fresh-server-x86_64-pc-windows-msvc.zip
- SHA256 b21a4b3246f361fd88965b9ea14a970fa0bd2330147133516251aab08cef2040
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fresh-server.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
fresh-server.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target fresh-server-x86_64-pc-windows-msvc.zip
- Size 1.3MB
- Sample261027-b9lm2acd79
- SHA256 b21a4b3246f361fd88965b9ea14a970fa0bd2330147133516251aab08cef2040
- MD5 90c142eab58517d2ed8df5b72b4a1cf4
- SHA1 93b1e5f70b65df2d914ba48cea1d4b3f64c4b4f5
- SHA512 a4143b8f38583cf5bae3f5a9ce599f7b2171b5e99941feee3ecff3997d68a3e8d43c16713d955df66ce7d4bfd156c3d1b7710057a33ae89d6c80ed3633ebc139
- SSDEEP 24576:8cotVC0kIFBzOOIvwL7ZAMFbRfbhBcpqdnunFfTp:8cotVC0k2pr1WpqdnefTp
- TLSH T106553B11B78A99ADD159C4B0834786A26A3178CA0B36FEFF45D462743E7AAF05F3C314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fresh-server.exe
File Explorer
-
fresh-server-x86_64-pc-windows-msvc.zip.zip 1.3MB
-
README.md7KB
-
fresh-server.exe.exe 1.3MB
README.md
- SHA256 52382524d73eeb68249554bfc7b93ae53b01fd76f9974ab29974f0d8120181ce
- MD5 785790377c34fb3d23211e308c2037ad
- SHA1 8b8bde9cbb85022ae959605e8e15d596e39968f5
- SHA512 12fb4edf64ebed4ef65c495d30a182aa98aaacacd2ec5d2fa8d3b025d1d52a399dc3d7c5c57bd9af62981b41137357b9b9c1896bb7680ef70b3fe7ef6bf000d3
- SSDEEP 192:QFlAeUhKtoKFjFtfOHZ1PI+f3vNmST6H73lP:QBUcy8tfOnf3vjMl
- TLSH T1FAF1A313766F937A21B20256B00DB2DC772981BC132B319575FDE02C371AAA553BE6C8
- MD5 SHA1 SHA512 SSDEEP TLSH
fresh-server.exe
- IMPHASH 397a6ab42b44698758c489bf7cfd2b70
- SHA256 249729c5d601c72c6b2b6ed44a6da8b449381e114636510795f544f06b09b7d7
- MD5 073ed4631618e570ff91dbb45f297864
- SHA1 c1bd70c80fba0bbd43e6965d3ee7aad2f252e1db
- SHA512 5c58bcc764f9ce8fc45229daf2c61bac28ee9a284b1101185e8a5d6ebbcc25d947f0f86527ecb60f592e97e123c5cc27cb6744f293cf1348e2da69fc5b870b07
- SSDEEP 24576:qcotVC0kIFBzOOIvwL7ZAMFbRfbhBcpqdnunFfT:qcotVC0k2pr1WpqdnefT
- TLSH T1BB553B11B78A99ADD159C4B0834786626E2178CA0B36FEFF45D462743E7AAF06F3C314
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
870796
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\fresh\fresh\target\x86_64-pc-windows-msvc\dist\deps\fresh_server.pdb
kernel32
QueryPerformanceCounter
GetLastError
Sleep
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
lstrlenW
CloseHandle
SwitchToThread
FlsFree
ReleaseMutex
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapReAlloc
HeapFree
GetCurrentDirectoryW
GetEnvironmentVariableW
GetFileInformationByHandle
GetFileInformationByHandleEx
SetFilePointerEx
FlsSetValue
TryAcquireSRWLockExclusive
QueryPerformanceFrequency
FlsGetValue
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
GetFullPathNameW
CreateFileW
WaitForSingleObject
FlsAlloc
SetHandleInformation
GetModuleHandleW
FormatMessageW
ExitProcess
GetProcessHeap
SetLastError
GetStdHandle
GetConsoleMode
WriteConsoleW
CreateThread
GetSystemTimeAsFileTime
GetStringTypeW
HeapAlloc
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
WriteFile
GetModuleFileNameW
TerminateProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
ws2_32
getpeername
WSASocketW
getaddrinfo
accept
freeaddrinfo
WSACleanup
bind
listen
WSAStartup
send
recv
shutdown
WSAGetLastError
ioctlsocket
setsockopt
closesocket
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
bcrypt
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider
Name
.text
Size
928KB
Virtual Size
928KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
359KB
Virtual Size
359KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=30795,
count=138, id=261, version=30795,
count=10, id=260, version=30795,
count=40, id=261, version=30034,
count=16, id=260, version=30034,
count=9, id=259, version=30034,
count=135, id=1, productName=Unmarked objects,
count=11, id=257, version=30148,
count=282, productName=Unmarked objects (old),
count=1, id=258, version=30148,