���+�7S&J���@e���3�Go:�ٍ���P�g#R������E��YhP�� �Lĝk����G�B���xG����]��M���� �B�����b���/F!H��G��(���ε��٧qr�������`�=�&Ծ��i��Dp%'6�a�լ�WO�9&��c��, ���w�R-�W4���L�_��w�#�3��h�h����\-��(A-�L�L��+X(��ؽ�iն?��8T粿 "$�L �;��wG`wچR�� |�.��7:?oM�W)w���c��TF�t%U�\|�+�Zg*�a�!�).�ؤ:@���;�U� w8D�"�9��������u��N�q� yjKƓ����������Bz���6�b���w|�b ��<�����/����+M��FCH��V ���&�1^�! �������b���VM=�=��1%�:��f�Ή��E%��сF��<5�M�ں��m�� ڢ�����h�p �2��|��K6O[2�{~]h�>��|��Ԙ7@ˈ\��k.߲>� ��q����ϣB8<�� Q�>t����(1��15+��ܸ(Q3t9����cs:�/��X� G@v��v��*� _�������Ǟ�|�>c�Z���b�kI��tN�iYP�lxNe� �8���� 9�SK�yw�Xk����']?�K Tv�����[m�v��!ס�{ZuO�ڰ�~Y�{�mc:��.<�3��d����"��[x�� �N�!r!��5��pH�����Zr����|嶼���\�yD��ûY�.E<�*;E��.K��;Ӡ�l �֡�3*���!K��;������kM�� _nݒ�͈ݾ��&p�^�M�!7U����`c=�|�E���v���c�����\�i?>s�h�(��n����VI���nK����� 0[�I�ő *��n\rb�RK�@�� ��������Ƴ�u�J����i=&�[��Ƅ�L���*�m\;"D���������_��G�Tc��}�ܔV�6�#���`�����1 q3ڸ��RS��)�����,4�f�v���~�d%K De:�(A�k4ϵ˚�������9��E>1A��hY��8����"~``J|�� 5F����-��JF4���_gN�C�,���!@T{I͇�X���CQ�%�Z���;���q���ߨ�-!��&8���3�$^. �_� q,�r����i�lH��wO#|�jrg���Y��C�n���&^?+R�>����)z���Z�ӥG5\#+��-s[�ǁO6�������s�zʽ��� p�k �׃|ê�o�ыa���z���3�#���V��#ո�ͳ!<.}$�������9$�m:М?h�#7q��dL��E0]a{ހ���-1L���pIÛy6�>d��Y8�Pl/�E�v���f�%��>;��a�dA�?LY4u����L�ą_���NHt������z�to���vSh�l��_����&H��M�wdYo�vA,���Sʄ $U�B�O�Wu[GM������N0���r��&.����#�Vʗ�7��&�bW`��9���I�=6J���q������I7��ԍϋ��ϵT�̟�<P�d�#�_��6���Xo��O)�VZ)Ac�Y�s�����薢@fs�����GV ���1�W�3�=G�{��nIPrN��ж�Gsf��Z�S=l�v g� ��M��x�ף+�����Zb��A;��t�q�k�C�N��""�4��ʸ�^en{�E,ug�:z���$H2Q���Rb�n�SR�e�CaaZ��Q1��ݟ�����T������X���"@�,�W2���"<�0Gf"t������i~����}��e����X� y[W�Ӭ5�M��8C�8[�m��H���]Z�H�<�0 9��Μ�⫆�c����?�G�����8{o���4ԋ�oh��fU>���ݿ���k;�\u3�;�]��8���)��#5g�!��ǟK#x�U�"1n�5_/\3��=s$�o�Ӡ�ƥ�άLϮ��i�,349j���z-�lSƌ�c����_��b�nȗ�.�ÿgL����=��%6k����a *.�pv��ћY��8�L>\b4G���`6���Sg���u��'�p�����A�������穢�=@��b�6��.8�P�[a<�~��ۧg�^D�h���C����9���(��gM� ��+��j�$�:H.-5� �]->,�JSԻ6X�2J�-��Də�B �o6��oʽ�!�_ڠp�L�V���qgV��o���݃��V��6p�ˇ�[�Zd� ����"DTP~R��պ J~�Ⱦ��b7��p�4��|>�пT�;M�\�^j .�.m�)��C��-gX�k���q�ݷmv����~�y-i�V�@�Q�d d�c�ԌԯM������O��U��\���LeZ#�/ Խ�Ą>�GT.m�t�yT��1�`&o���x����5oL�$}TK9gvŹ]�-��FS��e�~?�>�y�]Z!m`����T������@����{�M�4�HT������U�I�q �1�XD�����>�n��P�[i����WVr}l#�O����Pdm��T S}��v��������4��������#��� �e�pr��ّ����Cd�_Ҋa},3��Ot�=��L�%��ˠn��]��"w͕�cUޙF�.�}��x�S^/gw���Mg[���Vk[����Ô5f�C���z�� ����3U�;�̃qc�qt@�F��pl�$J���ń$�0��nT������ASf���Z(1]Ԯ�����2���,]_�ؕ_R������vtI4�H�����kQrD���л6����������7��\�L�F0J��O��NMC#6�ɛrE^e����7����]��^����ZbjRI|����W%Y����jZ#mХnc���n����{��4�@v��ry�GN�p�5M��< FB���4��b�W��${t9��b����{�y���髶ހ(�Tj<����v��<�f����y%s�fUV�9�l3`}��g��
Static task
static1
Behavioral task
behavioral1
Sample
BadwareFree.exe
Resource
win10v2004-20231215-en
General
-
Target
BadwareFree.exe
-
Size
7.2MB
-
MD5
6ec04fa24f0695f286801366108942f3
-
SHA1
309ee6a08c8ab0159dc3137865b6cfeb9f3e4e04
-
SHA256
ae27243a53f4c399aeb6bb39e67fa79f8378d51ef6b4fef9263791ec1acb6e78
-
SHA512
d835f387bb19b353f58eb72a94c2b32857826f3f1322c7b5be253a6dc3b2c6a9cf4cd0340ab001df74092899346bd0e4d1dfa8c5c8d77a2893b418311103a6b5
-
SSDEEP
98304:cMYzS+CQQ4vBmVK0Psj6+qU483Aj9urJBSzrAhzZVT6e3JKPfjV4ZTNy6oeZ2gCc:KS4qKsW80FIryV4fZo0/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BadwareFree.exe
Files
-
BadwareFree.exe.exe windows:6 windows x64 arch:x64
d32aa1ff669713b856a599a48cb39d61
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
getsockname
wldap32
ord27
crypt32
CertCloseStore
advapi32
CryptAcquireContextA
kernel32
ExitThread
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
CharUpperBuffW
shell32
ShellExecuteA
ole32
CoUninitialize
rpcrt4
RpcStringFreeA
iphlpapi
GetAdaptersInfo
bcrypt
BCryptGenRandom
Exports
Exports
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 791KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 868KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.>nn Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.`RL Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.{~g Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ