2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil

General

Target
2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil
Size 6.0MB
Sample240616-lfnweayard
SHA256 3c34a8beaef3f8410fa26e6ac460ca13155fc6095b10277024fd7ff8c39f8415
MD5 4e4693c60003209053327a6f692a77d4
SHA1 342d78fb28169dd70a987ff95e1716fbbbb2cc68
SHA512 baeee6104846efc490e5062a5df171fe1e6ef8e84ab23abd5eb898fe6e091aed81ec1e8e7c863f68012f5398b69bb05a41eb727f421e526ae4bce6df4ef6f2ad
SSDEEP 98304:S3stJARnrlGCG8z1Anqn4UJw//4ENvIPpHdVorLu4TK/O4YPk6ZD5r:BjQnRT1MEzJ4vItor64Sa8k1r
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil

File Explorer

2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil

.exe 6.0MB

2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil

IMPHASH 670b6cb26854e68590fd27fb8d91b79d
SHA256 3c34a8beaef3f8410fa26e6ac460ca13155fc6095b10277024fd7ff8c39f8415
MD5 4e4693c60003209053327a6f692a77d4
SHA1 342d78fb28169dd70a987ff95e1716fbbbb2cc68
SHA512 baeee6104846efc490e5062a5df171fe1e6ef8e84ab23abd5eb898fe6e091aed81ec1e8e7c863f68012f5398b69bb05a41eb727f421e526ae4bce6df4ef6f2ad
SSDEEP 98304:S3stJARnrlGCG8z1Anqn4UJw//4ENvIPpHdVorLu4TK/O4YPk6ZD5r:BjQnRT1MEzJ4vItor64Sa8k1r
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2532471

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v12_i18n_202404_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

GetCommandLineW SetEnvironmentVariableW SetUnhandledExceptionFilter GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindResourceExW LoadResource LockResource SizeofResource FindResourceW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryA VerSetConditionMask CreateDirectoryW GetDiskFreeSpaceExW GetTempFileNameW GetTempPathW OutputDebugStringA CreateMutexW OpenMutexW GetExitCodeProcess OpenProcess GetSystemDirectoryA GetSystemDirectoryW GetVersionExW GetSystemWow64DirectoryW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte GetGeoInfoW GetUserGeoID CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetSystemTime LoadLibraryW GetSystemPowerStatus GetUserDefaultUILanguage GetSystemDefaultLCID GetUserDefaultLCID CreateFileW GetFileAttributesW GetFileSizeEx ReadFile GetCurrentProcess TerminateProcess GetCurrentThreadId GetProcessId GetDateFormatW GetFileInformationByHandle GetFileSize SetFilePointer WriteFile GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc VirtualFree DeleteFileW ExitProcess FreeResource lstrcpyW GetLocaleInfoW GetUserDefaultLangID DecodePointer RaiseException InitializeCriticalSectionAndSpinCount GetStdHandle GetEnvironmentVariableW GetFileType SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency MoveFileExA CompareFileTime GetEnvironmentVariableA PeekNamedPipe WaitForMultipleObjects SleepEx GetVersionExA ExpandEnvironmentStringsA GetWindowsDirectoryA GetACP GetCurrentDirectoryW MulDiv GlobalAlloc GlobalUnlock GlobalLock LocalFree SetFileTime DuplicateHandle DosDateTimeToFileTime GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA CreateFileA DeviceIoControl CreateThread GetPrivateProfileStringW lstrlenW ExpandEnvironmentStringsW GetCurrentThread ProcessIdToSessionId CreateProcessW GetLongPathNameW CreateEventW GetFileAttributesExW SetEvent ResetEvent ReleaseSemaphore CreateSemaphoreW SystemTimeToTzSpecificLocalTime ReleaseMutex OpenFileMappingW IsDebuggerPresent OutputDebugStringW GetStringTypeW TryEnterCriticalSection SwitchToThread EncodePointer GetCPInfo CompareStringW LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlUnwind GetCommandLineA ExitThread GetDriveTypeW SetConsoleCtrlHandler SetFilePointerEx GetConsoleCP GetTimeFormatW IsValidLocale EnumSystemLocalesW FlushFileBuffers GetFullPathNameW SetStdHandle SetEndOfFile GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW FormatMessageA LockFileEx UnlockFile HeapCompact DeleteFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI

curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_header curl_easy_init curl_easy_nextheader curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_global_trace curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_poll curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_multi_wakeup curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_url_strerror

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil

kernel32

generic