2024-05-01_18acfbb3296db2e77cd0d3b76f6440ff_avoslocker

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-01_18acfbb3296db2e77cd0d3b76f6440ff_avoslocker
Size

3.4MB
MD5

18acfbb3296db2e77cd0d3b76f6440ff
SHA1

3765784edf02ebd49e74d4e19a96d10692a4e7ab
SHA256

f8a78de1b58abc8ef74824657d1a14dcd23153691ec30391a191a8e98d14015b
SHA512

9d2c14475c49a373457c832fe919ab2cbbb2d2cf71460a0af4664ca034481554dd367cd26b14b342463e0330288188884af9c0f4dd4d76f5231f947b073f127a
SSDEEP

12288:ljb7OlFU9HDKNwKMtDtnOij6ZDDp08VtpGtKbYbKbzxbZUb+bxbWbfmb2Dbxbibu:F7BzhZP6ZDDp08V5wGnZ5xYJn

Score

1^/10

Malware Config

Signatures

Files

2024-05-01_18acfbb3296db2e77cd0d3b76f6440ff_avoslocker
.exe windows:6 windows x86 arch:x86

2f868d49b494064c6ea47674b091e74f

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:d1:80:f1:96:fb:0d:54:4a:66:af:4d
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

19-02-2024 02:24

Not After

02-04-2027 06:21

Subject

SERIALNUMBER=131111-0483021,CN=ChuanQi IP Co.\,Ltd.,O=ChuanQi IP Co.\,Ltd.,STREET=49 Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02-11-2023 10:30

Not After

04-12-2034 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10-12-2014 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:08:a3:ef:17:78:57:08:05:41:b5:48:6e:32:5a:df:fa:aa:62:9d:4d:d4:e6:30:3b:44:5b:f4:48:dd:60:94
Signer

Actual PE Digest

6d:08:a3:ef:17:78:57:08:05:41:b5:48:6e:32:5a:df:fa:aa:62:9d:4d:d4:e6:30:3b:44:5b:f4:48:dd:60:94

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\WorkDesk\Mir2Patch_Webview\test\Mir2Patch.pdb

Imports

kernel32

WritePrivateProfileStringA
CopyFileA
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32First
Process32Next
SetEvent
WaitForSingleObject
ResumeThread
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CreateFileA
GetFileTime
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentProcessId
GetLocalTime
GetProcAddress
LoadLibraryA
FileTimeToSystemTime
DecodePointer
FreeLibrary
GetModuleHandleA
LoadLibraryExA
LoadResource
SizeofResource
lstrcmpiA
FindResourceA
IsDBCSLeadByte
CreateDirectoryA
FindClose
FindFirstFileA
GetFileSize
ReadFile
RemoveDirectoryA
SetFileAttributesA
SetFileTime
WriteFile
GetTempPathA
InitializeCriticalSection
MoveFileA
SystemTimeToFileTime
IsDebuggerPresent
DebugBreak
OutputDebugStringW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
GetModuleHandleW
GetModuleHandleExW
FormatMessageW
GetCurrentDirectoryA
GetSystemTimeAsFileTime
GetPrivateProfileStringA
CreateMutexA
OpenMutexA
DeleteFileA
WriteConsoleW
SetEndOfFile
CreateFileW
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetStdHandle
GetModuleFileNameW
VirtualQuery
VirtualProtect
GetSystemInfo
GetCommandLineW
GetCommandLineA
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
QueryPerformanceCounter
GetStartupInfoW
UnhandledExceptionFilter
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InitializeCriticalSectionEx
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetCPInfo
GetStringTypeW
LCMapStringEx
lstrcmpA
MulDiv
LocalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetModuleFileNameA
GetTickCount
OpenProcess
CreateProcessA
GetCurrentThreadId
TerminateProcess
ExitProcess
DeleteCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
CloseHandle
EncodePointer

user32

DispatchMessageA
PeekMessageA
SendMessageA
PostMessageA
TranslateMessage
PostQuitMessage
CallWindowProcA
UnregisterClassA
RegisterWindowMessageA
DefWindowProcA
GetMessageA
GetClassInfoExA
CreateWindowExA
IsWindow
IsChild
DestroyWindow
ShowWindow
MoveWindow
SetWindowPos
CreateDialogParamA
DialogBoxParamA
EndDialog
GetDlgItem
SetDlgItemTextA
CharNextA
SetFocus
RegisterClassExA
PtInRect
GetFocus
OffsetRect
DrawTextA
IsWindowEnabled
LoadCursorA
LoadBitmapA
GetWindow
GetClassNameA
GetParent
GetDesktopWindow
SetWindowLongA
GetWindowLongA
IsDialogMessageA
SetRect
FillRect
GetSysColor
ScreenToClient
ClientToScreen
MessageBoxA
GetClientRect
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
RedrawWindow
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
DestroyAcceleratorTable
CreateAcceleratorTableA
ReleaseCapture
SetCapture

gdi32

TextOutA
GetObjectA
SetTextColor
SetBkMode
SelectObject
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreateFontIndirectA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

advapi32

RegQueryInfoKeyW
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
RegSetValueExA

shell32

ShellExecuteA

ole32

CoTaskMemRealloc
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
OleInitialize
OleUninitialize
CoInitializeEx

oleaut32

VarUI4FromStr
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString

shlwapi

PathFileExistsA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

urlmon

URLDownloadToFileA

wininet

HttpQueryInfoA
InternetReadFile
InternetOpenUrlA
InternetCloseHandle
DeleteUrlCacheEntry
InternetOpenA

winmm

timeGetTime

comctl32

_TrackMouseEvent

Sections

.text
Size: 298KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f868d49b494064c6ea47674b091e74f

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

5a:d1:80:f1:96:fb:0d:54:4a:66:af:4dCertificate

Extended Key Usages

Key Usages

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

6d:08:a3:ef:17:78:57:08:05:41:b5:48:6e:32:5a:df:fa:aa:62:9d:4d:d4:e6:30:3b:44:5b:f4:48:dd:60:94Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

urlmon

wininet

winmm

comctl32

Sections

.text Size: 298KB - Virtual size: 297KB

.rdata Size: 87KB - Virtual size: 86KB

.data Size: 14KB - Virtual size: 20KB

.rsrc Size: 2.9MB - Virtual size: 2.9MB

.reloc Size: 16KB - Virtual size: 15KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

5a:d1:80:f1:96:fb:0d:54:4a:66:af:4d
Certificate

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

6d:08:a3:ef:17:78:57:08:05:41:b5:48:6e:32:5a:df:fa:aa:62:9d:4d:d4:e6:30:3b:44:5b:f4:48:dd:60:94
Signer

.text
Size: 298KB - Virtual size: 297KB

.rdata
Size: 87KB - Virtual size: 86KB

.data
Size: 14KB - Virtual size: 20KB

.rsrc
Size: 2.9MB - Virtual size: 2.9MB

.reloc
Size: 16KB - Virtual size: 15KB