freedom[.]v0[.]94[.]3[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

freedom.v0.94.3.zip
Size

507KB
MD5

2b49f6b23abf94845925fed00a57d515
SHA1

4d3212fc74d5fb13f83f4d990c47165e70e4dc65
SHA256

0db433e95fedaa65bf599771a91a55ad495c78bc00e81201e937429fd98559aa
SHA512

65b7d809096becf1ccab3e62f3cce6b41ebec651fc60a0928f3e7b9045da1d844bd059e1a18ed0863eb4b2bcdfa8ac8b201758a33a3cc4ef150c3025e15a9e1b
SSDEEP

12288:K+/IdPOH3roDLBiu/jf8xfAyAXHlhrt69xkQdVvuFlL158lNRCKApmil:B/IdPSoDL7/z8xfAy4rt5mmFlLDiNRfC

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/freedom.dll
unpack001/freedom_injector.exe

Files

freedom.v0.94.3.zip
.zip
freedom.dll
.dll windows:6 windows x86 arch:x86

121cde6d75e4ec93f689fa0e0c5acf93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryDataAvailable

opengl32

wglGetCurrentDC

user32

EnumWindows
WindowFromDC
GetWindowThreadProcessId
GetKeyState
GetMessageExtraInfo
ScreenToClient
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCursor
GetClientRect
IsWindowUnicode
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetSystemMetrics
SendInput

oleaut32

SysStringLen
SafeArrayPutElement
SysAllocString
SysFreeString
SafeArrayGetLBound
SafeArrayDestroy
VariantInit
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayCreateVector

kernel32

GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileSizeEx
GetConsoleOutputCP
WriteFile
FlushFileBuffers
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
GetStdHandle
LCMapStringW
HeapFree
HeapAlloc
ReadFile
ExitProcess
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
InterlockedFlushSList
RtlUnwind
VirtualFree
GetCurrentProcess
GetModuleHandleA
Sleep
CloseHandle
CreateThread
GetProcAddress
GetCurrentProcessId
FreeLibrary
WideCharToMultiByte
K32QueryWorkingSetEx
VirtualProtect
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
MultiByteToWideChar
GetLastError
IsProcessorFeaturePresent
DeleteCriticalSection
CreateToolhelp32Snapshot
Module32FirstW
GetModuleHandleW
Module32NextW
VirtualQuery
GetModuleFileNameW
VirtualFreeEx
GetCurrentThreadId
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
GetLocaleInfoA
QueryPerformanceFrequency
QueryPerformanceCounter
RaiseException
FreeLibraryWhenCallbackReturns
DecodePointer
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
LocalFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
SetStdHandle
CreateFileW
HeapSize
HeapReAlloc
SetEndOfFile
WriteConsoleW
CreateThreadpoolWork

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext

Sections

.text
Size: 463KB - Virtual size: 463KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 245KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
freedom_injector.exe
.exe windows:6 windows x86 arch:x86

85857586e412a48f0d1b7921ce4e0cfd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
GetFileAttributesW
GetFileSizeEx
GetLastError
Sleep
GetExitCodeProcess
MapViewOfFile
UnmapViewOfFile
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileMappingA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RaiseException
RtlUnwind
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
HeapSize
HeapReAlloc
CloseHandle
DecodePointer

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

121cde6d75e4ec93f689fa0e0c5acf93

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

opengl32

user32

oleaut32

kernel32

imm32

Sections

.text Size: 463KB - Virtual size: 463KB

.rdata Size: 245KB - Virtual size: 244KB

.data Size: 11KB - Virtual size: 22KB

.reloc Size: 19KB - Virtual size: 19KB

85857586e412a48f0d1b7921ce4e0cfd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 94KB - Virtual size: 94KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 2KB - Virtual size: 6KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 463KB - Virtual size: 463KB

.rdata
Size: 245KB - Virtual size: 244KB

.data
Size: 11KB - Virtual size: 22KB

.reloc
Size: 19KB - Virtual size: 19KB

.text
Size: 94KB - Virtual size: 94KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 2KB - Virtual size: 6KB

.reloc
Size: 5KB - Virtual size: 4KB