2024-05-24_331bacb03cbd035573395776d15cd590_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-24_331bacb03cbd035573395776d15cd590_avoslocker
Size

1.7MB
MD5

331bacb03cbd035573395776d15cd590
SHA1

0e49ce132407fe7e5ddf65f3ea5c09a17401570b
SHA256

d1574cdb1d006da29f7d583f3fdd75caf74d3bbb310ccd72362d42895c9df4c1
SHA512

9236b8a4bf84f960b90d4c2efc179f0ce558c480878caee6c9e8265462908a704669991d29a59b2b44747ef7adc0fc76dea9fb8c689f56838bdf03bc025f316b
SSDEEP

49152:GQnj4HiRgrOL6UQ5OmEGfkxaQI9cFRgT0w3a4CmXb/EQGd2T:GQjsbfkxaZ9ce5VXb/MQT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_331bacb03cbd035573395776d15cd590_avoslocker

Files

2024-05-24_331bacb03cbd035573395776d15cd590_avoslocker
.exe windows:5 windows x86 arch:x86

7877345e635c19e290efc047dfabd726

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins\CI\CCHyperdrive\build\x64\main\ccd-hyperdrive\build\msvs_win32\Release\x86\sym\Uninstaller\Uninstaller\Uninstaller.pdb

Imports

kernel32

GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
GetFileAttributesExW
lstrlenW
SystemTimeToFileTime
CreateMutexW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
LockFileEx
GetSystemTime
FormatMessageA
CreateFileMappingW
UnlockFileEx
GetCurrentProcess
CreateEventW
GlobalAlloc
GlobalFree
GetProcAddress
GetModuleHandleW
GetFileAttributesW
ReadFile
GetFullPathNameW
FindNextFileW
WriteFile
GetModuleFileNameW
GetTempPathW
FindClose
CreateFileW
DeleteFileW
GetFileSize
FlushFileBuffers
HeapFree
SetLastError
TerminateProcess
WaitForSingleObject
MapViewOfFile
HeapSize
Sleep
HeapReAlloc
CreateThread
HeapAlloc
HeapDestroy
GetCurrentProcessId
GetProcessHeap
CreateProcessW
MultiByteToWideChar
FormatMessageW
WideCharToMultiByte
LoadLibraryW
FreeLibrary
GetUserDefaultLCID
LoadLibraryA
LCMapStringW
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
CompareStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlUnwind
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
IsValidLocale
EnumSystemLocalesW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileSizeEx
GetConsoleCP
SetEndOfFile
WriteConsoleW
ExitThread
DeleteCriticalSection
LocalFree
DecodePointer
RaiseException
CloseHandle
GetLastError
InitializeCriticalSectionEx
OpenProcess
CreateNamedPipeW
FreeLibraryAndExitThread

user32

EnumWindows
GetShellWindow
AllowSetForegroundWindow
GetWindowThreadProcessId

advapi32

RegOpenKeyExW
GetTokenInformation
FreeSid
OpenProcessToken
SetEntriesInAclW
AllocateAndInitializeSid
EqualSid
RegQueryValueExW
GetUserNameW
RegCloseKey
GetNamedSecurityInfoW
SetNamedSecurityInfoW
DuplicateTokenEx
AdjustTokenPrivileges
LookupPrivilegeValueW

shell32

SHGetFolderLocation
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
CommandLineToArgvW

ole32

CLSIDFromProgID
StringFromGUID2
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoCreateGuid
CLSIDFromString
CoTaskMemFree
OleRun

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit
GetErrorInfo
SysStringLen
VariantChangeType

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathFileExistsA
PathAppendW
PathIsDirectoryW
PathStripPathW
PathRemoveBackslashW

Sections

.text
Size: 894KB - Virtual size: 894KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 596KB - Virtual size: 600KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7877345e635c19e290efc047dfabd726

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 894KB - Virtual size: 894KB

.rdata Size: 164KB - Virtual size: 163KB

.data Size: 10KB - Virtual size: 15KB

.rsrc Size: 88KB - Virtual size: 88KB

.reloc Size: 596KB - Virtual size: 600KB

.text
Size: 894KB - Virtual size: 894KB

.rdata
Size: 164KB - Virtual size: 163KB

.data
Size: 10KB - Virtual size: 15KB

.rsrc
Size: 88KB - Virtual size: 88KB

.reloc
Size: 596KB - Virtual size: 600KB