Static task
static1
Behavioral task
behavioral1
Sample
Freac-1.0.32.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Freac-1.0.32.exe
Resource
win10v2004-20230220-en
General
-
Target
Freac-1.0.32.exe
-
Size
7.6MB
-
MD5
b4275d4806e778d01b0ba1cfcd50f183
-
SHA1
2ade37c7b406342989bc4157305acc388ffbbfb1
-
SHA256
56e07d9ba190d418b1840ccea31008ff884474e1f04561f3dba4ce9bdba320af
-
SHA512
27ab29c7ac2fed58f62ba202d2608523ab405f4176eb6353fb7a7309d3b26c809e281bde0bb49543cb22b1db4acb6d30bd51451d3ca70356af05bc769e4ebe77
-
SSDEEP
196608:15ZrLhYJwlcUmSVoAdd7Wz6stoh/OSm1Fk2p4m0f:1DhY6CiLddKestmWzvkq4D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Freac-1.0.32.exe
Files
-
Freac-1.0.32.exe.exe windows x86
3e0046d10b32a10c46207cc182f02b85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
gdi32
CreateFontA
CreatePen
CreateSolidBrush
DeleteObject
GetDeviceCaps
GetTextExtentPoint32A
LineTo
MoveToEx
SelectObject
SetBkMode
SetTextColor
kernel32
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetExitCodeProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetTempPathA
InitializeCriticalSection
LeaveCriticalSection
MulDiv
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
_hread
_hwrite
_lclose
_lcreat
_llseek
_lopen
msvcrt
_fdopen
_itoa
_mkdir
_rmdir
_stat
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_ftime
_getcwd
_iob
_onexit
_setmode
_vsnprintf
abort
atexit
calloc
clearerr
fclose
fflush
fopen
fprintf
fputc
fread
free
fseek
ftell
fwrite
malloc
memcpy
remove
signal
sprintf
strcat
strcmp
strcpy
strerror
strncpy
vfprintf
shell32
ShellExecuteExA
user32
CreateWindowExA
DefWindowProcA
DestroyWindow
DrawTextExA
FillRect
GetSysColor
GetSystemMetrics
GetWindowDC
RegisterClassExA
ReleaseDC
ShowWindow
UnregisterClassA
Sections
.text Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 104B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE