2024-04-30_e1891d23a3374c3e70559aad18b455af_avoslocker_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-30_e1891d23a3374c3e70559aad18b455af_avoslocker_revil
Size

17.1MB
MD5

e1891d23a3374c3e70559aad18b455af
SHA1

a1784ab9d7e3e9de851caea2fb3925194821f6f6
SHA256

e05a4de7d337dfe8f30ea34a84eb439cbd3a82cafeb93a924321c45cf2b0e7c3
SHA512

52e269870dcf1cf0a6d1302d03d08f8904583de11c942f791493e095dd4fb1c4e0f5b2cf3d554121a8f8f13e15a795d06551ab9d8237e008cf07eee7673db8ac
SSDEEP

393216:/LFiCshZRZAvt+G+UdsXlhbo0rqNALlxos:3sVMuhbh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-30_e1891d23a3374c3e70559aad18b455af_avoslocker_revil

Files

2024-04-30_e1891d23a3374c3e70559aad18b455af_avoslocker_revil
.exe windows:6 windows x86 arch:x86

9823f91be043fdb5059be7ad31e108a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\buildbot\workers\adaware_antivirus\adaware_antivirus_builder\build\_build\bin\Win32\Release\AdAwareWebInstaller.pdb

Imports

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
OpenThreadToken
AdjustTokenPrivileges
GetTokenInformation
RevertToSelf
LookupPrivilegeValueW
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextA
LookupAccountSidW
ReportEventA
RegisterEventSourceA
DeregisterEventSource
SetThreadToken
ImpersonateNamedPipeClient
ControlService
SetNamedSecurityInfoW
CryptGetHashParam
CryptHashData
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
AddAce
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
IsValidSid
CopySid
InitializeAcl
GetLengthSid
QueryServiceStatusEx
DeleteService
StartServiceW
ChangeServiceConfig2W
OpenServiceW
CreateServiceW
CloseServiceHandle
OpenSCManagerW
FreeSid
SetFileSecurityW
SetEntriesInAclW
AllocateAndInitializeSid
CryptGetUserKey

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW
DragQueryFileW
SHGetSpecialFolderPathW
SHBrowseForFolderW
ord74
ord727
SHGetFileInfoW
ShellExecuteExW
Shell_NotifyIconW
SHGetPathFromIDListW

kernel32

FlushFileBuffers
ReadFile
WriteFile
SetLastError
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetNamedPipeHandleStateW
GetCurrentThread
QueueUserWorkItem
CreateNamedPipeA
GetFileSize
SetEndOfFile
SetFilePointer
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
ExitProcess
GetFileAttributesW
FreeLibrary
GetCPInfo
GetModuleHandleW
GlobalAlloc
GlobalFree
LocalAlloc
LocalSize
FormatMessageW
lstrlenW
GetEnvironmentVariableW
HeapReAlloc
CreateThread
SetThreadPriority
WriteConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleScreenBufferInfo
GetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleCursorInfo
SetConsoleTextAttribute
GetNumberOfConsoleInputEvents
ReadConsoleW
ReadConsoleInputW
SetConsoleMode
WriteConsoleW
SetConsoleCtrlHandler
GetCurrentDirectoryW
TerminateProcess
GetExitCodeProcess
CreateProcessW
OpenProcess
UnregisterWaitEx
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
LCMapStringW
CreateDirectoryW
GetFileInformationByHandle
RemoveDirectoryW
SetFilePointerEx
SetFileTime
DeviceIoControl
MoveFileExW
CreateHardLinkW
GetLongPathNameW
GetShortPathNameW
ReadDirectoryChangesW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetTempPathW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DecodePointer
RaiseException
CreateFileW
GetLogicalDriveStringsW
GetVolumeInformationW
GetStdHandle
GetStartupInfoW
LoadLibraryW
VirtualAlloc
VirtualFree
lstrcmpW
GetThreadPriority
GetTickCount
GetVersionExW
VirtualProtect
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetSystemTimeAsFileTime
GetFileTime
HeapDestroy
HeapSize
UnregisterWait
RegisterWaitForSingleObject
CancelIo
SetHandleInformation
GetConsoleMode
GetFileType
LoadLibraryA
GetFileSizeEx
CreateWaitableTimerW
GetSystemDirectoryA
TerminateThread
QueueUserAPC
SleepEx
GetOverlappedResult
LockFileEx
UnlockFile
HeapCompact
DeleteFileA
GetFileAttributesA
GetDiskFreeSpaceA
HeapValidate
CreateMutexW
UnlockFileEx
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
HeapCreate
OutputDebugStringA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
FindFirstFileExW
EnumSystemLocalesW
IsValidLocale
GetACP
VirtualQuery
GetConsoleCP
SetStdHandle
GetModuleHandleExW
ExitThread
GetCommandLineA
RtlUnwind
GetStringTypeExA
LCMapStringA
GetStringTypeExW
FoldStringW
EnumSystemLocalesA
GetLocaleInfoA
IsDBCSLeadByteEx
IsValidCodePage
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
FreeLibraryAndExitThread
GetThreadTimes
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
SignalObjectAndWait
CreateTimerQueue
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
CreateWaitableTimerA
GetLogicalProcessorInformation
SetWaitableTimer
OpenEventA
WaitForMultipleObjectsEx
SleepConditionVariableSRW
WakeAllConditionVariable
AreFileApisANSI
CreateDirectoryExW
SetFileAttributesW
GetDiskFreeSpaceExW
InitializeCriticalSectionAndSpinCount
GetNativeSystemInfo
GetExitCodeThread
EncodePointer
GetStringTypeW
DeleteFileW
GetFileAttributesExW
GetWindowsDirectoryW
IsWow64Process
CreateSemaphoreA
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetUserDefaultLocaleName
GetSystemDirectoryW
ExpandEnvironmentStringsW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
SetErrorMode
DebugBreak
LoadLibraryExA
GetModuleFileNameA
AllocConsole
GlobalLock
GlobalUnlock
GlobalSize
GetProcessHeap
HeapFree
HeapAlloc
GetCommandLineW
GetTempFileNameA
GetTempPathA
MulDiv
OutputDebugStringW
FindNextFileW
FindFirstFileW
FindClose
GetUserDefaultLCID
GetSystemDefaultLCID
GetCurrencyFormatW
GetNumberFormatW
CompareStringW
VerifyVersionInfoW
GetComputerNameW
QueryPerformanceFrequency
GetFullPathNameW
VerSetConditionMask
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
CreateSemaphoreW
WaitForMultipleObjects
CreateEventW
WaitForSingleObject
ReleaseSemaphore
ResetEvent
TryEnterCriticalSection
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime
GetLocalTime
GetSystemTime
LoadLibraryExW
MultiByteToWideChar
GetModuleHandleA
GetProcAddress
CreateFileA
MapViewOfFileEx
CreateFileMappingA
UnmapViewOfFile
GetCurrentProcess
DuplicateHandle
Sleep
SwitchToThread
LocalFree
FormatMessageA
GetLastError
GetCurrentProcessId
QueryPerformanceCounter
GetSystemInfo
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
SetUnhandledExceptionFilter
CreateEventA
WideCharToMultiByte
CloseHandle
WaitForSingleObjectEx
SetEvent
GetCurrentThreadId
CopyFileW
GetModuleFileNameW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetTickCount64
ExpandEnvironmentStringsA
VerifyVersionInfoA
GlobalMemoryStatus
FlushConsoleInputBuffer
ReadConsoleInputA
InitializeCriticalSectionEx

user32

GetWindowRect
IsWindow
ShowWindow
PostMessageW
ExitWindowsEx
LoadStringA
GetWindowThreadProcessId
LoadIconW
CreateWindowExW
GetWindowLongW
SystemParametersInfoW
GetClassInfoExW
RegisterClassExW
UpdateWindow
SetWindowLongW
DefWindowProcW
DestroyWindow
SetForegroundWindow
IsIconic
SetWindowTextW
RegisterWindowMessageW
SendMessageW
DialogBoxIndirectParamW
EndDialog
SetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
GetSystemMenu
TrackPopupMenu
ScreenToClient
GetMessageW
TranslateMessage
SetWindowPos
PostQuitMessage
GetDC
ReleaseDC
GetSysColor
LoadCursorW
LoadCursorFromFileA
DestroyCursor
GetKeyState
EnumDisplayDevicesW
EnumDisplayMonitors
MessageBoxA
PeekMessageW
GetMessageTime
GetMessageExtraInfo
IsChild
MoveWindow
GetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsWindowVisible
CallMsgFilterW
SetFocus
GetActiveWindow
GetFocus
GetAsyncKeyState
GetCapture
SetCapture
ReleaseCapture
SetTimer
KillTimer
IsWindowUnicode
EnableWindow
GetSystemMetrics
GetUpdateRect
InvalidateRect
GetDesktopWindow
DispatchMessageW
GetQueueStatus
GetWindowTextW
AdjustWindowRectEx
SetCursor
GetCursorPos
ClientToScreen
WindowFromPoint
IsRectEmpty
GetClassLongW
SetClassLongW
EnumThreadWindows
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetScrollInfo
GetScrollInfo
MonitorFromPoint
NotifyWinEvent
GetDoubleClickTime
MessageBeep
RegisterClassW
AnimateWindow
IsWindowEnabled
GetForegroundWindow
BeginPaint
EndPaint
RedrawWindow
DestroyIcon
DrawIconEx
CreateIconIndirect
GetIconInfo
LoadStringW
SetActiveWindow
MessageBoxW
GetKeyboardLayout
CreateCaret
DestroyCaret
SetCaretPos
FindWindowW
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardData
GetClipboardData
RegisterClipboardFormatW
CountClipboardFormats
EnumClipboardFormats
EmptyClipboard
IsClipboardFormatAvailable
MapVirtualKeyW
SetWinEventHook
UpdateLayeredWindow
PostThreadMessageW
MsgWaitForMultipleObjects
GetParent
SendMessageA
FindWindowA
GetProcessWindowStation
GetUserObjectInformationW

gdi32

AddFontMemResourceEx
GetDeviceCaps
GetFontUnicodeRanges
GetObjectA
StretchDIBits
GetClipBox
GetDIBits
SelectObject
GetObjectW
BitBlt
CreateCompatibleDC
DeleteObject
SetMapMode
CreateDIBSection
StartDocW
EndDoc
StartPage
EndPage
CreateSolidBrush
GetStockObject
SetLayout
CreateBitmap
CreateDCW
DeleteDC
SetViewportOrgEx
CreateFontW
GetGlyphIndicesW
SaveDC
RestoreDC
EnumFontFamiliesExW

winspool.drv

ord203

comdlg32

CommDlgExtendedError
PrintDlgW
GetSaveFileNameW
GetOpenFileNameW

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
OleInitialize
CoCreateInstance
CoTaskMemFree
OleUninitialize
RegisterDragDrop
RevokeDragDrop
DoDragDrop
ReleaseStgMedium
CreateStreamOnHGlobal
CoTaskMemAlloc
CoFreeUnusedLibraries
CoInitialize
CoInitializeEx
CoCreateGuid

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
VariantCopy
SysStringByteLen
SysStringLen
VariantClear
VariantInit

gdiplus

GdipGetFamily
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipGetLineSpacing
GdipGetCellAscent
GdipGetEmHeight
GdipDeleteFontFamily
GdiplusShutdown
GdiplusStartup
GdipEndContainer
GdipBeginContainer2
GdipRestoreGraphics
GdipSaveGraphics
GdipGetClipBoundsI
GdipSetClipRectI
GdipSetClipRect
GdipDrawImageRectRect
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillRectanglesI
GdipFillRectangleI
GdipFillRectangle
GdipGraphicsClear
GdipDrawPath
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipGetFontSize
GdipDrawLine
GdipTransformPoints
GdipSetPageUnit
GdipGetWorldTransform
GdipTranslateWorldTransform
GdipMultiplyWorldTransform
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipDrawDriverString
GdipDeleteGraphics
GdipCreateFromHWNDICM
GdipCreateFromHWND
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipSetLineWrapMode
GdipSetLinePresetBlend
GdipCreateLineBrush
GdipCreateSolidFill
GdipCreateTexture
GdipDeleteBrush
GdipCloneBrush
GdipGetMatrixElements
GdipShearMatrix
GdipRotateMatrix
GdipCreateBitmapFromGraphics
GdipCreateHBITMAPFromBitmap
GdipDrawArc
GdipDrawImageI
GdipAddPathLineI
GdipAddPathEllipse
GdipSetPenDashOffset
GdipSetPenDashStyle
GdipSetPenMiterLimit
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipClosePathFigure
GdipStartPathFigure
GdipSetPathFillMode
GdipResetPath
GdipDeletePath
GdipClonePath
GdipCreatePath
GdipFree
GdipSetPenLineJoin
GdipSetPenEndCap
GdipSetPenStartCap
GdipDeletePen
GdipCreatePen2
GdipSetPenDashArray
GdipCreatePathGradientFromPath
GdipAlloc
GdipSetCompositingQuality
GdipSetPathGradientCenterPoint
GdipSetPathGradientPresetBlend
GdipSetPathGradientWrapMode
GdipSetPathGradientTransform
GdipCreatePen1
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipMultiplyLineTransform
GdipScaleMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix2
GdipCreateMatrix
GdipIsVisiblePathPoint
GdipGetPathWorldBounds
GdipAddPathRectangleI
GdipAddPathArcI

uxtheme

SetWindowTheme
IsThemeBackgroundPartiallyTransparent
CloseThemeData
GetThemePartSize
DrawThemeBackground
OpenThemeData

urlmon

FindMimeFromData

shlwapi

PathIsRelativeW
PathFileExistsW

winmm

timeEndPeriod
timeKillEvent
timeGetTime
timeBeginPeriod
timeSetEvent

oleacc

AccessibleObjectFromWindow
LresultFromObject

comctl32

ImageList_DrawEx
ImageList_GetIconSize
ImageList_Destroy

imm32

ImmGetContext
ImmReleaseContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmNotifyIME
ImmSetCandidateWindow
ImmIsIME

usp10

ScriptBreak
ScriptApplyDigitSubstitution
ScriptFreeCache
ScriptItemize
ScriptShape
ScriptPlace

wininet

InternetConnectA
InternetOpenA
InternetCloseHandle
InternetOpenW
InternetReadFile
InternetQueryOptionW
InternetSetOptionW
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoW
InternetErrorDlg
InternetConnectW
HttpOpenRequestW
HttpSendRequestW

ws2_32

WSACleanup
send
recvfrom
ntohs
WSAStartup
gethostname
select
WSARecvFrom
htonl
freeaddrinfo
connect
socket
WSASetLastError
shutdown
listen
getsockname
accept
htons
closesocket
getsockopt
setsockopt
WSAGetLastError
sendto
bind
ioctlsocket
getpeername
gethostbyname
getservbyname
getaddrinfo
FreeAddrInfoW
__WSAFDIsSet
GetAddrInfoW
WSASocketW
WSASend
WSARecv
WSAIoctl
recv
WSADuplicateSocketW

crypt32

CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext

wldap32

ord143
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord46

Sections

.text
Size: 8.9MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 466KB - Virtual size: 542KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 217B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 542KB - Virtual size: 541KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9823f91be043fdb5059be7ad31e108a2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

shell32

kernel32

user32

gdi32

winspool.drv

comdlg32

ole32

oleaut32

gdiplus

uxtheme

urlmon

shlwapi

winmm

oleacc

comctl32

imm32

usp10

wininet

ws2_32

crypt32

wldap32

Sections

.text Size: 8.9MB - Virtual size: 8.9MB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.data Size: 466KB - Virtual size: 542KB

.tls Size: 512B - Virtual size: 217B

.gfids Size: 4KB - Virtual size: 3KB

.rsrc Size: 5.2MB - Virtual size: 5.2MB

.reloc Size: 542KB - Virtual size: 541KB

.text
Size: 8.9MB - Virtual size: 8.9MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 466KB - Virtual size: 542KB

.tls
Size: 512B - Virtual size: 217B

.gfids
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 5.2MB - Virtual size: 5.2MB

.reloc
Size: 542KB - Virtual size: 541KB