2024-08-25_a4ff9486d8f3c86f1012c94be28a68ca_avoslocker

General

Target
2024-08-25_a4ff9486d8f3c86f1012c94be28a68ca_avoslocker
Size 4.5MB
Sample240825-hpwe3asejp
SHA256 b763e6a2d6082ac8631eefc70ab66386220f75e75eb71544bcb2cb8f020502c0
MD5 a4ff9486d8f3c86f1012c94be28a68ca
SHA1 c75b310177761e582a65c1079f12f14df098e99a
SHA512 8633d1a0a96b7e4995725ed1b950e076b5d77dc984c9210e2d2143e5d6facca83ce9803e5ea04e4b779b1bbe9367749c96ca9f19b1169c34c37ac3628050472c
SSDEEP 98304:DWqq+Mb+eyWvjIy5YFWAvwzn7Nx99JEIjFMm2Va/5AZK6j0xnw:DWaPWvjIy5YPvwzn7N/rTAYAZK6jyw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-25_a4ff9486d8f3c86f1012c94be28a68ca_avoslocker

File Explorer

2024-08-25_a4ff9486d8f3c86f1012c94be28a68ca_avoslocker

.exe 4.5MB

2024-08-25_a4ff9486d8f3c86f1012c94be28a68ca_avoslocker

IMPHASH 116f2fb15b37440cc860b72ed33c8f16
SHA256 b763e6a2d6082ac8631eefc70ab66386220f75e75eb71544bcb2cb8f020502c0
MD5 a4ff9486d8f3c86f1012c94be28a68ca
SHA1 c75b310177761e582a65c1079f12f14df098e99a
SHA512 8633d1a0a96b7e4995725ed1b950e076b5d77dc984c9210e2d2143e5d6facca83ce9803e5ea04e4b779b1bbe9367749c96ca9f19b1169c34c37ac3628050472c
SSDEEP 98304:DWqq+Mb+eyWvjIy5YFWAvwzn7Nx99JEIjFMm2Va/5AZK6j0xnw:DWaPWvjIy5YPvwzn7N/rTAYAZK6jyw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\a\b\d_00000000_\b\out\Win32\Release\starter.pdb

kernel32

EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent CloseHandle ResetEvent DeleteCriticalSection LocalAlloc OpenProcess DeleteFileW RemoveDirectoryW GetModuleFileNameW GetLastError CreateDirectoryW CompareStringW GetTempPathW ExpandEnvironmentStringsW CreateProcessW CreateFileW GetSystemWindowsDirectoryW GetExitCodeProcess GetCurrentProcessId ReadFile FormatMessageW GetModuleHandleW GetFileAttributesW SetCurrentDirectoryW LoadLibraryExW GetProcAddress FreeLibrary LocalFree HeapFree GetProcessHeap MultiByteToWideChar GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleA GetCurrentProcess GetCurrentDirectoryW MoveFileW HeapAlloc RaiseException GetCurrentThreadId Sleep GetModuleHandleExW GetLocalTime SetUnhandledExceptionFilter SetEnvironmentVariableW GetWindowsDirectoryW GetLongPathNameW LoadLibraryW SetDllDirectoryW SetLastError TlsSetValue VirtualProtect VirtualAlloc TlsAlloc GetSystemInfo FlushInstructionCache TlsGetValue TlsFree GetTickCount VirtualQuery LoadLibraryExA FindResourceExW LoadResource LockResource SizeofResource WriteFile GetModuleFileNameA GetModuleHandleExA SetFilePointer FindNextFileW FindClose MoveFileExW GetTempFileNameW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FormatMessageA FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle SetFilePointerEx AreFileApisANSI CopyFileW GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW QueryPerformanceCounter GetSystemTimeAsFileTime WaitForSingleObjectEx EncodePointer DecodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetStdHandle LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

Name

.text

Size

243KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-08-25_a4ff9486d8f3c86f1012c94be28a68ca_avoslocker

kernel32

generic