Static task
static1
Behavioral task
behavioral1
Sample
foxiware.free.exe
Resource
win10-20240404-en
General
-
Target
3c4c57.rar
-
Size
11.7MB
-
MD5
f9fb796f68c23e179a68d7dbdef162a1
-
SHA1
9d453e7d9749181ee7905625f224376d35d5d8c4
-
SHA256
02dca1ad7f3b01bff90e1ae951c3bb0b9f87549f5d7c3a23349769e83eabf91c
-
SHA512
586aeae26c5a6efa4c95248e95512825a2809945eb779d4bc4db73abd1f67f06faabf0d3d6f1b9a63b5785bf4ca272a5ab854a87cd0ca6a15018334b34c3fe15
-
SSDEEP
196608:Xef2H5DlhDrr+BBTgRxMtdEXzvOJJJzntKkufF9PCvgmPP1P4eqrgKp5Lf9X4NVX:XDHbRrr+BWbMDErOJNcPygutP4ewgO16
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/foxiware.free.exe
Files
-
3c4c57.rar.rar
-
foxiware.free.exe.exe windows:6 windows x64 arch:x64
8e2b811b6749e92dbc38d347cf65d959
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MonitorFromWindow
gdi32
CreateSolidBrush
advapi32
CryptGenRandom
shell32
ShellExecuteA
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
wininet
InternetCloseHandle
ntdll
RtlInitAnsiString
dbghelp
ImageDirectoryEntryToData
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
rpcrt4
UuidToStringA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_purecall
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
llround
api-ms-win-crt-string-l1-1-0
isblank
api-ms-win-crt-runtime-l1-1-0
perror
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-utility-l1-1-0
qsort
ws2_32
getsockname
normaliz
IdnToAscii
crypt32
CertCreateCertificateChainEngine
wldap32
ord217
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 542KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DP? Size: - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ToF Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.3j_ Size: 13.2MB - Virtual size: 13.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ