2024-10-04_e12e349d457f818d8e78b3b6dfa5b081_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-04_e12e349d457f818d8e78b3b6dfa5b081_avoslocker
Size

2.3MB
MD5

e12e349d457f818d8e78b3b6dfa5b081
SHA1

608772d5f89db0e3350173fa2f1078900fd5f9a0
SHA256

a93d78a9bbd6a3e3bec8ab37b8c355bd08bbf6fc6f287a0b272513518439855d
SHA512

fff792bc6b724acab7559ac41e225c74bf26bb90d43db58757dbf029a037f878473fb6b0283c8667775b9e5a185efeb3cbba49cec2c1fec59ad7260f2c72808a
SSDEEP

49152:9dFFhsTKedBLc5zLDty4qox7QoKYWTsQOKUP/Lcxxg3aXM7xe:9oBLc5HDF3WTsQxU3L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-04_e12e349d457f818d8e78b3b6dfa5b081_avoslocker

Files

2024-10-04_e12e349d457f818d8e78b3b6dfa5b081_avoslocker
.exe windows:6 windows x86 arch:x86

21ec61969e6210f0c65dec34ef616958

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\ZAID ENCRYPTION - New FTP Download\_Programming\VC++\v5_0_3\VSampleWebView2\Release_Build\Ekatvam_Academy_Player.pdb

Imports

webview2loader

CreateCoreWebView2EnvironmentWithOptions

dwmapi

DwmIsCompositionEnabled

shlwapi

PathRemoveFileSpecW
PathFindFileNameA

winhttp

WinHttpGetIEProxyConfigForCurrentUser

kernel32

GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
CreateMutexW
Sleep
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcess
GetSystemFirmwareTable
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalAlloc
LocalFree
WinExec
FormatMessageW
MultiByteToWideChar
CreateToolhelp32Snapshot
Process32First
Process32Next
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
GetThreadTimes
SetCurrentDirectoryW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetConsoleCtrlHandler
HeapQueryInformation
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
RaiseException
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileSizeEx
GetFileType
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
OutputDebugStringW
GetCurrentProcess
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeSListHead
CreateEventW
ResetEvent
SetEvent
FindFirstFileExW
GetCPInfo
CompareStringEx
GetLocaleInfoEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseHandle
DecodePointer
WriteFile
ReadFile
GetFileSize
CreateFileW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetCurrentDirectoryW
WriteConsoleW
CreateDirectoryW
FindClose
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
GetStringTypeW
WideCharToMultiByte
FormatMessageA
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
LCMapStringEx
SetEndOfFile
SetFileAttributesW
EncodePointer
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CopyFileW
CreateDirectoryExW
DeviceIoControl
AreFileApisANSI
GetTempPathW
SetFileTime
SetFilePointerEx
SetFileInformationByHandle

user32

TrackMouseEvent
GetCapture
SetCapture
ReleaseCapture
ScreenToClient
PtInRect
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
PostMessageW
PostThreadMessageW
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow
MessageBoxW
GetWindowThreadProcessId
GetWindowPlacement
SetWindowDisplayAffinity
IsWindowVisible
DialogBoxParamW
EndDialog
SetDlgItemTextW
GetDlgItemTextW
GetKeyState
LoadAcceleratorsW
TranslateAcceleratorW
DrawTextW
UpdateWindow
GetDCEx
EnumWindows
ReleaseDC
RedrawWindow
SetWindowTextW
GetWindowTextA
GetClientRect
GetWindowRect
MessageBoxA
MapWindowPoints
FillRect
SetWindowPos
ShowWindow
SystemParametersInfoW
GetWindow
GetPropW
SetPropW
EndPaint
BeginPaint
SetLayeredWindowAttributes
IsWindow
LoadCursorW
LoadImageW
LoadIconW
OffsetRect

gdi32

SetTextColor
SetMapMode
SetBkMode
SetBkColor
SelectObject
ExtSelectClipRgn
OffsetRgn
GetStockObject
ExcludeClipRect
DeleteObject
CreateSolidBrush
CreateRectRgn
CreateFontW
CombineRgn

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptGenRandom

shell32

ShellExecuteW
SHGetKnownFolderPath

ole32

CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoInitializeSecurity
CoUninitialize
CoInitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

VariantClear
VariantInit
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocString
SysAllocStringByteLen
SysStringLen
SysFreeString
CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo
SafeArrayDestroy

cpr

?Add@?$CurlContainer@UPair@cpr@@@cpr@@QAEXABUPair@2@@Z
?Post@Session@cpr@@QAE?AVResponse@2@XZ
?SetOption@Session@cpr@@QAEXABUSslOptions@2@@Z
?SetOption@Session@cpr@@QAEX$$QAVPayload@2@@Z
?SetOption@Session@cpr@@QAEXABVUrl@2@@Z
??0Session@cpr@@QAE@XZ
??1EncodedAuthentication@cpr@@UAE@XZ
?secureStringClear@util@cpr@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

msimg32

GradientFill

gdiplus

GdipSetInterpolationMode
GdipGraphicsClear
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipCloneImage
GdipSetCompositingQuality
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateLineBrushFromRectI
GdipSetStringFormatAlign
GdipDisposeImage
GdipCreateBitmapFromHICON
GdipCreateFromHDC
GdipDeleteGraphics
GdipReleaseDC
GdipFillRectangleI
GdipDrawImageRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatLineAlign

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 355KB - Virtual size: 355KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

21ec61969e6210f0c65dec34ef616958

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

webview2loader

dwmapi

shlwapi

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

cpr

msimg32

gdiplus

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 355KB - Virtual size: 355KB

.data Size: 59KB - Virtual size: 74KB

.rsrc Size: 122KB - Virtual size: 122KB

.reloc Size: 87KB - Virtual size: 87KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 355KB - Virtual size: 355KB

.data
Size: 59KB - Virtual size: 74KB

.rsrc
Size: 122KB - Virtual size: 122KB

.reloc
Size: 87KB - Virtual size: 87KB