freefirewall-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
freefirewall-setup.exe
Size 41.1MB
Sample260925-j2wr2atake
SHA256 b6f0d4dd3a673b1f9e0663228c94a684e1d5a76cf943d125d52ae1ad9ba798bd
MD5 6d6145f263bc2b1a6b0694714a6bca26
SHA1 7a0eb3d2e59dc7faaeec49a2609a9c74eecf3c02
SHA512 7f41035272387ef61ca765f02b2ce79e836d9155fe610801d83861970ab8f35c39d226f18629d3bd723432bb6f8c167fb4db7422a597a6305e14c77b7f25ab06
SSDEEP 786432:FQysFlIe6HbdsuQr5mUXhC/WH4CtNDBT05XbZAwcS4mt5:FgFvuYbXhB4OTsrZASB5
TLSH
T16A9733195A9802B9D061C2BEC4E75451F771F4490732CBEB4695FA2A2F339E8CB39372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

freefirewall-setup.exe

.exe 41.1MB

freefirewall-setup.exe

IMPHASH d27a9b678f51f39a3661f1ea88f4d10d
SHA256 b6f0d4dd3a673b1f9e0663228c94a684e1d5a76cf943d125d52ae1ad9ba798bd
MD5 6d6145f263bc2b1a6b0694714a6bca26
SHA1 7a0eb3d2e59dc7faaeec49a2609a9c74eecf3c02
SHA512 7f41035272387ef61ca765f02b2ce79e836d9155fe610801d83861970ab8f35c39d226f18629d3bd723432bb6f8c167fb4db7422a597a6305e14c77b7f25ab06
SSDEEP 786432:FQysFlIe6HbdsuQr5mUXhC/WH4CtNDBT05XbZAwcS4mt5:FgFvuYbXhB4OTsrZASB5
TLSH
T16A9733195A9802B9D061C2BEC4E75451F771F4490732CBEB4695FA2A2F339E8CB39372
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

0c:ec:cf:d8:05:f2:59:a9:1c:42:0c:8e:d0:5f:b7:92:c8:d7:fe:20

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Eduard Steinmiller,OU=IT,O=Eduard Steinmiller,ST=Baden-Württemberg,C=DE

Chains

Sep 12, 2022

CN=Eduard Steinmiller,OU=IT,O=Eduard Steinmiller,ST=Baden-Württemberg,C=DE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Eduard Steinmiller,OU=IT,O=Eduard Steinmiller,ST=Baden-Württemberg,C=DE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

5b:d9:56:b1:d6:1b:eb:9c:87:e3:21:39:66:82:22:7b:98:2f:ea:de:f6:05:89:8e:43:d0:c4:9a:cf:ce:0f:04

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Eduard Steinmiller,OU=IT,O=Eduard Steinmiller,ST=Baden-Württemberg,C=DE

Chains

Sep 12, 2022

CN=Eduard Steinmiller,OU=IT,O=Eduard Steinmiller,ST=Baden-Württemberg,C=DE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Eduard Steinmiller,OU=IT,O=Eduard Steinmiller,ST=Baden-Württemberg,C=DE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Eduard Steinmiller,OU=IT,O=Eduard Steinmiller,ST=Baden-Württemberg,C=DE

Serial Number

d0:77:d9:2e:b3:a5:e3:c8:b8:e9:0b:37:bf:4e:6a:8d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 16, 2021 - Nov 15, 2024

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

510496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentThreadId GetVersionExW GetSystemDirectoryW UnmapViewOfFile ExitThread GetModuleHandleA FreeResource OpenProcess SetFileAttributesW CreateToolhelp32Snapshot GetExitCodeThread Sleep FormatMessageW LocalFileTimeToFileTime Process32NextW OutputDebugStringW CreateFileA SetEvent FileTimeToSystemTime GetDiskFreeSpaceExW GetCurrentThread LoadLibraryA TlsAlloc LockResource QueryPerformanceFrequency GetThreadPriority GlobalAlloc DeleteFileW Process32FirstW GlobalFree LoadLibraryW CreateThread ResetEvent LoadResource FindResourceW FileTimeToLocalFileTime GetLocalTime GetWindowsDirectoryW GetProcAddress GlobalLock SetFilePointerEx LocalFree MoveFileExW ExitProcess VerSetConditionMask GetComputerNameW FindVolumeClose GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW GetLongPathNameA FreeLibrary CopyFileW GetVolumePathNamesForVolumeNameW VerifyVersionInfoW TlsGetValue QueryFullProcessImageNameW GetTempFileNameW GetSystemTimeAsFileTime TlsFree CreateFileW CreateFileMappingW DosDateTimeToFileTime MapViewOfFile FindNextVolumeW lstrcmpiW QueryPerformanceCounter GetTickCount GlobalUnlock lstrcmpW MulDiv GetProcessTimes GetDriveTypeW GetFileTime SetUnhandledExceptionFilter GetExitCodeProcess FileTimeToDosDateTime GetLocaleInfoW WriteConsoleW GetConsoleMode GetConsoleOutputCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetStdHandle GetModuleHandleExW LoadLibraryExW RtlUnwindEx RtlPcToFileHeader InitializeSListHead GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx IsDebuggerPresent GetCPInfo GetStringTypeW LCMapStringW InitializeCriticalSectionAndSpinCount EncodePointer FindClose GetFirmwareEnvironmentVariableA GetTempPathW PeekNamedPipe SetEndOfFile SetErrorMode CreatePipe LeaveCriticalSection SetThreadPriority GetUserDefaultUILanguage K32GetModuleFileNameExW GetProcessId GetThreadLocale HeapFree WaitForMultipleObjects GetModuleFileNameW SetFileTime LoadLibraryExA RemoveDirectoryW TerminateProcess DeviceIoControl GetStringTypeExW lstrcpynW WriteFile GetCurrentProcess GetLongPathNameW FindNextFileW GetFullPathNameW GetCommandLineW EnterCriticalSection SetLastError FindFirstVolumeW TlsSetValue FindFirstFileA SetHandleInformation GetFileSizeEx FindFirstFileW SetThreadLocale GetVolumeInformationW SizeofResource GetModuleFileNameA ReadFile CreateDirectoryW FlushFileBuffers WideCharToMultiByte GetProcessHeap DeleteCriticalSection IsProcessorFeaturePresent DecodePointer HeapAlloc RaiseException CloseHandle HeapReAlloc GetLastError MultiByteToWideChar CreateEventW DisconnectNamedPipe ReleaseMutex WaitForSingleObject lstrlenA InitializeCriticalSectionEx CreateMutexW InitializeCriticalSection lstrlenW GetSystemTime

user32

PostQuitMessage KillTimer GetDlgItem GetClientRect SetWindowLongW LoadCursorW GetWindowTextLengthW TranslateMessage CharNextW GetClassInfoExW GetParent ExitWindowsEx CharPrevW GetMonitorInfoW SetTimer DispatchMessageW IsWindow ShowWindow LoadStringW UpdateWindow SetForegroundWindow BeginPaint InvalidateRect ReleaseDC GetForegroundWindow GetMessageW CreateDialogParamW CharUpperW CharLowerW RegisterClassExW SetWindowTextW SendMessageW CreateWindowExW MonitorFromWindow MessageBoxW SetWindowPos GetDC DestroyWindow GetWindowRect GetWindow PostMessageW DefWindowProcW EndPaint EnableWindow GetWindowTextW RegisterWindowMessageW MapWindowPoints GetWindowLongW LoadIconW

gdi32

CreateSolidBrush GetDeviceCaps CreateCompatibleDC DeleteObject CreateCompatibleBitmap BitBlt SetViewportOrgEx SelectObject DeleteDC GetStockObject

advapi32

RegCloseKey RegQueryInfoKeyW QueryServiceStatus ConvertSidToStringSidA SetSecurityDescriptorOwner EqualSid UnlockServiceDatabase CloseServiceHandle RegQueryValueExA OpenSCManagerW RegDeleteKeyW BuildExplicitAccessWithNameW AllocateAndInitializeSid SetEntriesInAclW CreateWellKnownSid LockServiceDatabase RegFlushKey RegCreateKeyExW SetNamedSecurityInfoW DeleteService SetServiceObjectSecurity ControlService GetServiceKeyNameW RegEnumKeyExW RegSetValueExW OpenProcessToken FreeSid StartServiceW CheckTokenMembership InitializeSecurityDescriptor RegOpenKeyExA RegOpenKeyExW ChangeServiceConfigW RegDeleteValueW OpenServiceW ConvertStringSecurityDescriptorToSecurityDescriptorW GetUserNameW ChangeServiceConfig2A OpenThreadToken RegEnumValueW RegQueryValueExW LookupAccountNameW GetSecurityInfo SetSecurityDescriptorGroup QueryServiceObjectSecurity GetTokenInformation SetSecurityInfo LookupPrivilegeValueW SetSecurityDescriptorDacl AdjustTokenPrivileges GetSecurityDescriptorDacl CreateServiceW SystemFunction036

shell32

SHBrowseForFolderW ShellExecuteExW SHGetPathFromIDListW SHGetFolderPathW SHGetMalloc SHGetSpecialFolderPathW

ole32

CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoInitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

shlwapi

PathFindFileNameW PathFileExistsW

gdiplus

GdiplusStartup GdiplusShutdown GdipCreateStringFormat GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDeleteBrush GdipAlloc GdipDisposeImage GdipSetSmoothingMode GdipFlush GdipCreateFont GdipCreateSolidFill GdipGraphicsClear GdipGetGenericFontFamilySansSerif GdipFree GdipDrawString GdipCreateFromHDC GdipCloneBrush GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipDrawImageRectRectI GdipLoadImageFromStream GdipCloneImage

setupapi

SetupDiGetClassDescriptionW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInterfaceDetailW

comctl32

InitCommonControlsEx

dbghelp

SymSetOptions StackWalk64 SymGetLineFromAddr64 UnDecorateSymbolName SymGetOptions SymCleanup MiniDumpWriteDump SymGetSymFromAddr64 SymInitialize

userenv

GetProfilesDirectoryW

wininet

InternetSetOptionW InternetConnectW InternetCloseHandle HttpSendRequestExW InternetReadFile HttpQueryInfoW InternetOpenW InternetWriteFile InternetQueryOptionW HttpOpenRequestW HttpEndRequestW

rstrtmgr

RmRestart RmEndSession RmShutdown RmStartSession RmGetList RmRegisterResources

Name

.text

Size

679KB

Virtual Size

679KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

572B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gehcont

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

40.1MB

Virtual Size

40.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

freefirewall-setup.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

setupapi

comctl32

dbghelp

userenv

wininet

rstrtmgr

generic