�_��S���%'�ձGw�gK��"J���hH:��O��T����n�Y���ê�������K�Q����娀��S�6�9�Iwr�0��V��5!��d�6�J��z3�>��� U��w��6]沧����䇍rJ h�Hhn�63����p�n����.�'���K��N��M����z�AS�%�W��o��rN�lk<�VQ�`Z*���#c,3A� ��V}����v�$�3���A-Nc�B��YRJ�i��5��_��ɲ<{r�����[�Bj4z5�őnk�����W��!���`�����~��= ��H_�x���9}?.t�v�{fk0Bk�f����0�>AjP�K,�*��/vK���mL/DJ'b��7�d�� �����a+} ��>��c��� �#�B����Q��܅�_x`�nz���!�o���ze3 �#���o�7��%��_�oyn{6��ڄ����+���;vf&<~�/(��h@�Ȭܗ�"���oj/0��%����%���~:os*��lQT����郷^�����3�}�.�;�p��I�Q��-��ln>:y��Lf������L����3{YC���-�3���a冑{[� �.{���!����4�]���/N������X��o ���_��K�7��b��2���ٴ%ugӸ~6��Ypѕ���n�;�����9!���#��}A8w��w�M�i����Z�O9�gb�yh\y���""�#ÿ� �Ik�aHuzt��އ[?b�b��ջ�>R�� H���$�F����Pӷ��L����࢚hF�n))Q�=spZx��8���j.r?�uxv�"��:�ܜ-/܈E���^��=�j/�qe��X�j�m�6�u��G�"*�N���U4P^0+�)����t���;�i� d����i3�>䞍?h�&*�w�B�(l�����?>�J-�T�&R�|��r�ZJ0��K���s&�g�s��%إf�N?�ȕ�'�-�}G�X�DӚ�2�pYW1n4��F7V:@�[]���n��kn��e���2���e�Yn��^�� ��nU��B/�|�L%GJiR�M��oG�f+��TC���%�/�X�g���/@�Y������V�fjN4mj����ϓ�]�f׆�~l$ud�z�DE#�uϿ��NZ��F��������V�1B�l_�iQ{\ަ������m,c�o���.��4�SX������l`�nB��������'�q<����kB��������GZ��y�>��b��XԠ(�F%�����n�,}�9��J�q�ҳH��+��������W�B�'��s����Gi��m��=�E�����H�q�G6�}�-q'�t~��˗� |2_E�6y��E�1%v���{K�W�[_�]R�]�2�媛���2���B��'2�f���;����w�"`F<W��GH�`$���O�����Cr�����i[@o�1~�5DL�RI5��!�'��ܿ�I�w"uZٷ��(�j�l���BiD5���'�/v��%p��u-�It�Љ/�z� �������gOǹSh!���b��z:�Si�m��t��Q*��� ��v# �o k�Z�p���(\��h�'��;j����qk�];��� �����P˷)�r&��W���"��~�\�����R�"k+�vȢ����gO��u��g#BZ���M�����wP�^�+����̂An�C%ŝ�q�ω��T�c�w&,ĕK��v=zN�YkR��C�����+���G5�ݳ�DbP��M�+�0]m�WP�._�l� h���������1��Z��3���"LKWL9�T^b~T�nاCI�n�$�Y�F ��@)Pۃ�0��U��']�@шS:�Lq��e�����_���$#�.�A�_������Ӡ�B��I�2���/)���X�;���Q��x��AǷ�?'h������!�]@6�&Ӳ�sUV\\!��mi���}:@�������N��(!��]<X-*ts��"\���T�9��cN�g�Щ�^a����j�V�*8�9��c�,XT���.}��ه�� �I�9�c�������2�K31u��(��%`CAqĦ-�v��e�#�O4�ȅ��Z=?������m��_�RȔݑ���G�����Vyf�@Z5�_kΤ�l����,ݶ8�͉mq?Kk�.i�I_SԿ̦ ��s��C�Z��v�,0�Q��j����&����c�q����{��H�������߁�������p�8r�=1`!:t�2.�.���]����z%Ja]�X+��G}�����I���۵�Bf��� ���]j�#���O�,�����p�ܞ�"Bz�r�}rcB���{�ޣ.���[�����)�:�oY�����u{���W_�}�`�}�6�������՝��ƒ�9��q��h+��)���z+4|�� 4J-��>BX�; };SU��GpU]�u��}N�YԠ<q�WA��)��d��Okvv�wE3T��!3K��ux����(�-����{��8?<���і�3<)d��/���`),n��q�X<������x�'+������s��k�����n���0_�������c�j����i�Ip_w�ʎ��:�6�zv�9��z���&Θ>��� ��k����=���n�7��<؉�g̅�"�kd�'B�����eo�<e�2��!g����4C�-a��� v@��ω��Ѓ������Gg���܃}�uFyek3�A˩d�I�����P�{u̩���F�Fj��:?�� ��2M�z9��\f996ʔe�ZHXQ�b^����7�V�d=V�m�{��X�V� \�,C�@��üu�] 6�0sp�㡅�$w�C�h�{Rz��T���[v��j���c#���O8$ȷF믔�������Xs��y����7�j^)����l��yh�����d�<kC�>'I~�|.� ���8�/L}��8`�l���O)`}�i�s���M�D� x�\�I��%a�GFE49���RV����Zq!x6��z�C�
Behavioral task
behavioral1
Sample
Cheat.exe
Resource
win10v2004-20220812-en
General
-
Target
Cheat.exe
-
Size
121.5MB
-
MD5
77b141a5d466b3053a3e13620a1c94c5
-
SHA1
dbbc2c31488925ade5b4028b4be5a312a16796c1
-
SHA256
a1c3ecfb363b5ff9815109bfd8e4b2b291bd2958384e91bed3ef0cd3cb5e2c7b
-
SHA512
b750f75fda7f2353b83b83af4d20c7b64d020c3809e21e001b5a9501c64bac1f146877ad4bdeee1c41bc8c1e985ff095205bc38089daee701875ca62ce0d6276
-
SSDEEP
3145728:a1hHLABAFUypLCrBmrP+EHD/Hs98jKRuTFB+AP7p7H+xCxL:eg4NL15HDFjK4TFHDRHvxL
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
Cheat.exe.exe windows x86
1c3089afeecd11feebb05bc59eea335a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 118.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 121.5MB - Virtual size: 121.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ