c:\jenkins\workspace\Vendors\crashgen\windows\vendors\crashrpt\build\windows\Bin\MT_Release\zCrashReportExe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_430f643cbcee26b2975fa4c98f69dceb_avoslocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-02_430f643cbcee26b2975fa4c98f69dceb_avoslocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-02_430f643cbcee26b2975fa4c98f69dceb_avoslocker
-
Size
1.6MB
-
MD5
430f643cbcee26b2975fa4c98f69dceb
-
SHA1
adab4a6cce2de1e0f2e35257d3de897e482a3230
-
SHA256
f623f13f220e658e782c489a1970db4d9c6d380638718af52c0932432adc5067
-
SHA512
fc3fb2e0f587c16b37c79a4c9b0304cb97caf54d716feb41a10da546858b659bf8e9fb7b938048f7c441a9ada8dc9ae962dca9b47d9b6548e6f2288aca7f1df1
-
SSDEEP
24576:2wn/MiscfwQMpYWJg+im1IdrUYmPJE57gALkkT:2y/MiphMKW6DinYmhE57f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-02_430f643cbcee26b2975fa4c98f69dceb_avoslocker
Files
-
2024-06-02_430f643cbcee26b2975fa4c98f69dceb_avoslocker.exe windows:6 windows x86 arch:x86
b0f22a756b23c79c74671dd14883f904
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcess
GetModuleFileNameW
GetFileAttributesW
OpenProcess
MultiByteToWideChar
GetPrivateProfileStringW
Sleep
FormatMessageW
LockResource
GlobalFree
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
GetProcAddress
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
VirtualQueryEx
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
FindFirstFileW
GetFileSizeEx
GetFullPathNameW
FindNextFileW
FindClose
K32GetProcessImageFileNameW
K32GetProcessMemoryInfo
FileTimeToSystemTime
SetLastError
ReadProcessMemory
GetSystemTime
GetProcessTimes
GetCommandLineW
GetCurrentThreadId
lstrcmpiW
LoadLibraryExW
ReadFile
WriteFile
TerminateProcess
CreateMutexW
MapViewOfFile
Process32NextW
Process32FirstW
CreateThread
VerSetConditionMask
GetCurrentProcessId
GlobalMemoryStatusEx
CreateProcessW
VerifyVersionInfoW
SizeofResource
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
IsDebuggerPresent
GetTimeZoneInformation
GetLocalTime
WritePrivateProfileStringW
DeleteCriticalSection
HeapDestroy
DecodePointer
GetSystemInfo
RaiseException
HeapReAlloc
GetLastError
HeapSize
UnmapViewOfFile
OpenFileMappingW
InitializeCriticalSectionEx
GetProcessHeap
HeapAlloc
CloseHandle
CreateFileW
HeapFree
SetEndOfFile
QueryPerformanceCounter
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind
GetStartupInfoW
CreateDirectoryW
OutputDebugStringW
InitializeSListHead
CreateToolhelp32Snapshot
WriteConsoleW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
GetSystemTimeAsFileTime
user32
IsWindow
EnumDisplayDevicesW
GetGuiResources
CharNextW
DestroyWindow
DefWindowProcW
SetProcessDefaultLayout
SendMessageW
PostMessageW
advapi32
RegDeleteValueW
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
RegCloseKey
RegOpenKeyExW
shell32
CommandLineToArgvW
ole32
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoInitialize
oleaut32
VarUI4FromStr
wintrust
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
crypt32
CertGetNameStringW
shlwapi
PathStripPathW
comctl32
InitCommonControlsEx
Sections
.text Size: 182KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE