Flow_V1_Free[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Flow_V1_Free.exe
Size 4.4MB
Sample260823-sagcpsae97
SHA256 073e6c04d584678158cb5c175938ed63728fa30ded9cb87aed76f4ddf4ae5f55
MD5 077d9d04a60a9ef0a19890b2cbef5fe6
SHA1 6a18eacbd3c494c44fc1ae3219286ffc4fc68f1c
SHA512 9b52d87b57fa3a5c1797857288bca591c09fb5b746a13bdc203a30ea844140fb3415635682119b0bf9aee76fb2d390174637429fb55cd29f40e6776d25e413ca
SSDEEP 98304:z0Fy+K7bTRSuULHO9y7MCXGTTYZMwXBYt8I4urI:BRQuULHJg+Z5Yt8LJ
TLSH
T105261256F1D28499C225E07F9562E607E675FC980B22E7CB23D09B1A5FB27D48EF6300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Flow_V1_Free.exe

File Explorer

Flow_V1_Free.exe

.exe 4.4MB

Flow_V1_Free.exe

IMPHASH 2e36eb41fecc82e94aaae3fe160257b3
SHA256 073e6c04d584678158cb5c175938ed63728fa30ded9cb87aed76f4ddf4ae5f55
MD5 077d9d04a60a9ef0a19890b2cbef5fe6
SHA1 6a18eacbd3c494c44fc1ae3219286ffc4fc68f1c
SHA512 9b52d87b57fa3a5c1797857288bca591c09fb5b746a13bdc203a30ea844140fb3415635682119b0bf9aee76fb2d390174637429fb55cd29f40e6776d25e413ca
SSDEEP 98304:z0Fy+K7bTRSuULHO9y7MCXGTTYZMwXBYt8I4urI:BRQuULHJg+Z5Yt8LJ
TLSH
T105261256F1D28499C225E07F9562E607E675FC980B22E7CB23D09B1A5FB27D48EF6300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

724224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ardac\Desktop\flow\Build\Cheat\Flow_V1_Free.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

InitializeSListHead GetSystemTimeAsFileTime MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter Process32First WriteProcessMemory FindFirstFileA GetCurrentProcess TerminateProcess Module32Next FindNextFileA FindClose GetVolumeInformationA Module32First GetCurrentThreadId OpenProcess CreateToolhelp32Snapshot Sleep GetTickCount64 K32GetProcessMemoryInfo QueryFullProcessImageNameA DeleteFileA GetStartupInfoW CloseHandle GetSystemInfo CreateThread VirtualProtectEx Beep VirtualAllocEx ReadProcessMemory CreateDirectoryA VirtualFreeEx GetTickCount IsDebuggerPresent VirtualQueryEx GetComputerNameA CheckRemoteDebuggerPresent GetExitCodeProcess GetCurrentProcessId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError SetUnhandledExceptionFilter GetModuleHandleW LocalFree FormatMessageA GetFileInformationByHandleEx GetLocaleInfoEx FindFirstFileW Process32Next

user32

GetWindowThreadProcessId DispatchMessageA DestroyWindow SetWindowPos SetWindowRgn PostMessageA GetSystemMetrics ShowWindow GetAsyncKeyState SetWindowLongA SetWindowDisplayAffinity AttachThreadInput DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetFocus TranslateMessage mouse_event PeekMessageA GetWindowDisplayAffinity UnregisterClassA PostQuitMessage SetWindowLongPtrA FindWindowA RegisterClassExA GetForegroundWindow UpdateWindow SetForegroundWindow GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout ReleaseCapture SetCursorPos GetCursorPos IsWindowUnicode GetClientRect SetCursor SetCapture OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData

gdi32

CreateRoundRectRgn

shell32

ShellExecuteW SHGetFolderPathA

ole32

CoCreateInstance

msvcp140

?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Thrd_join _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundA

winhttp

WinHttpCloseHandle WinHttpSetOption WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData WinHttpAddRequestHeaders WinHttpOpen

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_terminate strstr strchr __C_specific_handler __current_exception __std_exception_destroy _CxxThrowException memcmp memchr memcpy memmove memset __current_exception_context

api-ms-win-crt-stdio-l1-1-0

setvbuf fgetpos ungetc _get_stream_buffer_pointers fgetc __stdio_common_vsprintf_s _fseeki64 __p__commode _set_fmode fsetpos fputc fread __stdio_common_vsscanf _wfopen fwrite __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func ftell __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-string-l1-1-0

isdigit isspace strcpy_s tolower strncpy strcmp strlen strncmp toupper

api-ms-win-crt-convert-l1-1-0

strtoul atof strtol strtof

api-ms-win-crt-time-l1-1-0

clock _time64 _localtime64_s strftime

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _beginthreadex _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _errno abort _initialize_onexit_table _register_onexit_function _crt_atexit _set_app_type

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

powf ceilf acosf sinf _hypotf cosf logf fmodf sqrtf __setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale