Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_98c85d9783f89b6e39c8a90954a9cbb2_avoslocker.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-12_98c85d9783f89b6e39c8a90954a9cbb2_avoslocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_98c85d9783f89b6e39c8a90954a9cbb2_avoslocker
-
Size
10.9MB
-
MD5
98c85d9783f89b6e39c8a90954a9cbb2
-
SHA1
7c737259d2739db4635ae62fe7243548704a7794
-
SHA256
0692851b51c71e4c56d0c3542bd016033d09f7d460e020da19d7815c30afa5fe
-
SHA512
0eaf1a5fe4f6d58c2bd507f116d5091ec70ac61a824bdb42ca4859b9d433c1f3e5484ae64a465dedd4d8dde8eb5576fadda76ca9710e857c0a78a564879e26dd
-
SSDEEP
196608:yGTIk+6d6Z6w6c6HGQnMkhgJuP32+dmhZk/b:PjJ0onbH5nHS+28
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-12_98c85d9783f89b6e39c8a90954a9cbb2_avoslocker
Files
-
2024-06-12_98c85d9783f89b6e39c8a90954a9cbb2_avoslocker.exe windows:0 windows x86 arch:x86
1f22031915ea6a9f1423d217b30bce72
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
AllocateUserPhysicalPages
AttachConsole
BeginUpdateResourceW
CheckNameLegalDOS8Dot3W
CreateActCtxW
CreateFiber
CreateFileA
CreateFileMappingA
CreateFileW
CreateMemoryResourceNotification
CreateTapePartition
CreateWaitableTimerW
DeactivateActCtx
DeleteCriticalSection
DeleteTimerQueue
DnsHostnameToComputerNameW
EnumCalendarInfoExA
EnumDateFormatsW
EnumSystemCodePagesA
EnumerateLocalComputerNamesW
ExpungeConsoleCommandHistoryA
FatalAppExitW
FatalExit
FillConsoleOutputCharacterW
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstFileW
FindFirstVolumeMountPointA
FindNextChangeNotification
FindNextVolumeA
FindResourceExA
FindResourceExW
FindVolumeMountPointClose
GetAtomNameW
GetCPInfoExW
GetCalendarInfoA
GetComputerNameA
GetConsoleAliasW
GetConsoleCommandHistoryLengthW
GetConsoleCommandHistoryW
GetConsoleFontSize
GetCurrencyFormatA
GetCurrentDirectoryW
GetDriveTypeA
GetEnvironmentStringsA
GetFileSize
GetLogicalDriveStringsW
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetNextVDMCommand
GetPrivateProfileIntW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProfileSectionA
GetProfileStringW
GetQueuedCompletionStatus
GetSystemWow64DirectoryA
GetTapeStatus
GetThreadContext
GetThreadLocale
GetThreadPriority
GetThreadPriorityBoost
GetVolumePathNamesForVolumeNameW
GlobalAddAtomW
GlobalAlloc
HeapCompact
HeapQueryInformation
InitializeCriticalSectionAndSpinCount
InterlockedPushEntrySList
IsBadWritePtr
IsValidLocale
LCMapStringW
LZCloseFile
LZCopy
LZOpenFileW
LZSeek
LoadLibraryA
LoadLibraryExA
LoadLibraryW
LocalLock
MapUserPhysicalPagesScatter
Module32FirstW
MoveFileW
NlsConvertIntegerToString
OpenDataFile
OpenEventW
OpenJobObjectA
OpenMutexA
OpenWaitableTimerA
PostQueuedCompletionStatus
PulseEvent
QueryDepthSList
QueryPerformanceFrequency
QueryWin31IniFilesMappedToRegistry
QueueUserAPC
RaiseException
RegisterConsoleIME
RegisterConsoleVDM
RegisterWaitForSingleObjectEx
ReleaseActCtx
RemoveDirectoryA
RestoreLastError
RtlMoveMemory
SetCalendarInfoW
SetComputerNameExA
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleKeyShortcuts
SetConsoleMode
SetConsoleTitleA
SetConsoleWindowInfo
SetEndOfFile
SetFileTime
SetFileValidData
SetHandleCount
SetInformationJobObject
SetLastError
SetNamedPipeHandleState
SetStdHandle
SetSystemTimeAdjustment
SetTapeParameters
SetThreadUILanguage
SetTimerQueueTimer
ShowConsoleCursor
SignalObjectAndWait
TerminateJobObject
TransactNamedPipe
TzSpecificLocalTimeToSystemTime
VDMConsoleOperation
VirtualAlloc
VirtualQueryEx
WaitForSingleObjectEx
WinExec
WriteConsoleInputA
WriteFileEx
WriteFileGather
WriteProcessMemory
_lcreat
lstrcmp
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ