freefn[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
freefn.exe
Size 384KB
Sample260712-b284csd16x
SHA256 61bd12a88e8a8a612b7341100ca58d9ddb2fa45f46508c0717bfd9495f25c978
MD5 b7e931f7d22a960627f6a9898d728a9f
SHA1 73aa609d5558cf8cc28c6da7eeac4cab6cdbeea3
SHA512 6e8e6039f7d66c4f84d8ce2f02f23411a4d71c7f2729351668700b12dc93b47693d9a6f9d198b173d6a77564863bc7d9afd05ffa3d6277fd099de4c96756e69c
SSDEEP 6144:MfPHa4q2jOq0Zz67zJhEiLXAXMbAIapO8PoEXUPOUwB1FdAfdwOjkRhjQHnnzpbv:sH0hIfuRpO8w2AOFknnzpvl
TLSH
T132848E45F1A440E9E06BA07896BBF60BE935384D075059CB73E84D942BE37F07BBA742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
freefn.exe

File Explorer

freefn.exe

.exe 384KB

freefn.exe

IMPHASH 5c4022e329154074c3cb20f51f1b861e
SHA256 61bd12a88e8a8a612b7341100ca58d9ddb2fa45f46508c0717bfd9495f25c978
MD5 b7e931f7d22a960627f6a9898d728a9f
SHA1 73aa609d5558cf8cc28c6da7eeac4cab6cdbeea3
SHA512 6e8e6039f7d66c4f84d8ce2f02f23411a4d71c7f2729351668700b12dc93b47693d9a6f9d198b173d6a77564863bc7d9afd05ffa3d6277fd099de4c96756e69c
SSDEEP 6144:MfPHa4q2jOq0Zz67zJhEiLXAXMbAIapO8PoEXUPOUwB1FdAfdwOjkRhjQHnnzpbv:sH0hIfuRpO8w2AOFknnzpvl
TLSH
T132848E45F1A440E9E06BA07896BBF60BE935384D075059CB73E84D942BE37F07BBA742
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

307584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BEST FREE CHEETOS SOURCES\free-src\x64\Release\SofMainFNBase.pdb

kernel32

CreateToolhelp32Snapshot Sleep GetTempPathA GetTickCount64 GetLastError Process32NextW CreateFileA DeleteFileA Process32FirstW CloseHandle ExitProcess WaitForSingleObject SetConsoleOutputCP lstrcmpiW SetUnhandledExceptionFilter GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OpenProcess DeviceIoControl GetCurrentProcess GetCommandLineW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GetStartupInfoW GlobalAlloc CreateProcessA MultiByteToWideChar

user32

EnumWindows MapVirtualKeyA PeekMessageW DispatchMessageW GetAsyncKeyState GetKeyNameTextA ShowWindow GetSystemMetrics SetWindowPos DestroyWindow GetWindowRect GetWindowThreadProcessId SetWindowLongW GetDesktopWindow RegisterClassExA UpdateWindow GetKeyState DefWindowProcA ScreenToClient ClientToScreen GetForegroundWindow LoadCursorW SetLayeredWindowAttributes SetClipboardData SetCursor GetClientRect GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos TranslateMessage LoadIconW SetCursorPos

advapi32

OpenProcessToken LookupPrivilegeValueW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW SetThreadToken PrivilegeCheck SetTokenInformation RevertToSelf

d3d9

Direct3DCreate9Ex

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate strstr __std_exception_destroy __std_exception_copy __current_exception __current_exception_context __C_specific_handler memset memchr memcmp memcpy memmove _CxxThrowException

api-ms-win-crt-stdio-l1-1-0

ftell __acrt_iob_func fflush fclose fseek __p__commode __stdio_common_vsprintf_s __stdio_common_vfprintf _set_fmode fwrite __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-string-l1-1-0

_wcsicmp strcpy_s strcat_s strlen strcmp strncpy strncmp

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_cexit _crt_atexit _seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e _exit exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table system terminate _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-math-l1-1-0

asin logf atan2 pow powf acosf sinf sqrt sqrtf tan tanf atanf ceilf atan2f cosf _dclass __setusermatherr fmodf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale