D:\rc_v12_i18n_202403_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-16_00b2401ad397fd1d24ad2e1cc43cada3_avoslocker_magniber_revil.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-16_00b2401ad397fd1d24ad2e1cc43cada3_avoslocker_magniber_revil.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-16_00b2401ad397fd1d24ad2e1cc43cada3_avoslocker_magniber_revil
-
Size
6.0MB
-
MD5
00b2401ad397fd1d24ad2e1cc43cada3
-
SHA1
bf39ed616075bb9c2548e8eaa403f8ec6582de42
-
SHA256
7cebd590ef4918a410d28dab997d87042ac37f1aff63e76bf47b5232c81666e9
-
SHA512
2ae69f8a8d2e00720b9bf2c6afdc37032c485d85181e1fbc531d00a40a0f6f4012d14290b054623b6a750330e577bbfe3f2efab09af553a442279b02a139d1da
-
SSDEEP
98304:tA3utc4HTUfGJeO3ADxzbWxbsTZlVkAh0YdtLltLvWf/WPk6ZD5r:auc4QjVHW+lVkAXLlFIW8k1r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-16_00b2401ad397fd1d24ad2e1cc43cada3_avoslocker_magniber_revil
Files
-
2024-06-16_00b2401ad397fd1d24ad2e1cc43cada3_avoslocker_magniber_revil.exe windows:5 windows x86 arch:x86
a2f9eb2060503865cc8ea051d42d3043
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCommandLineW
SetEnvironmentVariableW
SetUnhandledExceptionFilter
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
GetTickCount
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryA
VerSetConditionMask
CreateDirectoryW
GetDiskFreeSpaceExW
GetTempFileNameW
GetTempPathW
OutputDebugStringA
CreateMutexW
OpenMutexW
GetExitCodeProcess
CreateProcessW
OpenProcess
GetSystemDirectoryA
GetSystemDirectoryW
GetVersionExW
GetSystemWow64DirectoryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
VerifyVersionInfoW
MultiByteToWideChar
WideCharToMultiByte
GetGeoInfoW
GetUserGeoID
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcessId
GetSystemTime
LoadLibraryW
GetSystemPowerStatus
GetUserDefaultUILanguage
GetSystemDefaultLCID
GetUserDefaultLCID
CreateFileW
GetFileAttributesW
GetFileSizeEx
ReadFile
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetProcessId
GetDateFormatW
GetFileInformationByHandle
GetFileSize
SetFilePointer
WriteFile
GetLocalTime
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FileTimeToSystemTime
SystemTimeToFileTime
VirtualAlloc
VirtualFree
DeleteFileW
ExitProcess
FreeResource
lstrcpyW
GetLocaleInfoW
GetUserDefaultLangID
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GetStdHandle
GetEnvironmentVariableW
GetFileType
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FormatMessageW
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
QueryPerformanceFrequency
MoveFileExA
CompareFileTime
GetEnvironmentVariableA
PeekNamedPipe
WaitForMultipleObjects
SleepEx
GetVersionExA
ExpandEnvironmentStringsA
GetWindowsDirectoryA
GetACP
GetCurrentDirectoryW
MulDiv
GlobalAlloc
GlobalUnlock
GlobalLock
LocalFree
SetFileTime
DuplicateHandle
DosDateTimeToFileTime
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
CreateFileA
DeviceIoControl
CreateThread
GetPrivateProfileStringW
GetCurrentThread
ProcessIdToSessionId
CreateEventW
GetFileAttributesExW
SetEvent
ResetEvent
ReleaseSemaphore
CreateSemaphoreW
SystemTimeToTzSpecificLocalTime
ReleaseMutex
OpenFileMappingW
IsDebuggerPresent
OutputDebugStringW
GetStringTypeW
TryEnterCriticalSection
SwitchToThread
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
InterlockedPushEntrySList
RtlUnwind
GetCommandLineA
ExitThread
GetDriveTypeW
SetConsoleCtrlHandler
SetFilePointerEx
GetConsoleCP
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
FlushFileBuffers
GetFullPathNameW
SetStdHandle
SetEndOfFile
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
FormatMessageA
LockFileEx
UnlockFile
HeapCompact
DeleteFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnlockFileEx
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
Exports
Exports
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_header
curl_easy_init
curl_easy_nextheader
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_global_trace
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_url_strerror
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 799KB - Virtual size: 799KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 51KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 671KB - Virtual size: 671KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 728KB - Virtual size: 732KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE