fresh-client-x86_64-pc-windows-msvc.zip
- SHA256 46cdbe17ef9090c8f582dc6d7fdc530cc17a77703b44a40f6e9e18020334ec6e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fresh-client.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
fresh-client.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target fresh-client-x86_64-pc-windows-msvc.zip
- Size 1.7MB
- Sample261027-b9gdbahy21
- SHA256 46cdbe17ef9090c8f582dc6d7fdc530cc17a77703b44a40f6e9e18020334ec6e
- MD5 92d66fc8c44d37489fbdc49401741972
- SHA1 3af5cf98a4ae5c6ad0e8d6e944c0329d68811bdd
- SHA512 9ba5ef2ec0b4f0c9dcbc82641b599d16a90862873bb99e34e6f5c117d06c2b77dcdb90512ec294b4fc9167c7f7864a423d4729d649b7a464720f9df20ff11702
- SSDEEP 24576:iHkMAOeOT89rut5QXZ9Bebn13aZDLV4eACcjbJ5j1dpL7Uoe9g49:0k9rut5Qpfun13aZDL6eNgo
- TLSH T127853B21BA9A98ADC15AC47483475A626A3178CB1B35BDFF40D462743F7AAF05F3C324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fresh-client.exe
File Explorer
-
fresh-client-x86_64-pc-windows-msvc.zip.zip 1.7MB
-
README.md7KB
-
fresh-client.exe.exe 1.7MB
README.md
- SHA256 b8192d7d24b6d7a3973db354f1c773683aa564846ba88b5cce503df39a6a1391
- MD5 2b6190bc578f890d5c4b07e0dd96ef62
- SHA1 99a3867153091b39086a8426e05847958cf6cbbb
- SHA512 8b637712efd06f17964fc3cdc2a2cbce94639af9242ef94c0a65f8b052859157bfaf4b1d87c2188494604cec24e15852231c12f1c791e3481e687e4252469efe
- SSDEEP 192:QFlAejhKtoKFjFtfOHaIPI+f3vNmST6H73lP:QBjcy8tfO7f3vjMl
- TLSH T16AF19313766F937A21B20251B00DB2DC772980BC132B359575FDE46C371AAA693BE6C8
- MD5 SHA1 SHA512 SSDEEP TLSH
fresh-client.exe
- IMPHASH d65ec0951672aad4a8b4dd24d958f153
- SHA256 bc768c9d8aed09a954047afe66e0ca94ca04ba585c29273298aebc148bd171e4
- MD5 38b90bc38078ff99f5fd2a5bb867c374
- SHA1 8f1ef3d30b1adc9e93d00992f375956275c17837
- SHA512 6157b1a7f4f17e883b964dfe9127c0a5857c078250fa33b00ddd4da1c0f9fbe074866ebaa8a0959924f24aa244f1788603a739076420e38af0c4a3f5a0958fd3
- SSDEEP 24576:4HkMAOeOT89rut5QXZ9Bebn13aZDLV4eACcjbJ5j1dpL7Uoe9g4:qk9rut5Qpfun13aZDL6eNg
- TLSH T19D853B21BA9A98ADC15AC474834759626A3178CB1B35BDFF40D462743FBAAF05F3C324
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1229356
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\fresh\fresh\target\x86_64-pc-windows-msvc\dist\deps\fresh_client.pdb
kernel32
GetStdHandle
GetConsoleMode
SetConsoleMode
GetLastError
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetConsoleOutputCP
FlushFileBuffers
HeapSize
Sleep
QueryPerformanceCounter
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
CloseHandle
WaitForMultipleObjects
GetNumberOfConsoleInputEvents
ReadConsoleInputW
SetConsoleCursorInfo
SetConsoleCursorPosition
LCMapStringW
CompareStringW
CreateFileW
FlsFree
FlsSetValue
lstrlenW
SetConsoleTitleW
GetFileType
GetFileInformationByHandleEx
GetModuleHandleA
GetProcAddress
FlsGetValue
HeapReAlloc
ReleaseMutex
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapFree
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
GetModuleFileNameW
GetFileInformationByHandle
SetFilePointerEx
TryAcquireSRWLockExclusive
QueryPerformanceFrequency
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetFullPathNameW
WaitForSingleObject
SetHandleInformation
GetModuleHandleW
FormatMessageW
ExitProcess
GetProcessHeap
HeapAlloc
WriteConsoleW
GetSystemTimeAsFileTime
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FlsAlloc
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
ws2_32
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
WSASocketW
connect
getpeername
send
recv
shutdown
WSAGetLastError
ioctlsocket
setsockopt
closesocket
user32
GetKeyboardLayout
ToUnicodeEx
GetWindowThreadProcessId
GetForegroundWindow
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
bcrypt
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
375KB
Virtual Size
374KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=30795,
count=138, id=261, version=30795,
count=10, id=260, version=30795,
count=40, id=261, version=30034,
count=16, id=260, version=30034,
count=9, id=259, version=30034,
count=146, id=1, productName=Unmarked objects,
count=13, id=257, version=30148,
count=496, productName=Unmarked objects (old),
count=1, id=258, version=30148,