2024-04-28_959f3482f40211267a124a5657381e1c_avoslocker

Sharing

Copy URL

Twitter E-mail

General

Target

2024-04-28_959f3482f40211267a124a5657381e1c_avoslocker
Size

1.6MB
MD5

959f3482f40211267a124a5657381e1c
SHA1

0e9c3e4079ba3b57d6282688b1f17668040cbbe7
SHA256

faafdd1418bf4b6cb8447a72e3e65da58f1978da356b950aefdaade4602ed6ac
SHA512

1761132b3d8112c887f4e16834ae92dc7970b3fed6d7ead8412d8d50240a4ead7cd76447216c96b6fe75b803e5edd51105e4c4adf0df3cc8dc6b9f9673ce9bad
SSDEEP

24576:jKlk6VEmdxlJRCHg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ulk6mqxlyHgLNiXicJFFRGNzj3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-28_959f3482f40211267a124a5657381e1c_avoslocker

Files

2024-04-28_959f3482f40211267a124a5657381e1c_avoslocker
.exe windows:6 windows x86 arch:x86

78293443550bdf17e0d97bc1aff81262

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\workspace\Vendors\crashgen\windows\vendors\crashrpt\build\windows\Bin\MT_Release\zCrashReportExe.pdb

Imports

kernel32

DeleteCriticalSection
MapViewOfFile
CreateDirectoryW
SizeofResource
SetLastError
GetCurrentProcess
GetModuleFileNameW
GetFileAttributesW
OpenProcess
GetPrivateProfileStringW
Sleep
FormatMessageW
LockResource
GlobalFree
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
VirtualQueryEx
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
FindFirstFileW
GetFileSizeEx
GetFullPathNameW
FindNextFileW
FindClose
HeapDestroy
K32GetProcessMemoryInfo
FileTimeToSystemTime
GetLocalTime
ReadProcessMemory
GetSystemTime
GetProcessTimes
GetCommandLineW
GetCurrentThreadId
lstrcmpiW
LoadLibraryExW
ReadFile
WriteFile
GetSystemInfo
CreateMutexW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CreateThread
GetCurrentProcessId
GlobalMemoryStatusEx
CreateProcessW
IsDebuggerPresent
IsProcessorFeaturePresent
WriteConsoleW
SetEndOfFile
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
ReadConsoleW
GetConsoleMode
K32GetProcessImageFileNameW
DecodePointer
SetUnhandledExceptionFilter
RaiseException
HeapReAlloc
GetLastError
HeapSize
UnmapViewOfFile
OpenFileMappingW
InitializeCriticalSectionEx
VerifyVersionInfoW
VerSetConditionMask
GetProcAddress
CloseHandle
CreateFileW
WritePrivateProfileStringW
GetProcessHeap
HeapAlloc
MultiByteToWideChar
SetFilePointerEx
GetTimeZoneInformation
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
HeapFree
GetStartupInfoW
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind
LocalFree
QueryPerformanceCounter
TerminateProcess
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime

user32

EnumDisplayDevicesW
GetGuiResources
CharNextW
DestroyWindow
DefWindowProcW
IsWindow
PostMessageW
SetProcessDefaultLayout
SendMessageW

advapi32

RegOpenKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
RegDeleteValueW
RegCloseKey
RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoInitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoSetProxyBlanket
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
SysFreeString
SysAllocString
VariantInit
VarUI4FromStr

wintrust

WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

shlwapi

PathStripPathW

comctl32

InitCommonControlsEx

Sections

.text
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

78293443550bdf17e0d97bc1aff81262

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

wintrust

crypt32

shlwapi

comctl32

Sections

.text Size: 185KB - Virtual size: 185KB

.rdata Size: 49KB - Virtual size: 49KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 83KB - Virtual size: 82KB

.reloc Size: 1.3MB - Virtual size: 2.0MB

.text
Size: 185KB - Virtual size: 185KB

.rdata
Size: 49KB - Virtual size: 49KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 83KB - Virtual size: 82KB

.reloc
Size: 1.3MB - Virtual size: 2.0MB