2024-05-08_e1032e2c150661d6deea56dad73bdb29_avoslocker_cobalt-strike_floxif

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-08_e1032e2c150661d6deea56dad73bdb29_avoslocker_cobalt-strike_floxif
Size

624KB
MD5

e1032e2c150661d6deea56dad73bdb29
SHA1

2beb83fa4a378cbf56a36b942ab776a07d7727c6
SHA256

644521d0e677f2b421665804bb06c26957bfd3126b5d718477bcc8282f05bded
SHA512

93d56f5a57a63e3401a884a6762e766f6567c1847c5a4213ccedaa594d7ea9851c78cc30d025116e437182061e81490345a694196b05eb792358fef9f29075e6
SSDEEP

12288:y5oHRKVYAaFrs5J3XQgfnPfoWkVMdSFLSF51M7FBjvrEH7Uf:y5OtrqXQCnULFGFvM7rrEH7Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-08_e1032e2c150661d6deea56dad73bdb29_avoslocker_cobalt-strike_floxif

Files

2024-05-08_e1032e2c150661d6deea56dad73bdb29_avoslocker_cobalt-strike_floxif
.exe windows:6 windows x86 arch:x86

bd4c82ae1adcfd5e0cfe9576340869c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\HDCleaner 2.050\Setup X32\Release\Setup.pdb

Imports

user32

PtInRect
PostQuitMessage
GetClientRect
SetWindowLongW
wsprintfW
SetCursor
LoadCursorW
TranslateMessage
SetFocus
MoveWindow
TrackMouseEvent
ReleaseCapture
LoadImageW
InvalidateRect
BeginPaint
EndPaint
GetCursorPos
PeekMessageW
ExitWindowsEx
ClientToScreen
IsDialogMessageW
DispatchMessageW
ShowWindow
GetWindowTextW
RegisterClassExW
SetWindowTextW
GetWindowLongW
GetWindowTextLengthW
GetMessageW
DefWindowProcW
GetWindowRect
DestroyWindow
GetDC
IsWindowVisible
SetWindowPos
MessageBoxW
MessageBoxExW
FillRect
CreateWindowExW
ScreenToClient
SendMessageW
GetSystemMetrics

ole32

CoInitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetStringTypeW
LCMapStringEx
EncodePointer
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
SizeofResource
FindFirstFileW
WritePrivateProfileStringW
HeapFree
SetLastError
EnterCriticalSection
GetCommandLineW
FindNextFileW
GetCurrentProcess
lstrlenW
WriteFile
ExpandEnvironmentStringsW
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
K32GetModuleFileNameExW
LeaveCriticalSection
GetTempPathW
InitializeCriticalSectionEx
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
FreeResource
OpenProcess
HeapSize
CreateToolhelp32Snapshot
MultiByteToWideChar
GetPrivateProfileStringW
Sleep
FormatMessageW
GetLastError
Process32NextW
WaitForSingleObjectEx
LockResource
GlobalAlloc
DeleteFileW
Process32FirstW
HeapReAlloc
CloseHandle
RaiseException
LoadLibraryW
CreateThread
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
GetLocalTime
GetCurrentDirectoryW
DecodePointer
HeapDestroy
SetCurrentDirectoryW
GetProcAddress
LocalFree
MoveFileExW
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
FreeLibrary
CopyFileW
WideCharToMultiByte
lstrcpyW
GetTempFileNameW
lstrcmpiW
lstrcmpW
IsDebuggerPresent
WriteConsoleW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetStdHandle
GetFileType
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetSystemDirectoryW
OutputDebugStringW

advapi32

RegQueryInfoKeyW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
OpenProcessToken
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegDeleteKeyW

shell32

CommandLineToArgvW
SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW
SHGetFileInfoW
SHFileOperationW
SHGetDesktopFolder
SHGetSpecialFolderPathW
SHCreateDirectoryExW

shlwapi

PathFileExistsW
SHDeleteKeyW
StrStrIW

gdi32

CreateFontW
GetStockObject
CreatePatternBrush
DeleteDC
TextOutW
GetTextExtentPoint32W
SetTextColor
SetBkMode
CreatePen
SetBkColor
DeleteObject
CreateSolidBrush
ExtTextOutW
CreateCompatibleDC
RoundRect
SelectObject
CreateCompatibleBitmap

gdiplus

GdipDeleteGraphics
GdipDisposeImage
GdipFree
GdipDrawImageI
GdipLoadImageFromStream
GdipCreateFromHDC
GdipDrawImageRectI
GdiplusStartup
GdipCloneImage
GdipAlloc

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd4c82ae1adcfd5e0cfe9576340869c9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

ole32

oleaut32

kernel32

advapi32

shell32

shlwapi

gdi32

gdiplus

version

Sections

.text Size: 198KB - Virtual size: 198KB

.rdata Size: 132KB - Virtual size: 131KB

.data Size: 16KB - Virtual size: 27KB

.rsrc Size: 185KB - Virtual size: 184KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 198KB - Virtual size: 198KB

.rdata
Size: 132KB - Virtual size: 131KB

.data
Size: 16KB - Virtual size: 27KB

.rsrc
Size: 185KB - Virtual size: 184KB

.reloc
Size: 15KB - Virtual size: 15KB