2024-05-08_3b06faf16579febfc7e6c69f039356e8_avoslocker

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-08_3b06faf16579febfc7e6c69f039356e8_avoslocker
Size

2.6MB
MD5

3b06faf16579febfc7e6c69f039356e8
SHA1

97260e4d36d5226f10d3ad3b7218b8af36a8bde9
SHA256

888bdf42b6a7528a9c1bc36579c5eeccd2bd49a3599ff42c13a9a10ad0d29635
SHA512

33c87564438953fd1612e76588ab5ada1121d0763809895d4aff836c9657aa6f6b6071c6589dbc99946bf093a2dc0470f24c6bdfa8d32894f0540207a5c545df
SSDEEP

49152:1lVQ2bPYfQtzKTp7R25wNS1LPqCwItnp6pLxfwkxHeY4XcRHq:1f1bPYfQ6O6SMIJpyLpwkxQM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-08_3b06faf16579febfc7e6c69f039356e8_avoslocker

Files

2024-05-08_3b06faf16579febfc7e6c69f039356e8_avoslocker
.exe windows:6 windows x86 arch:x86

2361f00cfe95b057b215126efea03d0d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\OtherComp\D\D1Ex\Projects\src\xls2exe\RtmStarter\Win32\Release\RtmStarter.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wsock32

htonl
recv
connect
socket
send
ioctlsocket
ntohl
select
WSAStartup
htons
gethostbyname

gdiplus

GdipGetImageBounds
GdipCloneImage
GdipLoadImageFromStream
GdipDrawImageRectI
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup

kernel32

GetConsoleCP
HeapSize
lstrlenW
Sleep
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
RaiseException
DeleteCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObject
MulDiv
DecodePointer
GetCommandLineW
GetLongPathNameW
GetModuleFileNameW
GetTempPathW
CreateMutexW
CreateEventW
CloseHandle
CreateThread
GetProcAddress
LocalFree
GetCurrentProcessId
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
SizeofResource
CreateFileW
GetFileAttributesW
LockResource
QueryPerformanceFrequency
LoadResource
FindResourceW
GetWindowsDirectoryW
FreeLibrary
QueryPerformanceCounter
LoadLibraryExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetDateFormatW
GetVolumeInformationW
DeviceIoControl
GetVersionExW
LoadLibraryW
GlobalReAlloc
TlsGetValue
GetConsoleMode
TlsAlloc
GetSystemDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
WriteFile
GetStdHandle
ExitProcess
HeapReAlloc
GetModuleHandleExW
ExitThread
GetTimeZoneInformation
PeekNamedPipe
GetFileType
GetFileInformationByHandle
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetFullPathNameW
GetDriveTypeW
RemoveDirectoryW
DeleteFileW
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
FindClose
GetFileAttributesExW
GetCommandLineA
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
VirtualProtect
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
SetEvent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTickCount
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
WriteConsoleW
SetEndOfFile
GetSystemTime
TlsFree
GetSystemTimeAsFileTime
TlsSetValue
GetStringTypeW
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
EncodePointer

user32

GetDC
SendMessageW
GetClientRect
MoveWindow
SetWindowTextW
GetWindowRect
ScreenToClient
EndDialog
CreateWindowExW
DefWindowProcW
SetWindowLongW
ShowWindow
PeekMessageW
UpdateWindow
RedrawWindow
GetDialogBaseUnits
SetTimer
HideCaret
EndPaint
BeginPaint
SetForegroundWindow
GetSystemMetrics
ClientToScreen
KillTimer
EnumWindows
GetClassNameW
GetWindowThreadProcessId
PostMessageW
GetActiveWindow
DestroyIcon
DialogBoxIndirectParamW
FindWindowW
PostThreadMessageW
DialogBoxParamW
CallWindowProcW
LoadCursorW
GetClassInfoExW
RegisterClassExW
InvalidateRect
ReleaseDC
GetWindowDC
FillRect
GetMessageW
MessageBoxW
GetWindowTextW
SetFocus
CreateDialogParamW
UnregisterClassW
DestroyWindow
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetParent
MapWindowPoints
SetWindowPos
DispatchMessageW
IsWindow

gdi32

SetBkColor
SelectObject
CreateSolidBrush
CreateFontIndirectW
GetDeviceCaps
CreateFontW
GetTextExtentPoint32W
DeleteDC
DeleteObject
GetStockObject

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
IsTextUnicode

shell32

DuplicateIcon
SHGetFolderPathW
ShellExecuteExW
ExtractIconExW

ole32

CoInitializeSecurity
CoSetProxyBlanket
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitialize

oleaut32

SysAllocStringByteLen
CreateErrorInfo
VariantClear
VariantInit
VariantCopy
OleLoadPicture
SysFreeString
SysStringByteLen
VariantChangeType
SysAllocString

Sections

.text
Size: 401KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2361f00cfe95b057b215126efea03d0d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

wsock32

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 401KB - Virtual size: 400KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 23KB - Virtual size: 163KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 401KB - Virtual size: 400KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 23KB - Virtual size: 163KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 22KB - Virtual size: 22KB