Liberator[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Liberator.exe
Size 5.2MB
Sample261003-29vttazv8m
SHA256 14a9e18166e8bbf50adc769a770936a2e5fc2fa7a220393988d422c1124f1a99
MD5 e17e4abaf85914a3ca875baf6f693bb4
SHA1 4d42f8c3cab44c74c308761922f892064caa7656
SHA512 b6eba7ea2f2c2546493f18cb2361e81e2131115742fd3c1c8fb3d30a005ab37614651ad6415abbb6575cbac7d3d523cf7dbe039b61b6407e48845b6df25b79b5
SSDEEP 49152:I4KGoXWuGoS/mOJgHS4cLd1j8ZFwoIs90B7yqzgDDfOc1LdBfiPrxDu48/Jp2g7V:jKGoNVLHLSytbUu46dbEvHgT
TLSH
T1B2466CC3F6A291EFD22AC034435AB633FA227C4E05256AA757D0CB353E61B506F1DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Liberator.exe

File Explorer

Liberator.exe

.exe 5.2MB

Liberator.exe

IMPHASH 3450be8c59238ec6b447295601b55c89
SHA256 14a9e18166e8bbf50adc769a770936a2e5fc2fa7a220393988d422c1124f1a99
MD5 e17e4abaf85914a3ca875baf6f693bb4
SHA1 4d42f8c3cab44c74c308761922f892064caa7656
SHA512 b6eba7ea2f2c2546493f18cb2361e81e2131115742fd3c1c8fb3d30a005ab37614651ad6415abbb6575cbac7d3d523cf7dbe039b61b6407e48845b6df25b79b5
SSDEEP 49152:I4KGoXWuGoS/mOJgHS4cLd1j8ZFwoIs90B7yqzgDDfOc1LdBfiPrxDu48/Jp2g7V:jKGoNVLHLSytbUu46dbEvHgT
TLSH
T1B2466CC3F6A291EFD22AC034435AB633FA227C4E05256AA757D0CB353E61B506F1DB19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ImpersonateAnonymousToken RevertToSelf

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

gdi32

ChoosePixelFormat CreateBitmap CreateCompatibleBitmap CreateRectRgn DeleteObject DescribePixelFormat GetDeviceCaps SetBitmapBits SetPixelFormat SwapBuffers

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

kernel32

AddVectoredExceptionHandler CompareStringOrdinal CreateFileMappingA CreateFileMappingW CreateFileW CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW ExitProcess FindClose FindFirstFileExW FlsAlloc FlsFree FlsSetValue FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetModuleHandleW GetProcessHeap GetStdHandle GetSystemDirectoryW GetTempPathW GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete IsThreadAFiber LoadLibraryA LoadLibraryW MapViewOfFile Module32First Module32FirstW Module32NextW MultiByteToWideChar OpenProcess Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency ReadFileEx ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAllocEx VirtualFreeEx VirtualProtectEx VirtualQueryEx WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx WriteProcessMemory DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler FreeLibrary GetLastError GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW SetThreadErrorMode GetModuleHandleA Sleep CloseHandle DuplicateHandle GlobalFree SetHandleInformation SetLastError

ntdll

NtOpenFile NtReadFile NtWriteFile NtCreateNamedPipeFile RtlNtStatusToDosError

ole32

OleInitialize RegisterDragDrop RevokeDragDrop CoCreateInstance CoInitializeEx CoUninitialize

opengl32

wglCreateContext wglDeleteContext wglGetCurrentContext wglGetCurrentDC wglGetProcAddress wglMakeCurrent wglShareLists

user32

ChangeDisplaySettingsExW ClientToScreen CloseClipboard CloseTouchInputHandle CreateIconIndirect EmptyClipboard EnumDisplayMonitors GetClassInfoExW GetClipboardData GetDC GetMonitorInfoW GetTouchInputInfo InvalidateRgn IsClipboardFormatAvailable MonitorFromPoint MonitorFromRect MonitorFromWindow OpenClipboard RedrawWindow RegisterClassExW RegisterClipboardFormatW RegisterTouchWindow ReleaseDC ScreenToClient SetClipboardData ValidateRect AdjustWindowRectEx ClipCursor CreateIcon CreateIconFromResourceEx CreateWindowExW DefWindowProcW DestroyCursor DestroyIcon DestroyWindow DispatchMessageW EnableMenuItem FlashWindowEx GetActiveWindow GetAsyncKeyState GetClassNameW GetClientRect GetClipCursor GetCursorPos GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetRawInputData GetSystemMenu GetSystemMetrics GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW IsIconic IsProcessDPIAware IsWindowVisible LoadCursorW MapVirtualKeyExW MapVirtualKeyW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW RegisterRawInputDevices RegisterWindowMessageA ReleaseCapture SendInput SendMessageW SetCapture SetCursor SetCursorPos SetForegroundWindow SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA ToUnicodeEx TrackMouseEvent TranslateMessage

uxtheme

SetWindowTheme

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getsockname ioctlsocket listen recv send setsockopt

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _hypot acosf atan2 atan2f cbrt cbrtf ceil ceilf cos cosf exp2f expf floor floorf fma fmod hypot log log2 pow powf round roundf sin sinf tan tanf trunc truncf

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

shell32

DragFinish DragQueryFileW

shlwapi

AssocQueryStringW

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

916KB

Virtual Size

915KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Liberator.exe

advapi32

dwmapi

gdi32

imm32

kernel32

ntdll

ole32

opengl32

user32

uxtheme

ws2_32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-synch-l1-2-0

bcryptprimitives

shell32

shlwapi

generic