2024-08-26_08c28d33fa2400b5b23959edfb7030af_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-26_08c28d33fa2400b5b23959edfb7030af_avoslocker
Size

1.6MB
MD5

08c28d33fa2400b5b23959edfb7030af
SHA1

e629dc3ff5db3cbf47ff991e974a776259f762c3
SHA256

fde8f6b851128118d982dcca72ba7eec0611363daddd0da90442a9f4ba8a16cf
SHA512

4da82606cdb55d1e24f67e949d4a05c09420ce5f8017897a0467b8971ad0bbc93e608a72bc8f568bbd434f6dbe300f68c25b4b9630e50f49352240f18cc364fb
SSDEEP

24576:5UNFW9zqljRMdmY472iyzGaaFpB2DVGZHxUEqWsK0l+4:5aFWkljRins2nGx3aVGWB+4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-26_08c28d33fa2400b5b23959edfb7030af_avoslocker

Files

2024-08-26_08c28d33fa2400b5b23959edfb7030af_avoslocker
.exe windows:6 windows x86 arch:x86

72523efe3ef7268f33b128fda71aa744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\zoomcode\EP_2017\bin\Release\CptService.pdb

Imports

kernel32

SetLastError
CopyFileW
MoveFileW
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetFileSize
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
TerminateThread
GetExitCodeThread
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
LoadLibraryExW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
GetFullPathNameW
DeleteFileW
ResumeThread
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetEndOfFile
GetProcAddress
GetModuleHandleW
GetModuleHandleA
FreeLibrary
GetVersionExW
HeapFree
GetSystemInfo
OpenProcess
TerminateProcess
GetCurrentProcess
MultiByteToWideChar
FileTimeToSystemTime
lstrcpyW
lstrcmpA
LocalFree
LocalAlloc
GetLocalTime
GetFileAttributesW
FileTimeToLocalFileTime
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
CloseHandle
HeapReAlloc
SetEvent
GetLastError
ProcessIdToSessionId
ReadConsoleW
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
GetFileType
WriteFile
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadFile
GetFileAttributesExW
TlsFree
TlsSetValue
TlsGetValue
CreateEventW
HeapSize
CreateFileW
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
GetCommandLineA
TlsAlloc
EncodePointer
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
WriteConsoleW

user32

GetSystemMetrics

advapi32

SetServiceStatus
RegisterServiceCtrlHandlerExW
OpenProcessToken
AllocateAndInitializeSid
FreeSid
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSidToSidW
QueryServiceStatusEx
SetTokenInformation
GetLengthSid
DuplicateTokenEx
CreateProcessAsUserW
SetEntriesInAclW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
StartServiceCtrlDispatcherW

shell32

CommandLineToArgvW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHCreateDirectoryExW

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAppendW
PathIsRelativeW
PathFindFileNameW

crypt32

CryptMsgGetParam
CertCloseStore
CryptDecodeObject
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertFindCertificateInStore
CryptMsgClose

wintrust

WinVerifyTrust

psapi

GetProcessImageFileNameA

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
VerQueryValueA

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

72523efe3ef7268f33b128fda71aa744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

shlwapi

crypt32

wintrust

psapi

version

Sections

.text Size: 134KB - Virtual size: 133KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1.4MB - Virtual size: 2.3MB

.text
Size: 134KB - Virtual size: 133KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1.4MB - Virtual size: 2.3MB