avil[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
avil.exe
Size 19.0MB
Sample260824-bwdehasand
SHA256 ef4ec3cf86c407b68304e8881f1d6803639af00357a6971e77100b345eea3573
MD5 310af9756a479b84ee869ba9b8356d16
SHA1 3a605d10ee4dd296e31c1e5a7a38a61174fb7935
SHA512 7a63c59acee04c1fd119e1742ddc8d3d783baf5ad8f2a341c3a798ca8c0ba83552000f6b84f087560724034febfbdb192f30cb9e84ec6cdee0255affcb1ffd5b
SSDEEP 393216:PbBd7W/Y4YUJKSjb8TVqqUPzJmNfPcccZfO0Kk2sEdleWciqm1FR:PddK/RDjyD2MscAXpEdleW6CR
TLSH
T119172353B39808C5E43AA33AC476492BDB32FC25437595CB0762A52E2F7B2C45B7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
avil.exe

File Explorer

avil.exe

.exe 19.0MB

avil.exe

IMPHASH f25f910d2cd9915e16f1936fc8b56746
SHA256 ef4ec3cf86c407b68304e8881f1d6803639af00357a6971e77100b345eea3573
MD5 310af9756a479b84ee869ba9b8356d16
SHA1 3a605d10ee4dd296e31c1e5a7a38a61174fb7935
SHA512 7a63c59acee04c1fd119e1742ddc8d3d783baf5ad8f2a341c3a798ca8c0ba83552000f6b84f087560724034febfbdb192f30cb9e84ec6cdee0255affcb1ffd5b
SSDEEP 393216:PbBd7W/Y4YUJKSjb8TVqqUPzJmNfPcccZfO0Kk2sEdleWciqm1FR:PddK/RDjyD2MscAXpEdleW6CR
TLSH
T119172353B39808C5E43AA33AC476492BDB32FC25437595CB0762A52E2F7B2C45B7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

715120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\__w\1\s\x64\Release\ZoomIt64.pdb

comctl32

ord412 ord413 ord410

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeBeginPeriod timeSetEvent PlaySoundW timeKillEvent timeEndPeriod

gdiplus

GdipDeletePath GdipCreatePath GdipSetPenLineCap197819 GdipSaveImageToFile GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFile GdipGetImageEncoders GdipGetImageEncodersSize GdipBitmapUnlockBits GdipDrawLineI GdipFillEllipseI GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipSetPenLineJoin GdipSetEffectParameters GdipDeleteEffect GdipCreateEffect GdipBitmapGetPixel GdipBitmapLockBits GdipGetImageWidth GdipGetImageHeight GdipStartPathFigure GdipDisposeImage GdipCloneImage GdipCreateBitmapFromHBITMAP GdiplusShutdown GdiplusStartup GdipDrawLine GdipDrawArc GdipFillRectangleI GdipFillPolygon GdipFillRectangle GdipDrawEllipse GdipDeletePen GdipCreatePen1 GdipFillEllipse GdipCloneBrush GdipAlloc GdipFree GdipDeleteBrush GdipCreateSolidFill GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipDrawPath GdipDrawRectangleI GdipDrawEllipseI GdipClosePathFigure GdipGetImagePixelFormat GdipAddPathLineI GdipBitmapApplyEffect

msimg32

AlphaBlend

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

kernel32

InterlockedPushEntrySList RtlUnwindEx InitializeSListHead GetStartupInfoW GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo OutputDebugStringA CloseHandle OutputDebugStringW GetCurrentThreadId FormatMessageW IsDebuggerPresent GetLastError WaitForMultipleObjectsEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WaitForSingleObjectEx SetEvent ResetEvent CreateEventExW SetLastError GetVersionExW LoadLibraryExW GetCommandLineW GetStdHandle LocalAlloc GetProcAddress LocalFree GetModuleHandleW GetFileType MulDiv WaitForSingleObject WideCharToMultiByte GetTempPathW GetModuleFileNameW GetLocalTime GetCurrentProcessId GetTickCount64 Sleep GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetModuleFileNameA CreateSemaphoreExW HeapFree ReleaseSemaphore GetModuleHandleExW ReleaseMutex OpenSemaphoreW HeapAlloc CreateMutexExW GetProcessHeap DebugBreak GlobalSize MultiByteToWideChar CreateFileW GetFileTime CompareFileTime QueryPerformanceFrequency QueryPerformanceCounter ExpandEnvironmentStringsW CreateDirectoryW CopyFileW InitializeCriticalSectionAndSpinCount GetFileAttributesExW FindResourceW LoadResource SizeofResource LockResource WriteFile lstrcpynW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess GetFileAttributesW Beep SetThreadPriority GetCurrentThread GetTickCount CreateEventW GetVersion ReadFile SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetStringTypeW GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA TryAcquireSRWLockExclusive GetNativeSystemInfo GetExitCodeThread SwitchToThread RaiseException RtlPcToFileHeader CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork InitializeCriticalSectionEx GetSystemTimeAsFileTime CreateThreadpoolTimer SetThreadpoolTimer CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringEx TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary ExitProcess GetConsoleCP FreeLibraryWhenCallbackReturns CreateThread ExitThread FreeLibraryAndExitThread FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode SetConsoleMode ReadConsoleInputW ReadConsoleW FlushFileBuffers GetConsoleOutputCP SetFilePointerEx GetFileSizeEx HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize WriteConsoleW SetEndOfFile RtlUnwind TrySubmitThreadpoolCallback SetThreadpoolTimerEx SetThreadpoolWaitEx IsProcessorFeaturePresent InitOnceBeginInitialize InitOnceComplete DeleteFileW

user32

ChangeDisplaySettingsExW EnumDisplaySettingsW IsWindowVisible ClientToScreen UpdateLayeredWindow DestroyMenu TrackPopupMenu AppendMenuW CreatePopupMenu DrawFrameControl MapDialogRect MsgWaitForMultipleObjects ScreenToClient IsZoomed PtInRect SetFocus SetTimer TrackMouseEvent KillTimer DrawTextW DialogBoxParamW PostMessageW InvalidateRect UnionRect SetDlgItemTextW GetDlgItemTextW MonitorFromWindow UnhookWindowsHookEx SetWindowsHookExW CallNextHookEx GetForegroundWindow VkKeyScanW GetClipboardData IsClipboardFormatAvailable GetClipboardSequenceNumber GetKeyState SendInput MapWindowPoints GetWindow MonitorFromPoint GetMonitorInfoW FindWindowW SetMenuInfo IsWindowEnabled EnumChildWindows GetDlgCtrlID GetClassNameW EndPaint ReleaseCapture GetCapture SetCapture SetRectEmpty RedrawWindow ShowCursor MoveWindow SetCursorPos SendNotifyMessageW CheckDlgButton TranslateAcceleratorW LoadAcceleratorsW InsertMenuW OffsetRect EnableWindow GetWindowLongW SetWindowLongW IsWindow GetMessageW ClipCursor GetClipCursor SetForegroundWindow SetLayeredWindowAttributes ShowWindow RegisterWindowMessageW SetRect GetMessageExtraInfo SetMessageExtraInfo SetActiveWindow BringWindowToTop GetClassInfoW RegisterClassW SetClipboardData CloseClipboard GetPropW GetWindowDC EmptyClipboard OpenClipboard MessageBoxW PostQuitMessage GetAsyncKeyState SetWindowDisplayAffinity GetLayeredWindowAttributes GetCursorPos WindowFromPoint GetKeyNameTextW MapVirtualKeyW GetSystemMetrics ReleaseDC GetDC RegisterClassExW DefWindowProcW FillRect GetClientRect DispatchMessageW TranslateMessage PeekMessageW DestroyWindow UpdateWindow LoadIconW SystemParametersInfoW GetSysColor SetWindowPos GetWindowLongPtrW SetWindowLongPtrW CreateWindowExW GetWindowRect AdjustWindowRectEx GetDesktopWindow InflateRect SendMessageW EndDialog SetWindowTextW DialogBoxIndirectParamW LoadCursorW SetCursor GetDlgItem GetSysColorBrush GetWindowTextW SetPropW RegisterHotKey UnregisterHotKey CreateDialogParamW GetParent SetWindowRgn IsDlgButtonChecked BeginPaint

gdi32

GetObjectW GetDIBits CreateDCW GetStockObject CreateRectRgnIndirect CombineRgn CreateSolidBrush RoundRect CreatePen MoveToEx CreateCompatibleDC DeleteDC CreateFontW Ellipse SetStretchBltMode SetBrushOrgEx StretchBlt Rectangle GetTextMetricsW GetTextExtentPoint32W Polygon CreateBitmap GetCurrentObject SetROP2 GdiFlush BitBlt CreateCompatibleBitmap CreateDIBSection SetBkMode SetBkColor SetTextColor DeleteObject CreateFontIndirectW StartPage EndDoc GetDeviceCaps SetMapMode StartDocW SelectObject LineTo EndPage

comdlg32

PrintDlgW ChooseFontW

advapi32

RegDeleteValueW RegOpenKeyW RegCreateKeyW RegDeleteKeyW RegDeleteKeyValueW RegSetKeyValueW RegCreateKeyExW RegQueryValueExW RegGetValueW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

SHGetKnownFolderItem Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteW SHCreateItemFromParsingName

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemAlloc CoGetApartmentType CoTaskMemFree CoInitializeEx CoUninitialize CoInitialize PropVariantClear RoGetAgileReference CoGetObjectContext

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext RoTransformError GetRestrictedErrorInfo SetRestrictedErrorInfo

mfplat

MFShutdown MFStartup MFCopyImage MFCreateMediaType MFCreateAttributes

mfreadwrite

MFCreateSourceReaderFromMediaSource

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle

uxtheme

CloseThemeData DrawThemeBackground OpenThemeData SetWindowTheme

shlwapi

SHCreateStreamOnFileEx ord219

mf

MFEnumDeviceSources

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

1005KB

Virtual Size

1005KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.8MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

81KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12.2MB

Virtual Size

12.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

avil.exe

comctl32

version

winmm

gdiplus

msimg32

wtsapi32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

mfplat

mfreadwrite

api-ms-win-core-synch-l1-2-0

uxtheme

shlwapi

mf

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic