\\cpbufs\transfer\aataneja\ReaderPOC\ReaderSolution\ReaderPOC\Release\ReaderPOC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-28_df6b51843cecd9dcbfc566fc0a44463e_avoslocker.exe
Resource
win7-20240221-en
General
-
Target
2024-05-28_df6b51843cecd9dcbfc566fc0a44463e_avoslocker
-
Size
1.3MB
-
MD5
df6b51843cecd9dcbfc566fc0a44463e
-
SHA1
14b3050024af01a1694401f582e1d5fea351e3ac
-
SHA256
64b59414b7bca319d86f527b1baafc4d9645fe67aca7e64d6c4eccaba246069b
-
SHA512
898db70e285de7a84a7e3c1714277f631e6248d4ecb061dd84983f892fc308ce01c38ec6e3bfbe3096cf0b1b75158ff5ba05cf5bbbd00953e6c7f4c82355e0a1
-
SSDEEP
24576:T2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbged56LaRFdGJm0Q3WKVSwdr13Ekb:TPtjtQiIhUyQd1SkFd56KFdi2Ga9x3EJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-28_df6b51843cecd9dcbfc566fc0a44463e_avoslocker
Files
-
2024-05-28_df6b51843cecd9dcbfc566fc0a44463e_avoslocker.exe windows:6 windows x86 arch:x86
99779933d13e7f3a0c46176caa0baa44
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msi
ord205
ord70
kernel32
CreateFileMappingA
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
GetVersionExA
LoadLibraryA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
LocalFree
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
InterlockedCompareExchange
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
DecodePointer
FindNextFileW
GetModuleFileNameW
FindClose
GetCurrentProcess
CreateEventW
GetModuleHandleW
TlsSetValue
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
TlsGetValue
GetTickCount
FlushFileBuffers
GetLastError
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
TlsFree
EncodePointer
GetFullPathNameW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileSizeEx
GetFileType
GetModuleHandleExW
ExitProcess
GetStdHandle
LoadLibraryExW
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
GetStringTypeW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
CompareStringW
advapi32
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetFolderPathW
SHCreateDirectoryExW
SHGetFolderPathAndSubDirW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetSpecialFolderPathW
ole32
CoTaskMemFree
CoCreateInstance
CoCreateGuid
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoInitialize
StringFromGUID2
OleRun
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantCopy
GetErrorInfo
VariantInit
shlwapi
PathFileExistsA
PathAppendW
PathFileExistsW
PathIsDirectoryW
Sections
.text Size: 606KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 588KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE