Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_29e6b859a82ac9d820eb341a454bcc53_avoslocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-22_29e6b859a82ac9d820eb341a454bcc53_avoslocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-22_29e6b859a82ac9d820eb341a454bcc53_avoslocker
-
Size
2.2MB
-
MD5
29e6b859a82ac9d820eb341a454bcc53
-
SHA1
d23b118e963ce33953f5730fa3c30162fad7e6b8
-
SHA256
4ff3761245b2f156cabbfb60ea6804a6fea2b162d2102fd696240fdc3981b75c
-
SHA512
1a3eb1b0d965fefbf10b9866467521ff39772d8620330857f10b2da463dab2432ef6460074bbb79a903074d69a64caa0078a493b20ba58811c0f6a2b03b9b799
-
SSDEEP
49152:HUQrQhWCX/QHsahs3yzKrPaRa1aOMjUfkptVx2Zyijd1:HUQrQ9PgHs3yzKrejUu5k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-22_29e6b859a82ac9d820eb341a454bcc53_avoslocker
Files
-
2024-05-22_29e6b859a82ac9d820eb341a454bcc53_avoslocker.exe windows:6 windows x86 arch:x86
a5df5a26582f0e1a369762c91921fcd5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetTokenInformation
RegCloseKey
OpenProcessToken
CopySid
EqualSid
ConvertStringSidToSidA
ConvertStringSecurityDescriptorToSecurityDescriptorA
kernel32
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
CreateDirectoryA
GetLastError
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetModuleHandleExA
GetProcAddress
SetDllDirectoryA
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetCurrentProcess
LocalFree
GetCommandLineW
GetTempPathA
SetLastError
GetSystemDirectoryA
GetNativeSystemInfo
GetModuleFileNameA
GetModuleHandleExW
CreateFileA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
GetDriveTypeA
GetFileAttributesA
RemoveDirectoryA
SetFileAttributesA
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetTickCount
CopyFileA
MoveFileExA
LoadResource
LockResource
SizeofResource
FindResourceA
Sleep
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
FormatMessageW
FreeLibrary
LoadLibraryW
QueryPerformanceCounter
FlushFileBuffers
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
EncodePointer
LCMapStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetCurrentDirectoryW
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetCommandLineA
CreateFileW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetEndOfFile
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetStdHandle
GetModuleFileNameW
WriteConsoleW
ExitProcess
HeapFree
HeapAlloc
CompareStringW
Sections
.text Size: 193KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ