FreeWill.pdb
Static task
static1
Behavioral task
behavioral1
Sample
FreeWill.exe
Resource
win10v2004-20250314-en
General
-
Target
FreeWill.exe
-
Size
7.1MB
-
MD5
4318d93e4b3d3590f3b4c6c2cdd794f3
-
SHA1
166c8a860d24671c6236944d32f5713a91449893
-
SHA256
ebbb8769086dcf3f7bdaf9366cf6a5ac4c5ac981e4be3c69d08ce06fc80c2f28
-
SHA512
291b8fa416147008a6c703d1cae0006f26b91b1561e6919208bdf329622c1f1137bd7dad3f4f2707c33241db93d243ded74317aa7cb1bccfdb6926057f5413da
-
SSDEEP
196608:JOoKoTbXauPIo+8izlrAjDCbXauPIo+8iAo:XlT70Rcu7M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FreeWill.exe
Files
-
FreeWill.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 223KB - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ