2024-09-30_4c1284a15a0a5fba7002b1f6946071db_avoslocker

Sharing

Copy URL

Twitter E-mail

General

Target

2024-09-30_4c1284a15a0a5fba7002b1f6946071db_avoslocker
Size

2.3MB
MD5

4c1284a15a0a5fba7002b1f6946071db
SHA1

b816cc901fba4cadbbae7a8743b365d9c10f619d
SHA256

7a7317ddd8db1be26b030b00520ad98d093d7837e5dd9c3e52ce87add4131859
SHA512

a3a06acbb177086921af982f254b012e400c62a8a79e7d98ec30900769b9df60a2bfa613b63cc9c5aed30d2259f1b3f7b0f9e3a3bff8623493339eb4089d1655
SSDEEP

49152:uEoqO5cI31ONNYGv7p24h6/3cshVCVeG1tEBA9hcr:OqEtGNYGvlIvCVest

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-30_4c1284a15a0a5fba7002b1f6946071db_avoslocker

Files

2024-09-30_4c1284a15a0a5fba7002b1f6946071db_avoslocker
.exe windows:6 windows x86 arch:x86

579b15aab440688affcd4714d1e218ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\ZAID ENCRYPTION - New FTP Download\_Programming\VC++\v5_0_3\WindowFilePlayback\Release_Build\VSLPlayer.pdb

Imports

winhttp

WinHttpGetIEProxyConfigForCurrentUser

dwmapi

DwmIsCompositionEnabled

cpr

??1EncodedAuthentication@cpr@@UAE@XZ
?secureStringClear@util@cpr@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Add@?$CurlContainer@UPair@cpr@@@cpr@@QAEXABUPair@2@@Z
?SetOption@Session@cpr@@QAEX$$QAVPayload@2@@Z
?SetOption@Session@cpr@@QAEXABUSslOptions@2@@Z
?Post@Session@cpr@@QAE?AVResponse@2@XZ
??0Session@cpr@@QAE@XZ
?SetOption@Session@cpr@@QAEXABVUrl@2@@Z

libcurl

curl_global_init
curl_easy_perform
curl_easy_cleanup
curl_easy_getinfo
curl_easy_init
curl_easy_setopt

kernel32

ReadFile
WriteFile
CloseHandle
GetLastError
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetFileAttributesExW
DecodePointer
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
GetModuleFileNameW
Sleep
MultiByteToWideChar
CreateMutexW
WaitForMultipleObjects
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcess
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
WinExec
CreateToolhelp32Snapshot
Process32First
Process32Next
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
GetThreadTimes
WideCharToMultiByte
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetFileSize
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
DeleteFileW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetCurrentProcess
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
GetCPInfo
CompareStringEx
GetLocaleInfoEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
LCMapStringEx
EncodePointer
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
CreateFileW
GetConsoleMode
GetFileSizeEx
ReadConsoleW
GetTimeZoneInformation
HeapQueryInformation
SetConsoleCtrlHandler
IsValidCodePage
GetACP
GetCommandLineA
GetOEMCP
GetCommandLineW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
LocalFree
FormatMessageA
GetEnvironmentStringsW
GetDateFormatW
ReleaseSRWLockExclusive
InitializeSRWLock
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
GetStringTypeW
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CopyFileW
CreateDirectoryExW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
DeviceIoControl
AreFileApisANSI
GetTempPathW
SetFileTime
SetFilePointerEx
SetFileInformationByHandle
SetFileAttributesW
SetEndOfFile

user32

MessageBoxW
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
DestroyWindow
GetDlgItemTextW
GetSystemMetrics
PeekMessageW
UnregisterClassW
GetPropW
BringWindowToTop
SetDlgItemTextW
GetDlgCtrlID
CreateWindowExW
DrawTextW
SetForegroundWindow
InvalidateRect
GetCursorPos
ScreenToClient
FillRect
PtInRect
GetClientRect
SetPropW
EndPaint
BeginPaint
GetDlgItem
SetWindowPos
DrawEdge
GetWindowRect
LoadImageW
DrawIconEx
IsWindowVisible
GetKeyState
SetWindowTextW
LoadStringW
PostThreadMessageW
PostQuitMessage
ShowWindow
RegisterClassExW
DefWindowProcW
SendMessageW
DrawTextA
SetWindowDisplayAffinity
SetLayeredWindowAttributes
IsWindow
GetParent
ClientToScreen
ReleaseCapture
SetCapture
GetCapture
EndDialog
DialogBoxParamW
TrackMouseEvent
LoadIconW
GetWindow
GetWindowThreadProcessId
EnumWindows
SetWindowLongW
GetWindowLongW
SetFocus
GetWindowTextA
RedrawWindow
UpdateWindow
TrackPopupMenu
AppendMenuW
CreatePopupMenu
LoadAcceleratorsW
EnableWindow
RegisterClassW

gdi32

Ellipse
SetTextColor
SetBkMode
SelectObject
Rectangle
GetStockObject
DeleteObject
CreateSolidBrush
CreatePen
CreateFontW

comdlg32

GetOpenFileNameW

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegGetValueW
RegSetValueExW
RegCreateKeyW

shell32

SHGetKnownFolderPath
SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW

ole32

CoUninitialize
OleInitialize
CoTaskMemFree
CoInitializeEx
CoInitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysAllocString
VariantClear
VariantInit
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
CreateErrorInfo
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
GetErrorInfo
VariantChangeType
SetErrorInfo
SafeArrayDestroy

shlwapi

PathRemoveExtensionW
PathFindExtensionW
PathFindFileNameA
PathFindFileNameW
PathRemoveFileSpecW
PathAddExtensionW

wininet

FtpSetCurrentDirectoryW
FtpFindFirstFileW
InternetSetOptionW
InternetFindNextFileW
InternetConnectW
InternetCloseHandle
InternetOpenW

gdiplus

GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdiplusShutdown
GdiplusStartup
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipFree
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawImageI
GdipFillRectangleI
GdipReleaseDC
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipDeleteFont

comctl32

ord413

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

579b15aab440688affcd4714d1e218ca

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winhttp

dwmapi

cpr

libcurl

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

gdiplus

comctl32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 378KB - Virtual size: 377KB

.data Size: 50KB - Virtual size: 66KB

.rsrc Size: 15KB - Virtual size: 15KB

.reloc Size: 89KB - Virtual size: 89KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 378KB - Virtual size: 377KB

.data
Size: 50KB - Virtual size: 66KB

.rsrc
Size: 15KB - Virtual size: 15KB

.reloc
Size: 89KB - Virtual size: 89KB