2024-04-30_0cb955e492b115333739b9dd1cd94a9b_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-30_0cb955e492b115333739b9dd1cd94a9b_avoslocker
Size

1.7MB
MD5

0cb955e492b115333739b9dd1cd94a9b
SHA1

4917b46f13132c091238e0f4c03cd3cc1ee53453
SHA256

5cc58b99f779589188fdcafa70e6367ac13b83343eccd73cfedd980c0dfb2e0b
SHA512

aff5de024c7affc61ec6b1e225812b1aa588dafe116a91ac717ee09f7dbae9813544893cb11d152390cb0facfd90cd1829a4f28e1f05e5d19d7d04ecc7bb101a
SSDEEP

24576:KkBI3s2flE1kIsqjnhMgeiCl7G0nehbGZpbD:KkB43flf0Dmg27RnWGj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-30_0cb955e492b115333739b9dd1cd94a9b_avoslocker

Files

2024-04-30_0cb955e492b115333739b9dd1cd94a9b_avoslocker
.exe windows:6 windows x86 arch:x86

78293443550bdf17e0d97bc1aff81262

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\jenkins\workspace\Vendors\crashgen\windows\vendors\crashrpt\build\windows\Bin\MT_Release\zCrashReportExe.pdb

Imports

kernel32

DeleteCriticalSection
MapViewOfFile
CreateDirectoryW
SizeofResource
SetLastError
GetCurrentProcess
GetModuleFileNameW
GetFileAttributesW
OpenProcess
GetPrivateProfileStringW
Sleep
FormatMessageW
LockResource
GlobalFree
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
VirtualQueryEx
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
FindFirstFileW
GetFileSizeEx
GetFullPathNameW
FindNextFileW
FindClose
HeapDestroy
K32GetProcessMemoryInfo
FileTimeToSystemTime
GetLocalTime
ReadProcessMemory
GetSystemTime
GetProcessTimes
GetCommandLineW
GetCurrentThreadId
lstrcmpiW
LoadLibraryExW
ReadFile
WriteFile
GetSystemInfo
CreateMutexW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CreateThread
GetCurrentProcessId
GlobalMemoryStatusEx
CreateProcessW
IsDebuggerPresent
IsProcessorFeaturePresent
WriteConsoleW
SetEndOfFile
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
ReadConsoleW
GetConsoleMode
K32GetProcessImageFileNameW
DecodePointer
SetUnhandledExceptionFilter
RaiseException
HeapReAlloc
GetLastError
HeapSize
UnmapViewOfFile
OpenFileMappingW
InitializeCriticalSectionEx
VerifyVersionInfoW
VerSetConditionMask
GetProcAddress
CloseHandle
CreateFileW
WritePrivateProfileStringW
GetProcessHeap
HeapAlloc
MultiByteToWideChar
SetFilePointerEx
GetTimeZoneInformation
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
HeapFree
GetStartupInfoW
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind
LocalFree
QueryPerformanceCounter
TerminateProcess
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime

user32

EnumDisplayDevicesW
GetGuiResources
CharNextW
DestroyWindow
DefWindowProcW
IsWindow
PostMessageW
SetProcessDefaultLayout
SendMessageW

advapi32

RegOpenKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
RegDeleteValueW
RegCloseKey
RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoInitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoSetProxyBlanket
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
SysFreeString
SysAllocString
VariantInit
VarUI4FromStr

wintrust

WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

shlwapi

PathStripPathW

comctl32

InitCommonControlsEx

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

78293443550bdf17e0d97bc1aff81262

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

wintrust

crypt32

shlwapi

comctl32

Sections

.text Size: 186KB - Virtual size: 185KB

.rdata Size: 50KB - Virtual size: 49KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 83KB - Virtual size: 82KB

.reloc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 186KB - Virtual size: 185KB

.rdata
Size: 50KB - Virtual size: 49KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 83KB - Virtual size: 82KB

.reloc
Size: 1.4MB - Virtual size: 1.4MB