2024-05-15_38a5ff3447165d0e1a66833f48f4db44_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-15_38a5ff3447165d0e1a66833f48f4db44_avoslocker
Size

7.7MB
MD5

38a5ff3447165d0e1a66833f48f4db44
SHA1

947cea77b321c150b4ef3848779269731ffed037
SHA256

cae6e3c04656621abb568ed30e5b37838362a7e34a85d70580ecde852a497171
SHA512

776e92e6fcf2934b486777881afc548fb5991bb670ef3a185b54260d26137e9bbb34b2901aa6b187ce60ff521ec9d87c03dd90e63cb1094adfc21edd3c055395
SSDEEP

196608:Yk2pxtPBGcyCg0+tkex3eVP1jZ75fwXND4Qplm7:Y1v9BNg5tk7VPFsNkil

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-15_38a5ff3447165d0e1a66833f48f4db44_avoslocker

Files

2024-05-15_38a5ff3447165d0e1a66833f48f4db44_avoslocker
.exe windows:6 windows x86 arch:x86

dcad062068de02fb9fd5005514ad619e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\OtherComp\D\D1Ex\Projects\src\xls2exe\RtmStarter\Win32\Release\RtmStarter.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wsock32

htonl
recv
connect
socket
send
ioctlsocket
ntohl
select
WSAStartup
htons
gethostbyname

gdiplus

GdipGetImageBounds
GdipCloneImage
GdipLoadImageFromStream
GdipDrawImageRectI
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup

kernel32

GetConsoleCP
HeapSize
lstrlenW
Sleep
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
RaiseException
DeleteCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObject
MulDiv
DecodePointer
GetCommandLineW
GetLongPathNameW
GetModuleFileNameW
GetTempPathW
CreateMutexW
CreateEventW
CloseHandle
CreateThread
GetProcAddress
LocalFree
GetCurrentProcessId
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
SizeofResource
CreateFileW
GetFileAttributesW
LockResource
QueryPerformanceFrequency
LoadResource
FindResourceW
GetWindowsDirectoryW
FreeLibrary
QueryPerformanceCounter
LoadLibraryExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetDateFormatW
GetVolumeInformationW
DeviceIoControl
GetVersionExW
LoadLibraryW
GlobalReAlloc
TlsGetValue
GetConsoleMode
TlsAlloc
GetSystemDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
WriteFile
GetStdHandle
ExitProcess
HeapReAlloc
GetModuleHandleExW
ExitThread
GetTimeZoneInformation
FindNextFileW
FindFirstFileExW
FindClose
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetFullPathNameW
GetDriveTypeW
RemoveDirectoryW
DeleteFileW
GetFileAttributesExW
GetCommandLineA
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
VirtualProtect
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
SetEvent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTickCount
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
WriteConsoleW
SetEndOfFile
GetSystemTime
TlsFree
GetSystemTimeAsFileTime
TlsSetValue
GetStringTypeW
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
EncodePointer

user32

GetDC
SendMessageW
GetClientRect
MoveWindow
SetWindowTextW
GetWindowRect
ScreenToClient
EndDialog
CreateWindowExW
DefWindowProcW
SetWindowLongW
ShowWindow
PeekMessageW
UpdateWindow
RedrawWindow
GetDialogBaseUnits
SetTimer
HideCaret
EndPaint
BeginPaint
SetForegroundWindow
GetSystemMetrics
ClientToScreen
KillTimer
EnumWindows
GetClassNameW
GetWindowThreadProcessId
PostMessageW
GetActiveWindow
DestroyIcon
DialogBoxIndirectParamW
FindWindowW
PostThreadMessageW
DialogBoxParamW
CallWindowProcW
LoadCursorW
GetClassInfoExW
RegisterClassExW
InvalidateRect
ReleaseDC
GetWindowDC
FillRect
GetMessageW
MessageBoxW
GetWindowTextW
SetFocus
CreateDialogParamW
UnregisterClassW
DestroyWindow
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetParent
MapWindowPoints
SetWindowPos
DispatchMessageW
IsWindow

gdi32

SetBkColor
SelectObject
CreateSolidBrush
CreateFontIndirectW
GetDeviceCaps
CreateFontW
GetTextExtentPoint32W
DeleteDC
DeleteObject
GetStockObject

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
IsTextUnicode

shell32

DuplicateIcon
SHGetFolderPathW
ShellExecuteExW
ExtractIconExW

ole32

CoInitializeSecurity
CoSetProxyBlanket
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitialize

oleaut32

SysAllocStringByteLen
CreateErrorInfo
VariantClear
VariantInit
VariantCopy
OleLoadPicture
SysFreeString
SysStringByteLen
VariantChangeType
SysAllocString

Sections

.text
Size: 399KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcad062068de02fb9fd5005514ad619e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

wsock32

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 399KB - Virtual size: 399KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 23KB - Virtual size: 162KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 7.1MB - Virtual size: 7.1MB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 399KB - Virtual size: 399KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 23KB - Virtual size: 162KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 7.1MB - Virtual size: 7.1MB

.reloc
Size: 22KB - Virtual size: 22KB