a-shadow-over-freddy-s[.]exe

General

Target
a-shadow-over-freddy-s.exe
Size 479.6MB
Sample260720-w2f3ssbv9p
SHA256 9f5bdda361cda914e25a501c86c63d1203b6ac633ad1f7b7be185f5826c9f10f
MD5 d2516f376bba13033312e21f6f09aaae
SHA1 68e9589e8eb7b3afc2605b199f912428f3e52abf
SHA512 66ddc95a59d33903d204e12032cf089e90736bde155182ab7e2000ad35e023aa40784dbdee4d864125b70d38e1314a2d947605d0751dc3124afa01d9e6374385
SSDEEP 12582912:PLf5qgX9bYFgKtQrJa5Vfw/P4N6HeSS02625r:PFBX98FLEJ52R
TLSH
T1D039339DF090A18AD433A835CAB1E9B063741036904EC8F8E16E77D2B7D79DD1FA198D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a-shadow-over-freddy-s.exe

File Explorer

a-shadow-over-freddy-s.exe

.exe 479.6MB

a-shadow-over-freddy-s.exe

IMPHASH faac987cca0c4b64dfdd5177ceabbd32
SHA256 9f5bdda361cda914e25a501c86c63d1203b6ac633ad1f7b7be185f5826c9f10f
MD5 d2516f376bba13033312e21f6f09aaae
SHA1 68e9589e8eb7b3afc2605b199f912428f3e52abf
SHA512 66ddc95a59d33903d204e12032cf089e90736bde155182ab7e2000ad35e023aa40784dbdee4d864125b70d38e1314a2d947605d0751dc3124afa01d9e6374385
SSDEEP 12582912:PLf5qgX9bYFgKtQrJa5Vfw/P4N6HeSS02625r:PFBX98FLEJ52R
TLSH
T1D039339DF090A18AD433A835CAB1E9B063741036904EC8F8E16E77D2B7D79DD1FA198D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetExitCodeProcess Sleep FindClose CloseHandle GetModuleFileNameW CreateProcessW GetCommandLineW GetTempPathW GetTempFileNameW SetCurrentDirectoryW CreateDirectoryW RemoveDirectoryW FindFirstFileW FindNextFileW CreateFileW GetLastError ReadFile WriteFile SetFilePointer WideCharToMultiByte MultiByteToWideChar SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LoadLibraryW OutputDebugStringW LoadLibraryExW IsDebuggerPresent IsProcessorFeaturePresent HeapFree DeleteFileW SetEnvironmentVariableW GetCurrentDirectoryW GetCommandLineA HeapAlloc EncodePointer DecodePointer RtlUnwind HeapCompact HeapReAlloc HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress InterlockedIncrement InterlockedDecrement IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId GetProcessHeap ExitProcess GetModuleHandleExW GetStdHandle GetFileType DeleteCriticalSection GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException EnterCriticalSection LeaveCriticalSection GetStringTypeW LCMapStringW WriteConsoleW

user32

LoadStringW MessageBoxW MsgWaitForMultipleObjects PeekMessageW DispatchMessageW TranslateMessage GetMessageW wsprintfW

Sharing