Static task
static1
Behavioral task
behavioral1
Sample
2024-09-02_3958bcaadf17622a8d8a34d04ce2377e_avoslocker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-02_3958bcaadf17622a8d8a34d04ce2377e_avoslocker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-02_3958bcaadf17622a8d8a34d04ce2377e_avoslocker
-
Size
1.3MB
-
MD5
3958bcaadf17622a8d8a34d04ce2377e
-
SHA1
33761e3ffed7718e280e5698dea951bff9d246a9
-
SHA256
74176a13b34586db5b6756b53dfa6529e58263ed165d2f26fea42f176c4fbdc7
-
SHA512
f4e2672a6c8f263d7e38f1bf9ed65474bf2a08d6b5feddc2ed8444722a2d91d91f2283f74ba72e381546d8612da7b90a5e096e47e4a65d6f325baf76736844c5
-
SSDEEP
24576:70oke8wfTBmnBaMcVbWwG45cwerQJ/UZHl055hKVv8rdhVtITMg5/E5II:IoXdAaMYWT45cwAq/+c5hCvaFykII
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-02_3958bcaadf17622a8d8a34d04ce2377e_avoslocker
Files
-
2024-09-02_3958bcaadf17622a8d8a34d04ce2377e_avoslocker.exe windows:5 windows x86 arch:x86
a9ac0d2510c24e399676f9833f4b5ab0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSAWaitForMultipleEvents
crypt32
CertFreeCertificateChain
kernel32
ExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
TranslateMessage
advapi32
CryptGetHashParam
shell32
SHGetFolderPathW
ntdll
NtResumeThread
bcrypt
BCryptGenRandom
Sections
.text Size: 436KB - Virtual size: 435KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.be0 Size: 454KB - Virtual size: 453KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.be1 Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 272KB - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ