atlasfreefn[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
atlasfreefn.exe
Size 389KB
Sample260724-2jls8agm2v
SHA256 a5eec85f950103e1e4a7cab0cf93f857184d0a0f96e2ecb7fc19c957d7571715
MD5 e63a5078d2e690cd3b2781d99b8f085c
SHA1 8cf845ac5eebe3f72f2d1a569f295232b9b49975
SHA512 64a1d69a928ebf677f6d8894f8909052d773d7880e2bf03f9d4dbce8c738a1573e5774031b1b3985a6490c589409263ae0ced193e67d751dd8c4b31d1dcf84d5
SSDEEP 6144:mx0xfS+8SvwBwEpE9gnXbSKghEA/cNVJjWPcNSz6QbL4x0gX8rPnYcZb:pfepTgh4/XSzPnY
TLSH
T1A8848E86E1A480F9D06BA078956BB30BE935384C07505ACB73E84D952FE37E07FBA751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
atlasfreefn.exe

File Explorer

atlasfreefn.exe

.exe 389KB

atlasfreefn.exe

IMPHASH 50727867994cefa97036ba38af278932
SHA256 a5eec85f950103e1e4a7cab0cf93f857184d0a0f96e2ecb7fc19c957d7571715
MD5 e63a5078d2e690cd3b2781d99b8f085c
SHA1 8cf845ac5eebe3f72f2d1a569f295232b9b49975
SHA512 64a1d69a928ebf677f6d8894f8909052d773d7880e2bf03f9d4dbce8c738a1573e5774031b1b3985a6490c589409263ae0ced193e67d751dd8c4b31d1dcf84d5
SSDEEP 6144:mx0xfS+8SvwBwEpE9gnXbSKghEA/cNVJjWPcNSz6QbL4x0gX8rPnYcZb:pfepTgh4/XSzPnY
TLSH
T1A8848E86E1A480F9D06BA078956BB30BE935384C07505ACB73E84D952FE37E07FBA751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

310460

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BEST FREE CHEETOS SOURCES\atlas free\ATLASFREEFN\x64\Release\atlasfreefn.pdb

kernel32

CreateToolhelp32Snapshot Sleep GetTempPathA GetTickCount64 GetLastError Process32NextW CreateFileA DeleteFileA Process32FirstW CloseHandle ExitProcess CreateProcessA SetConsoleOutputCP lstrcmpiW WaitForSingleObject QueryPerformanceCounter UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime OpenProcess DeviceIoControl GetCurrentProcess GetCommandLineW RtlLookupFunctionEntry InitializeSListHead FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GetStartupInfoW GlobalAlloc RtlCaptureContext RtlVirtualUnwind MultiByteToWideChar

user32

GetSystemMetrics SetWindowPos DestroyWindow GetWindowRect GetWindowThreadProcessId ShowWindow PeekMessageW MapVirtualKeyA DefWindowProcA SetLayeredWindowAttributes TranslateMessage LoadIconW SetWindowLongW GetDesktopWindow RegisterClassExA GetKeyNameTextA GetKeyState SetClipboardData ScreenToClient ClientToScreen GetForegroundWindow LoadCursorW SetCursor GetClientRect GetAsyncKeyState UpdateWindow DispatchMessageW SetCursorPos GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos EnumWindows

advapi32

OpenProcessToken LookupPrivilegeValueW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW SetThreadToken PrivilegeCheck SetTokenInformation RevertToSelf

d3d9

Direct3DCreate9Ex

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler memset _CxxThrowException memchr memcmp __current_exception_context __std_exception_copy __std_exception_destroy strstr __std_terminate memmove memcpy __current_exception

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func ftell __stdio_common_vfprintf fflush fclose fwrite __stdio_common_vsprintf_s __p__commode _set_fmode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fseek

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncpy strcmp strncmp _wcsicmp strcpy_s strcat_s

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _seh_filter_exe _exit exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _cexit _invoke_watson system _crt_atexit _register_onexit_function _initialize_onexit_table terminate _initialize_narrow_environment _set_app_type _configure_narrow_argv _initterm_e

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-math-l1-1-0

sinf sqrtf fmodf atanf ceilf pow atan2f atan2 cosf asin acosf powf logf tan sqrt tanf _dclass __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale