Static task
static1
Behavioral task
behavioral1
Sample
FreeScript.exe
Resource
win10v2004-20231215-es
General
-
Target
FreeScript.exe
-
Size
913KB
-
MD5
799c188cf6df366f4c0f98b8800a4977
-
SHA1
161d6006518879ecba6cf45b29599992d8eadfce
-
SHA256
32e96ac5e9d2f869ad11ca48401ca8eaeb520027751427145ddb5ab43bce1841
-
SHA512
32a3749f4ef40e9345644c84666207a7c4f0369274cc18f71eecd1eeb6ea22733bc4cc6751f7281bbdff7e0a2187209a6c00653a95d6d39adb4dab06f355e1b1
-
SSDEEP
12288:Oxav1AVHL4i+u35DWVEogz69eUvkR8sgLLyTzvXrkveB1lvctx0OjQgoyCnramAF:Oav1AVvKVNj9eUvknfvnvcD0Ojl7CnC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FreeScript.exe
Files
-
FreeScript.exe.exe windows:6 windows x64 arch:x64
48ea5580192fd1f09633f4bedc115042
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryPerformanceCounter
SetPriorityClass
GetCurrentProcess
Sleep
CreateThread
Beep
SetEndOfFile
HeapSize
CreateFileW
HeapReAlloc
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
CreateDirectoryW
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
OutputDebugStringW
GetFileSizeEx
GetConsoleOutputCP
VerifyVersionInfoW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
ReadConsoleW
GetConsoleMode
SetFilePointerEx
WriteFile
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetFileType
GetStdHandle
ReadFile
LoadLibraryExW
FreeLibrary
TlsFree
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
GetLastError
GlobalFree
GlobalAlloc
FlushFileBuffers
MultiByteToWideChar
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
RtlUnwind
user32
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
DispatchMessageA
keybd_event
GetSystemMetrics
GetAsyncKeyState
GetCursorInfo
GetWindowTextA
MessageBoxA
TranslateMessage
SendMessageA
mouse_event
PeekMessageA
PostQuitMessage
FindWindowA
GetWindowLongW
AdjustWindowRectEx
GetKeyState
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
WindowFromPoint
SetWindowTextW
ScreenToClient
ShowWindow
GetCapture
SetWindowLongA
ClientToScreen
IsChild
GetMonitorInfoA
GetForegroundWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
SetCapture
SetCursor
SetWindowLongW
GetClientRect
UnregisterClassA
RegisterClassExA
ReleaseCapture
SetForegroundWindow
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos
OpenClipboard
gdi32
GetDeviceCaps
advapi32
RegOpenKeyExA
GetUserNameA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
shell32
ShellExecuteA
xinput1_3
ord4
ord2
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
d3d9
Direct3DCreate9
shlwapi
SHDeleteValueW
magnification
MagSetFullscreenTransform
MagSetFullscreenColorEffect
Sections
.text Size: 712KB - Virtual size: 711KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ