KazeFreeBEST[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
KazeFreeBEST.exe
Size 1.5MB
Sample260910-sscggatxc1
SHA256 b50b991cc3d9ccbe3ff30d889af95d802087a2bc956731bf36a3d3f0b9656792
MD5 9eec26c9effe38f0042091528d4f02d1
SHA1 bdcdf81eddb685a20aef02a78ad8913c01dcf72b
SHA512 d6174db82463a7bf7f68ebbcc10e3cb1841aa100de1c158a14561c9ec916f55ce4c4d34812fa657f2ab8534927bae8467921e123b5f08bafc0a46bac3c0412d6
SSDEEP 24576:ObQZTWYZZeuQj3573JraU32WElbEIsI5fv1h0lhSMXlVVciTnG1svoA:sLYZu35DZa6mm1zZTn
TLSH
T13975BF47B3E801E9D06BD178C946961BEBB27044032467DF27E88E682F73BE05E7A751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KazeFreeBEST.exe

File Explorer

KazeFreeBEST.exe

.exe 1.5MB

KazeFreeBEST.exe

IMPHASH b12e047d975df11aa87d8d2c102e324c
SHA256 b50b991cc3d9ccbe3ff30d889af95d802087a2bc956731bf36a3d3f0b9656792
MD5 9eec26c9effe38f0042091528d4f02d1
SHA1 bdcdf81eddb685a20aef02a78ad8913c01dcf72b
SHA512 d6174db82463a7bf7f68ebbcc10e3cb1841aa100de1c158a14561c9ec916f55ce4c4d34812fa657f2ab8534927bae8467921e123b5f08bafc0a46bac3c0412d6
SSDEEP 24576:ObQZTWYZZeuQj3573JraU32WElbEIsI5fv1h0lhSMXlVVciTnG1svoA:sLYZu35DZa6mm1zZTn
TLSH
T13975BF47B3E801E9D06BD178C946961BEBB27044032467DF27E88E682F73BE05E7A751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

726944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\durmu\OneDrive\Desktop\Yeni klasör (3)\cs2-external-esp\x64\Release\cs2-external-esp.pdb

kernel32

GetVolumeInformationW IsDebuggerPresent CheckRemoteDebuggerPresent GetThreadContext GetCurrentThread AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId CreateDirectoryW FindClose FindFirstFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetLastError WideCharToMultiByte GetModuleHandleW MoveFileExW GetFileInformationByHandleEx LocalFree FormatMessageA GetLocaleInfoEx GetCurrentProcess SetUnhandledExceptionFilter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LoadLibraryW SetLastError FormatMessageW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerifyVersionInfoW CreateFileW GetFileSizeEx GlobalLock VerSetConditionMask FreeLibrary LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA SetPriorityClass SetConsoleTextAttribute AddVectoredExceptionHandler VirtualQuery VirtualQueryEx Module32NextW K32GetModuleInformation K32EnumProcessModulesEx OpenProcess CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot MultiByteToWideChar SetConsoleMode GetConsoleMode SetConsoleOutputCP GetSystemDirectoryW GlobalFree GlobalAlloc WakeAllConditionVariable GlobalUnlock SetConsoleTitleA GetStdHandle GetModuleHandleA GetProcAddress ReleaseSRWLockExclusive

user32

GetWindowThreadProcessId FindWindowExA GetWindowTextA IsWindowVisible GetKeyboardLayout SetPropA SetCursor LoadCursorA GetKeyState GetCursorPos GetForegroundWindow IsChild ClientToScreen SetCursorPos ScreenToClient WindowFromPoint EnumDisplayMonitors GetClientRect GetMessageExtraInfo TrackMouseEvent GetCapture SetCapture ReleaseCapture IsWindowUnicode SetWindowPos SetProcessDPIAware GetDC ReleaseDC MonitorFromWindow AdjustWindowRectEx CreateWindowExW DestroyWindow GetMonitorInfoA DefWindowProcA SetWindowDisplayAffinity GetWindowLongPtrA DispatchMessageA SetWindowLongPtrA ShowWindow SetWindowLongA GetWindowLongW BringWindowToTop SetForegroundWindow SetFocus IsIconic DefWindowProcW RegisterClassExW UnregisterClassW OpenClipboard GetClipboardData CloseClipboard EmptyClipboard SetClipboardData GetAsyncKeyState IsWindow GetWindowRect RegisterClassExA GetSystemMetrics CreateWindowExA UpdateWindow UnregisterClassA PeekMessageA TranslateMessage SetLayeredWindowAttributes SetWindowLongW GetPropA

gdi32

GetDeviceCaps

shell32

ShellExecuteW

msvcp140

??0facet@locale@std@@IEAA@_K@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?always_noconv@codecvt_base@std@@QEBA_NXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_function_call@std@@YAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ??0_Lockit@std@@QEAA@H@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Winerror_map@std@@YAHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?classic@locale@std@@SAAEBV12@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??Bios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Xtime_get_ticks _Thrd_join _Thrd_id _Cnd_wait _Cnd_signal ??7ios_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1facet@locale@std@@MEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Lockit@std@@QEAA@XZ ??1_Locinfo@std@@QEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Xbad_alloc@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3d11

D3D11CreateDeviceAndSwapChain

ws2_32

getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect closesocket WSAGetLastError gethostname ioctlsocket getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind accept select __WSAFDIsSet socket htons WSAIoctl ntohs inet_pton inet_ntop WSASetLastError setsockopt

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertCloseStore CertOpenStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext

wininet

InternetConnectA InternetReadFile HttpQueryInfoA HttpSendRequestA HttpOpenRequestA InternetCloseHandle InternetOpenA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memmove strrchr memcmp memchr strstr strchr __std_exception_destroy __std_exception_copy __std_terminate memcpy wcschr

api-ms-win-crt-heap-l1-1-0

free calloc malloc realloc _callnewh _set_new_mode

api-ms-win-crt-stdio-l1-1-0

_wfopen _lseeki64 fseek __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsscanf _close _fileno __stdio_common_vsprintf_s fgets ftell _write _wopen __p__commode _read _get_stream_buffer_pointers __stdio_common_vsprintf fclose fwrite feof fgetc ungetc fread _fseeki64 fgetpos fsetpos setvbuf fflush fputs fputc _set_fmode

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _fstat64 _waccess _wstat64 _unlink _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

_ldsign _dsign atan2f floorf acosf cosf ceilf fmodf logf sqrtf sinf powf _fdsign _fdopen __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initterm _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm_e abort exit _exit __sys_errlist __sys_nerr _get_initial_narrow_environment system _register_thread_local_exe_atexit_callback _errno __p___argc terminate _beginthreadex _c_exit __p___argv

api-ms-win-crt-convert-l1-1-0

strtol atoi strtoull strtoll strtoul wcstombs strtod atof

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64_s strftime _gmtime64_s _mkgmtime64 _time64

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

strspn strncmp strcspn strcmp wcspbrk wcsncmp strpbrk wcsncpy _strdup wcslen wcscmp strlen strncpy

api-ms-win-crt-environment-l1-1-0

_dupenv_s

bcrypt

BCryptGenRandom

advapi32

CryptAcquireContextW CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam