\\cpbufs\transfer\aataneja\ReaderPOC\ReaderSolution\ReaderPOC\Release\ReaderPOC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-03_206936ca4d19a105b5b784db602ea640_avoslocker.exe
Resource
win7-20240708-en
General
-
Target
2024-08-03_206936ca4d19a105b5b784db602ea640_avoslocker
-
Size
1.3MB
-
MD5
206936ca4d19a105b5b784db602ea640
-
SHA1
3e3a4f73c29ec49e5ac608f9d1d9c7cc633863f2
-
SHA256
89c33ddff687153ad8d5da064bc11581bb317e0c82dc3ee6b0bffb1ef6166f62
-
SHA512
dac21a9e838c422156e6d5a2b80ad25e6ccd2699e2b22dc5d5cf3a2c4f8573f8202cb71fd5cf6e06baffa90567e661348a956590fc0d8cdac5f85a3df5dd33ca
-
SSDEEP
24576:e2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedhHofe3y1sInB2COzRq8DvFqt:ePtjtQiIhUyQd1SkFdlP4suIRbDv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-03_206936ca4d19a105b5b784db602ea640_avoslocker
Files
-
2024-08-03_206936ca4d19a105b5b784db602ea640_avoslocker.exe windows:6 windows x86 arch:x86
99779933d13e7f3a0c46176caa0baa44
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msi
ord205
ord70
kernel32
CreateFileMappingA
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
GetVersionExA
LoadLibraryA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
LocalFree
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
InterlockedCompareExchange
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
DecodePointer
FindNextFileW
GetModuleFileNameW
FindClose
GetCurrentProcess
CreateEventW
GetModuleHandleW
TlsSetValue
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
TlsGetValue
GetTickCount
FlushFileBuffers
GetLastError
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
TlsFree
EncodePointer
GetFullPathNameW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileSizeEx
GetFileType
GetModuleHandleExW
ExitProcess
GetStdHandle
LoadLibraryExW
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
GetStringTypeW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
CompareStringW
advapi32
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetFolderPathW
SHCreateDirectoryExW
SHGetFolderPathAndSubDirW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetSpecialFolderPathW
ole32
CoTaskMemFree
CoCreateInstance
CoCreateGuid
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoInitialize
StringFromGUID2
OleRun
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantCopy
GetErrorInfo
VariantInit
shlwapi
PathFileExistsA
PathAppendW
PathFileExistsW
PathIsDirectoryW
Sections
.text Size: 606KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 588KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE