D:\jkp\workspace\BCP_HSW\3941\PHBTW00290\src\ibt_win_src\06-host_sw\win\bin\setup\Release\Win32\WirelessSetup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-09_bbb1fe933f99217750cecf0201c7e280_avoslocker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-09_bbb1fe933f99217750cecf0201c7e280_avoslocker.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-09_bbb1fe933f99217750cecf0201c7e280_avoslocker
-
Size
3.9MB
-
MD5
bbb1fe933f99217750cecf0201c7e280
-
SHA1
bdb8afb7f2dc9541a965b5d9684dd8134f9666a7
-
SHA256
3a348796264f013874ad9ec449b4f39e3aac654ad136fde78b8a47ae9c9ce313
-
SHA512
87dfb076bc8a2ccb6a03fb54891b62a1041b3365d6bfd108885cef707c1204b396803ca27d50b7714f2c4161531c3ed72e56c32742489b13a4fbf995d43120ce
-
SSDEEP
98304:mmMNx5IBfO8B3u80nrki6YM3HhPouF/mqrWETR9b:NC3MFcne3HhPouFp9b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-07-09_bbb1fe933f99217750cecf0201c7e280_avoslocker
Files
-
2024-07-09_bbb1fe933f99217750cecf0201c7e280_avoslocker.exe windows:6 windows x86 arch:x86
c55ceca4509f7e2bb9ae16cb1999dc49
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FormatMessageW
LocalFree
Sleep
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileSectionW
CreateMutexW
GetLastError
CloseHandle
LocalAlloc
CreateFileW
SetDefaultDllDirectories
IsWow64Process
GetCurrentProcess
VerSetConditionMask
VerifyVersionInfoW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SizeofResource
LockResource
LoadResource
FindResourceW
CreateDirectoryW
CopyFileW
LoadLibraryW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
DeleteFileW
WaitForSingleObject
GetExitCodeProcess
GetCommandLineW
FreeLibrary
GetWindowsDirectoryW
SetCurrentDirectoryW
CreateProcessW
GetSystemDirectoryW
GetUserDefaultUILanguage
GetSystemDefaultLangID
lstrlenW
GetProcAddress
ExpandEnvironmentStringsW
GetLocalTime
SetFileAttributesW
MultiByteToWideChar
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
OutputDebugStringW
GetSystemInfo
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
OutputDebugStringA
SetLastError
FreeResource
GetModuleHandleA
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
GlobalAlloc
GlobalSize
WideCharToMultiByte
EncodePointer
GetCurrentThreadId
LoadLibraryExW
LoadLibraryA
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
SetEvent
CreateEventW
SetThreadPriority
SuspendThread
ResumeThread
GetCurrentThread
GetVersionExW
lstrcmpA
GetTickCount
GetPrivateProfileIntW
WritePrivateProfileStringW
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GlobalFlags
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GlobalGetAtomNameW
GetThreadLocale
GetLocaleInfoW
GetSystemDefaultUILanguage
lstrcpyW
GetCurrentDirectoryW
FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
WriteFile
DuplicateHandle
lstrcmpiW
FindResourceExW
GetFileAttributesW
SetErrorMode
GetFileAttributesExW
GetFileSizeEx
GetFileTime
GetTempPathW
GetProfileIntW
SearchPathW
GetTempFileNameW
GetUserDefaultLCID
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
SetEnvironmentVariableW
GetStringTypeW
SwitchToThread
LCMapStringW
GetCPInfo
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetCommandLineA
HeapQueryInformation
VirtualAlloc
QueryPerformanceFrequency
SetStdHandle
GetFileType
GetStdHandle
ExitProcess
IsValidLocale
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetFilePointerEx
GetDriveTypeW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 408KB - Virtual size: 407KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 716KB - Virtual size: 720KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE