IceFree[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
IceFree.exe
Size 1.4MB
Sample260808-e46mssbg37
SHA256 9e6d1db317972fd2caa18062ba0bb2ddecd7bee75de43cb77a5e8b37ebd1559a
MD5 727c75097efcd9e1c09153c23b09a0f9
SHA1 704b7befd11b4155339cf19ea26dbfd63e43a63b
SHA512 edaee250385e8dd12f34ea654026460a373cb3a14896d76c32794e81da001219fe5827cc47a1f4af7c6924a65edf8aefd580334d14c98e4929868c7175c4e5ad
SSDEEP 24576:LbjMuwbnvpRi1omWVIi4Enez24UUUZyFlXgWgYDv:z+RI+VV7neKjUUZyFgWgYr
TLSH
T1E6659D1DB69B0669C9A2D87C827AA207F325B44D1B7049E373E404F87B97AEC1775E03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IceFree.exe

File Explorer

IceFree.exe

.exe 1.4MB

IceFree.exe

IMPHASH d3b73b576535b5482d2696c006b792e4
SHA256 9e6d1db317972fd2caa18062ba0bb2ddecd7bee75de43cb77a5e8b37ebd1559a
MD5 727c75097efcd9e1c09153c23b09a0f9
SHA1 704b7befd11b4155339cf19ea26dbfd63e43a63b
SHA512 edaee250385e8dd12f34ea654026460a373cb3a14896d76c32794e81da001219fe5827cc47a1f4af7c6924a65edf8aefd580334d14c98e4929868c7175c4e5ad
SSDEEP 24576:LbjMuwbnvpRi1omWVIi4Enez24UUUZyFlXgWgYDv:z+RI+VV7neKjUUZyFgWgYr
TLSH
T1E6659D1DB69B0669C9A2D87C827AA207F325B44D1B7049E373E404F87B97AEC1775E03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

689288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\Desktop\Ice Free Test Driver\x64\Release\IceFree.pdb

kernel32

CreateToolhelp32Snapshot Sleep GetConsoleMode SetConsoleCursorInfo Process32NextW Process32FirstW CloseHandle WritePrivateProfileStringA CreateThread CreateFileMappingA LocalFree GetCurrentProcessId CreateProcessA MapViewOfFile GetPrivateProfileIntA GetPrivateProfileStringA WaitForSingleObject GetFileInformationByHandleEx GetLastError AreFileApisANSI TerminateProcess SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW GetLocaleInfoEx FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry VirtualAlloc SetConsoleMode GetStdHandle GetCurrentProcess SetConsoleTitleA GetModuleHandleW LoadLibraryW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte RtlCaptureContext OpenProcess GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar

user32

GetDesktopWindow RegisterClassExA UpdateWindow SetForegroundWindow PeekMessageA SetWindowLongW FindWindowW LoadIconW TranslateMessage SetLayeredWindowAttributes CreateWindowExA DefWindowProcA GetWindowLongA SetWindowLongA DispatchMessageW GetAsyncKeyState ShowWindow GetSystemMetrics keybd_event SetWindowPos DestroyWindow GetWindowRect SetCursor GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture GetKeyState GetClientRect IsWindowUnicode ReleaseCapture SetClipboardData SetCursorPos GetClipboardData EmptyClipboard CloseClipboard GetCursorPos OpenClipboard

advapi32

RegSetValueExA GetTokenInformation OpenServiceA QueryServiceStatusEx OpenProcessToken RegCloseKey ConvertSidToStringSidA CloseServiceHandle RegQueryValueExA OpenSCManagerA RegCreateKeyExA RegOpenKeyExA

shell32

ShellExecuteA ShellExecuteW

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Query_perf_counter _Thrd_detach _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

d3d11

D3D11CreateDeviceAndSwapChain

wininet

InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy _CxxThrowException __C_specific_handler strstr __std_exception_copy __current_exception_context __std_exception_destroy memmove strrchr strchr memcmp __std_terminate __current_exception memchr memset

api-ms-win-crt-stdio-l1-1-0

ftell __acrt_iob_func fflush __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos fclose fgetc __stdio_common_vsprintf_s fseek __stdio_common_vfprintf fwrite fputc _wfopen __stdio_common_vsprintf __stdio_common_vsscanf fread

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

_wcsicmp strncpy strtok_s strncmp tolower strcmp strcpy_s

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

abort _register_thread_local_exe_atexit_callback _c_exit __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate system _beginthreadex _invoke_watson __p___argv exit

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

sqrtf __setusermatherr logf log fmodf cosf ceilf atanf atan2f atan2 pow powf asin acosf sinf sqrt tanf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale