2024-06-11_947c1800b72e6f7cfc0d398a78193be9_avoslocker_floxif

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-11_947c1800b72e6f7cfc0d398a78193be9_avoslocker_floxif
Size

7.7MB
MD5

947c1800b72e6f7cfc0d398a78193be9
SHA1

9d861d3ec7428ae95a5a1f8762fdc8d2eecedb21
SHA256

489387cdbaee58f336f5b2ae628d8055a665cba6592b112928a75c938860eb0d
SHA512

595c179d6a3f79b5aeddeec886d1ce8c20d08934907799df4efebb636bad247c9b8d99f78a621e9207f368f483aaf87fda3d685007308bb43e66090fddbb687b
SSDEEP

98304:hWKF5ScKtWqhU4t0ipTQgn7yNncfZDQ4nRtojzU4bUuU1Vm+sxVs2B:hX5ScKvhU4tbygnO1cfxgwoD

Score

1^/10

Malware Config

Signatures

Files

2024-06-11_947c1800b72e6f7cfc0d398a78193be9_avoslocker_floxif
.exe windows:5 windows x86 arch:x86

1ec5f8e7ee2e86fad5c5364ac8fac8c6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:28:96:11:07:88:b1:29:82:5f:b1:d1:f6:ba:ac:a3
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29/04/2022, 00:00

Not After

01/05/2024, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:46:4f:8e:35:7a:fd:d1:e7:dc:48:cb:dc:84:35:33:54:30:e4:27:77:a6:93:60:ce:34:f9:b5:00:dd:b4:4a
Signer

Actual PE Digest

eb:46:4f:8e:35:7a:fd:d1:e7:dc:48:cb:dc:84:35:33:54:30:e4:27:77:a6:93:60:ce:34:f9:b5:00:dd:b4:4a

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins\workspace\ccd-hyperdrive\main\native\win32\build\msvs_win32\Release\x86\sym\HDBootStrapper\HDBootStrapper\Set-up.pdb

Imports

kernel32

FindFirstFileW
SetLastError
FindNextFileW
lstrlenW
RemoveDirectoryW
GetModuleFileNameW
GetTempPathW
FindClose
LocalAlloc
CreateFileW
GetFileAttributesW
SetFileAttributesW
FormatMessageW
GetLastError
GetDiskFreeSpaceExW
DeleteFileW
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
LocalFree
MoveFileExW
CopyFileW
lstrcmpiW
lstrcmpW
GetDriveTypeW
GetCurrentProcess
ReadFile
WaitForSingleObject
GetProcAddress
CreateProcessW
GetModuleHandleW
GetExitCodeProcess
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
Process32NextW
Process32FirstW
LoadLibraryW
FreeLibrary
WideCharToMultiByte
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetStdHandle
AttachConsole
FreeConsole
GetConsoleWindow
CreateMutexW
ReleaseMutex
GetSystemDirectoryW
SetDllDirectoryW
GetVersionExW
GetFullPathNameW
OpenMutexW
SetWaitableTimer
CreateWaitableTimerW
WaitForMultipleObjects
CancelWaitableTimer
CreateEventW
SetEvent
ResetEvent
GetOverlappedResult
ReadDirectoryChangesW
GetFileSizeEx
GetLocalTime
GetTimeFormatW
GetDateFormatW
SetHandleInformation
ExpandEnvironmentStringsW
DeviceIoControl
GetUserDefaultLangID
CreatePipe
GetComputerNameExW
FileTimeToSystemTime
GetNativeSystemInfo
GetWindowsDirectoryW
VerSetConditionMask
VerifyVersionInfoW
InitializeCriticalSection
GetCurrentProcessId
GetLocaleInfoA
EnumSystemLocalesW
GetUserDefaultUILanguage
GetACP
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
LoadLibraryA
LCMapStringW
GetUserDefaultLCID
SizeofResource
WriteFile
LockResource
LoadResource
FindResourceW
GetFileSize
FlushFileBuffers
GlobalFree
CreateThread
SetFilePointer
ProcessIdToSessionId
TerminateThread
FindResourceExW
QueryFullProcessImageNameW
GetFileInformationByHandle
CreateNamedPipeW
ConnectNamedPipe
CreateDirectoryW
ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreW
GetTimeZoneInformation
SystemTimeToFileTime
VirtualFree
VirtualAlloc
CreateFileA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
SetFilePointerEx
ResumeThread
SetThreadPriority
GetCurrentThread
GetStringTypeW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
GetExitCodeThread
GetLocaleInfoEx
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
SetStdHandle
ExitThread
FreeLibraryAndExitThread
ExitProcess
CompareStringW
GetLocaleInfoW
IsValidLocale
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
FindFirstFileExW
IsValidCodePage

ws2_32

getnameinfo
WSAStartup
WSACleanup

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1023KB - Virtual size: 1022KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 178KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 239KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ec5f8e7ee2e86fad5c5364ac8fac8c6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:28:96:11:07:88:b1:29:82:5f:b1:d1:f6:ba:ac:a3Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

eb:46:4f:8e:35:7a:fd:d1:e7:dc:48:cb:dc:84:35:33:54:30:e4:27:77:a6:93:60:ce:34:f9:b5:00:dd:b4:4aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 1023KB - Virtual size: 1022KB

.data Size: 178KB - Virtual size: 195KB

.rsrc Size: 2.6MB - Virtual size: 2.6MB

.reloc Size: 239KB - Virtual size: 238KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:28:96:11:07:88:b1:29:82:5f:b1:d1:f6:ba:ac:a3
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

eb:46:4f:8e:35:7a:fd:d1:e7:dc:48:cb:dc:84:35:33:54:30:e4:27:77:a6:93:60:ce:34:f9:b5:00:dd:b4:4a
Signer

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 1023KB - Virtual size: 1022KB

.data
Size: 178KB - Virtual size: 195KB

.rsrc
Size: 2.6MB - Virtual size: 2.6MB

.reloc
Size: 239KB - Virtual size: 238KB