2024-05-28_b2cf25ed3c0e8215a916e7378a929e1d_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-28_b2cf25ed3c0e8215a916e7378a929e1d_avoslocker
Size

4.4MB
MD5

b2cf25ed3c0e8215a916e7378a929e1d
SHA1

5e69e7393cf0233dbebd56fb6b1f66bdc45a0152
SHA256

2f153fb624a3323c9f1f636713b6dfb544088b066f2e9552d9ddafc8c706153e
SHA512

24c7a8bb228851e6adcb3ce59ce06f46b77c82c2e90ed8e39b6c0ac89b7642731eca03395835e07ba2a43fdfc90657de79c17f61305732435981659b2076727d
SSDEEP

98304:Ef1vPGnlwKFBu0M9OOicy78HHE03FyYjYjzMxW56raprYm0:KlP9KG0M90ZPivM56raprr

Score

1^/10

Malware Config

Signatures

Files

2024-05-28_b2cf25ed3c0e8215a916e7378a929e1d_avoslocker
.exe windows:6 windows x86 arch:x86

f826701f41e61b40213ff4526f8fafff

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16/04/2020, 18:36

Not After

16/04/2045, 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:01:09:88:59:70:f7:a2:f3:f2:a1:58:00:00:00:01:09:88
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28/05/2024, 01:02

Not After

31/05/2024, 01:02

Subject

CN=Key Metric Software,O=Key Metric Software,L=Traverse City,ST=Michigan,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:01:09:88:59:70:f7:a2:f3:f2:a1:58:00:00:00:01:09:88
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28/05/2024, 01:02

Not After

31/05/2024, 01:02

Subject

CN=Key Metric Software,O=Key Metric Software,L=Traverse City,ST=Michigan,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13/04/2021, 17:31

Not After

13/04/2026, 17:31

Subject

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01/04/2021, 20:05

Not After

01/04/2036, 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19/11/2020, 20:32

Not After

19/11/2035, 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:35:09:05:b5:b2:e7:84:ef:0c:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

15/02/2024, 20:35

Not After

15/02/2025, 20:35

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ae:10:84:74:cd:f0:59:1f:70:50:01:c9:fd:2d:da:b4:38:7d:f6:a0:4b:d6:d6:e6:c8:b5:3c:e9:cc:53:38:a6
Signer

Actual PE Digest

ae:10:84:74:cd:f0:59:1f:70:50:01:c9:fd:2d:da:b4:38:7d:f6:a0:4b:d6:d6:e6:c8:b5:3c:e9:cc:53:38:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\administrator\Documents\Visual Studio Projects\XCrashReport\XCrashReport\ReleaseUnicode\XCrashReport.pdb

Imports

kernel32

ExitProcess
GetStdHandle
SetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
GetModuleHandleExW
LCMapStringW
ExitThread
GetTimeZoneInformation
GetCommandLineW
GetCommandLineA
RtlUnwind
RaiseException
OutputDebugStringW
SetFilePointerEx
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTempFileNameW
SearchPathW
GetProfileIntW
GetTickCount64
SystemTimeToTzSpecificLocalTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
SetErrorMode
VerifyVersionInfoW
VerSetConditionMask
FindResourceExW
UnlockFile
LockFile
GetVolumeInformationW
FlushFileBuffers
lstrcmpiW
GetCPInfo
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GlobalFlags
GlobalGetAtomNameW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
WritePrivateProfileStringW
GetPrivateProfileIntW
ResumeThread
SetThreadPriority
lstrcmpA
GetVersionExW
GetCurrentThread
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetSystemDirectoryW
EncodePointer
GetModuleHandleW
OutputDebugStringA
GetCurrentProcessId
FormatMessageW
LocalFree
GlobalFree
GlobalLock
GlobalUnlock
GlobalSize
GlobalAlloc
SetLastError
WaitForSingleObject
GetVersionExA
SetEndOfFile
GetFileTime
GetCurrentThreadId
QueryPerformanceFrequency
QueryPerformanceCounter
MoveFileW
GetModuleHandleA
GetTempPathW
SetFileAttributesW
GetFullPathNameW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
GetCurrentDirectoryA
GetOEMCP
GetACP
GetComputerNameW
FormatMessageA
GetTickCount
GetSystemTimeAsFileTime
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetSystemTime
CompareFileTime
CreateThread
FileTimeToDosDateTime
GetFileType
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
GetFileInformationByHandle
DuplicateHandle
UnmapViewOfFile
SetFilePointer
GetCurrentProcess
WinExec
LoadLibraryW
GetWindowsDirectoryW
GetFileAttributesW
WriteFile
MultiByteToWideChar
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
WideCharToMultiByte
SizeofResource
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpynW
GetPrivateProfileStringW
GetModuleFileNameW
GetLocaleInfoW
lstrcpyW
GetNumberFormatW
MulDiv
CloseHandle
ReadFile
GetFileSize
CreateFileW
CreateProcessW
CopyFileW
FindResourceW
LoadResource
LockResource
FreeLibraryAndExitThread
WriteConsoleW

user32

GetAsyncKeyState
CopyImage
SystemParametersInfoW
GetMenuItemInfoW
DestroyMenu
RealChildWindowFromPoint
GetSysColorBrush
ShowOwnedPopups
TranslateMessage
GetMessageW
PostQuitMessage
IntersectRect
MapVirtualKeyW
GetKeyNameTextW
WindowFromPoint
GetCursorPos
OffsetRect
SetRectEmpty
SendDlgItemMessageA
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetTopWindow
GetClassNameW
GetClassLongW
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
MapDialogRect
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
GetDlgCtrlID
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DefMDIChildProcW
DefFrameProcW
SetClipboardData
EmptyClipboard
SendMessageW
GetWindowRect
LockWindowUpdate
GetClientRect
SetWindowPlacement
GetWindowPlacement
SetWindowPos
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
PeekMessageW
DispatchMessageW
LoadMenuW
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
ClientToScreen
EndPaint
BeginPaint
GetWindowDC
GetLastActivePopup
GetWindowThreadProcessId
GetWindowLongW
IsWindowEnabled
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
UpdateWindow
GetFocus
TrackMouseEvent
DestroyIcon
LoadImageW
WaitMessage
DeleteMenu
IsClipboardFormatAvailable
SetRect
CharUpperW
CreatePopupMenu
GetMenuDefaultItem
GetNextDlgGroupItem
DrawFocusRect
IsRectEmpty
DrawIconEx
GetIconInfo
DrawEdge
IsWindow
MessageBeep
SetWindowLongW
KillTimer
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
SetLayeredWindowAttributes
EnumDisplayMonitors
OpenClipboard
ValidateRect
wsprintfW
GetSysColor
DrawMenuBar
GetDC
GetParent
GetSystemMetrics
ReleaseDC
ReleaseCapture
SetCapture
SetFocus
SetActiveWindow
MessageBoxW
UnregisterClassW
GetKeyboardLayout
DrawIcon
FillRect
RedrawWindow
LoadIconW
DestroyCursor
SetTimer
IsIconic
GetMessagePos
ScreenToClient
PtInRect
SetCursor
LoadCursorW
CopyIcon
InvalidateRect
InflateRect
DrawTextW
TabbedTextOutW
DrawTextExW
GrayStringW
RegisterWindowMessageW
DrawStateW
SetClassLongW
SetWindowRgn
SetParent
CloseClipboard
DrawFrameControl
IsZoomed
GetSystemMenu
BringWindowToTop
SetCursorPos
FrameRect
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
UnionRect
UpdateLayeredWindow
MonitorFromPoint
GetComboBoxInfo
PostThreadMessageW
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
GetUpdateRect
TranslateMDISysAccel
GetWindowRgn
CreateMenu
EnableWindow
SubtractRect

gdi32

SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRectRgnIndirect
PatBlt
CombineRgn
SetRectRgn
DPtoLP
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
SetBkMode
RealizePalette
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
SetBkColor
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
DeleteObject
CreatePatternBrush
CreatePen
CreateHatchBrush
CopyMetaFileW
CreateRectRgn
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetBkColor
GetCurrentObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
TranslateCharsetInfo
GetTextExtentPoint32W
DeleteDC
GetDeviceCaps
CreateDCW
CreateFontIndirectW
GetObjectW
GetSystemPaletteEntries
CreateBitmap
CreateSolidBrush

msimg32

AlphaBlend
TransparentBlt

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

CryptDestroyKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
CryptSignHashA
CryptSetHashParam
CryptDestroyHash
CryptCreateHash
CryptExportKey
IsTextUnicode
CryptGenRandom
CryptGetUserKey
CryptGetProvParam
CryptReleaseContext
RegSetValueExW
RegQueryValueExA
CryptAcquireContextA
RegOpenKeyExA
RegQueryValueW
RegCloseKey

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
ShellExecuteW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
DragFinish
DragQueryFileW
SHGetDesktopFolder
ExtractIconW

comctl32

ImageList_GetBkColor
ImageList_SetBkColor
ImageList_GetImageInfo
InitCommonControlsEx

shlwapi

PathFindExtensionW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW
PathIsUNCW
PathFindFileNameW

uxtheme

OpenThemeData
IsAppThemed
GetWindowTheme
IsThemeBackgroundPartiallyTransparent
GetCurrentThemeName
GetThemePartSize
DrawThemeText
DrawThemeParentBackground
CloseThemeData
DrawThemeBackground
GetThemeColor
GetThemeSysColor

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
OleGetClipboard
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
DoDragDrop
CoInitializeEx
CreateStreamOnHGlobal
CoDisconnectObject
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VariantChangeType
SysAllocString
LoadTypeLi
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantClear
VariantCopy
VarBstrFromDate
VariantInit
SysAllocStringLen
SysFreeString

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ws2_32

socket
shutdown
setsockopt
send
select
recv
WSAStartup
inet_ntoa
inet_addr
htons
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
__WSAFDIsSet
WSAGetLastError
WSAIoctl
ntohs
gethostbyname

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipBitmapUnlockBits

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 983KB - Virtual size: 982KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 81KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f826701f41e61b40213ff4526f8fafff

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99Certificate

Key Usages

33:00:01:09:88:59:70:f7:a2:f3:f2:a1:58:00:00:00:01:09:88Certificate

Extended Key Usages

Key Usages

33:00:01:09:88:59:70:f7:a2:f3:f2:a1:58:00:00:00:01:09:88Certificate

Extended Key Usages

Key Usages

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04Certificate

Key Usages

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07Certificate

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:35:09:05:b5:b2:e7:84:ef:0c:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

ae:10:84:74:cd:f0:59:1f:70:50:01:c9:fd:2d:da:b4:38:7d:f6:a0:4b:d6:d6:e6:c8:b5:3c:e9:cc:53:38:a6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

version

ws2_32

gdiplus

oleacc

imm32

winmm

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 983KB - Virtual size: 982KB

.data Size: 81KB - Virtual size: 113KB

.rsrc Size: 88KB - Virtual size: 87KB

.reloc Size: 201KB - Virtual size: 201KB

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

33:00:01:09:88:59:70:f7:a2:f3:f2:a1:58:00:00:00:01:09:88
Certificate

33:00:01:09:88:59:70:f7:a2:f3:f2:a1:58:00:00:00:01:09:88
Certificate

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:35:09:05:b5:b2:e7:84:ef:0c:00:00:00:00:00:35
Certificate

ae:10:84:74:cd:f0:59:1f:70:50:01:c9:fd:2d:da:b4:38:7d:f6:a0:4b:d6:d6:e6:c8:b5:3c:e9:cc:53:38:a6
Signer

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 983KB - Virtual size: 982KB

.data
Size: 81KB - Virtual size: 113KB

.rsrc
Size: 88KB - Virtual size: 87KB

.reloc
Size: 201KB - Virtual size: 201KB