Reverse Free Perm[.]exe

Resubmissions

13/06/2024, 12:19

240613-phhzqaybpg3

13/06/2024, 11:58

240613-n46ggaxflh9

Sharing

Copy URL Twitter E-mail

General

Target
Reverse Free Perm.exe
Size 736KB
Sample240613-phhzqaybpg
SHA256 16a011eac8a7ecd0777eb1d4e1feebe9221bdb222b421c0906177e6198b3e644
MD5 c2c696e2c2368686a4ebaff993688bfc
SHA1 ed187bf2120d9da913f0b531312941873c7f03fd
SHA512 bd303dc11ea7af6c234a53bfdbb0137c37cd35cdd20d119279048ffa807c600eac6c595da9ba607dc548d7a2631af85e0b13c21e2b4161b2abf1962c84512e15
SSDEEP 12288:xYZCya5NuXZ8l6B2iFv1heQHU/6kQhQOhfaTYZMc5:xYEyamZk6BJFeQHU/67G2S0ZMc5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Reverse Free Perm.exe

File Explorer

Reverse Free Perm.exe

.exe 736KB

Reverse Free Perm.exe

IMPHASH b723a9c55e3aeb54fd428f11c50fdbe5
SHA256 16a011eac8a7ecd0777eb1d4e1feebe9221bdb222b421c0906177e6198b3e644
MD5 c2c696e2c2368686a4ebaff993688bfc
SHA1 ed187bf2120d9da913f0b531312941873c7f03fd
SHA512 bd303dc11ea7af6c234a53bfdbb0137c37cd35cdd20d119279048ffa807c600eac6c595da9ba607dc548d7a2631af85e0b13c21e2b4161b2abf1962c84512e15
SSDEEP 12288:xYZCya5NuXZ8l6B2iFv1heQHU/6kQhQOhfaTYZMc5:xYEyamZk6BJFeQHU/67G2S0ZMc5
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

575612

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\vunch\Desktop\Sources\Perm-Unban-Spoofer\x64\Release\Solution.pdb

kernel32

MoveFileExA WaitForSingleObjectEx MultiByteToWideChar GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx WideCharToMultiByte GetTickCount FindClose FindFirstFileW GetFileAttributesExW GetLocaleInfoEx VerifyVersionInfoA LeaveCriticalSection LoadLibraryA GetProcAddress FreeLibrary GetSystemDirectoryA QueryPerformanceFrequency VerSetConditionMask AreFileApisANSI GetFileInformationByHandleEx InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead QueryPerformanceCounter EnterCriticalSection LocalFree FormatMessageA SetLastError QueryFullProcessImageNameW GetModuleHandleW GetModuleHandleA GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect CreateThread GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx SetConsoleTitleA GetProcessHeap OutputDebugStringW HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError CloseHandle GetConsoleWindow Beep SetConsoleCursorInfo Sleep GetConsoleCursorInfo GetStdHandle SleepEx CreateFileW

user32

MessageBoxA GetWindowLongA SetWindowLongA ShowWindow SetWindowPos

msvcp140

??1_Lockit@std@@QEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setf@ios_base@std@@QEAAHHH@Z ??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z

normaliz

IdnToAscii

wldap32

ord200 ord301 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord30 ord22 ord26 ord27 ord32 ord33 ord143 ord35 ord79

crypt32

CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA CertEnumCertificatesInStore CertOpenStore PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertCloseStore CertFreeCertificateChain CertGetCertificateChain

ws2_32

WSACleanup accept WSAIoctl WSASetLastError socket listen ioctlsocket setsockopt ntohs __WSAFDIsSet select getaddrinfo freeaddrinfo htons recvfrom getsockopt getsockname sendto gethostname ntohl connect bind WSAGetLastError send recv closesocket WSAStartup htonl getpeername

rpcrt4

RpcStringFreeA UuidToStringA UuidCreate

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler _CxxThrowException __std_exception_destroy __std_exception_copy memchr memcmp memcpy memmove memset strchr __current_exception strrchr strstr __current_exception_context __std_terminate

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv system _initialize_narrow_environment _errno _initialize_onexit_table _register_onexit_function _crt_atexit terminate _seh_filter_exe _invalid_parameter_noinfo_noreturn _set_app_type exit _get_initial_narrow_environment _initterm _beginthreadex strerror _invalid_parameter_noinfo __sys_nerr _resetstkoflw _initterm_e _exit _cexit __p___argc __p___argv _getpid _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_read feof __p__commode _close _open __stdio_common_vsscanf __acrt_iob_func _set_fmode fputs fopen _popen _pclose fgets _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fwrite __stdio_common_vfprintf fgetc fflush fseek ftell fputc _write _lseeki64 fclose

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh realloc calloc

api-ms-win-crt-math-l1-1-0

_dclass __setusermatherr _dsign

api-ms-win-crt-convert-l1-1-0

strtoll strtoull strtoul atoi strtol strtod

api-ms-win-crt-filesystem-l1-1-0

remove _access _unlink _unlock_file _lock_file _stat64 _fstat64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-string-l1-1-0

strncpy strpbrk tolower strcspn isupper _strdup strncmp strcmp strspn

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-utility-l1-1-0

qsort

advapi32

AddAccessAllowedAce CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA ConvertSidToStringSidA CopySid SetSecurityInfo CryptEncrypt CryptImportKey CryptDestroyKey IsValidSid InitializeAcl GetTokenInformation CryptDestroyHash GetLengthSid OpenProcessToken

shell32

ShellExecuteA