bestfreecheeto[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bestfreecheeto.exe
Size 554KB
Sample260809-pr4b1sad85
SHA256 dfa9f2873659d6725d1cffe0162eac805838fa54a2c6935523e0b41bd6c1a436
MD5 9b7d964bad826efa2f4794818e5367de
SHA1 aad034041b7570c656d37e4bacf1ef742d6d0fc7
SHA512 e0d14148d1d575aa63722ef9f57df89b7eb55d25c36ed6ffa5a4dbe6466c251af91133bb37d7c2ccb7a2df5da3324e702506ab7000dee8ea52d962fe2c2045b8
SSDEEP 6144:83ENvJHFPsyqKKYm4hEfyE7OezSjf65UUJQcndcgNpBDUs7ncFSQ31JWljfZXan:pkh978qKgNpBeFSQlkRknCx
TLSH
T162C49E46A2E400F9E0A7D078D5A76617FA763844072496CF33E049692FA37E07F7E762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bestfreecheeto.exe

File Explorer

bestfreecheeto.exe

.exe 554KB

bestfreecheeto.exe

IMPHASH 2fbc26b2d960d43cc0818aeb72e5f7c0
SHA256 dfa9f2873659d6725d1cffe0162eac805838fa54a2c6935523e0b41bd6c1a436
MD5 9b7d964bad826efa2f4794818e5367de
SHA1 aad034041b7570c656d37e4bacf1ef742d6d0fc7
SHA512 e0d14148d1d575aa63722ef9f57df89b7eb55d25c36ed6ffa5a4dbe6466c251af91133bb37d7c2ccb7a2df5da3324e702506ab7000dee8ea52d962fe2c2045b8
SSDEEP 6144:83ENvJHFPsyqKKYm4hEfyE7OezSjf65UUJQcndcgNpBDUs7ncFSQ31JWljfZXan:pkh978qKgNpBeFSQlkRknCx
TLSH
T162C49E46A2E400F9E0A7D078D5A76617FA763844072496CF33E049692FA37E07F7E762
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

315540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\1234\Documents\BEST FREE CHEETOS SOURCES\jamalsudfree\as free\freefn\x64\Release\bestfreecheeto.pdb

kernel32

GetCommandLineA CreateToolhelp32Snapshot Sleep GetTempPathA GetTickCount64 GetLastError Process32NextW DeleteFileA Process32FirstW CloseHandle ExitProcess SetConsoleOutputCP lstrcmpiW OpenProcess InitializeSListHead CreateFileW GetCurrentThreadId GetCurrentProcessId GetModuleHandleW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext MultiByteToWideChar WaitForSingleObject DeviceIoControl GetCurrentProcess GetStartupInfoW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc GetSystemTimeAsFileTime

user32

GetClientRect CloseClipboard GetWindowThreadProcessId GetWindowRect DestroyWindow SetWindowPos GetSystemMetrics ShowWindow GetKeyNameTextA GetAsyncKeyState DispatchMessageW PeekMessageW MapVirtualKeyA EnumWindows DefWindowProcA SetLayeredWindowAttributes TranslateMessage LoadIconW SetWindowLongW GetDesktopWindow RegisterClassExA UpdateWindow GetKeyState ScreenToClient ClientToScreen SetCursorPos GetForegroundWindow EmptyClipboard LoadCursorW GetClipboardData SetClipboardData GetCursorPos SetCursor OpenClipboard

advapi32

SetTokenInformation RevertToSelf PrivilegeCheck OpenProcessToken GetTokenInformation DuplicateTokenEx CreateProcessAsUserW SetThreadToken LookupPrivilegeValueW

shell32

ShellExecuteExA

d3d9

Direct3DCreate9Ex

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

msvcp140

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception __std_exception_copy memmove memcpy memset memchr __std_exception_destroy strstr __std_terminate memcmp __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fsetpos ungetc setvbuf fgetpos fgetc __stdio_common_vsprintf_s _get_stream_buffer_pointers __p__commode _set_fmode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func ftell fputc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp strcpy_s strcat_s strncpy _wcsicmp strncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

_set_app_type _cexit _get_initial_narrow_environment _initterm _initterm_e _exit system __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _invalid_parameter_noinfo_noreturn _register_onexit_function _initialize_onexit_table _initialize_narrow_environment exit _configure_narrow_argv terminate _seh_filter_exe

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

atanf fmodf atan2f pow powf cosf sinf sqrt sqrtf acosf asin atan2 tan ceilf __setusermatherr tanf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale