2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker

General

Target
2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker
Size 4.3MB
Sample240928-kgnflawern
SHA256 d68b06e73cb3a0807bc442c0782ac667bdc2ceff4bc566c2c2c30e0adea42686
MD5 7dda564955fa2f0d8c64135cb34221c0
SHA1 2ad4576e5ca1c3c67e3de9fe21b17d191019243c
SHA512 d1ca6462ad6fb5d7cb3e9e657f64cd0f59d9584c65f977fc6c4ebcee75870e29862d14de4e149a2e479a2bdcef271d1bb092d354f1db914e6876fcba7d33cf19
SSDEEP 98304:Ypq/d8kCBLlMyQjujDW9tBcg2jGqwwASMmhdWuVIaN3fu+ekQwtsIukB3tiXV:Zc65ujyp8jGqwwvrVIaNvu+ekteyNtmV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker

File Explorer

2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker

.exe 4.3MB

2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker

IMPHASH 73a99421c03d3f56333f368b6d96c755
SHA256 d68b06e73cb3a0807bc442c0782ac667bdc2ceff4bc566c2c2c30e0adea42686
MD5 7dda564955fa2f0d8c64135cb34221c0
SHA1 2ad4576e5ca1c3c67e3de9fe21b17d191019243c
SHA512 d1ca6462ad6fb5d7cb3e9e657f64cd0f59d9584c65f977fc6c4ebcee75870e29862d14de4e149a2e479a2bdcef271d1bb092d354f1db914e6876fcba7d33cf19
SSDEEP 98304:Ypq/d8kCBLlMyQjujDW9tBcg2jGqwwASMmhdWuVIaN3fu+ekQwtsIukB3tiXV:Zc65ujyp8jGqwwvrVIaNvu+ekteyNtmV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\a\b\d_00000000_\b\out\Win32\Release\starter.pdb

kernel32

EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent CloseHandle ResetEvent DeleteCriticalSection LocalAlloc OpenProcess DeleteFileW RemoveDirectoryW GetModuleFileNameW GetLastError CreateDirectoryW CompareStringW GetTempPathW ExpandEnvironmentStringsW CreateProcessW CreateFileW GetSystemWindowsDirectoryW GetExitCodeProcess GetCurrentProcessId ReadFile FormatMessageW GetModuleHandleW GetFileAttributesW SetCurrentDirectoryW LoadLibraryExW GetProcAddress FreeLibrary LocalFree HeapFree GetProcessHeap MultiByteToWideChar GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleA GetCurrentProcess GetCurrentDirectoryW MoveFileW HeapAlloc GetLocalTime Sleep GetCurrentThreadId SetUnhandledExceptionFilter SetEnvironmentVariableW GetWindowsDirectoryW GetLongPathNameW LoadLibraryW SetDllDirectoryW SetLastError TlsSetValue VirtualProtect VirtualAlloc TlsAlloc GetSystemInfo FlushInstructionCache TlsGetValue TlsFree GetTickCount VirtualQuery RaiseException LoadLibraryExA FindResourceExW LoadResource LockResource SizeofResource WriteFile GetModuleFileNameA GetModuleHandleExA SetFilePointer FindNextFileW FindClose MoveFileExW GetTempFileNameW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FormatMessageA FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle SetFilePointerEx AreFileApisANSI CopyFileW GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW QueryPerformanceCounter GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

Name

.text

Size

237KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker

kernel32

generic