freestuffs[.]rar | Triage™

Resubmissions

15/07/2026, 18:40

260715-xbb7lafv4t

15/07/2026, 18:01

260715-wlvk9aat8k3

15/07/2026, 16:07

260715-tkmg5sgs2n10

Sharing

Copy URL Twitter E-mail

General

Target
freestuffs.rar
Size 4.6MB
Sample260715-xbb7lafv4t
SHA256 1374d47c40ac721529d40a99c8cb6a0c722f8993dc4bf5231e22ae3d7b3af1ce
MD5 aed00d6bf33e9d5adad3f33c67c7aa12
SHA1 7255539aa6da757a9be6407d36d0b66f4e261ebf
SHA512 2f78c1ab47df84ce70670011848265a567f2dc25bb0f185bad383bf4298ed0ecae204529cf25646fc7c2be04e5e87f0da114fbbb92ea759ea05306063d3d320f
SSDEEP 49152:U6kzQgHK60AgRQUNBVP7+riYj6JyXgUP7JzVnPP7tzVnxP7YzVnlP7tzVn3:USsdg+UNBIrBGyXXzVn5zVnGzVnfzVn3
TLSH
T12326331E5B1D1F7996E2F243DA8AF8A53FE0C5546F3F30D16A4A672E67C0B02D748844
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/freestuffs/AP.exe
unpack001/freestuffs/EU.exe
unpack001/freestuffs/EU.exe.bak
unpack001/freestuffs/NA.exe
unpack001/freestuffs/NA.exe.bak
unpack001/freestuffs/injector.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/freestuffs/Internal MAGIC BULLET.dll

File Explorer

freestuffs.rar

.rar 4.6MB
freestuffs/AP.exe

.exe 4.5MB
freestuffs/EU.exe

.exe 4.5MB
freestuffs/EU.exe.bak

.exe 4.5MB
freestuffs/Internal MAGIC BULLET.dll

.dll 477KB
freestuffs/NA.exe

.exe 4.5MB
freestuffs/NA.exe.bak

.exe 4.5MB
freestuffs/injector.exe

.exe 120KB

freestuffs.rar

SHA256 1374d47c40ac721529d40a99c8cb6a0c722f8993dc4bf5231e22ae3d7b3af1ce
MD5 aed00d6bf33e9d5adad3f33c67c7aa12
SHA1 7255539aa6da757a9be6407d36d0b66f4e261ebf
SHA512 2f78c1ab47df84ce70670011848265a567f2dc25bb0f185bad383bf4298ed0ecae204529cf25646fc7c2be04e5e87f0da114fbbb92ea759ea05306063d3d320f
SSDEEP 49152:U6kzQgHK60AgRQUNBVP7+riYj6JyXgUP7JzVnPP7tzVnxP7YzVnlP7tzVn3:USsdg+UNBIrBGyXXzVn5zVnGzVnfzVn3
TLSH
T12326331E5B1D1F7996E2F243DA8AF8A53FE0C5546F3F30D16A4A672E67C0B02D748844
MD5 SHA1 SHA512 SSDEEP TLSH

Password

yTbI4ZDYCdLCJcQBh3XKRmOu||

freestuffs/AP.exe

IMPHASH c0188ca665cf3d8581b7ff29f13f774b
SHA256 b2c969f0a57aec05f3ed9eb676ba066f07fb4381dc0ae76d289631e4afc48ef9
MD5 926bac80766e9ec3d36010b884d5ee3f
SHA1 a7fd517517414afc1cd6840dbdd879f365f8866d
SHA512 e99c6096bcfa8ebc2af153b721ab7f755e9f1a553af0f84b5ef87ea241446ff5b5aa0ca7e789facfd56c091db56cd26f601bebfb773dbd83c7ab668e41b53d6a
SSDEEP 49152:fhZYKmP6MctN/cfNfdpMvZ7pNMD5TXhnAWdHdVdZdLdvdAdPd1bdUd77dud3dXpM:s6yNfPMvZIgSbs8J2o4GQE
TLSH
T16926F69329DB0CF5DED267B875CB22399734FD32CE681B2B9648C12469532C4BD2EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

yTbI4ZDYCdLCJcQBh3XKRmOu||

Minor OS version

Major OS version

Entry point

1855488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext LookupPrivilegeValueW OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptBinaryToStringA CryptStringToBinaryA

kernel32

CancelIoEx CloseHandle ConnectNamedPipe CreateEventA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DisconnectNamedPipe DuplicateHandle EnterCriticalSection FileTimeToSystemTime FlushFileBuffers FormatMessageA GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStdHandle GetSystemInfo GetSystemTimeAdjustment GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 HeapAlloc HeapFree InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LocalFree OpenProcess OpenThread OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleTextAttribute SetConsoleTitleA SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess Thread32First Thread32Next TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WriteConsoleOutputCharacterA WriteFile

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr wcsstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_errno _set_invalid_parameter_handler abort exit strerror system

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf_s _fileno _fileno _fseeki64 _ftelli64 _get_osfhandle _lseeki64 _read _setmode _wfopen _write fclose fflush fopen fputc fputs fread fwrite getc getwc putc putwc setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _wcsicmp iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscoll wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

shell32

ShellExecuteW

user32

GetAsyncKeyState GetForegroundWindow

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

freestuffs/EU.exe

IMPHASH c0188ca665cf3d8581b7ff29f13f774b
SHA256 4e4a5bc54814a36edea4a4b3e88cf5af49a3fa9f9bfa7ede5fc03286c07616c7
MD5 84406024256c6b92b357a15de6840103
SHA1 5e3d7894e45b617a3b7dd31ba7be821b1ed852f2
SHA512 d171c2d90c9376303c61a3c10e079fa2a3f9b2fe4324605ded086b53e7f4543aabf07d867d94482d2ad1b4ece34be99ad2840d048ae7e9e5e6eb74efd799b1ab
SSDEEP 49152:fhZYKmP6MctN/cfNfdpMvZ7pNMD5TXhnAWd0dVdZdLdvdAdPd1bdUd77dud3dXpM:s6yNfPMvZIjSbs8J2o4GQE
TLSH
T1E126F69329DB0CF5DED267B875CB22399734FD32CE681B2B9648C12469532C4BD2EB41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

yTbI4ZDYCdLCJcQBh3XKRmOu||

Minor OS version

Major OS version

Entry point

1855488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext LookupPrivilegeValueW OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptBinaryToStringA CryptStringToBinaryA

kernel32

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr wcsstr

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _wcsicmp iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscoll wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

shell32

ShellExecuteW

user32

GetAsyncKeyState GetForegroundWindow

winhttp

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

freestuffs/EU.exe.bak

IMPHASH c0188ca665cf3d8581b7ff29f13f774b
SHA256 b2c969f0a57aec05f3ed9eb676ba066f07fb4381dc0ae76d289631e4afc48ef9
MD5 926bac80766e9ec3d36010b884d5ee3f
SHA1 a7fd517517414afc1cd6840dbdd879f365f8866d
SHA512 e99c6096bcfa8ebc2af153b721ab7f755e9f1a553af0f84b5ef87ea241446ff5b5aa0ca7e789facfd56c091db56cd26f601bebfb773dbd83c7ab668e41b53d6a
SSDEEP 49152:fhZYKmP6MctN/cfNfdpMvZ7pNMD5TXhnAWdHdVdZdLdvdAdPd1bdUd77dud3dXpM:s6yNfPMvZIgSbs8J2o4GQE
TLSH
T16926F69329DB0CF5DED267B875CB22399734FD32CE681B2B9648C12469532C4BD2EB41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

yTbI4ZDYCdLCJcQBh3XKRmOu||

Minor OS version

Major OS version

Entry point

1855488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext LookupPrivilegeValueW OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptBinaryToStringA CryptStringToBinaryA

kernel32

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr wcsstr

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _wcsicmp iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscoll wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

shell32

ShellExecuteW

user32

GetAsyncKeyState GetForegroundWindow

winhttp

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

freestuffs/Internal MAGIC BULLET.dll

IMPHASH eecaaa413d00642a04cd6a7ec2bcb683
SHA256 89190818555e0c9c445e925710cee9f88bc7d035d1c4a136d20f9a216895ab7d
MD5 0f9604d1cc8643840e73e23b45e67083
SHA1 1ba8e98f958425607a1e1efa4d87bd76d0b3f2f2
SHA512 30615f464d43bab7ac7595aececf4a8a54db0d41c25d42fe4c54539f74890e34ac277413d8b23c65032da51c70f727ccba3140e7d462ff87d3232b507c7466e3
SSDEEP 12288:KJq0bc62kQCLo7wBlZnbTX+wIGjn/dycm4khBSN:KJq04KH+wIidWhBSN
TLSH
T10BA46C1DA59602BCE172E4B45A725C13FA717C4E0764A9DB13E0CCB91F2ABD4A73BE01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

yTbI4ZDYCdLCJcQBh3XKRmOu||

PE Signature issue

Digest

f3:dc:de:d0:3c:c8:db:cf:f1:89:e8:b0:ab:3e:0b:fd:f0:36:8b:e9:d8:fe:a6:15:74:48:b6:fd:d4:8a:6c:3a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN

Chains

Jul 15, 2026

CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN

Serial Number

36:ea:f6:1d:c3:95:f6:30:41:f4:24:7d:ae:76:ab:7e

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 9, 2016 - Aug 12, 2018

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

365488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\valorant_is_gay\int\hmm Nice\x64\Release\Internal MAGIC BULLET.pdb

kernel32

Sleep GetLastError DisableThreadLibraryCalls Beep DeleteCriticalSection AllocConsole VirtualQuery MultiByteToWideChar GetTickCount64 GetFileAttributesA GlobalLock GetTickCount GlobalUnlock FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive OutputDebugStringW IsDebuggerPresent InitializeCriticalSectionEx VirtualAlloc GetModuleHandleExW SetConsoleTitleA WideCharToMultiByte VirtualProtect GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW GetFileAttributesExW CreateFile2 AreFileApisANSI CloseHandle GetFileInformationByHandleEx LocalFree

user32

GetAsyncKeyState GetKeyNameTextA GetKeyboardState GetSystemMetrics MapVirtualKeyW CloseClipboard GetClipboardData ToUnicode MessageBoxA GetCursorPos CallNextHookEx OpenClipboard

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?narrow@?$ctype@_W@std@@QEBAPEB_WPEB_W0DPEAD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?uncaught_exceptions@std@@YAHXZ ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?good@ios_base@std@@QEBA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?id@?$ctype@D@std@@2V0locale@2@A

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __std_exception_copy memcpy __C_specific_handler __std_exception_destroy memmove __std_type_info_destroy_list memset _CxxThrowException __current_exception_context __current_exception __std_terminate

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc

api-ms-win-crt-stdio-l1-1-0

fflush fclose ungetc fgetc __stdio_common_vfprintf fsetpos __acrt_iob_func fwrite _fseeki64 fread freopen_s setvbuf __stdio_common_vsprintf _get_stream_buffer_pointers __stdio_common_vsprintf_s fputc __stdio_common_vswprintf_s fgetpos

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _beginthreadex _crt_atexit system terminate abort _errno _cexit _initterm _initterm_e _initialize_onexit_table _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _execute_onexit_table

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

iswprint isdigit tolower strcmp strlen toupper wcslen

api-ms-win-crt-convert-l1-1-0

strtol strtof mbstowcs strtod

api-ms-win-crt-math-l1-1-0

sin powf fmodf fmod cosf sinf fmax cos ceilf atan2 atan acos roundf fmin sqrt

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

freestuffs/NA.exe

IMPHASH c0188ca665cf3d8581b7ff29f13f774b
SHA256 0400be06069bcaf0dc6e30afb27a788920b1737411857321b01115e0ea76656f
MD5 e7006d68be23b07892870dc55c247f37
SHA1 50fecac76d0068698499fcff5bd3e62707d4a956
SHA512 6fc11abdf06e695b44ebdfd797e6fe60b7ae40433ca069751ba901a556a4e3bc365137095137123e0afbf208c650823a349662414b5f2e1d76d866c525ea09b8
SSDEEP 49152:fhZYKmP6MctN/cfNfdpMvZ7pNMD5TXhnAWdTdVdZdLdvdAdPd1bdUd77dud3dXpM:s6yNfPMvZIgSbs8J2o4GQE
TLSH
T12826F69329DB0CF5DED267B875CB22399734FD32CE681B2B9648C12469532C4BD2EB41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

yTbI4ZDYCdLCJcQBh3XKRmOu||

Minor OS version

Major OS version

Entry point

1855488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext LookupPrivilegeValueW OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptBinaryToStringA CryptStringToBinaryA

kernel32

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr wcsstr

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _wcsicmp iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscoll wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

shell32

ShellExecuteW

user32

GetAsyncKeyState GetForegroundWindow

winhttp

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

freestuffs/NA.exe.bak

IMPHASH c0188ca665cf3d8581b7ff29f13f774b
SHA256 b2c969f0a57aec05f3ed9eb676ba066f07fb4381dc0ae76d289631e4afc48ef9
MD5 926bac80766e9ec3d36010b884d5ee3f
SHA1 a7fd517517414afc1cd6840dbdd879f365f8866d
SHA512 e99c6096bcfa8ebc2af153b721ab7f755e9f1a553af0f84b5ef87ea241446ff5b5aa0ca7e789facfd56c091db56cd26f601bebfb773dbd83c7ab668e41b53d6a
SSDEEP 49152:fhZYKmP6MctN/cfNfdpMvZ7pNMD5TXhnAWdHdVdZdLdvdAdPd1bdUd77dud3dXpM:s6yNfPMvZIgSbs8J2o4GQE
TLSH
T16926F69329DB0CF5DED267B875CB22399734FD32CE681B2B9648C12469532C4BD2EB41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

yTbI4ZDYCdLCJcQBh3XKRmOu||

Minor OS version

Major OS version

Entry point

1855488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext LookupPrivilegeValueW OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptBinaryToStringA CryptStringToBinaryA

kernel32

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr wcsstr

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _wcsicmp iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscoll wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

shell32

ShellExecuteW

user32

GetAsyncKeyState GetForegroundWindow

winhttp

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

freestuffs/injector.exe

IMPHASH ff3c50d74aa40efad4dc07060189227d
SHA256 d72c7ca912266d1570135e9e58754342dac6d7d2e0384a47d042fc0486a4d0b4
MD5 f267b6fa192ed3881b351e478764671d
SHA1 a24514a67a524ad670554e33d084b88fe0368380
SHA512 cd463c986514669022dd58a66675ad07bb10b4955afcd5f7f585bb19678bdd61121d392935b0272275986e0367d41bb9bf57630e94074c7ccac1ee89e6a87e69
SSDEEP 768:vMW6uyteoJ+cMKEU1CfOYM7o+HZVN2S7AHv7k5PwyMtBu6LR:vM7teoJ+0Y5+ZySczk5Psru6LR
TLSH
T158C35B4AE7A904FDD0B6C17EC9631D95D673F8194761ABCF0390522A0FB23C09D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

yTbI4ZDYCdLCJcQBh3XKRmOu||

Minor OS version

Major OS version

Entry point

36864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FreeLibrary LoadLibraryExW GetProcAddress GetCommandLineW WaitForSingleObject GetFileAttributesW OpenProcess Sleep CloseHandle Beep LocalFree GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetStartupInfoW GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW InitializeSListHead

user32

GetWindowThreadProcessId MessageBoxW PostThreadMessageW SetWindowsHookExW UnhookWindowsHookEx FindWindowW IsWindow

shell32

CommandLineToArgvW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

dbghelp

ImageDirectoryEntryToData

vcruntime140

__current_exception __current_exception_context memset __C_specific_handler memcpy __std_exception_copy __std_exception_destroy _CxxThrowException

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate _exit _get_wide_winmain_command_line _register_thread_local_exe_atexit_callback _configure_wide_argv exit _initterm_e _initterm _initialize_wide_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

wcslen strlen

Name

.text

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

636B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

freestuffs.rar

freestuffs/AP.exe

advapi32

bcrypt

crypt32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

shell32

user32

winhttp

generic

freestuffs/EU.exe

advapi32

bcrypt

crypt32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

shell32

user32

winhttp

generic

freestuffs/EU.exe.bak

advapi32

bcrypt

crypt32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

shell32

user32

winhttp

generic

freestuffs/Internal MAGIC BULLET.dll

PE Signature issue

kernel32

user32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0