D:\gocart-client-build\win-intel\build\gocartclient\public\gcInstaller\binaries\windows\release\AdobeGenuineInstaller.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-01_36ca294b76cb449c0ffdd1383f79ea79_avoslocker_revil.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-01_36ca294b76cb449c0ffdd1383f79ea79_avoslocker_revil.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-01_36ca294b76cb449c0ffdd1383f79ea79_avoslocker_revil
-
Size
4.3MB
-
MD5
36ca294b76cb449c0ffdd1383f79ea79
-
SHA1
2a257182a9f471677f7c837b7820ed89c6e9a9bc
-
SHA256
1742d1e3be050beb7abf8d7015ef2966e6dbe858d9a8acc885d20ea04f68f580
-
SHA512
b2c434cb2fc5e35394bd7eb63194a92d77257ff9e22b8a75b05cba67dc97a1aa41744daafb177aadb296eb3b37b0845f54f244f526da8c0543dd5ec018af8261
-
SSDEEP
98304:v+AUB75ZF+/ry4kcir45i68SVK1zU8uP/E3Xc:v8ZyryXcaZbqG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-01_36ca294b76cb449c0ffdd1383f79ea79_avoslocker_revil
Files
-
2024-06-01_36ca294b76cb449c0ffdd1383f79ea79_avoslocker_revil.exe windows:5 windows x86 arch:x86
39db7103b9ee8c0183bcb630933cd209
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
RpcStringFreeW
UuidToStringW
shell32
SHGetKnownFolderPath
SHGetPathFromIDListW
SHGetFolderLocation
SHGetFolderPathW
SHCreateDirectoryExW
CommandLineToArgvW
shlwapi
PathFileExistsW
PathRemoveFileSpecW
PathRemoveExtensionW
PathAddExtensionW
PathIsFileSpecW
PathAppendW
PathIsDirectoryW
PathRenameExtensionW
PathRemoveBackslashW
PathFindExtensionW
PathFindFileNameW
PathStripPathW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winhttp
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetOption
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpQueryAuthSchemes
WinHttpSetTimeouts
kernel32
WideCharToMultiByte
FindClose
FindFirstFileW
FindNextFileW
SetLastError
CopyFileA
GetFileAttributesW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTime
OpenProcess
SystemTimeToFileTime
GetEnvironmentVariableA
QueryPerformanceCounter
QueryPerformanceFrequency
GetTempPathW
GetModuleHandleExW
WaitForMultipleObjects
GlobalFree
ReadConsoleInputW
ResumeThread
TerminateProcess
GetCurrentProcess
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
RaiseException
DuplicateHandle
DecodePointer
CreateDirectoryW
SetEnvironmentVariableW
GetEnvironmentVariableW
lstrlenW
lstrcmpW
lstrcmpA
CopyFileW
GetModuleFileNameW
SetErrorMode
GetCommandLineW
LocalFree
LocalAlloc
Sleep
CreateNamedPipeW
PeekNamedPipe
ConnectNamedPipe
GetLastError
CloseHandle
WriteFile
ReadFile
CreateFileW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
TerminateThread
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MultiByteToWideChar
SetInformationJobObject
AssignProcessToJobObject
SetConsoleMode
SetStdHandle
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
GetFileTime
DosDateTimeToFileTime
lstrcatW
LocalFileTimeToFileTime
SetFileTime
FlushConsoleInputBuffer
CreateJobObjectW
RemoveDirectoryW
GetTickCount
IsValidLocale
SetFilePointerEx
ReadConsoleW
CreateThread
GetConsoleMode
GetConsoleCP
FreeLibraryAndExitThread
ExitThread
MoveFileExW
SetConsoleCtrlHandler
ExitProcess
GetACP
GetStringTypeW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
LoadLibraryExW
InterlockedPushEntrySList
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
OutputDebugStringA
FreeLibrary
GetProcAddress
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
CreateSemaphoreW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
ReleaseSemaphore
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetStdHandle
GetFileType
GetModuleHandleA
SetFilePointer
GetCurrentThread
GetTimeZoneInformation
LoadLibraryA
GlobalMemoryStatus
GetFileSizeEx
CreateMutexW
ReleaseMutex
OpenMutexW
GetModuleHandleW
ResetEvent
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTimeAsFileTime
GetFileSize
LockFileEx
CreateFileMappingA
UnlockFile
HeapCompact
GetSystemInfo
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapValidate
UnmapViewOfFile
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
AreFileApisANSI
LCMapStringW
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
advapi32
StartServiceW
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
RevertToSelf
CreateProcessAsUserW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
CopySid
OpenThreadToken
ReportEventA
RegisterEventSourceA
DeregisterEventSource
GetNamedSecurityInfoW
SetThreadToken
ConvertSecurityDescriptorToStringSecurityDescriptorW
MakeAbsoluteSD
CreateWellKnownSid
QueryServiceStatus
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
SetNamedSecurityInfoW
GetExplicitEntriesFromAclW
ConvertStringSidToSidW
ConvertSidToStringSidA
QueryServiceStatusEx
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
EnumDependentServicesW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
LookupPrivilegeValueW
SetTokenInformation
SetSecurityDescriptorSacl
InitializeAcl
GetTokenInformation
GetSecurityDescriptorDacl
GetLengthSid
GetFileSecurityW
GetAclInformation
GetAce
FreeSid
EqualSid
DuplicateTokenEx
CreateRestrictedToken
AddMandatoryAce
OpenProcessToken
AllocateAndInitializeSid
ole32
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
SysAllocStringByteLen
SysStringByteLen
VariantTimeToSystemTime
SysStringLen
VariantInit
setupapi
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
crypt32
CryptMsgGetParam
CertCloseStore
CryptDecodeObject
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertFindCertificateInStore
CryptMsgClose
wintrust
WinVerifyTrust
Exports
Exports
AGDServiceAllKeysInSubDomain
AGDServiceConvertAGDStatusTypeEnumToString
AGDServiceCountKeysInSubDomain
AGDServiceRemoveAllKeysInSubDomain
AGDServiceRemoveKeyInSubDomain
AGDServiceSetMultipleValueForKeyInSubDomain
AGDServiceSetValueForKeyInSubDomain
AGDServiceValueForKeyInSubDomain
AGDTruncateAdobeGenuineDataTable
CCDGetNGLAppID
CCDServiceSetAllRecords
CCDTruncateCCDataTable
IAL_CloseSession
IAL_CreateSession
IAL_DownloadAdobeGCClientFromPath
IAL_FetchRulesForLEIDs
IAL_GetAdobeGCClientAppDownloadPath
IAL_GetClientConfiguration
IAL_GetServerURLFromDispatch
IAL_GetVersion
IAL_PostRulesForLEIDs
IAL_SendCheckPatch
IAL_SendEventToETSHostfileMod
IAL_SendInAppEvents
IAL_SendMachineEvents
IAL_SendNotifAuditEvents
IAL_SendPHEvents
IAL_SendPatchAudit
IAL_SendUninstallationStatus
IAL_SetLoggingMethod
IAL_SetProxyDetails
LEDGetCachedGMEpoch
LEDServiceGetAllRecords
LEDServiceRecordEvent
LEDTruncateGCDataTable
NADServiceGetAllRecords
NADServiceRecordEvent
NADTruncateTable
RSDConvertPCDStatusTypeEnumToString
RSDServiceGetAllRecords
RSDServiceRecordStatus
RSDTruncateGCDataTable
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 575KB - Virtual size: 574KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 245KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 792KB - Virtual size: 796KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE