IceFree (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
IceFree (1).exe
Size 1.4MB
Sample260807-14bcjsxtbx
SHA256 378cd51e9ce75d4af7de47d2faf481247052687ad2db4b2351092ac5192bfc9d
MD5 02a549257bc0fd86ba932e237f899732
SHA1 70c5c6505d27952ee02e654b9953ba66ae9a1303
SHA512 e207bea4c0a0621f19281531f04aeac6e4a91c145c28e0f0557c3a5c94695f69a91213d335fedc496c9db3a41c0253d66bb337fa09914375dd626474e78296f9
SSDEEP 24576:LbjMuwbnvpRi1omWVIi4Enez24UUUZyFlXgWgYDv:z+RI+VV3neKjUUZyFgWgYr
TLSH
T119659D1DB69B0669C9A2D87C827AA207F325B44D1B7049E373E404F87B97AEC1775E03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IceFree (1).exe

File Explorer

IceFree (1).exe

.exe 1.4MB

IceFree (1).exe

IMPHASH d3b73b576535b5482d2696c006b792e4
SHA256 378cd51e9ce75d4af7de47d2faf481247052687ad2db4b2351092ac5192bfc9d
MD5 02a549257bc0fd86ba932e237f899732
SHA1 70c5c6505d27952ee02e654b9953ba66ae9a1303
SHA512 e207bea4c0a0621f19281531f04aeac6e4a91c145c28e0f0557c3a5c94695f69a91213d335fedc496c9db3a41c0253d66bb337fa09914375dd626474e78296f9
SSDEEP 24576:LbjMuwbnvpRi1omWVIi4Enez24UUUZyFlXgWgYDv:z+RI+VV3neKjUUZyFgWgYr
TLSH
T119659D1DB69B0669C9A2D87C827AA207F325B44D1B7049E373E404F87B97AEC1775E03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

689288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\Desktop\Ice Free Test Driver\x64\Release\IceFree.pdb

kernel32

CreateToolhelp32Snapshot Sleep GetConsoleMode SetConsoleCursorInfo Process32NextW Process32FirstW CloseHandle WritePrivateProfileStringA CreateThread CreateFileMappingA LocalFree GetCurrentProcessId CreateProcessA MapViewOfFile GetPrivateProfileIntA GetPrivateProfileStringA WaitForSingleObject GetFileInformationByHandleEx GetLastError AreFileApisANSI TerminateProcess SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW GetLocaleInfoEx FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry VirtualAlloc SetConsoleMode GetStdHandle GetCurrentProcess SetConsoleTitleA GetModuleHandleW LoadLibraryW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte RtlCaptureContext OpenProcess GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar

user32

GetDesktopWindow RegisterClassExA UpdateWindow SetForegroundWindow PeekMessageA SetWindowLongW FindWindowW LoadIconW TranslateMessage SetLayeredWindowAttributes CreateWindowExA DefWindowProcA GetWindowLongA SetWindowLongA DispatchMessageW GetAsyncKeyState ShowWindow GetSystemMetrics keybd_event SetWindowPos DestroyWindow GetWindowRect SetCursor GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture GetKeyState GetClientRect IsWindowUnicode ReleaseCapture SetClipboardData SetCursorPos GetClipboardData EmptyClipboard CloseClipboard GetCursorPos OpenClipboard

advapi32

RegSetValueExA GetTokenInformation OpenServiceA QueryServiceStatusEx OpenProcessToken RegCloseKey ConvertSidToStringSidA CloseServiceHandle RegQueryValueExA OpenSCManagerA RegCreateKeyExA RegOpenKeyExA

shell32

ShellExecuteA ShellExecuteW

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Query_perf_counter _Thrd_detach _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

d3d11

D3D11CreateDeviceAndSwapChain

wininet

InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy _CxxThrowException __C_specific_handler strstr __std_exception_copy __current_exception_context __std_exception_destroy memmove strrchr strchr memcmp __std_terminate __current_exception memchr memset

api-ms-win-crt-stdio-l1-1-0

ftell __acrt_iob_func fflush __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos fclose fgetc __stdio_common_vsprintf_s fseek __stdio_common_vfprintf fwrite fputc _wfopen __stdio_common_vsprintf __stdio_common_vsscanf fread

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

_wcsicmp strncpy strtok_s strncmp tolower strcmp strcpy_s

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

abort _register_thread_local_exe_atexit_callback _c_exit __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate system _beginthreadex _invoke_watson __p___argv exit

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

sqrtf __setusermatherr logf log fmodf cosf ceilf atanf atan2f atan2 pow powf asin acosf sinf sqrt tanf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale