runtime-free[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
runtime-free.exe
Size 2.7MB
Sample261113-bysbfaev5t
SHA256 e03159fc490fcaf0cc37b73774bfef6b8fbafde3edd230d5592e1100b6594b45
MD5 d9c7e38aed94309423b3b1e5b65cf8b8
SHA1 01054a9bf1020842eef913e96d5074b6f5af8478
SHA512 d963c4e2ff40ae49082b65a0db18d1e45fdd9b90edbd81c9582ae659d6daeff70daa945392c82fbadf16864bca2cc6e0664646ec753f036567908e2165a80191
SSDEEP 49152:UH+8WEySFnVKv/23hB43vXSS0nS5s/sOHInowgAcH8nirF:XfoQ/28l1OMlgFyir
TLSH
T1AED5BE8992A540E4CE7BE23D8D4B8707E7707C5D0330A6EB67D81AA51F637E41A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
runtime-free.exe

File Explorer

runtime-free.exe

.exe 2.7MB

runtime-free.exe

IMPHASH 7f209a905c2cdfa9c17c911e1863fbd9
SHA256 e03159fc490fcaf0cc37b73774bfef6b8fbafde3edd230d5592e1100b6594b45
MD5 d9c7e38aed94309423b3b1e5b65cf8b8
SHA1 01054a9bf1020842eef913e96d5074b6f5af8478
SHA512 d963c4e2ff40ae49082b65a0db18d1e45fdd9b90edbd81c9582ae659d6daeff70daa945392c82fbadf16864bca2cc6e0664646ec753f036567908e2165a80191
SSDEEP 49152:UH+8WEySFnVKv/23hB43vXSS0nS5s/sOHInowgAcH8nirF:XfoQ/28l1OMlgFyir
TLSH
T1AED5BE8992A540E4CE7BE23D8D4B8707E7707C5D0330A6EB67D81AA51F637E41A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1330656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetThreadContext SetProcessMitigationPolicy OpenProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetTickCount64 GetSystemFirmwareTable VirtualProtect MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA LocalAlloc LocalFree SetThreadAffinityMask CreateFileMappingA MoveFileA CreateNamedPipeA GetComputerNameA GetDynamicTimeZoneInformation GetSystemPowerStatus WideCharToMultiByte SetConsoleTextAttribute CreateToolhelp32Snapshot Process32First Process32Next Thread32First Thread32Next Module32First Module32Next SetLastError GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar FreeLibrary GetLocaleInfoA IsDBCSLeadByte WriteConsoleW GetFileSize HeapAlloc HeapReAlloc HeapFree GetProcessHeap HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage GetExitCodeThread ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP GetFileType EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW RtlVirtualUnwind RtlCaptureContext GetModuleFileNameW IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread GetModuleHandleExW RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable DeleteCriticalSection CreateThread GetExitCodeProcess TerminateProcess ExitProcess GetCurrentProcessId GetCurrentProcess Sleep CreateEventA WaitForSingleObject CancelIo IsDebuggerPresent GetVolumeInformationA GetTempPathA WriteFile RemoveDirectoryA ReadFile GetFileTime GetStdHandle GetFileSizeEx GetFileAttributesA GetDiskFreeSpaceExA FlushFileBuffers DeleteFileA CreateFileW CreateFileA CreateDirectoryA GetCommandLineA InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection OpenThread FindNextFileW FindFirstFileExW QueryPerformanceFrequency QueryPerformanceCounter DisconnectNamedPipe FindClose SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive WaitForSingleObjectEx GetSystemTimePreciseAsFileTime ConnectNamedPipe SetErrorMode LoadLibraryExW GetCurrentThreadId GetCurrentThread GetLastError DuplicateHandle CloseHandle UnhandledExceptionFilter CheckRemoteDebuggerPresent GetUserDefaultLCID SetEndOfFile

user32

SendMessageA DefWindowProcA PostQuitMessage UnregisterClassA RegisterClassExA CreateWindowExA DestroyWindow ShowWindow GetSystemMetrics DrawTextA UpdateWindow GetDC ReleaseDC GetWindowRect PeekMessageA FindWindowA GetWindowThreadProcessId LoadCursorA EnumDisplayMonitors OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo DefWindowProcW GetKeyState GetCapture SetCapture DispatchMessageA TranslateMessage MessageBoxA ReleaseCapture IsWindowUnicode GetForegroundWindow GetClientRect SetCursorPos SetCursor SetWindowPos ScreenToClient ClientToScreen GetCursorPos GetActiveWindow

gdi32

CreateSolidBrush CreateFontA DeleteObject SetBkColor SetTextColor SelectObject

comdlg32

GetOpenFileNameA

advapi32

CryptAcquireContextA InitializeSecurityDescriptor RegSetValueExA RegDeleteValueA ConvertStringSidToSidA CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameA SetSecurityDescriptorDacl SetKernelObjectSecurity InitializeAcl

shell32

ShellExecuteA SHGetFileInfoA SHGetFolderPathA SHGetKnownFolderPath ord680 ShellExecuteW

ole32

CoTaskMemFree

iphlpapi

GetAdaptersInfo

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptDecrypt

crypt32

CryptHashCertificate2 CertFreeCertificateContext

dxgi

CreateDXGIFactory

winhttp

WinHttpConnect WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryOption WinHttpQueryDataAvailable WinHttpReadData WinHttpOpen WinHttpCloseHandle

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute

shlwapi

PathCombineA

winmm

waveOutGetNumDevs timeGetTime

uxtheme

IsThemeActive IsAppThemed

msimg32

AlphaBlend

comctl32

InitCommonControlsEx

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

683KB

Virtual Size

682KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

509KB

Virtual Size

518KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

runtime-free.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

iphlpapi

bcrypt

crypt32

dxgi

winhttp

d3d11

d3dcompiler_47

dwmapi

shlwapi

winmm

uxtheme

msimg32

comctl32

setupapi

imm32

generic