}���}��?��8c��������� o��_��/V+%�A���#���L���Rn~k(�A��C��7���=z5������R���CL7�4���Q�.�l輟������9}>p�dȴ�*Z�H��@RN� ����{��CͰú�m�n������L)`���-�$N���'�!j�>�{y���y.��h���H0�x�u���H�O���7/�%��QR$�Õ�mU�V��l��w�q��%��:>Y|�, KJL�b����02�V}��������t��������x�p�f�[�V�82�5*�ErMw��9�$��o ���L�bo;쵠N~_�R�\O�41����1��m��X�=d�_\A��s)ly��J��o��yHX���h� �KOZL����Ƨ�v�ȼ�.p���y#�4B1�����?��x\���9��A����.�ʲ�<���_N��E�$F{�\I��OH�<��_~�����r+�J>�3��JZ����}�̾�A�=[�C�R�5�5,�ax�D}7V"���)uKrJ_C~ms���c��OUC�pDO(0��^�=>�ԸBo��}C�զ���sk���Z�� 7��C�=r�9c�tR���B��ꅺ�����x�>�ݫZՙ��ce���v��t�U��>�Z����b%)A�5l����Х� �c�����U|#Y��4/"#��?�J�<����E��>!�ID��z0s;��0�7��Y9�+��9Ϟ}� /Ҕ�M��b�~Kݲ��H6��.'1[�!ܖ�����mZ��bM'�$Oc\&����i�=�N���Zʓa^���� [F�����q�L���l��e@dT���8EM��4���ϧQǺ�7~�y���e�_\�3���(��!�#��|�^-�>��{aVy譂B�B�4�k��H�#�3D���;u w��<|��'2�͜<�2����-�B�y8^�>9�϶�Dm1H������ 2�����;e�b��1`㴺Б�Ś����^��f�ѧ��ۯc��"�I����MG��_�r ];r�+�r]O:��J�����I����+��)�)����7�*������0�8�]�k�]l�</��s�;��l24�S��.�n��B���i;��ءecNz|)l_�5O��Q���L��v" �� �!\+LX��i\I`9�C;��"�k�}��f�oQ���,���S�48yrÅ���Z� ���'�c��:��e@�T���߲|{7���D��k7C����$�!��7 ��e�����N��B�V*h�R|_�](D1�S����*梶�םz��WWl�C���c���}&�8����l�_�������ڟ8�#2����* "p:�TwXkCO���^�§��fޡD�ո�;�:���'=��� �2#fdsQ�! ���3΄u�W 5�V�o�p6j�߁%����,T�hy��^��aR�\�z@^9*:w�S���3�H$o��T��2��.� x�@v�ɶb��;Ϲ���z���X���t��wT�>�����.F�a~����6a"�!ש�� �����n�'a�Ե��b��F��N�Lk� Y5�u�j���2���>���i��MvP303�r ����Q��ƀ����Hc� ۰a��7����0�uZ�L�,� ���U��Յ��Y�dÂ�X?;�S�� V���_�#G6(�E8bUp5��5tt�\;�-�Z�t=���!/b`A�Z.L�p���#2�a�ӊ�ҕYc,"�����Y���`w��,�x�\7���{��fH糜�9���$vO ��Kz�[��Ne0��Y0OB��:�v��3�dV9Y|�� �4ը/sk�*&��>YHL���l*���M�j�d���w�Ġ�Cd��T����š �k%m-B���j�����B����<��%�6(��1�2���'�{|�t��i!"<��T�\/HZ����I� 9������z)N�֏`�������}������_A]��/k�� κ��Ÿh����R���� ���"N_���A���X��s!^����=*e��i��_S��+��M��Vh5�0����:B�� 8^x�nR�0x��� m_��/�������c <[��%8$ZS�J��.x^�l�^��lD��f9�L@^f�>���V:����&���/�襣.�;r����w�6S��o+��:)�N�1[�ip�NQ��Z+B\@���K��5M�u���߳eG���`��L�R����d� O#����� ǂ7^�����Ě�_�7����%�̐6�)�㰘7S���݁��O>��"F��}2�J�������G����9�)٢�����ٝ�f;��V}/9��h��hS�#��� �B��)���'�R2����]�>#� ��0p9ҿS6o-���gn�6�w�\�#��@�������^'���������"����Ͷո'Q��Մ)�o���6w�{5yPC�O�Y57P?=�\�zj�+�O��CT����0j�A��2!" Й�t�9v��l�V�MꞾ�]1V�<� SM`��<.xz!y~UB���f�C1��p�,�2���4k�,�o��N�c��tUH>��KY���>v�J�>A%�7u��VPu�3)��)>�vl�L�\|��dAZ��+>0.�Y��`H��?�͕�zQ�?��w{]�W�ͨ�Jw��ځIq�B��t�d`��?�K�8�h�3���m$ް�p�λ҅{G��7�E"V]��Q���,�ns�M��[yi�O���\(}��<�f����������e����_*��RL�Q�K�����ɨ���uŧ��� R�[�Z�`����7�9�b���?�~�.E&EQ��3�������`r����K]tg�����0�������2�V��x�� ��ɉ��m�A�;� ���i�3�M-�D>H,E���_7��UK����\xhI5>����LG�t-����;���J7�=^�P�_��ZW�+��u�N�AT�!��������!��)�=�83��Z�t��xa��cf�
Static task
static1
Behavioral task
behavioral1
Sample
AcessFree.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
AcessFree.exe
Resource
win10v2004-20230703-en
General
-
Target
AcessFree.rar
-
Size
5.4MB
-
MD5
3a3ad7ec0bf4f589d16cf59eeb741333
-
SHA1
bc3c11544bce24fd20a629fac65d0e449d5c0b38
-
SHA256
9c4de7650b236976eca384d1b0f82037e5959b1f4b60c7ff39a1670703395d06
-
SHA512
d152c29193809d9b53c9a195fbe0d13d87e3a88eb9b48098d7179f657dd115fffffbd7b3ab29f27670e72db1458afe18fc8583ac59826c6cb735194dcbae44b5
-
SSDEEP
98304:nDehL66d6rnHVfh+Z94yjnvOGQA8C/ciK7peiZ2/7zkcuHbXnCi:nDoL6ZHVfhXGQA8Cnic8cuH7Ci
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AcessFree.exe
Files
-
AcessFree.rar.rar
-
AcessFree.exe.exe windows x64
10aaad497e5a8e68ebbeddad54f7bc92
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SleepEx
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
imm32
ImmReleaseContext
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemory
normaliz
IdnToAscii
wldap32
ord45
crypt32
CertCloseStore
ws2_32
send
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_fstat64
advapi32
CryptReleaseContext
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 728KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.main0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.main1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
tutorial.txt