Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-30_71b255e77ded3de630fa3733e659e7e2_avoslocker_metamorfo_revil.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-30_71b255e77ded3de630fa3733e659e7e2_avoslocker_metamorfo_revil.exe
Resource
win10v2004-20240426-en
Target
2024-05-30_71b255e77ded3de630fa3733e659e7e2_avoslocker_metamorfo_revil
Size
21.3MB
MD5
71b255e77ded3de630fa3733e659e7e2
SHA1
6c51579c4ac3e9e6861c537b3c4245895c37c123
SHA256
86679db3477906006c5f6aeb0e49470bb815a2c224702adfa80e327d90e0daad
SHA512
075c00a0dcc3d2bf2793b6fd8908f3fb7019428f3668c18e04758166d1f72e653cc522252dd13bd3466dadfa0b8f90bdebc2727519240dedc1993ef6b1f7b837
SSDEEP
196608:2CfsQRc4Zkr+K6SHULTHpFnsVufrqNsaUQGXiXCS1gJynzK:2FUarEJhsofrqN1/GXiT1q
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
E:\TemporaryBuilds\azure-installer-pool-de-1\14\s\_bin\suite2021\Win32\PDFSuite2021Installer.pdb
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
CreateEventA
SetEvent
CreateDirectoryW
RemoveDirectoryW
WaitForSingleObjectEx
GetCurrentThreadId
GetCurrentProcess
LocalAlloc
LocalFree
GetDriveTypeW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCommandLineW
GetLastError
RaiseException
GetModuleHandleW
GetProcAddress
DecodePointer
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
CreateThread
WaitForSingleObject
CreateEventW
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetModuleFileNameW
GetFileSize
ReadFile
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
OutputDebugStringW
SetUnhandledExceptionFilter
InterlockedExchange
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteFileW
SetFileAttributesW
GetFullPathNameW
GetVersionExW
WriteFile
CopyFileW
CreateProcessW
FindFirstFileW
FindNextFileW
FindClose
Sleep
CreateMutexW
ReleaseMutex
LoadLibraryW
FreeLibrary
ReleaseSemaphore
CreateSemaphoreA
WaitForMultipleObjectsEx
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
QueryPerformanceCounter
QueryPerformanceFrequency
CreateMutexA
GetUserDefaultLCID
OpenProcess
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
IsWow64Process
GetExitCodeProcess
Process32FirstW
Process32NextW
GetModuleHandleA
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetModuleFileNameA
LoadLibraryExA
FormatMessageW
SetLastError
DuplicateHandle
TlsAlloc
WaitForMultipleObjects
TerminateThread
QueueUserAPC
InterlockedExchangeAdd
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
InterlockedCompareExchange
VerSetConditionMask
VerifyVersionInfoW
ProcessIdToSessionId
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
GetTickCount
GetStdHandle
OutputDebugStringA
GetTempPathA
GetWindowsDirectoryA
GetComputerNameA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetSystemTimeAsFileTime
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryW
GetFileAttributesW
lstrcpynW
SwitchToThread
UnmapViewOfFile
CreateFileMappingA
FormatMessageA
GlobalSize
LoadLibraryA
GetTempFileNameA
GetLocaleInfoA
FindResourceA
MulDiv
ExitThread
GetCPInfo
SetThreadLocale
GetNumberFormatW
GetCurrencyFormatW
GetSystemTime
GetLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
GetLocaleInfoW
GetDateFormatW
GetThreadLocale
GetVersionExA
SetEndOfFile
MapViewOfFile
FlushViewOfFile
CompareStringW
GetTempPathW
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
GetFileType
PeekNamedPipe
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentThread
GetThreadTimes
UnregisterWaitEx
VirtualProtect
VirtualQuery
GetWindowsDirectoryW
GetFileAttributesExW
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetStringTypeW
GetExitCodeThread
TryEnterCriticalSection
QueueUserWorkItem
EncodePointer
LCMapStringW
OpenEventA
ResumeThread
CreateWaitableTimerA
SetFilePointerEx
DeviceIoControl
AreFileApisANSI
GetStringTypeExW
LCMapStringA
GetStringTypeExA
IsValidCodePage
IsDBCSLeadByteEx
EnumSystemLocalesA
FoldStringW
GetTimeFormatW
CreateProcessA
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetConsoleCtrlHandler
VirtualAlloc
WriteConsoleW
GetConsoleCP
ExitProcess
SystemTimeToTzSpecificLocalTime
FreeLibraryAndExitThread
GetACP
IsValidLocale
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
CreatePipe
FindFirstFileExW
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
VirtualFree
InterlockedPopEntrySList
QueryDepthSList
GetStringTypeA
??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_lock@singleton_module@serialization@boost@@CAAA_NXZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@SA_NXZ
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@SAXXZ
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?unlock@singleton_module@serialization@boost@@SAXXZ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ