F:\TemporaryBuilds\Azure_PDF_BUILD_KH-BUILD02\3\s\_bin\suite2021\Win32\PDFSuite2021Installer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-30_255eb197c972b1c9c59980e93ad5dc97_avoslocker_metamorfo_revil.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-30_255eb197c972b1c9c59980e93ad5dc97_avoslocker_metamorfo_revil.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-30_255eb197c972b1c9c59980e93ad5dc97_avoslocker_metamorfo_revil
-
Size
21.3MB
-
MD5
255eb197c972b1c9c59980e93ad5dc97
-
SHA1
e6a172c69e778e68b606ba904a0dca6a6daf730b
-
SHA256
da1d65215c6ddf52ecec95ff28ca5f8a6ea3b677adf0fe547d0cd9127ac97189
-
SHA512
7aa7a9428471ae6a853c22ec15532cb4565b1302379243602fde68df220918109b97389a35f4f48dac1b96c7bfa20fb792bdbe5bb1938a4d630c9aee9040b3a5
-
SSDEEP
196608:u1wAT/Y/rja3K6RHUsvp2fA0rqNb3aUQGXAXCSxgJy:uO3PaWfzrqNbq/GXATx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-30_255eb197c972b1c9c59980e93ad5dc97_avoslocker_metamorfo_revil
Files
-
2024-05-30_255eb197c972b1c9c59980e93ad5dc97_avoslocker_metamorfo_revil.exe windows:5 windows x86 arch:x86
65a603fdc32eed194c86af51cc334e46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
CreateEventA
SetEvent
CreateDirectoryW
RemoveDirectoryW
WaitForSingleObjectEx
GetCurrentThreadId
GetCurrentProcess
LocalAlloc
LocalFree
GetDriveTypeW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCommandLineW
GetLastError
RaiseException
GetModuleHandleW
GetProcAddress
DecodePointer
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
CreateThread
WaitForSingleObject
CreateEventW
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetModuleFileNameW
GetFileSize
ReadFile
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
OutputDebugStringW
SetUnhandledExceptionFilter
InterlockedExchange
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteFileW
SetFileAttributesW
GetFullPathNameW
GetVersionExW
WriteFile
CopyFileW
CreateProcessW
FindFirstFileW
FindNextFileW
FindClose
Sleep
CreateMutexW
ReleaseMutex
LoadLibraryW
FreeLibrary
ReleaseSemaphore
CreateSemaphoreA
WaitForMultipleObjectsEx
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
QueryPerformanceCounter
QueryPerformanceFrequency
CreateMutexA
GetUserDefaultLCID
OpenProcess
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
IsWow64Process
GetExitCodeProcess
Process32FirstW
Process32NextW
GetModuleHandleA
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetModuleFileNameA
LoadLibraryExA
FormatMessageW
SetLastError
DuplicateHandle
TlsAlloc
WaitForMultipleObjects
TerminateThread
QueueUserAPC
InterlockedExchangeAdd
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
InterlockedCompareExchange
VerSetConditionMask
VerifyVersionInfoW
ProcessIdToSessionId
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
GetTickCount
GetStdHandle
OutputDebugStringA
GetTempPathA
GetWindowsDirectoryA
GetComputerNameA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetSystemTimeAsFileTime
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryW
GetFileAttributesW
lstrcpynW
SwitchToThread
UnmapViewOfFile
CreateFileMappingA
FormatMessageA
GlobalSize
LoadLibraryA
GetTempFileNameA
GetLocaleInfoA
FindResourceA
MulDiv
ExitThread
GetCPInfo
SetThreadLocale
GetNumberFormatW
GetCurrencyFormatW
GetSystemTime
GetLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
GetLocaleInfoW
GetDateFormatW
GetThreadLocale
GetVersionExA
SetEndOfFile
MapViewOfFile
FlushViewOfFile
CompareStringW
GetTempPathW
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
GetFileType
PeekNamedPipe
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentThread
GetThreadTimes
UnregisterWaitEx
VirtualProtect
VirtualQuery
GetWindowsDirectoryW
GetFileAttributesExW
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetStringTypeW
GetExitCodeThread
TryEnterCriticalSection
QueueUserWorkItem
EncodePointer
LCMapStringW
OpenEventA
ResumeThread
CreateWaitableTimerA
SetFilePointerEx
DeviceIoControl
AreFileApisANSI
GetStringTypeExW
LCMapStringA
GetStringTypeExA
IsValidCodePage
IsDBCSLeadByteEx
EnumSystemLocalesA
FoldStringW
GetTimeFormatW
CreateProcessA
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetConsoleCtrlHandler
VirtualAlloc
WriteConsoleW
GetConsoleCP
ExitProcess
SystemTimeToTzSpecificLocalTime
FreeLibraryAndExitThread
GetACP
IsValidLocale
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
CreatePipe
FindFirstFileExW
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
VirtualFree
InterlockedPopEntrySList
QueryDepthSList
GetStringTypeA
Exports
Exports
??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_lock@singleton_module@serialization@boost@@CAAA_NXZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@SA_NXZ
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@SAXXZ
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?unlock@singleton_module@serialization@boost@@SAXXZ
Sections
.text Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 222KB - Virtual size: 316KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13.2MB - Virtual size: 13.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 346KB - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ