_ɳ"�{�)ֻ#$L��f�7,Oճ.��3�j�`���} o�rg��8eQ��j.��9N6[S�3H� Y-�,�U��:21��.N��@��^7 1~�J��lj{a��:"�,�k��>w#��ŋ��<d���ah|�hf��|x!q�|��c2���{tL�*o�Ѱ��}[��`�:����LNp;����n�1�d ����!.�uK����(E5�k!�p" P���������_�Y���8����Լ�q��7�u����c�Z����Yf(�:H��u�HS��7��p�M�K�!%��=���7ͦ��0ܤ��>H�~٤���}LTٸ�6W�3�u��{��-�9`�m�N���+'Z: o8���'ϋ��ަ�2�i\M}�h��K������Q&��ȶ���Y3 �u�=��b5�Bhe�r��a�c�R�7tm������c\�G`t��,���l��V��'�f��E��G1�R�H�M�_T�����I���D����w�k�"-Vo�d m���,�I ���#`�w�i}=�_���2��7��Y�z�lJ�h>5s��;��P��[������.�'#P.=BM ����=�K夼ҭM�H��j���ҝ��a[R��E2��2���d����p� U����Lx���v7��֓@��n�t�w��=2��b�g��79B��?0�V���U�� ������j����N��ĕ��Y���o_@��;������⤿�q��"Y8��Z)�yɗ��o��q��;d�K�h�3LD��;/��m�)?|k����2�d��7\����|�x����BAS�����K�AV�B4s��+�u1 $�[�i���n���=n�W�-�� K`/X��#��4ְNf-W(���-��-�����ģ%g���^v�9���Mx����^�����4-��sr$�%a�,帛���<sk��AM�GА�z)�Neا3@�?����@6v[M�������' +����s���/nn�o*��D���q���N� +F���}'q|�D!�O]B1��Ћ���S� �.�03����]7��7&Q��fQ�=�sD�T_-{�}�-Տ��=�8c)�#V]�a%*!��@/&���Ha�i�Y��w� �)C���B�%��WV�~�����%@��V^�.vA `m����o�? T�}�O, F���vo��'no<�v��q~q�!���$�fj�A^�F�}���j�3��(�_cHH���3]W�%�� r�EB��>��%��e���xtl�c�_���D��?8�Ib�;�h�i}�|~Gy�BDž���O����J�7�w�n_�zB��Zi�@ f5�>�bs��WS9-��N��� 0:R��������[� ۋ�/Ψ�u�������MJ����� �N������_� � bWd�}��!�q&Μɕ��9 ��I�ں�P갬����`�q�m`�3��6��y���!S�ţ������%�ۯ̦U\�e�0����C����e���H�� ߍs�;x�J(]�;R�Q�9�.�� ��������~T� ���Ǭ����p�����8^��S�� =ц�I~��>�O-���yOwn�����"Y<�Y���o�O��`n{'��Ӧ��E����I���Cy~J爃٣�;�,N%T0^`����Qޡ��.v�y�S<�~���h�N��|���+��Jֹ��@��g���U6N�(>E�� A/��>�JJѥ$O���t=�#�j�}�L�V�����}#���3�yjV�����u�MVq��,Ѐ�O7�v<m��ԟ^h�Eu��+kZ<8��z߆xI~Z�d�j;��A��pf�Dyk�2�>_�g<(U��ѳj� �o+@1�&��b�1c[�J��(��({�!#�{"#ג|�[������Z����&��>�S���W�6�\��v�W��wNJ�!T��z�XQ��.K�8�<�n0�z8 <\�2/������9CA+noZ++�֢�"��]��ȅ�S��?���J�� ˬ����N4��҇���]��*�����^2�*�.���F��j5���V����U,J�`�Y�َV���4��8����1Q���9�)�����T3�(�z��:������H��3WR��l�YTN��,?^����R�t'��`��a,��Q��� X��T1��D�76[��ɚ��B���L �qϤ��V-�-��n��5w~��j�/�����V(U�2�L�X���q�v lR ݇%����X����B@D�U������`:ޗzh��D�V�E&Bٙ��ta#����ރSD��z_�Յ���Y�+�<�;���IDp����:�ìS��*���<Ə%�����p�м����{��]�H���平s;��-8�m����H���T��HO��t�.' u�V����i����ug��<��|�D�C���0�qs���e!�H]S,��f�����9�o����5�'�.���� ��Cw/\�Tfd�zp�c�KΉ�[fvp:�?};?���f�rpC��c�D2l��X!� ch���g� ���b0��2[�.�D� ��q���i��.�[qtO��,8����kT���u�/w�Ty�19����?PG�s��q��!�נd\���$�<����cPh���߷�<탽��A��D߇���2���2��P>��`�,b�9 ܚL�^_����x�r8���Ɩ(���;�n,�M��,jb]���w^��JآW�rq����L֒f���j�A���������R펉�"a�y*3�3<�+�"q��%��ڐwDR�E������V�?r�߸��#�:ڒ����7������8l�Ka �y�����.L�o{��xr��F���D��R�%�w��h%{�ٛ�Y2�yh�a���N�O��ƚ=`��?���M,(��AXK��:����F�W�eV�ߎ�p�Qw���o�CU-mov�����!�╦Ƕ�靪k��*���R�E�.��YP���ڙa�aU��S�[@h��el����\��
Static task
static1
Behavioral task
behavioral1
Sample
BadwareFreeValo.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
BadwareFreeValo.exe
Resource
win10v2004-20220901-en
General
-
Target
BadwareFreeValo.exe
-
Size
6.6MB
-
MD5
ada216b77ddd4e5348a3b141e0134693
-
SHA1
10425d5f97105124ab33a4997371b141cb09b9ef
-
SHA256
116a80b9656d3f0e17d63cd0b0c8c846ae11eed78ba84b4fddba95ea5d6f13e4
-
SHA512
4529e0d8f684020edbce9f056b8349207abf4b49cf94475ab21b73bfb4ae16c7046b36e3be289a08e825fb33145d7ab5612c492ad1e279d550c0a133a62b1a1b
-
SSDEEP
98304:3dOKCra5ySTQQpENgTHIhXJKqm0UAiAO2g0XoBY7iVZ1KUsEhXFvaqup0JKbplGF:30KCu5IQpHUnRO2BaYM1KfqVSquz4k
Malware Config
Signatures
Files
-
BadwareFreeValo.exe.exe windows x64
fd6c059bc58363339c8b3da3c4cb7dee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetLastError
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcW
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
ntdll
RtlVirtualUnwind
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFreeCertificateChain
ws2_32
ntohl
psapi
GetModuleInformation
vcruntime140
__std_exception_copy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-stdio-l1-1-0
_open
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 744KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.u'[ Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.#Ft Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.#5S Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ