X:\jenkins-workspace\workspace\client-builder-remoteieframe\ut_win\Build\Win32\Release\RemoteIEFrame.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-24_9fd1a2c864e3fe362ee2cba2e63c1814_avoslocker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-24_9fd1a2c864e3fe362ee2cba2e63c1814_avoslocker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-24_9fd1a2c864e3fe362ee2cba2e63c1814_avoslocker
-
Size
1.2MB
-
MD5
9fd1a2c864e3fe362ee2cba2e63c1814
-
SHA1
3f4d93e1ddfba2713875352ddff7f563b58f9fc2
-
SHA256
5554f7169ee95af3f8c7234b1dee6ef0872c6e6d98a542a78dbd56da89b0c3b5
-
SHA512
41820821f820f62fc6380af6d3025885d674f3648ba979f8f44d984ce4ecec37abc1626b7817413d02bf39a0190caa5410dbdedad9f7d1b748871a29d39ed4c4
-
SSDEEP
24576:nNtUWVFQrT54YLyHozcKVImVcO77+yhnF0PZPFAbFbGnqtbS2MdIuwe3zfIe7xm3:DUWVFQrT54YLyHozcKVImVcO77+yhnFN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-24_9fd1a2c864e3fe362ee2cba2e63c1814_avoslocker
Files
-
2024-08-24_9fd1a2c864e3fe362ee2cba2e63c1814_avoslocker.exe windows:6 windows x86 arch:x86
ab944e3f7f98089d9caea43eef9e2b23
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
urlmon
UrlMkSetSessionOption
kernel32
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
TerminateThread
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
LoadLibraryW
CreateThread
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
GetVolumeInformationA
GetCurrentProcess
LoadLibraryA
GetModuleFileNameW
GetDriveTypeW
GetModuleHandleA
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
ReadFile
VirtualAlloc
CreateFileW
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
VerSetConditionMask
VerifyVersionInfoW
ReleaseSemaphore
WriteFile
CreateNamedPipeW
DisconnectNamedPipe
CreateEventW
Sleep
CancelSynchronousIo
SetEvent
CancelIoEx
GetOverlappedResult
ConnectNamedPipe
FlushFileBuffers
LocalFree
ExitProcess
GlobalAlloc
GetFileSizeEx
GetCommandLineW
GetFileAttributesW
LoadLibraryExW
FreeLibrary
GetEnvironmentVariableW
LCMapStringEx
HeapSize
GetConsoleMode
GetConsoleOutputCP
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
CreateDirectoryW
GetLocaleInfoW
WriteConsoleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
RtlUnwind
InitializeSListHead
GetStartupInfoW
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetCPInfo
CompareStringEx
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
QueryPerformanceCounter
GetLocaleInfoEx
user32
BeginPaint
PostQuitMessage
EndPaint
TranslateMessage
DispatchMessageW
ShowWindow
DestroyWindow
PostMessageW
GetKeyState
DefWindowProcW
GetClientRect
GetMessageW
GetForegroundWindow
MoveWindow
GetParent
InvalidateRect
GetWindowLongW
GetWindowRect
LoadCursorA
SetWindowPos
CreateWindowExW
RegisterClassExW
TrackMouseEvent
FindWindowW
SetWindowLongW
PtInRect
GetCursorPos
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegGetValueW
shell32
SHGetSpecialFolderPathW
DragFinish
CommandLineToArgvW
DragQueryFileW
ole32
OleUninitialize
CoTaskMemAlloc
CoTaskMemFree
OleInitialize
CoCreateInstance
ReleaseStgMedium
OleSetContainedObject
OleCreate
CreateStreamOnHGlobal
StgCreateStorageEx
oleaut32
SysFreeString
LoadTypeLibEx
SysStringLen
SysAllocString
VariantClear
DispGetParam
VariantInit
shlwapi
PathFileExistsW
PathRemoveFileSpecW
PathCombineW
PathFindFileNameW
Sections
.text Size: 462KB - Virtual size: 461KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 592KB - Virtual size: 596KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE