q9V�z���>����}�pJE���o:�I�a�w�Y�#��s1:ONR�M���9�ҳU��ɞ�C7 �_�fi7�TN�8� ��œ�eØk�9r���]2�����V�<��&*0��\?�>�z�$j8�L�Y�����2Z֬9��8�S�U�TQ=�"y�d&��o��1��xF.�j#�L`��|� T�����ѳ\mՀ;\44�=�3$��ۉ�K5�c�G2��qJ�%��2h�6�����)����ʸ �*�����/�nۆg����}vH�K��r�Q� �w��N����5z��.�:� �=BR�q�%v`����C�-�LÉgu�:Q�Oh�w� e�N�^H��4�i�o���r�TJ�G<:#A���J��Ë��QN��3��Z�q��̥ޤ�S��V���g>��vm����YDߐ��n?r��$3<w�7��r�e�ȭv8N�3�Pā G�4z�Q-(E���FL}��L!�e��H1���E���Ա9 g�BK*e�d%�Ww�_�D�����ʩ|�\���&��!t-PEԺ�d?]�c�l��v2_iJF��0H���I�,���1Z��s��F��:t�t�P�� ����g p2�RI�]��7�Y��8�m#�5���ng�W�&Q�� }�9}�b���Bp�τۜL� ��V�;^��K4F���Z�T#����x���2(u�<�w��8dr�z� �K \w����3��4gB���af�p����r��]�Ђ`�H:v|>25*G`ape����#����tN�q올�<�~�b�1挜�I�����q���U���H(5?.����#���\���F��t֒y��Q��8��:A#A6��Çπ���r4N�������%&�}��t&�)�m2j4#Q���kT��(�w)�Gx8K1���%B��B�z�*�ZPO�GZ�xV�u����B-�j�I|k_x�+b��c`���K���C5�YT�(�vT{�{����4�/����]ԏ���^�*k�%C�z�6��m{���<�5>��;�a��O1RKS�3�]��pT�9c7¿]s�����t80�Aw��zқs�í�!B}�±,���/s`2�ޝ=��pJ�E�Ԭ���d�njj5�����N~��6#84I�T8R؎tɓh�>v(��3��+K�H'�3�`d�Z�[s�D�|��9�C_����ɳV�y��\j��3H[�fIZ�Dy�����F���� ��&��5�H�e3���̮Ƞ:W�q��tc8�'�Y"�`�/��e�t'��w{i�\ Ù@�5�����K�����S �VL�ld��S�/�^3�C� HPa��3� R�Ⱥ����/������k��x�d�r��y3��A��♔$�yF�����a������t�7f�|3�0���HTo�\��k "~1QM|3�r��G�{Gea��lܴ�� ���ڂg�M�D��4T]��K]���`/ V�����sF��7��X�auSf� ~�Ho �o� �ߴH�.k"��ʋ�w����.���:C�������l諗M7��S ��]a�l�व.��2B �u{����g�9����Y�����0���k�^��U��$v�����7��ph�@Ӝ���`��cq>|�{�ew�|�}�� �IF\�����+=��Sq��Gts���B�\��gy1��Ի���E�b��z�R;��Z����7���h��H�!�k�����dGQ�W���0��8���ƭ�O��k�3?�`b�:�ʽ�eiQ׃��e+]ȇt�-"AbX�wIb���t2�#���8@���8��E��d���)�9 �=��Ak��Un���uU�e���H�k��"�����p�[��+G ��+�|�4 ���2�������~������$.������j��%sLu��«c�91��{�H�ϯ��K��i�_Q�����7�ز�-���=>D~�)|6ԝ���� A�F@�W~������k�EŌ�b#�7����0�$¼��v�7H����V���L����x�J+ظ���[pr�z�����xyi�DI����T��Hץ���Y G�X{X�4QWu�ff��&���� �����uz-J�"̾���D���Vh�rtc�=l������R~�6�"���J��<�.�С�r��Vx��<�x?&�}��e>7 ?¡����:��$%��>͉�"� ye�g>Hi:�T�6Y� w�,�Bi���p�y�9�p���_�tŠ [��u `��Θ4w��1��[��;���ƋZH�Ce�$7���guų$�c��ip�O$�g������4����*��vE��P^���b#�ETwg�_"W4�!^�k��n��5�WL��&!��lc�-���,#�E����g�&��q{&�RP�1 ���z����wN�L/����6��l Ȧi���1A��y�Y�sTz)�V�!�d_9 ͦ#�c�%m��Dʾ/QK�s�Z �J� q��o{�=9+�I�4���A�c���� ��mqg₥�"1Ib�ת�-0-ߤ�9�:����AC��~znSR:�"3I���5�����r*dD&�4��L?b{;M��vP���s�^�����#h���*�r���s¢(;Hy�M���@]��IJ�W7B��gC[��-�=-��0T��wuв� �â�:<?�.��:w3�$��E�EJ\��>~@b�iO�b>�Qo�����fv㌔6�t��;Ծ���c8g.��2� ��v �����(\�*ڞ ��Y��C�^���c�OƧ���:�'n82�T�R�+:�V�y��$��1\a��A�Q ��K�G�M��R��= �� B�aZr�sz?C����>iF���Sy$�5~ةa�]q䫩܁�V����Y�&pd���Z��Jt�}�7�t`���ںX���-qW��3cd����!��-��@rL��f��m����u00�vh7Cu���26?bxA�W �R�!$r"�x��1�Rn�lT ���ʸ��� ^�T��⎾P=C�-�L�����P���کM���e���]7m��VX��1^��]
Static task
static1
Behavioral task
behavioral1
Sample
free.exe
Resource
win7-20240220-en
General
-
Target
free.exe
-
Size
6.2MB
-
MD5
cfed224f0e753bf34b8bffabfba8479c
-
SHA1
bcee57728c634793c6052014b796805e5228507c
-
SHA256
57a5f69ecb165f207619bd57d9e90d9bffe9fce42aaf791480d8e33174044411
-
SHA512
1eee0590536bf57cc5900b6feaf9a0f266bdb7ad920b78caa6a891d79127ec02300e3e673feb5e61bcd4538d2def4ce3383cdb17a10178e4694818dd3dafbb14
-
SSDEEP
98304:ljqCvkjEYbpWmvDRIG2tBUTB0l6eCFyQ6RjE9jFe9yTsSg2LFDwbiUoI9GM67SKj:ljejbxyBo0l6RPTe9EvLFEirMT7e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource free.exe
Files
-
free.exe.exe windows:6 windows x64 arch:x64
2b4ef3badb2bf61f65efd94817299019
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
FreeSid
msvcp140
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-stdio-l1-1-0
setvbuf
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.v20 Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.v21 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ