C:\zoomcode\EP_2017\bin\Release\CptInstall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-26_d065d3deca56faa247caa64d06d15045_avoslocker.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-26_d065d3deca56faa247caa64d06d15045_avoslocker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-26_d065d3deca56faa247caa64d06d15045_avoslocker
-
Size
1.6MB
-
MD5
d065d3deca56faa247caa64d06d15045
-
SHA1
41715d96b98df3c6c728699409e63e9ddf93425c
-
SHA256
3f07780c02fa9140a569a1064ae657d8fbd0731d35799982cca53c09d4ee519e
-
SHA512
ff51399d00c01bda0108807ce0735c874fc26d2f9f12e6f6f000057d4644b1e5e46e9681e6e140c10cf808b69cf723dae1107036e9d1eb8e1c75b431956ad18c
-
SSDEEP
24576:48ksDZoH2b+dfzA2iyzGaaFpB2DVGZHxUEqWsK0l+4:bkWO2b+NzA2nGx3aVGWB+4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-26_d065d3deca56faa247caa64d06d15045_avoslocker
Files
-
2024-08-26_d065d3deca56faa247caa64d06d15045_avoslocker.exe windows:6 windows x86 arch:x86
e674c181edb40ee9d54df5afbe186913
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleHandleExW
FileTimeToLocalFileTime
lstrcmpA
lstrcpyW
FileTimeToSystemTime
MultiByteToWideChar
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetFileSize
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
SetEvent
CreateEventW
GetLocalTime
GetExitCodeThread
SetEndOfFile
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
TerminateProcess
WideCharToMultiByte
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
ReadConsoleW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetSystemInfo
LocalAlloc
LoadLibraryExW
GetModuleHandleW
GetVersionExW
TerminateThread
LeaveCriticalSection
EnterCriticalSection
GetCommandLineW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
CreateFileW
LoadLibraryW
GetProcAddress
FreeLibrary
OpenProcess
ResumeThread
Sleep
MoveFileExW
MoveFileW
CopyFileW
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetLastError
GetTempPathW
GetTempFileNameW
GetFullPathNameW
DeleteFileW
GetExitCodeProcess
GetCurrentProcessId
DeleteCriticalSection
LocalFree
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
GetFileType
WriteFile
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadFile
GetFileAttributesExW
TlsFree
TlsSetValue
RaiseException
CloseHandle
GetLastError
ProcessIdToSessionId
GetFileAttributesW
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleFileNameW
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
IsDebuggerPresent
OutputDebugStringW
UnhandledExceptionFilter
WriteConsoleW
user32
GetSystemMetrics
advapi32
GetTokenInformation
ChangeServiceConfig2W
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
OpenServiceW
OpenSCManagerW
OpenProcessToken
shell32
CommandLineToArgvW
ShellExecuteExW
SHFileOperationW
SHCreateDirectoryExW
SHGetFolderPathW
SHGetSpecialFolderPathW
shlwapi
PathIsRelativeW
PathFindFileNameW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
crypt32
CryptMsgGetParam
CertCloseStore
CryptDecodeObject
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertFindCertificateInStore
CryptMsgClose
wintrust
WinVerifyTrust
psapi
GetProcessImageFileNameA
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
VerQueryValueA
Sections
.text Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.4MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE