\\cpbufs\transfer\aataneja\ReaderPOC\ReaderSolution\ReaderPOC\Release\ReaderPOC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_1458975315929c40804b59c1e4cf82f7_avoslocker.exe
Resource
win7-20240221-en
General
-
Target
2024-04-28_1458975315929c40804b59c1e4cf82f7_avoslocker
-
Size
1.3MB
-
MD5
1458975315929c40804b59c1e4cf82f7
-
SHA1
527b76567d7a8b4da6362ca72eaf0ce579496def
-
SHA256
c3b515c9bec9282f8dab6b8264c1d9b390608fd9b27b935c0ac2658f17e88067
-
SHA512
e362396ab3699d83811bda0595bd55c7d06f80e84d255acd4b83409aefb4dfb23dbde15cd0c73917a0b62b61cb31b22e746a5a517f784afbe6af07f2a688871a
-
SSDEEP
24576:92zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedTgokO3C3VrC8JCu30GiISOrcw:9PtjtQiIhUyQd1SkFdTgoBIrCuEfIXQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-04-28_1458975315929c40804b59c1e4cf82f7_avoslocker
Files
-
2024-04-28_1458975315929c40804b59c1e4cf82f7_avoslocker.exe windows:6 windows x86 arch:x86
99779933d13e7f3a0c46176caa0baa44
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msi
ord205
ord70
kernel32
CreateFileMappingA
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
GetVersionExA
LoadLibraryA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
LocalFree
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
InterlockedCompareExchange
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
DecodePointer
FindNextFileW
GetModuleFileNameW
FindClose
GetCurrentProcess
CreateEventW
GetModuleHandleW
TlsSetValue
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
TlsGetValue
GetTickCount
FlushFileBuffers
GetLastError
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
TlsFree
EncodePointer
GetFullPathNameW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileSizeEx
GetFileType
GetModuleHandleExW
ExitProcess
GetStdHandle
LoadLibraryExW
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
GetStringTypeW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
CompareStringW
advapi32
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetFolderPathW
SHCreateDirectoryExW
SHGetFolderPathAndSubDirW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetSpecialFolderPathW
ole32
CoTaskMemFree
CoCreateInstance
CoCreateGuid
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoInitialize
StringFromGUID2
OleRun
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantCopy
GetErrorInfo
VariantInit
shlwapi
PathFileExistsA
PathAppendW
PathFileExistsW
PathIsDirectoryW
Sections
.text Size: 606KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 588KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE