2024-05-08_9cf01a843ce6d48fc9bf2b238b8c680a_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-08_9cf01a843ce6d48fc9bf2b238b8c680a_avoslocker
Size

2.6MB
MD5

9cf01a843ce6d48fc9bf2b238b8c680a
SHA1

6ee5936db4ea421ccedcdc3c835b2d48915ac884
SHA256

34d7a64ba57d7256563df9e779573d888bf6efa94a75a9a6f46b53a98b1c3146
SHA512

d27ababee7a16add1c166bf3028e3dda9dc4f0e48562d3be28285797c04f22a65cdb2a817eff30757732520e1fd7be0793bc5cffab95e012f1b5669360fc3fb5
SSDEEP

49152:NlVQ2bPYfQtzKTpaR25wNS1LPqCwItnp6pLxfwkxHeY4XDxHq:Nf1bPYfQXO6SMIJpyLpwkxQT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-08_9cf01a843ce6d48fc9bf2b238b8c680a_avoslocker

Files

2024-05-08_9cf01a843ce6d48fc9bf2b238b8c680a_avoslocker
.exe windows:6 windows x86 arch:x86

2361f00cfe95b057b215126efea03d0d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\OtherComp\D\D1Ex\Projects\src\xls2exe\RtmStarter\Win32\Release\RtmStarter.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wsock32

htonl
recv
connect
socket
send
ioctlsocket
ntohl
select
WSAStartup
htons
gethostbyname

gdiplus

GdipGetImageBounds
GdipCloneImage
GdipLoadImageFromStream
GdipDrawImageRectI
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup

kernel32

GetConsoleCP
HeapSize
lstrlenW
Sleep
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
RaiseException
DeleteCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObject
MulDiv
DecodePointer
GetCommandLineW
GetLongPathNameW
GetModuleFileNameW
GetTempPathW
CreateMutexW
CreateEventW
CloseHandle
CreateThread
GetProcAddress
LocalFree
GetCurrentProcessId
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
SizeofResource
CreateFileW
GetFileAttributesW
LockResource
QueryPerformanceFrequency
LoadResource
FindResourceW
GetWindowsDirectoryW
FreeLibrary
QueryPerformanceCounter
LoadLibraryExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetDateFormatW
GetVolumeInformationW
DeviceIoControl
GetVersionExW
LoadLibraryW
GlobalReAlloc
TlsGetValue
GetConsoleMode
TlsAlloc
GetSystemDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
WriteFile
GetStdHandle
ExitProcess
HeapReAlloc
GetModuleHandleExW
ExitThread
GetTimeZoneInformation
PeekNamedPipe
GetFileType
GetFileInformationByHandle
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetFullPathNameW
GetDriveTypeW
RemoveDirectoryW
DeleteFileW
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
FindClose
GetFileAttributesExW
GetCommandLineA
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
VirtualProtect
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
SetEvent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTickCount
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
WriteConsoleW
SetEndOfFile
GetSystemTime
TlsFree
GetSystemTimeAsFileTime
TlsSetValue
GetStringTypeW
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
EncodePointer

user32

GetDC
SendMessageW
GetClientRect
MoveWindow
SetWindowTextW
GetWindowRect
ScreenToClient
EndDialog
CreateWindowExW
DefWindowProcW
SetWindowLongW
ShowWindow
PeekMessageW
UpdateWindow
RedrawWindow
GetDialogBaseUnits
SetTimer
HideCaret
EndPaint
BeginPaint
SetForegroundWindow
GetSystemMetrics
ClientToScreen
KillTimer
EnumWindows
GetClassNameW
GetWindowThreadProcessId
PostMessageW
GetActiveWindow
DestroyIcon
DialogBoxIndirectParamW
FindWindowW
PostThreadMessageW
DialogBoxParamW
CallWindowProcW
LoadCursorW
GetClassInfoExW
RegisterClassExW
InvalidateRect
ReleaseDC
GetWindowDC
FillRect
GetMessageW
MessageBoxW
GetWindowTextW
SetFocus
CreateDialogParamW
UnregisterClassW
DestroyWindow
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetParent
MapWindowPoints
SetWindowPos
DispatchMessageW
IsWindow

gdi32

SetBkColor
SelectObject
CreateSolidBrush
CreateFontIndirectW
GetDeviceCaps
CreateFontW
GetTextExtentPoint32W
DeleteDC
DeleteObject
GetStockObject

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
IsTextUnicode

shell32

DuplicateIcon
SHGetFolderPathW
ShellExecuteExW
ExtractIconExW

ole32

CoInitializeSecurity
CoSetProxyBlanket
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitialize

oleaut32

SysAllocStringByteLen
CreateErrorInfo
VariantClear
VariantInit
VariantCopy
OleLoadPicture
SysFreeString
SysStringByteLen
VariantChangeType
SysAllocString

Sections

.text
Size: 401KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2361f00cfe95b057b215126efea03d0d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

wsock32

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 401KB - Virtual size: 400KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 23KB - Virtual size: 163KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 401KB - Virtual size: 400KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 23KB - Virtual size: 163KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 22KB - Virtual size: 22KB