risepro | 2024-06-06_f224664b3103e27a75f47497a977b767_avoslocker_magniber_metamorfo

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-06_f224664b3103e27a75f47497a977b767_avoslocker_magniber_metamorfo
Size 13.1MB
Sample240606-xpxepaae2s
SHA256 356b91d25d223c89ecd5b0dea1c0e0c747172d89108cc64d3d1cf9425f6dde52
MD5 f224664b3103e27a75f47497a977b767
SHA1 234cd3239115c94417439437dadf3630c52d67f1
SHA512 990a0f5ef2743835b2569e0ed1dd66c866732dd5b0a54074fa71ff905ecc7207c34af8dffb89724440dec831ca32dc40b5ec6b82ee7afbb5d38e7f8dcc6733d5
SSDEEP 196608:R16y1UicZXDmaEKCqtf6PaaLCtx+zFUlBbLrqNcaUQGXT2RKJ:Rrp0hUPaSfUBbLrqNl/GXjJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

File Explorer

2024-06-06_f224664b3103e27a75f47497a977b767_avoslocker_magniber_metamorfo

.exe 13.1MB

2024-06-06_f224664b3103e27a75f47497a977b767_avoslocker_magniber_metamorfo

IMPHASH 74e4bb90780ee33f1a5d9003c0c25c48
SHA256 356b91d25d223c89ecd5b0dea1c0e0c747172d89108cc64d3d1cf9425f6dde52
MD5 f224664b3103e27a75f47497a977b767
SHA1 234cd3239115c94417439437dadf3630c52d67f1
SHA512 990a0f5ef2743835b2569e0ed1dd66c866732dd5b0a54074fa71ff905ecc7207c34af8dffb89724440dec831ca32dc40b5ec6b82ee7afbb5d38e7f8dcc6733d5
SSDEEP 196608:R16y1UicZXDmaEKCqtf6PaaLCtx+zFUlBbLrqNcaUQGXT2RKJ:Rrp0hUPaSfUBbLrqNl/GXjJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

61:a4:2d:f0:dd:9e:8b:ad:86:13:88:a4:07:3d:28:0b:51:02:68:5f:60:06:b7:5e:9e:42:cd:2c:d0:8b:1c:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=727035-6,CN=Avanquest Software (7270356 Canada Inc),O=Avanquest Software (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

Sep 1, 2023

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

Serial Number

11:03:be:35:d4:e1:07:3e:40:02:1f:eb:7b:5f:03:2d

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 18, 2021 - Nov 18, 2023

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7100256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\azure-installer-pool-de-1\21\s\Installer\_bin\soda\Win32\SodaPDFDesktop14.pdb

msi

ord14 ord111 ord43 ord168 ord70 ord205 ord118 ord117 ord141 ord160 ord159 ord45 ord32 ord92 ord88 ord137 ord8

kernel32

GetEnvironmentVariableA GetSystemDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP EnumSystemLocalesW IsValidLocale GetConsoleOutputCP SetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList RtlUnwind HeapFree InitializeCriticalSectionEx HeapSize FormatMessageW GetLastError SetEvent HeapReAlloc CloseHandle HeapAlloc DecodePointer HeapDestroy LocalFree DeleteCriticalSection GetProcessHeap WideCharToMultiByte FormatMessageA CreateEventA GetCurrentProcess LocalAlloc GetTickCount QueryPerformanceCounter QueryPerformanceFrequency GetDriveTypeW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetModuleFileNameW GetCommandLineW GetUserDefaultLCID GetStringTypeExW LCMapStringW LoadLibraryA FreeLibrary GetProcAddress GetModuleHandleW Sleep WaitForSingleObject RaiseException GetCurrentThreadId CreateEventW CreateThread MultiByteToWideChar SizeofResource LockResource LoadResource FindResourceW TerminateProcess OutputDebugStringW GetCurrentProcessId GetFileSize ReadFile CreateFileW SetUnhandledExceptionFilter GetLogicalDriveStringsW GetStringTypeExA LCMapStringA GetFullPathNameW SetFileAttributesW DeleteFileW CopyFileW FindFirstFileW FindNextFileW FindClose WaitForSingleObjectEx ReleaseMutex CreateMutexW LoadLibraryW ReleaseSemaphore CreateSemaphoreA WaitForMultipleObjectsEx lstrcmpiW LoadLibraryExW CreateDirectoryW RemoveDirectoryW MoveFileExW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW UpdateResourceA GlobalAlloc GlobalLock GlobalUnlock GlobalFree ProcessIdToSessionId GetModuleFileNameA LoadLibraryExA OpenProcess TlsAlloc InitializeCriticalSectionAndSpinCount WaitForMultipleObjects TerminateThread QueueUserAPC SleepEx PostQueuedCompletionStatus SetWaitableTimer GetQueuedCompletionStatus VerSetConditionMask VerifyVersionInfoW TlsGetValue TlsSetValue TlsFree DuplicateHandle GetSystemTime GetLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetLocaleInfoW ResetEvent CreateSemaphoreW ResumeThread GetComputerNameW CompareStringW CompareStringA GetNumberFormatW GetCurrencyFormatW GetSystemDefaultLCID MulDiv GetTempPathA GetTempFileNameA GlobalSize AllocConsole DebugBreak SetErrorMode GetModuleHandleA SetEndOfFile SetFilePointer CreateFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile ExitProcess GetFileAttributesW LocalSize lstrlenW GetCPInfo GetEnvironmentVariableW SetHandleInformation CancelIo RegisterWaitForSingleObject UnregisterWait GetFileType GetConsoleMode FlushFileBuffers WriteFile ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW WaitNamedPipeW GetNamedPipeHandleStateW SwitchToThread GetCurrentThread QueueUserWorkItem CreateNamedPipeA CreateFileA GetNumberOfConsoleInputEvents ReadConsoleInputW ReadConsoleW WriteConsoleW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW SetConsoleCtrlHandler GetCurrentDirectoryW GetExitCodeProcess CreateProcessW UnregisterWaitEx CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetFileInformationByHandle SetFilePointerEx SetFileTime DeviceIoControl CreateHardLinkW GetLongPathNameW GetShortPathNameW ReadDirectoryChangesW SetEnvironmentVariableW GetTempPathW GetSystemInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetVolumeInformationW GetStdHandle GetStartupInfoW VirtualAlloc VirtualFree lstrcmpW SetThreadPriority GetThreadPriority GetVersionExW VirtualProtect CreateIoCompletionPort InitializeSListHead UnhandledExceptionFilter VirtualQuery GetSystemTimeAsFileTime IsValidCodePage CompareStringEx LCMapStringEx EncodePointer InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns WakeConditionVariable InitializeConditionVariable GetExitCodeThread GetLocaleInfoEx CreateSymbolicLinkW GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle FindFirstFileExW TryAcquireSRWLockExclusive GetStringTypeW IsDebuggerPresent GetTickCount64 GetWindowsDirectoryW GetDiskFreeSpaceExW Module32NextW Module32FirstW K32GetModuleFileNameExW IsWow64Process MapViewOfFileEx CreateFileMappingA lstrcpynW GetFileTime GetFileSizeEx GetFileAttributesExW CreateWaitableTimerA OpenEventA SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock FoldStringW EnumSystemLocalesA GetLocaleInfoA IsDBCSLeadByteEx SystemTimeToTzSpecificLocalTime

winspool.drv

ord203

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

gdiplus

GdiplusStartup GdiplusShutdown GdipDeleteFontFamily GdipGetEmHeight GdipGetCellAscent GdipGetLineSpacing GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipGetFontSize GdipCreateBitmapFromGraphics GdipCreateHBITMAPFromBitmap GdipDrawImageI GdipDrawDriverString GdipBeginContainer2 GdipSetClipRectI GdipSetClipRect GdipDrawImageRectRect GdipFillPath GdipFillPie GdipFillEllipse GdipFillRectanglesI GdipSetPageUnit GdipGetWorldTransform GdipFillRectangleI GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawPie GdipDrawEllipse GdipDrawRectangle GdipRestoreGraphics GdipTranslateWorldTransform GdipMultiplyWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipGetSmoothingMode GdipSetSmoothingMode GdipSetCompositingQuality GdipDeleteGraphics GdipDrawArc GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipSaveGraphics GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipSetPenMiterLimit GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen2 GdipCreatePen1 GdipSetPathGradientTransform GdipSetPathGradientWrapMode GdipSetPathGradientPresetBlend GdipSetPathGradientCenterPoint GdipCreatePathGradientFromPath GdipMultiplyLineTransform GdipSetLineWrapMode GdipSetLinePresetBlend GdipCreateLineBrush GdipCreateSolidFill GdipCreateTexture GdipDeleteBrush GdipCloneBrush GdipGetMatrixElements GdipShearMatrix GdipRotateMatrix GdipScaleMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix2 GdipCreateMatrix GdipIsVisiblePathPoint GdipGetPathWorldBounds GdipAddPathRectangleI GdipAddPathArcI GdipAddPathLineI GdipAddPathEllipse GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipResetPath GdipDeletePath GdipClonePath GdipCreatePath GdipFree GdipAlloc GdipEndContainer GdipCreateBitmapFromScan0 GdipGetClipBoundsI GdipDrawLine GdipCreateFromHWND GdipTransformPoints

uxtheme

OpenThemeData CloseThemeData DrawThemeBackground SetWindowTheme IsThemeBackgroundPartiallyTransparent GetThemePartSize

usp10

ScriptItemize ScriptShape ScriptPlace ScriptApplyDigitSubstitution ScriptBreak ScriptFreeCache

??0?$codecvt_null@_W@archive@boost@@QAE@I@Z ??0?$singleton@V?$extended_type_info_typeid@UAppMdiData@?A0x9fec0d0d@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@Vdate@gregorian@boost@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@Vptime@posix_time@boost@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@serialization@boost@@@serialization@boost@@IAE@XZ ??1?$codecvt_null@_W@archive@boost@@UAE@XZ ??_F?$codecvt_null@_W@archive@boost@@QAEXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EBE_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UAppMdiData@?A0x9fec0d0d@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UAppMdiData@?A0x9fec0d0d@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vdate@gregorian@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vdate@gregorian@boost@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vptime@posix_time@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vptime@posix_time@boost@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@UAppMdiData@?A0x9fec0d0d@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@UAppMdiData@?A0x9fec0d0d@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_lock@singleton_module@serialization@boost@@AAEAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QAE_NXZ ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@UAppMdiData@?A0x9fec0d0d@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AAEAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QAEXXZ ?unlock@singleton_module@serialization@boost@@QAEXXZ

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-06_f224664b3103e27a75f47497a977b767_avoslocker_magniber_metamorfo

msi

kernel32

winspool.drv

userenv

gdiplus

uxtheme

usp10

generic