KenoFree[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
KenoFree.exe
Size 3.4MB
Sample260722-vxk1hsdp21
SHA256 b4793d8c33af862862adb516fc42d59e91c44f3c4289bcc39c7ad94b5b78787a
MD5 393a961e5735706f3a1171dd1b70400b
SHA1 29f03b924f4a747328311b52c27712e76fba25df
SHA512 1cfe3f7f07e58a11b9e48202151b8b0c14de396765eceab1f893f7f30564b57c759684844bde38097a2d44438d8327a5b296a87b85722992ea80af152cd0bcf3
SSDEEP 49152:ukMbIGker49kXtRm8zgaSnI2O0+yhh/qNwffAj3g/bTqSk6hAP7d:uXGerckdR81/lgQ/6S
TLSH
T137F5CF0BE3A345E9D662D13CC5226313E6B1B018173287DF2BE54966EF876F09EB9701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KenoFree.exe

File Explorer

KenoFree.exe

.exe 3.4MB

KenoFree.exe

IMPHASH 1e48d232eb3f0ed2c6dfb51e041b467d
SHA256 b4793d8c33af862862adb516fc42d59e91c44f3c4289bcc39c7ad94b5b78787a
MD5 393a961e5735706f3a1171dd1b70400b
SHA1 29f03b924f4a747328311b52c27712e76fba25df
SHA512 1cfe3f7f07e58a11b9e48202151b8b0c14de396765eceab1f893f7f30564b57c759684844bde38097a2d44438d8327a5b296a87b85722992ea80af152cd0bcf3
SSDEEP 49152:ukMbIGker49kXtRm8zgaSnI2O0+yhh/qNwffAj3g/bTqSk6hAP7d:uXGerckdR81/lgQ/6S
TLSH
T137F5CF0BE3A345E9D662D13CC5226313E6B1B018173287DF2BE54966EF876F09EB9701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1484324

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\kacza\Desktop\KenoFreecomeback.pdb

d3dx9_43

D3DXMatrixTranspose D3DXVec3Transform D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

VerifyVersionInfoA GetTickCount Sleep MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SetLastError FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId LocalFree GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW CreateThread GetFileAttributesExW CreateFileMappingA UnmapViewOfFile QueryPerformanceCounter FreeLibrary SleepEx GetTempPathA MultiByteToWideChar ExitProcess GetStartupInfoA GetProcAddress LoadLibraryA GetLastError GetCommandLineA GetModuleHandleA GetCurrentProcess GlobalUnlock AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead CreateDirectoryA GlobalLock GlobalAlloc GetTickCount64 ReadProcessMemory VirtualProtectEx CloseHandle Process32Next VerSetConditionMask QueryPerformanceFrequency GetSystemDirectoryA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection GlobalFree EnterCriticalSection CreateToolhelp32Snapshot WideCharToMultiByte OpenProcess Module32First Module32Next Process32First VirtualFreeEx VirtualAllocEx MapViewOfFile HeapFree HeapAlloc ReadFile CreateFileA GetFileSizeEx

user32

ScreenToClient GetCursorPos LoadCursorA TrackMouseEvent SetCapture SetCursor GetClientRect GetWindowThreadProcessId GetForegroundWindow GetAsyncKeyState mouse_event ClientToScreen GetCapture GetKeyState SetClipboardData GetClipboardData SetWindowDisplayAffinity EmptyClipboard CloseClipboard SetWindowLongA OpenClipboard GetSystemMetrics UpdateWindow FindWindowA PostQuitMessage DispatchMessageA GetWindowRect DestroyWindow UnregisterClassW RegisterClassExW ShowWindow MessageBoxA MoveWindow UnhookWindowsHookEx DefWindowProcA SetLayeredWindowAttributes TranslateMessage PeekMessageA GetWindowLongPtrA SetCursorPos ReleaseCapture

advapi32

CryptDestroyHash OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx SetThreadToken LookupPrivilegeValueA SetTokenInformation PrivilegeCheck RegGetValueA CreateProcessAsUserA RevertToSelf CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptEncrypt CryptImportKey CryptDestroyKey GetTokenInformation CryptHashData CryptCreateHash

shell32

SHGetFolderPathA SHParseDisplayName ShellExecuteA SHOpenFolderAndSelectItems

ole32

CoInitializeEx

msvcp140

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Random_device@std@@YAIXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z

ws2_32

WSAStartup ntohl gethostname sendto recv recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket send WSAGetLastError listen bind connect htonl accept WSACleanup closesocket WSAIoctl getpeername getsockname WSASetLastError socket getsockopt htons setsockopt ntohs

normaliz

IdnToAscii

crypt32

CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertFindCertificateInStore CertOpenStore

wldap32

ord143 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord217 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

urlmon

URLDownloadToFileA

imm32

ImmAssociateContextEx ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memcmp memchr memset memmove memcpy longjmp strrchr strchr strstr __std_terminate __std_exception_copy _CxxThrowException __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode realloc _callnewh calloc free

api-ms-win-crt-runtime-l1-1-0

exit _invoke_watson _errno strerror terminate __sys_nerr _beginthreadex abort _configure_narrow_argv _register_thread_local_exe_atexit_callback _c_exit _initialize_narrow_environment _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _getpid

api-ms-win-crt-string-l1-1-0

strncmp strcmp strpbrk strncpy strcspn strspn isupper _strdup tolower toupper

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-convert-l1-1-0

atof mbstowcs strtod strtoll atoi strtol strtoul strtoull

api-ms-win-crt-stdio-l1-1-0

fclose _read _write _close fgetc __p__commode _wfopen _lseeki64 fwrite fgets __stdio_common_vsprintf _open feof fgetpos fputs fopen setvbuf ungetc __stdio_common_vsscanf fflush fsetpos fread __stdio_common_vfprintf fseek __acrt_iob_func ftell _set_fmode _get_stream_buffer_pointers _fseeki64 fputc

api-ms-win-crt-math-l1-1-0

_hypotf sqrtf acosf cosf fmodf atan2f log logf __setusermatherr _dclass pow _dsign powf sinf ceilf

api-ms-win-crt-filesystem-l1-1-0

_access _lock_file _stat64 _unlock_file _fstat64 _unlink

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64