����x�Q����o�v�m���A���0���ٶ!��� ?Xr�y,���P�Y��\.rTF X���;�W���̸ ��7k�!���z=��KN��2��;�fӰ�w�< �k�p �j��!��9����4�Iѕ�i1���Ӫ�lk�,-������H��M�L��T��^-|Y$������m���r:f���E���&��G,��BpɈ@�9���;M%��Y%���bl��%�0~�e�W�|�t��!�=F��5��M]��쩊>5��9�����P� X(fL����bREt~M:��VO�Y��:>[�Wl^W'�z��-�`�N�J��� ��ƒ�Rw!�U�hcX=�������;!���S2��&Ť_9�U�pQ��a�W�9���/��X'a�/cN�w`���� ���"����M.���,�>�#֝"H8�}UvX҅E���ɩ{'#���ա�p"�_��^����1L^���onm����qHz���^�7�=?����23�ᴛ�1`"�!/z�,H��sR��9�S����b�s�`�Lv�D����F�Uuo��g�����˃��[/��!�t�J�'Oi��M)#ݸ�"�I�h�[�����:x�� ���S�Q�T㽤-ݤPY��ߪX � #h?�ID��)��Cq�8�Z�9.I��`�=�������=�K�LnWw���=|�o:;Pƌ�����~�#� ��O`���ѻM�hl*��&��--t�"��$�Æ�Ң�1p���V�<�}�q8K� ��+F~!֗N�|Nh�����=���>�LW)�!B��,(�x���0GM�Z,�Lj����m������I��y:ߴ&���jc݄ų���U�����89���?�y�lC��lH�.���G�a�<y{I�ەhp�� Z�"�L�C4�frk��Fi ���۵���蜫᧻;�L2��~��azǪ�����a�X{_�:���<`I�g3��n����:� ��s�x�{.[q�XU�����Ӿ��\�9�\ȎdT6���e( !���� Vb��2W!"��MJ���y�0�������i�Ō�"��&=� X%�?~��nʹ�u�]����Za�3�6w!�KQ����@g��J>�V{]Yt��7�Qu9�5����}�I��瓔��j&�T�A�����p�� ���t�C�������R^6���?���4� ˜�m����l�}O���o��;�J^X�gb·��`8˽�m+r���к����6! �2��ً�4l��+QP�"g�^7"2]��e�����m�\�L�����v���k'²�bѶ��>��_$�:�D�ǯ���@��#�{�wg"e�����g�c�0��Kh���0>9�5>������ӏ�<�T��d��"3#:����xUV�qi'|?����:��/�;�^��t@�)���t�(xa�����,�Ό�gX����?�H5��8��h��Ȗ�Tu�����TdY�Ts&�;�UAc�јw) r�l� í�ҫ��n���c�f�ٷ�����R���"�s$)�ޙ�$��ueV�Bcw��-G��\u����V�y-Y�kn�n���鲡N�V�����Ԡ�s��/��G�ԉx�EM?'�@���4���pX X�AGJ��*T�g�����nZ�Nme/m/-���q,P�G$����8~?�����Up��ڶ�6Q���-e����$M2{-Oh� k�A��m��n 0;7f�+�q�����-,�����x�V��&�8\v�d�@��ԡ��s��e�?�o��@;�����ડW��=��� �D��N��\�����ȏ�7'�c���5����MO����l[)~��.��)o��h�,֥��e)� J}2c�d�v���?�Z8X�l�g,��j�h7�fU,0u���]��<Y7s%{�]���>�3�%�=6�eZ6��U �#���~c��K��DȌ��X��C�5��4��9/��>��l`�J#l>-�p��;��V�n!���c���S���Cb�Q��{��AG]��}>�o?pϛy�ySݘ8��Kw���â�IA9{?�:�p������,�ü�UlAzdl6��^���&}4\�WpGZ�}p��,��E�8�b��湘���hPbV0�xF� �h=U�~<���C�H��tρF�+�n��� w9o3r���\��Mgk��\����L*59u�0��|�w\%;��Ǎk��z�R��\�� ��*���^�dA�N��-k�jl��� (hpJN#�oE�U,� P�kQ��C*#�7E���:���//E�oϻ�j� ��/�)|}��� �x��@��`��N����j��k�z2��Q__�n�� �#�8h��g�3 �q(��L7���8\�ܘ����ֺ�8��l��@j!�;#j�3���,��Vb._�s���X1��|}�j�r!�d�i�& j�{�cZ��$G�I��sRN1ۡ����P��o� ZF �#�e�44�7k!����;5;J�ᐓ}<Y�Wh�>$�ɜvF�흽Z98yL���O YD�4��H���6�����1���.�@Џ]�]3z�{/��4�\�qn��|�Ej�\DY�l�d[@��@h���JV1l��z�ut�А�5 �!x��#F�@+I����CA��s4������R��6�,h���FC�5�eǚ�mW^� &gx�7Xs�K-�=7�u��iC�𩙐�"�<N0���Q<�s�ie�0a�x?�0j�l�.TT���6�kjap��� x������A��J�1>3�� =��L�5�W_NN�,]�a�� QH��Ɉ��� =�H���"��S���O."[g|%u�[}�z�����JK��k����,ٸk|G̴�5����@n7,�K�Zy�ݟg:����-:�Kk.�O0���/�7���9��ab��u��k��n+�]��P n��?16����� ,`nq$�Ȇ|B�����S�+眔��x��0�E�u�n@_2��/�&��ٮ�����˩�a�̷_n�e���;�
Static task
static1
Behavioral task
behavioral1
Sample
BadwareFreeValo.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
BadwareFreeValo.exe
Resource
win10v2004-20220812-en
General
-
Target
BadwareFreeValo.exe
-
Size
6.6MB
-
MD5
c60b80e1ba4ef40a10b207fcf69d6b99
-
SHA1
d2ad41768dd88dccc87f536a56e9843a1fb259b3
-
SHA256
cf4576f0d72dbbc00bd2d6a1084799f7e77cd3fcf1be9f5eae3c2d920fd7888a
-
SHA512
94658cc055d374ca0d5e972176a009bc2bb99bd9891216e2dd103b347ff82c952ca209a5985f6c2c118533ea804f3dd811ab1d315164af672ae215d1402de963
-
SSDEEP
98304:Np2l5y1mOyZp5sKlRQf79e/+JK6jQTSsY47JMv0QvFE574aHNiBwN/R666k+P7:NpsqMnjw7G+46kTgjsbGwf6VP
Malware Config
Signatures
Files
-
BadwareFreeValo.exe.exe windows x64
ac58f3a3bfb470a5023c2612630568ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
EnterCriticalSection
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
ntdll
RtlCaptureContext
imm32
ImmGetContext
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFreeCertificateChain
ws2_32
__WSAFDIsSet
rpcrt4
UuidCreate
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
atan2f
Exports
Exports
Sections
.text Size: - Virtual size: 719KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.\R, Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.BNe Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.K>/ Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ