General

Malware Config

Signatures

Files

• e0a4ef63cf6b5f38f684b7df4d7052c037707212e6c608086bc8d44f5768ac1e

  .exe windows x86

  b25dc196c34c678593c9311929eac7c2

  
  

  Code Sign

  04:00:00:00:00:01:2f:4e:e1:52:d7

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  13-04-2011 10:00

  Not After

  28-01-2028 12:00

  Subject

  CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  04:00:00:00:00:01:2f:4e:e1:35:5c

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  13-04-2011 10:00

  Not After

  13-04-2019 10:00

  Subject

  CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

  Not Before

  23-08-2013 00:00

  Not After

  23-09-2024 00:00

  Subject

  CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  11:21:77:30:89:91:0c:f0:e7:ea:1d:8a:1e:40:3d:53:44:a8

  Certificate

  Issuer

  CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

  Not Before

  14-05-2014 12:14

  Not After

  22-08-2015 11:08

  Subject

  CN=Cheat Engine,O=Cheat Engine,L=Eindhoven,C=NL,1.2.840.113549.1.9.1=#0c156461726b5f6279746540686f746d61696c2e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  30:2b:b6:97:63:63:19:af:e5:cc:f3:4d:17:b5:9c:c1:1f:d6:7d:bf

  Signer

  Actual PE Digest

  30:2b:b6:97:63:63:19:af:e5:cc:f3:4d:17:b5:9c:c1:1f:d6:7d:bf

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Cheat Engine,O=Cheat Engine,L=Eindhoven,C=NL,1.2.840.113549.1.9.1=#0c156461726b5f6279746540686f746d61696c2e636f6d

  19-06-2014 09:51

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvbvm60

  ord584

  ord696

  ord589

  MethCallEngine

  ord517

  __vbaCopyBytes

  ord666

  ord595

  ord631

  ord525

  EVENT_SINK_AddRef

  DllFunctionCall

  EVENT_SINK_Release

  EVENT_SINK_QueryInterface

  __vbaExceptHandler

  ord711

  ord607

  ord608

  ord717

  ProcCallEngine

  ord644

  ord681

  ord576

  ord685

  ord578

  ord100

  ord616

  ord618

  Sections

  .text

  Size: 64KB - Virtual size: 60KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 216KB - Virtual size: 214KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ