C:\workspace\_bin\Win32\Release\SophosUpdate\ALSvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-20_19fab49cf5aa8b012d6b776ca653004b_avoslocker.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-20_19fab49cf5aa8b012d6b776ca653004b_avoslocker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-20_19fab49cf5aa8b012d6b776ca653004b_avoslocker
-
Size
1.3MB
-
MD5
19fab49cf5aa8b012d6b776ca653004b
-
SHA1
622740a7bfa7742da737d7fb0cafc5d28dc75aa8
-
SHA256
7d4d0902d0e761f824a390b584a8eb57692120841257410105e445357cea4cf5
-
SHA512
754f97293c42819aad97b9924312b07ee82dfdcc9c6d4287b449d34f9a9c8ade5d9d09aaf5ab533ff70348134f492cb3edbaabd3e8798cdc45579a70f7ac0d81
-
SSDEEP
24576:C2S5OSowD0DYvVLxEhKim1P2RGC00qVpOkpufGUay0KEfGHBC2U1QxgNEOBgaf:eD0DWx6KP2RGCT8JuGUa4Ef6JU1QxwZd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-20_19fab49cf5aa8b012d6b776ca653004b_avoslocker
Files
-
2024-08-20_19fab49cf5aa8b012d6b776ca653004b_avoslocker.exe windows:6 windows x86 arch:x86
4895d500d79a8dfb8fbf4dce8a49a1ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapReAlloc
RaiseException
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
GetCommandLineW
GetCurrentProcess
WaitForMultipleObjects
GetCurrentThreadId
CreateEventW
SetEvent
GetCurrentThread
LockResource
CloseHandle
FindResourceExW
VerSetConditionMask
WideCharToMultiByte
VerifyVersionInfoW
CreateMutexW
ResetEvent
CreateProcessW
GetExitCodeProcess
GetEnvironmentStringsW
GetCommandLineA
GetLastError
GetACP
IsValidCodePage
SetStdHandle
GetTimeZoneInformation
ReadConsoleW
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ExitProcess
GetModuleHandleExW
ExitThread
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
HeapSize
MultiByteToWideChar
InitializeCriticalSectionEx
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
HeapFree
GetOEMCP
SizeofResource
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
LocalFree
GetVersionExW
IsWow64Process
GetFileSizeEx
GetStdHandle
WriteFile
CreateFileW
Sleep
GetConsoleMode
WriteConsoleW
MoveFileExW
ReplaceFileW
GetCurrentProcessId
ReadFile
OpenProcess
SetProcessWorkingSetSize
GetPrivateProfileStringW
SetEnvironmentVariableW
FindClose
FreeEnvironmentStringsW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
IsDebuggerPresent
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageA
TryEnterCriticalSection
CreateDirectoryW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
GetTempPathW
AreFileApisANSI
CopyFileW
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
GetStringTypeW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualAlloc
VirtualFree
user32
CharNextW
RegisterWindowMessageW
PostThreadMessageW
GetMessageW
MessageBoxW
DispatchMessageW
LoadStringW
ole32
CoRevokeClassObject
CoTaskMemFree
CoTaskMemRealloc
CoInitialize
StringFromGUID2
CoUninitialize
CoCreateInstance
CoRegisterClassObject
CoInitializeSecurity
CoTaskMemAlloc
oleaut32
RegisterTypeLi
LoadRegTypeLi
VariantInit
LoadTypeLi
UnRegisterTypeLi
SysAllocString
SysStringLen
VariantClear
VarUI4FromStr
SysFreeString
iphlpapi
GetAdaptersAddresses
shell32
CommandLineToArgvW
SHGetFolderPathW
Sections
.text Size: 524KB - Virtual size: 523KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 604KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE