D:\jenkins\workspace\ccd-hyperdrive\main\native\win32\build\msvs_win32\Release\x86\sym\HDBootStrapper\HDBootStrapper\Set-up.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-02_249fcf23f2ad321d8a20f8aa9020ab81_avoslocker_magniber.exe
Resource
win7-20240215-en
General
-
Target
2024-05-02_249fcf23f2ad321d8a20f8aa9020ab81_avoslocker_magniber
-
Size
8.2MB
-
MD5
249fcf23f2ad321d8a20f8aa9020ab81
-
SHA1
f1d1be81b22e69777d9dba56a8f67574d97be4c6
-
SHA256
6c4ea5528d6f99b350895c36e925f87d02cec3e9f35284a142dd412c17289b0e
-
SHA512
7f494573b71c061bb6052d5d6d4a5a7a16198383f1526cc23d810e74bf2757733cfc3942244911fdb601bc54c3089062a9fdd87d00fd98ed02010b8e3022b45a
-
SSDEEP
98304:1WKF5ScKtWqhU4t0ipTQgn7yNncfZDQQXnRtojzU4bUuU1Vm+sxVs2HMT:1X5ScKvhU4tbygnO1cfxtawoS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-02_249fcf23f2ad321d8a20f8aa9020ab81_avoslocker_magniber
Files
-
2024-05-02_249fcf23f2ad321d8a20f8aa9020ab81_avoslocker_magniber.exe windows:5 windows x86 arch:x86
1ec5f8e7ee2e86fad5c5364ac8fac8c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindFirstFileW
SetLastError
FindNextFileW
lstrlenW
RemoveDirectoryW
GetModuleFileNameW
GetTempPathW
FindClose
LocalAlloc
CreateFileW
GetFileAttributesW
SetFileAttributesW
FormatMessageW
GetLastError
GetDiskFreeSpaceExW
DeleteFileW
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
LocalFree
MoveFileExW
CopyFileW
lstrcmpiW
lstrcmpW
GetDriveTypeW
GetCurrentProcess
ReadFile
WaitForSingleObject
GetProcAddress
CreateProcessW
GetModuleHandleW
GetExitCodeProcess
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
Process32NextW
Process32FirstW
LoadLibraryW
FreeLibrary
WideCharToMultiByte
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetStdHandle
AttachConsole
FreeConsole
GetConsoleWindow
CreateMutexW
ReleaseMutex
GetSystemDirectoryW
SetDllDirectoryW
GetVersionExW
GetFullPathNameW
OpenMutexW
SetWaitableTimer
CreateWaitableTimerW
WaitForMultipleObjects
CancelWaitableTimer
CreateEventW
SetEvent
ResetEvent
GetOverlappedResult
ReadDirectoryChangesW
GetFileSizeEx
GetLocalTime
GetTimeFormatW
GetDateFormatW
SetHandleInformation
ExpandEnvironmentStringsW
DeviceIoControl
GetUserDefaultLangID
CreatePipe
GetComputerNameExW
FileTimeToSystemTime
GetNativeSystemInfo
GetWindowsDirectoryW
VerSetConditionMask
VerifyVersionInfoW
InitializeCriticalSection
GetCurrentProcessId
GetLocaleInfoA
EnumSystemLocalesW
GetUserDefaultUILanguage
GetACP
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
LoadLibraryA
LCMapStringW
GetUserDefaultLCID
SizeofResource
WriteFile
LockResource
LoadResource
FindResourceW
GetFileSize
FlushFileBuffers
GlobalFree
CreateThread
SetFilePointer
ProcessIdToSessionId
TerminateThread
FindResourceExW
QueryFullProcessImageNameW
GetFileInformationByHandle
CreateNamedPipeW
ConnectNamedPipe
CreateDirectoryW
ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreW
GetTimeZoneInformation
SystemTimeToFileTime
VirtualFree
VirtualAlloc
CreateFileA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
SetFilePointerEx
ResumeThread
SetThreadPriority
GetCurrentThread
GetStringTypeW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
GetExitCodeThread
GetLocaleInfoEx
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
SetStdHandle
ExitThread
FreeLibraryAndExitThread
ExitProcess
CompareStringW
GetLocaleInfoW
IsValidLocale
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
FindFirstFileExW
IsValidCodePage
ws2_32
getnameinfo
WSAStartup
WSACleanup
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1023KB - Virtual size: 1022KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 178KB - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 804KB - Virtual size: 808KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE