2024-07-05_8f71761fb363a6d797bcd17feaacd26a_avoslocker

Sharing

Copy URL

Twitter E-mail

General

Target

2024-07-05_8f71761fb363a6d797bcd17feaacd26a_avoslocker
Size

5.1MB
MD5

8f71761fb363a6d797bcd17feaacd26a
SHA1

6ce7925e1c56ab3416b15e1c9f71496f822f8006
SHA256

6433894605c185b0a8e76545c9ce44a603f9d31f60a65e9cdbc9fd84d9bfdc20
SHA512

f47fa1ce4cce931dbb6818c72810f95497c36a13c385ab4f1b48bec05a11741b4b4f20f8e6fd74bc841cf61dc2291e9a456dec2c51d5ec19309d7558e07286af
SSDEEP

98304:g0lXWe8FREeLBrT6nrZjMyd5b85ijExqqyy/La5SWuzw+F+BI5xmpR+VBordFW7t:flXWe8FREeLBrTq5b85ijEE0KSNHFS+r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-05_8f71761fb363a6d797bcd17feaacd26a_avoslocker

Files

2024-07-05_8f71761fb363a6d797bcd17feaacd26a_avoslocker
.exe windows:6 windows x86 arch:x86

5fbc9a802e4ea515cd910ee7d6e7333b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\360Work\2.vpn_turbo\win_turbo\Release\TurboVPN.pdb

Imports

crypt32

CertCreateCertificateContext
PFXImportCertStore
CryptDecodeObjectEx
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertGetNameStringA
CertAddCertificateContextToStore
CryptStringToBinaryA
CertFreeCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CryptMsgClose
CertFindExtension

ws2_32

WSAStartup
ntohl
ntohs
setsockopt
gethostbyname
inet_addr
closesocket
recvfrom
sendto
htons
inet_ntop
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
shutdown
socket
WSACleanup
htonl
inet_pton
select
__WSAFDIsSet
WSAGetLastError
WSASocketW
recv
send
bind
connect
getpeername
getsockname
getsockopt
WSASetLastError
WSAIoctl
accept
listen
ioctlsocket
getaddrinfo
freeaddrinfo
inet_ntoa

shlwapi

SHDeleteValueW
SHSetValueW
SHGetValueW
PathAppendW
PathRemoveFileSpecW
PathFileExistsW

payment

WebExecuteScript
ConstructionEnv
WebNaviage
CreateBrowser

kernel32

LeaveCriticalSection
ReadFile
CreateFileW
DeviceIoControl
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
WriteFile
GetFileAttributesW
CreateFileA
GetVersionExW
lstrcmpA
FindNextFileW
GetTempPathW
FindClose
GlobalAlloc
GlobalFree
GlobalLock
MoveFileExW
GlobalUnlock
CreatePipe
VirtualFree
VirtualAlloc
SetFilePointer
GetFileSize
SleepEx
GetSystemDirectoryA
LoadLibraryA
VerifyVersionInfoA
WaitForSingleObjectEx
ExpandEnvironmentStringsA
FormatMessageA
GetFileSizeEx
lstrlenW
lstrcpynW
LocalAlloc
lstrcpyW
lstrcmpW
GetTickCount64
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
WriteConsoleA
GetDynamicTimeZoneInformation
GetConsoleMode
GetFileAttributesA
ResetEvent
ReleaseMutex
CreateMutexW
TryEnterCriticalSection
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCurrentDirectoryW
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileTime
GetLongPathNameW
GetTempFileNameW
RemoveDirectoryW
CopyFileW
MoveFileW
ReplaceFileW
GetUserDefaultLangID
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
IsDebuggerPresent
SetThreadPriority
SetUnhandledExceptionFilter
FlushFileBuffers
SetLastError
SetEndOfFile
SetFilePointerEx
SetFileTime
DuplicateHandle
GetModuleHandleExA
GetNativeSystemInfo
GetModuleHandleExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
UnregisterWaitEx
RegisterWaitForSingleObject
CreateSemaphoreA
ReleaseSemaphore
CreateMutexA
GetFullPathNameA
GetEnvironmentVariableA
LCIDToLocaleName
GetThreadLocale
MoveFileExA
WriteConsoleW
GetFullPathNameW
GetConsoleCP
ExitThread
GetTimeZoneInformation
PeekNamedPipe
GetDriveTypeW
FindFirstFileExW
RtlUnwind
QueryDepthSList
InterlockedFlushSList
VirtualProtect
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
UnhandledExceptionFilter
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
DosDateTimeToFileTime
GetFileType
GetACP
ExitProcess
LCMapStringW
CompareStringW
GetCPInfo
QueueUserWorkItem
IsProcessorFeaturePresent
EncodePointer
GetExitCodeThread
GetCurrentThread
SwitchToThread
GetStringTypeW
GetLocaleInfoA
CreateDirectoryW
CreateThread
TerminateProcess
GetCurrentProcess
MapViewOfFile
CreateFileMappingW
DeleteFileW
SetEvent
CreateEventW
GetLocaleInfoW
GetCurrentThreadId
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetCommandLineW
SystemTimeToFileTime
GetLocalTime
GetSystemDefaultLCID
GetTickCount
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
MultiByteToWideChar
FreeResource
SizeofResource
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
VerifyVersionInfoW
VerSetConditionMask
GetExitCodeProcess
GetSystemDirectoryW
Sleep
WinExec
GetWindowsDirectoryW
GetCurrentProcessId
LocalFree
OutputDebugStringW
FormatMessageW
ExpandEnvironmentStringsW
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetModuleFileNameW
CreateProcessW
WaitForSingleObject
InitializeCriticalSectionEx
GetProcessTimes
QueryFullProcessImageNameW
CloseHandle
OpenProcess
K32GetProcessImageFileNameW
CompareFileTime
MulDiv
GetProcessHeap
DeleteCriticalSection
GetProcAddress
DecodePointer
HeapAlloc
LoadLibraryW
RaiseException
IsValidCodePage
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ReadConsoleW
HeapFree
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
HeapReAlloc
EnterCriticalSection
GetFileInformationByHandle

user32

CreateCaret
SetRect
FillRect
DrawTextW
CharPrevW
GetPropW
SetPropW
RegisterClassW
OffsetRect
wvsprintfW
SetWindowRgn
IsZoomed
GetWindow
IsRectEmpty
UnionRect
ScreenToClient
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseCapture
SetCapture
GetKeyState
GetFocus
GetActiveWindow
CharNextW
IsIconic
GetMessageW
GetCaretPos
ClientToScreen
GetSysColor
SetWindowTextW
GetCaretBlinkTime
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
ShowCaret
EnableWindow
ReleaseDC
GetParent
GetDesktopWindow
UnregisterClassW
SetWindowPos
GetDC
GetWindowRect
MonitorFromPoint
SetFocus
KillTimer
FindWindowW
SetTimer
LoadImageW
GetSystemMetrics
RegisterWindowMessageW
PostMessageW
SendMessageW
SetForegroundWindow
GetMonitorInfoW
MonitorFromWindow
DestroyWindow
GetClientRect
SetWindowLongW
IntersectRect
MoveWindow
MapWindowPoints
ShowWindow
GetWindowTextW
HideCaret
GetWindowLongW
GetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
GetCursorPos
PtInRect
PostQuitMessage
SetCursor
LoadCursorW
SetCaretPos
IsWindow
MsgWaitForMultipleObjectsEx
GetQueueStatus
CallMsgFilterW
WaitMessage
CreateWindowExW
IsWindowVisible
PeekMessageW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DispatchMessageW
TranslateMessage
MessageBoxW
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
DefWindowProcW

gdi32

CreatePatternBrush
GdiFlush
ExtTextOutW
TextOutW
GetDeviceCaps
DeleteObject
GetObjectW
SetBkMode
DeleteDC
CreateCompatibleDC
CreateDIBSection
SelectObject
GetDIBits
CreateDCW
MoveToEx
SetTextColor
SetStretchBltMode
StretchBlt
SetBkColor
ExtSelectClipRgn
BitBlt
CreateCompatibleBitmap
CreateFontIndirectW
CreatePen
GetStockObject
Rectangle
RestoreDC
SaveDC
GetTextMetricsW
SetWindowOrgEx
CreateRoundRectRgn
GetObjectA
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
SelectClipRgn
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
GetCharABCWidthsW

comdlg32

GetOpenFileNameW

advapi32

RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
OpenServiceW
StartServiceW
ControlService
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey

shell32

SHCreateItemFromParsingName
ShellExecuteW
ShellExecuteA
Shell_NotifyIconW
SHGetKnownFolderPath
SHFileOperationW
CommandLineToArgvW
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
CoCreateGuid
CoTaskMemFree
StringFromGUID2
CoInitialize
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
OleLockRunning

oleaut32

SysFreeString
VariantClear
SysAllocString
VariantInit
SysStringLen
VariantChangeType

gdiplus

GdipBitmapUnlockBits
GdipCloneImage
GdipDrawImageRectRect
GdipGetImageHeight
GdipDisposeImage
GdiplusShutdown
GdiplusStartup
GdipGetImageWidth
GdipDeletePen
GdipCreatePen1
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipGetFamily
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipImageGetFrameDimensionsCount
GdipFree
GdipBitmapLockBits
GdipDeleteGraphics
GdipAlloc
GdipCreateFromHDC
GdipDrawLineI
GdipCreateBitmapFromScan0
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawImageRectRectI
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipCreateSolidFill
GdipSetStringFormatLineAlign
GdipGetImageGraphicsContext
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushI
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipGraphicsClear
GdipDrawImage
GdipDrawImageRectI

iphlpapi

InitializeIpForwardEntry
DeleteIpForwardEntry2
CreateIpForwardEntry2
ConvertInterfaceLuidToNameA
FreeMibTable
GetIpInterfaceTable
GetIpForwardTable2
SetIpForwardEntry
DeleteIpForwardEntry
CreateIpForwardEntry
GetInterfaceInfo
GetAdaptersInfo
IpReleaseAddress
GetTcpTable
NotifyIpInterfaceChange
SetIpInterfaceEntry
GetIpInterfaceEntry
GetAdaptersAddresses
NotifyUnicastIpAddressChange
GetIfTable
CancelMibChangeNotify2
InitializeIpInterfaceEntry
NotifyRouteChange2
GetBestInterface
IpRenewAddress
GetUnicastIpAddressTable

fwpuclnt

FwpmProviderContextAdd1
FwpmCalloutAdd0
FwpmCalloutDestroyEnumHandle0
FwpmTransactionAbort0
FwpmProviderContextEnum1
FwpmFreeMemory0
FwpmCalloutDeleteByKey0
FwpmFilterDeleteByKey0
FwpmTransactionBegin0
FwpmProviderDeleteByKey0
FwpmFilterEnum0
FwpmProviderContextDestroyEnumHandle0
FwpmEngineOpen0
FwpmFilterDestroyEnumHandle0
FwpmSubLayerDeleteByKey0
FwpmSubLayerGetByKey0
FwpmSubLayerAdd0
FwpmProviderContextDeleteByKey0
FwpmCalloutCreateEnumHandle0
FwpmTransactionCommit0
FwpmProviderGetByKey0
FwpmProviderAdd0
FwpmGetAppIdFromFileName0
FwpmProviderContextCreateEnumHandle0
FwpmFilterCreateEnumHandle0
FwpmFilterDeleteById0
FwpmFilterAdd0
FwpmCalloutEnum0
FwpmEngineClose0

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

rlottie

?loadFromData@Animation@rlottie@@SA?AV?$unique_ptr@VAnimation@rlottie@@U?$default_delete@VAnimation@rlottie@@@std@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@ABV54@1_N@Z
?totalFrame@Animation@rlottie@@QBEIXZ
?size@Animation@rlottie@@QBEXAAI0@Z
?duration@Animation@rlottie@@QBENXZ
?renderSync@Animation@rlottie@@QAEXIVSurface@2@_N@Z
??1Animation@rlottie@@QAE@XZ
??0Surface@rlottie@@QAE@PAIIII@Z

winsparkle

win_sparkle_set_langid
win_sparkle_init
win_sparkle_set_appcast_url
win_sparkle_set_http_header
win_sparkle_cleanup
win_sparkle_set_automatic_check_for_updates

wininet

InternetSetOptionW
InternetGetConnectedState
InternetQueryOptionW

netapi32

Netbios

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

sensapi

IsNetworkAlive

setupapi

CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

rasapi32

RasGetErrorStringW
RasGetEntryPropertiesW
RasValidateEntryNameW
RasDeleteEntryW
RasEnumConnectionsW
RasDialW
RasSetEntryPropertiesW
RasGetConnectStatusW
RasHangUpW

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

comctl32

_TrackMouseEvent
ord17

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionFontW
ImmSetCompositionWindow

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 626KB - Virtual size: 625KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5fbc9a802e4ea515cd910ee7d6e7333b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

ws2_32

shlwapi

payment

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

gdiplus

iphlpapi

fwpuclnt

rpcrt4

rlottie

winsparkle

wininet

netapi32

version

sensapi

setupapi

rasapi32

winmm

comctl32

imm32

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 626KB - Virtual size: 625KB

.data Size: 71KB - Virtual size: 131KB

.sxdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 3.3MB - Virtual size: 3.3MB

.reloc Size: 172KB - Virtual size: 171KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 626KB - Virtual size: 625KB

.data
Size: 71KB - Virtual size: 131KB

.sxdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

.reloc
Size: 172KB - Virtual size: 171KB