atlasfreefn[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
atlasfreefn.exe
Size 386KB
Sample260716-xe4e9afv9x
SHA256 27ee58565da7d35204e0939dc3034c5e2d6cf81d6d8df5dc2487ab35fed92aa9
MD5 1e13161271c47d6202ec9a180655a1cc
SHA1 45e0436c033cc2f39aa2bf4b106b035872d11a99
SHA512 b066bf226bfced2a34aaa9936429357e1474e363af36394c114ad81d964ba544c0365f9750d49b09c873972e47eabc509cf851280fb5117cd296e7b32c80bcbb
SSDEEP 6144:9fIhYQAeEE/Wwz+h9urdvvg+ImtH+X9jZPdQZfSaAhnhMOj6MknsPd+bnj:yYQgEg+EtgZNCknsl+bj
TLSH
T1A9848E86F1A490E5D0AFA078916BB30BE975384D07505ACB73E84D943BE37E07BBA741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
atlasfreefn.exe

File Explorer

atlasfreefn.exe

.exe 386KB

atlasfreefn.exe

IMPHASH 50727867994cefa97036ba38af278932
SHA256 27ee58565da7d35204e0939dc3034c5e2d6cf81d6d8df5dc2487ab35fed92aa9
MD5 1e13161271c47d6202ec9a180655a1cc
SHA1 45e0436c033cc2f39aa2bf4b106b035872d11a99
SHA512 b066bf226bfced2a34aaa9936429357e1474e363af36394c114ad81d964ba544c0365f9750d49b09c873972e47eabc509cf851280fb5117cd296e7b32c80bcbb
SSDEEP 6144:9fIhYQAeEE/Wwz+h9urdvvg+ImtH+X9jZPdQZfSaAhnhMOj6MknsPd+bnj:yYQgEg+EtgZNCknsl+bj
TLSH
T1A9848E86F1A490E5D0AFA078916BB30BE975384D07505ACB73E84D943BE37E07BBA741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

307588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BEST FREE CHEETOS SOURCES\atlas free\ATLASFREEFN\x64\Release\atlasfreefn.pdb

kernel32

CreateToolhelp32Snapshot Sleep GetTempPathA GetTickCount64 GetLastError Process32NextW CreateFileA DeleteFileA Process32FirstW CloseHandle ExitProcess CreateProcessA SetConsoleOutputCP lstrcmpiW WaitForSingleObject QueryPerformanceCounter UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime OpenProcess DeviceIoControl GetCurrentProcess GetCommandLineW RtlLookupFunctionEntry InitializeSListHead FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GetStartupInfoW GlobalAlloc RtlCaptureContext RtlVirtualUnwind MultiByteToWideChar

user32

GetSystemMetrics SetWindowPos DestroyWindow GetWindowRect GetWindowThreadProcessId ShowWindow PeekMessageW MapVirtualKeyA DefWindowProcA SetLayeredWindowAttributes TranslateMessage LoadIconW SetWindowLongW GetDesktopWindow RegisterClassExA GetKeyNameTextA GetKeyState SetClipboardData ScreenToClient ClientToScreen GetForegroundWindow LoadCursorW SetCursor GetClientRect GetAsyncKeyState UpdateWindow DispatchMessageW SetCursorPos GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos EnumWindows

advapi32

OpenProcessToken LookupPrivilegeValueW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW SetThreadToken PrivilegeCheck SetTokenInformation RevertToSelf

d3d9

Direct3DCreate9Ex

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler memset _CxxThrowException memchr memcmp __current_exception_context __std_exception_copy __std_exception_destroy strstr __std_terminate memmove memcpy __current_exception

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func ftell __stdio_common_vfprintf fflush fclose fwrite __stdio_common_vsprintf_s __p__commode _set_fmode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fseek

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncpy strcmp strncmp _wcsicmp strcpy_s strcat_s

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _seh_filter_exe _exit exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _cexit _invoke_watson system _crt_atexit _register_onexit_function _initialize_onexit_table terminate _initialize_narrow_environment _set_app_type _configure_narrow_argv _initterm_e

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-math-l1-1-0

sinf sqrtf fmodf atanf ceilf pow atan2f atan2 cosf asin acosf powf logf tan sqrt tanf _dclass __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale