2024-10-11_1ec695c39a0e8dc300813a2896839a08_avoslocker | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-11_1ec695c39a0e8dc300813a2896839a08_avoslocker
Size

1.2MB
MD5

1ec695c39a0e8dc300813a2896839a08
SHA1

8b844023f769c806537978e7ee3963530d052843
SHA256

2fb760cd23a8cb6b579cf9d76f767f4b5dfcb26af19eb2afaf5478480d1362b9
SHA512

205c8805da1be211448a49efcf22188b8c14e34f2a25eafb9cd680950d69b94b486c63fe86199e1381133a108706d9d777c4692d4a69e3efa8de8b41a9eef389
SSDEEP

24576:zRWnl2+o6eSoKw2+s7SSXUyYRn5QK5emadDBh5qIh4TE:yo6d7v+ztrTAmIB/v4T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-11_1ec695c39a0e8dc300813a2896839a08_avoslocker

Files

2024-10-11_1ec695c39a0e8dc300813a2896839a08_avoslocker
.exe windows:6 windows x86 arch:x86

8b18edac65cf62fc24dc39039063d3c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\a\b\d_00000000_\b\out\Win32\Release\SetupUi\setup_ui.pdb

Imports

kernel32

ExitProcess
GetProcAddress
LoadLibraryA
OutputDebugStringA
OutputDebugStringW
VirtualProtect

Exports

Exports

mainEECStartup

Sections

.text
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.eecseg
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 368KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE