash
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptHashData
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteTreeW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateProcessAsUserW
DuplicateTokenEx
OpenProcessToken
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shlwapi

PathFileExistsW

ole32

StringFromCLSID
CoCreateGuid
CoTaskMemFree
CoGetObjectContext
CoGetApartmentType
CoInitializeEx

crypt32

CertFreeCertificateChain
CertCloseStore
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertAddCertificateContextToStore
CryptStringToBinaryA
CertFreeCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore

kernel32

GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
TransactNamedPipe
SetNamedPipeHandleState
GetCurrentThreadId
GlobalMemoryStatusEx
GetModuleHandleA
GetProcAddress
GetTempPathW
GetCommandLineW
LocalFree
AreFileApisANSI
WideCharToMultiByte
GetStdHandle
SetStdHandle
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
CloseHandle
DuplicateHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
WaitForSingleObject
CreateEventW
Sleep
GetCurrentProcess
GetTickCount
GetModuleFileNameW
FlushFileBuffers
GetFileSize
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
RemoveDirectoryW
MoveFileExW
DeleteFileW
GetFileAttributesExW
CopyFileW
WaitNamedPipeW
GetFullPathNameW
OpenProcess
lstrcmpiW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
TerminateProcess
GetExitCodeProcess
CreateProcessW
lstrcpyW
OutputDebugStringA
GetCurrentProcessId
GetDynamicTimeZoneInformation
LocalAlloc
FormatMessageW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
GetOverlappedResult
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
MultiByteToWideChar
DecodePointer
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleHandleW
LoadLibraryW
GetSystemPowerStatus
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
VerifyVersionInfoA
QueryPerformanceCounter
WaitForSingleObjectEx
ExpandEnvironmentStringsA
CreateFileA
GetFileSizeEx
GetFileInformationByHandle
GetFileType
SetFileAttributesW
SetFilePointer
SetFileTime
DeviceIoControl
IsValidCodePage
GetACP
GetOEMCP
GetFileAttributesA
SearchPathA
CreatePipe
CreateProcessA
RtlCaptureContext
ReleaseSemaphore
GetProcessId
InitializeCriticalSection
CreateThread
CreateSemaphoreW
InterlockedIncrement
VirtualQueryEx
SetUnhandledExceptionFilter
EncodePointer
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
ExitProcess
GetCurrentDirectoryW
SetHandleInformation
SetConsoleCtrlHandler
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
OutputDebugStringW
GetStringTypeW
GetCPInfo
CompareStringEx
LCMapStringEx
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
InitializeCriticalSectionAndSpinCount
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetExitCodeThread
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
GetLocaleInfoEx
FindFirstFileExW
SetFileInformationByHandle
GetFileInformationByHandleEx

oleaut32

SysAllocString
SysFreeString
VariantClear

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

psapi

GetModuleFileNameExW

ws2_32

WSAGetLastError
send
recv
closesocket
freeaddrinfo
getaddrinfo
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
WSAIoctl
WSAStartup
ioctlsocket
listen
socket
htonl
accept
select
WSACleanup
__WSAFDIsSet

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 379KB - Virtual size: 378KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cccacbc4a2a95dce94582ed01bf1b00e

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

01:cc:b9:96:71:cf:ce:0e:de:b3:2a:e3:4d:0a:2c:1fCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

a7:08:ae:b5:d5:b6:5c:50:d8:de:5e:65:d9:a2:e1:9a:65:14:24:82:7c:e7:94:f8:09:e2:2b:8a:9f:91:4e:e2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

shell32

advapi32

shlwapi

ole32

crypt32

kernel32

oleaut32

rpcrt4

psapi

ws2_32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 379KB - Virtual size: 378KB

.data Size: 33KB - Virtual size: 53KB

.rsrc Size: 1024B - Virtual size: 976B

.reloc Size: 52KB - Virtual size: 52KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

01:cc:b9:96:71:cf:ce:0e:de:b3:2a:e3:4d:0a:2c:1f
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

a7:08:ae:b5:d5:b6:5c:50:d8:de:5e:65:d9:a2:e1:9a:65:14:24:82:7c:e7:94:f8:09:e2:2b:8a:9f:91:4e:e2
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 379KB - Virtual size: 378KB

.data
Size: 33KB - Virtual size: 53KB

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 52KB - Virtual size: 52KB