Static task
static1
General
-
Target
Free.exe
-
Size
4.8MB
-
MD5
27481ca39df51853063858acf309eef1
-
SHA1
910e35289392e1b0fbb80ce11efe67acd9a4b725
-
SHA256
5af9e9621b048bac3c09441ca834f5e72abc2bf21582275839eefc9a2b4c3cc1
-
SHA512
21b7ce8247278df20fb1f0e015de9775d5352380d6cbecb42638ee48ae923040fff232ef28d9df3da42e6c8d0344a1df9a04ca40124ceb0d409c69d905a15ed7
-
SSDEEP
98304:AL2k4isTmgJK6TCxfd1duxdgRwtF9ee9J9a86CBVWQqrUJVAZBQ7uPZ:A6/iYN46TCxxuxdOwT9D9bJzRq4JVAZR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Free.exe
Files
-
Free.exe.exe windows x64
51555472f731edc7b7cbe240a909503d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeSListHead
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
TranslateMessage
msvcp140
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
imm32
ImmReleaseContext
d3d9
Direct3DCreate9Ex
normaliz
IdnToAscii
wldap32
ord26
crypt32
CryptQueryObject
ws2_32
__WSAFDIsSet
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
ntdll
RtlVirtualUnwind
dbghelp
ImageDirectoryEntryToData
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-string-l1-1-0
wcscpy_s
api-ms-win-crt-stdio-l1-1-0
fgets
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
atan2f
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
getenv
advapi32
OpenProcessToken
shell32
ShellExecuteA
Sections
.text Size: - Virtual size: 814KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.6;+ Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.N2' Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Wv) Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ