\\cpbufs\transfer\aataneja\ReaderPOC\ReaderSolution\ReaderPOC\Release\ReaderPOC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_e9538e8930d24d7ce4812163ba742d76_avoslocker.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-27_e9538e8930d24d7ce4812163ba742d76_avoslocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-27_e9538e8930d24d7ce4812163ba742d76_avoslocker
-
Size
1.3MB
-
MD5
e9538e8930d24d7ce4812163ba742d76
-
SHA1
1228b579809481a48f8c8bbff4fd7f01f09ac5ce
-
SHA256
4d8fd6944921319a937901c024a3d61ce87ea0cf2846f1acc5bc36447ede6ca1
-
SHA512
1475708ae398dc966028ab16801389340581ce1f69f63bbbb3d3dd5668a9537a78ef68acc18068bfd40dcea08235c6518b395ec98551c3d1b5a573c124eccf19
-
SSDEEP
24576:v2zEYytjjqNSlhvpfQiIhKPtehfQw99qySkbged1sqjnhMgeiCl7G0nehbGZpbD:vPtjtQiIhUyQc1SkFdpDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-27_e9538e8930d24d7ce4812163ba742d76_avoslocker
Files
-
2024-05-27_e9538e8930d24d7ce4812163ba742d76_avoslocker.exe windows:6 windows x86 arch:x86
99779933d13e7f3a0c46176caa0baa44
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msi
ord205
ord70
kernel32
CreateFileMappingA
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
GetVersionExA
LoadLibraryA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
LocalFree
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
InterlockedCompareExchange
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
DecodePointer
FindNextFileW
GetModuleFileNameW
FindClose
GetCurrentProcess
CreateEventW
GetModuleHandleW
TlsSetValue
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
TlsGetValue
GetTickCount
FlushFileBuffers
GetLastError
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
TlsFree
EncodePointer
GetFullPathNameW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileSizeEx
GetFileType
GetModuleHandleExW
ExitProcess
GetStdHandle
LoadLibraryExW
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
GetStringTypeW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
CompareStringW
advapi32
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetFolderPathW
SHCreateDirectoryExW
SHGetFolderPathAndSubDirW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetSpecialFolderPathW
ole32
CoTaskMemFree
CoCreateInstance
CoCreateGuid
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoInitialize
StringFromGUID2
OleRun
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantCopy
GetErrorInfo
VariantInit
shlwapi
PathFileExistsA
PathAppendW
PathFileExistsW
PathIsDirectoryW
Sections
.text Size: 606KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 588KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE