Static task
static1
Behavioral task
behavioral1
Sample
PowerChanger free(1).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PowerChanger free(1).exe
Resource
win10v2004-20240802-en
General
-
Target
PowerChanger free(1).exe
-
Size
6.9MB
-
MD5
fe426d0c55e659f7855f5629b43526e6
-
SHA1
256a0e3eec6d6238aebcccd0bc38448d9d893b1c
-
SHA256
8d96024a5d49ac0c7516827f47f074f986e20cd2ba475e5d912a18ef89cadc0a
-
SHA512
7f59e96125c2002480e1cabc76cd2f1c250570e44c9a687a792d0cc5f75b2dc45f987ac6943bec67eed7cdaef0347a5721fe5e43e547daf60c10a4f710072600
-
SSDEEP
196608:sBYUOztYQC4wmOH2dWJMicb5zBXVnTekSIgOe:sAzupHjJdIbakSpO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PowerChanger free(1).exe
Files
-
PowerChanger free(1).exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
m8pZ^Y` Size: 194KB - Virtual size: 194KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
m8pZ^Y` Size: 194KB - Virtual size: 194KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ