2024-05-02_a489e88ad7c4dbee1b041f71b1449463_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-02_a489e88ad7c4dbee1b041f71b1449463_avoslocker
Size

1.7MB
MD5

a489e88ad7c4dbee1b041f71b1449463
SHA1

e64b35347a75111f9434ca11cbba1d4782d1704f
SHA256

bc9c596bbb4f5463b2504b1a302506e0fa41bd44c9ec1d7ebe43e398aeb646d4
SHA512

ab8c7c8680a6b4a9d5fecdb334c4d9065b2c5c055a14cbf9cac334430780a1c7bf63bcf060a7c1be269cffb411caa8718bbf6b7391970f53c658ae9921cfa9a6
SSDEEP

24576:7dqEV+eWOhwB3Avt1uQA9RK6cOzwPbLKJBWQDilDinVajJqiT9if6u2nlw6WJyyt:c9efhw7KIRyUilMV0JqiT9+6V6JaTzu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-02_a489e88ad7c4dbee1b041f71b1449463_avoslocker

Files

2024-05-02_a489e88ad7c4dbee1b041f71b1449463_avoslocker
.exe windows:5 windows x86 arch:x86

12f725025084aea26b04fe7baca4f7e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins\workspace\ccd-hyperdrive\main\native\win32\build\msvs_win32\Release\x86\sym\Uninstaller\Uninstaller\Uninstaller.pdb

Imports

kernel32

GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
GetFileAttributesExW
lstrlenW
SystemTimeToFileTime
CreateMutexW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
LockFileEx
GetSystemTime
CreateFileMappingW
MapViewOfFile
UnlockFileEx
GetCurrentProcess
CreateEventW
GlobalAlloc
GlobalFree
GetProcAddress
GetModuleHandleW
CreateFileW
GetFileAttributesW
ReadFile
GetFullPathNameW
FindNextFileW
WriteFile
GetModuleFileNameW
GetTempPathW
FindClose
DeleteFileW
GetFileSize
FlushFileBuffers
HeapFree
SetLastError
TerminateProcess
WaitForSingleObject
GetTickCount
HeapSize
Sleep
HeapReAlloc
CreateThread
HeapAlloc
HeapDestroy
GetCurrentProcessId
GetProcessHeap
CreateProcessW
MultiByteToWideChar
FormatMessageW
WideCharToMultiByte
LoadLibraryW
FreeLibrary
LoadLibraryA
LCMapStringW
GetUserDefaultLCID
FormatMessageA
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LCMapStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
CompareStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileSizeEx
GetConsoleOutputCP
SetEndOfFile
WriteConsoleW
ExitThread
DeleteCriticalSection
LocalFree
DecodePointer
RaiseException
CloseHandle
GetLastError
InitializeCriticalSectionEx
OpenProcess
CreateNamedPipeW
FreeLibraryAndExitThread

user32

EnumWindows
GetShellWindow
AllowSetForegroundWindow
GetWindowThreadProcessId

advapi32

RegQueryValueExW
GetTokenInformation
FreeSid
OpenProcessToken
SetEntriesInAclW
AllocateAndInitializeSid
EqualSid
RegOpenKeyExW
GetUserNameW
RegCloseKey
GetNamedSecurityInfoW
SetNamedSecurityInfoW
DuplicateTokenEx
AdjustTokenPrivileges
LookupPrivilegeValueW

shell32

CommandLineToArgvW
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHGetFolderLocation

ole32

CLSIDFromProgID
StringFromGUID2
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoCreateGuid
CLSIDFromString
CoTaskMemFree
OleRun

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit
GetErrorInfo
SysStringLen
VariantChangeType

shlwapi

PathRemoveBackslashW
PathRemoveFileSpecW
PathFileExistsW
PathFileExistsA
PathIsDirectoryW
PathStripPathW
PathAppendW

Sections

.text
Size: 889KB - Virtual size: 889KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 596KB - Virtual size: 600KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

12f725025084aea26b04fe7baca4f7e2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 889KB - Virtual size: 889KB

.rdata Size: 164KB - Virtual size: 163KB

.data Size: 11KB - Virtual size: 15KB

.rsrc Size: 88KB - Virtual size: 88KB

.reloc Size: 596KB - Virtual size: 600KB

.text
Size: 889KB - Virtual size: 889KB

.rdata
Size: 164KB - Virtual size: 163KB

.data
Size: 11KB - Virtual size: 15KB

.rsrc
Size: 88KB - Virtual size: 88KB

.reloc
Size: 596KB - Virtual size: 600KB