C:\workspace\HitmanPro.Alert\Alert\bin\Release\hmpalert.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-20_81616a7b2c99530b7d596db29e43c8db_avoslocker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-20_81616a7b2c99530b7d596db29e43c8db_avoslocker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-20_81616a7b2c99530b7d596db29e43c8db_avoslocker
-
Size
3.4MB
-
MD5
81616a7b2c99530b7d596db29e43c8db
-
SHA1
f7ba06aa8a85b210e802f88ca7d9e4e26c006d3c
-
SHA256
e100f1d1c636cc9745489e42c06bf4126d67d7f5607b9b8466292e03eb7c0691
-
SHA512
451d7530d93abad47fa416bbba6b2190ef8a80cc219f1c7173033122bb75e228b9ff8006e48c293dee609b9c92eb2527c3159aa7e5155a31945d832b08694eaf
-
SSDEEP
98304:w4D7ndXxK9EvxclAbDCs43oLJFeVu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996u:13ndXxK9pKmVu0VLGMb5Cx0taAUgLdpp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-20_81616a7b2c99530b7d596db29e43c8db_avoslocker
Files
-
2024-08-20_81616a7b2c99530b7d596db29e43c8db_avoslocker.exe windows:6 windows x86 arch:x86
5f507fc27893b77aa012931a5a9f450d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetWindowsDirectoryW
TryEnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleA
GetProcAddress
CloseHandle
DeviceIoControl
GetLastError
GetCurrentProcess
LocalFree
WideCharToMultiByte
WTSGetActiveConsoleSessionId
CreateEventW
WaitForSingleObject
CreateThread
SignalObjectAndWait
TerminateThread
FileTimeToSystemTime
SetEvent
GetSystemDirectoryW
SetThreadPriority
GetCurrentThread
Sleep
DuplicateHandle
CreateFileW
GetTickCount
OpenProcess
GetModuleHandleExW
CancelIo
FileTimeToLocalFileTime
CompareFileTime
ResetEvent
MultiByteToWideChar
CreateDirectoryW
GetCurrentProcessId
WaitForMultipleObjects
WaitForSingleObjectEx
GetOverlappedResult
GetLogicalDriveStringsW
QueryDosDeviceW
GetLongPathNameW
CreateTimerQueue
DeleteTimerQueueEx
CopyFileW
DeleteFileW
DeleteTimerQueueTimer
CreateTimerQueueTimer
ReadDirectoryChangesW
LoadLibraryA
FreeLibrary
LocalAlloc
ReadFile
GetFileInformationByHandle
GetDriveTypeW
RaiseException
InitializeCriticalSectionEx
GetModuleHandleW
DecodePointer
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetWindowsDirectoryA
LoadLibraryExA
VirtualQuery
VirtualProtect
LoadLibraryExW
GetSystemTime
WriteFile
SetLastError
CreateHardLinkW
OpenEventW
ProcessIdToSessionId
SetFilePointer
GlobalAlloc
GlobalFree
GetModuleFileNameW
GetTimeZoneInformation
GetVersionExW
GetNativeSystemInfo
CreateProcessW
CreateEventA
FindFirstFileW
FindNextFileW
FindClose
GetCurrentThreadId
GetSystemInfo
CreateIoCompletionPort
DisconnectNamedPipe
GetQueuedCompletionStatus
CreateNamedPipeW
ConnectNamedPipe
PeekNamedPipe
SetFileAttributesW
GetFileSize
GetLocalTime
CreatePipe
SetHandleInformation
GetStdHandle
GetFileAttributesW
FindResourceW
MulDiv
ConvertDefaultLocale
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
SystemTimeToFileTime
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
GetConsoleOutputCP
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
ExitProcess
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
GetTickCount64
ExitThread
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
QueryPerformanceFrequency
IsProcessorFeaturePresent
GetExitCodeThread
SwitchToThread
GetStringTypeW
GetEnvironmentVariableA
TransactNamedPipe
GetComputerNameA
LockFileEx
MoveFileExW
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
GetEnvironmentVariableW
VerifyVersionInfoW
VerSetConditionMask
GetFinalPathNameByHandleW
GetSystemWow64DirectoryW
GetModuleHandleExA
FreeResource
LockResource
LoadResource
TerminateProcess
WaitNamedPipeW
SetNamedPipeHandleState
VirtualFree
VirtualAlloc
GetConsoleMode
QueryPerformanceCounter
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
DeleteFileA
LoadLibraryW
HeapCompact
UnlockFile
SizeofResource
user32
BeginPaint
SetRect
FillRect
CopyRect
DrawTextW
KillTimer
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoW
GetDesktopWindow
GetWindowThreadProcessId
IsWindowEnabled
EnumWindows
GetClientRect
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
GetSystemMetrics
DefWindowProcW
GetWindowLongW
EnableWindow
SendMessageW
DestroyWindow
LoadCursorW
SetRectEmpty
TrackMouseEvent
CallWindowProcW
GetPropW
SetPropW
InvalidateRect
EndPaint
CreateWindowExW
RegisterClassW
GetClassInfoW
MoveWindow
ShowWindow
GetWindowRect
PtInRect
ScreenToClient
InflateRect
CharUpperW
ReleaseDC
GetDC
PostMessageW
SetTimer
MessageBoxW
RedrawWindow
CharUpperBuffW
CharLowerW
CharLowerBuffW
RegisterWindowMessageW
GetThreadDesktop
GetUserObjectInformationW
MonitorFromWindow
GetMonitorInfoW
SetLayeredWindowAttributes
IsDialogMessageW
SwitchDesktop
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
dbghelp
MiniDumpWriteDump
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 362KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 45KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 1024B - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 360KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 656KB - Virtual size: 660KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE