qeżbB���b#�|����L،�}��Y���<A2DtB>^=':V� � �z�ejڭ��-�0��xe���Hw�&䍧�z�!6���x�B�d9�˝0`�U��EE�x`��e� ��U�϶�� �)�d��X���K��,�I |�B��=�(�����2��� Gq�-`�xolwT3�)%�Gn�_�� G���<�|�#Nd������̒|C|� �K����ak������qyx��3����N�� X�)�z��z����ԮA ��s�ǭnΧ�X���+�H&���B��y���!��Fs���TG"�����-�o/'^�˯�~�G�Օ��N��ro���[x�*�r�xz����p�����p��U9!H+iu@�?=��"�r�c��U_�B50��iG<��VY�����/u=\}��e�8@n��t&]Xn��1�`E�㎝���? βÝj;��Ш��gO4�M����ܭ�A2pZ��0������������`0���+�ު<�� �r��M��U+/���W��^*O��yIBh*T�8y㑀���x���y�Q*�nM�/2�N]�(�&� Dz��`&�}ڽ�5A��*D��Ⴀ�CQ��Vˉ�Z�^D�AG�����s�y�?�F��qi�cu�����;o����BU@AD����D���@B��:��t\�(,���E�]�G�6��5��e�ִ�e��wY�/ob�>^�P|��,$���0�\��Cg{GjD��N�4��ۈԬ�g�Zy�_8e�*�۫d�D���w�����o s|��Vnj��c�~f���y�(o�w+K��ߕg ��<�.;�[���#��k5�����EA���j͡�qk�T,E����lGI��5ܨ.{�n�Sk��X֙�tx� ��W���G�n��:�J>�/$hc���(A�|D�,OޮQ;.��~�*j>�#�d1� �o��d�K��m�W� 3����Y��]1�@ }:L�R�o�Lޚ���43(`~����Lq���@͏u��|q��T�s�߮�]vyq�!�\y߇����|�J��q���.�������Z�M���XwIKS�U�eѓ�`�YQm�� ���R�ʙ��xV�v�\je�E;2w�\����.2�4� ��� v��!�������0.�A�0l_by�����K�j|�6n���V����P"[x�C�<n��6?*.��U��ȶFO�y:w}J�9�eE{d�@!�[�翕�B�*�Fb��D�Bn[`�\Am��&���i!ϏY����*���� J�~!���Z�?���kͽ��90�^�6��������`a� qU�fߙ@:K���f�J�3��47�#�i���w�$pY�����y�����/���ȯ� 7_��#]��]��!�y��� � S{{�:����|��'�i&��$7\�0�G��9��Ucp���5f�m�G��rt���e>� �"s��b]Y�����.��֎˥�%�����W/=2��X䐱n�6ߘ��� y���K+6�Ax��F%�Ggj' tր3�ؒG����BZd͵ ��a��OW,ccݎ2����ն����LmQ���l+��f�6�7��VU�88��Uf4$��i�� `+Q�d����||��BGl}�M(K���4=vY�3~.�]��F��=!gF���0���f^����T�Ⱥ���0�Dɱ�W�dl~��u��`N���U���2��E^@d<A4#Q��yTQ�����[�%Hw7�4I�����ߠхS}�GS�o�UVS���S����1ԗ����eH ��-y4W%����-��rֲ ��k��`\de���L��b/�/�`�<�+[9��ϪG�����w�J�p�^�*⡰X�ۺ�l�:�m��}���LJT�� e��9R������-�8����'4��+u��{�/��� ��5��,�/����R2��L�?�ni'��vLj:nMN}xFQ Չ�|�1ք�/���4����@�c\���X�OQ�[�( ���П���B����@+|L`��Q3�TW~�T�g!�2,���=�����Lx+�Z���$k;G��#9*�^�g������#���-�\UEQ3pe���/�.,B,g)aQN\1VZ"tS���*%'V(O�K�WQt�E2TՋF��e�h[��IN��3��8xp�K��Ԛ=��T�� Y�e��,V�8��"�&�2��C� ��B�o��:1�xJ�@��"�3�h� Y:n A��ڽ���+{BͽbЄ���������Ɉ���V��}m6��ޥ���S@E���FGFS$��kON|*�d�6Cn���:H�Jz����<O�� ����pa��r�%�yX9�r�Kdb kE댈��zb�S$"<D�W����f%�;ߏ��/�[!��ZFU�s�Q�� _�s�����e�1��� �"`��� �@����� pH �>�+���s�����NW���OMq��/���-+1/��nΊ���%� [��m���s�MC`e���(��$n|3���A�ȫ#��Z�Sls s*3�UC��������m�!�;�����1s��GV�=�O~��C��1FL����D�$Y�d��m���.����u!@��� ?��Ƈ��Y��w5>�wK�[%g�X��E�4)��� �� ���u��<[��< ��v��n� �~�6�c��7Lu���O{��IϨK6�ѤY�+�4!��Ԉ������!� �ٽY�,�dd3�hYn�ۚ� �kf֎6c^u�J��٦���H�d@�4>�x�R3�0=g��c��:.W�6&�����3 {!����J���#��&��挧s������p��#�e�5 E������+���,jis�S�U�����\x���4ikz��)��F�C�����э*�k�=�O�?����T��f����"��f��i6����fK��e����*_��d��봯�HHjP��GW�'�>�OKc�|��]�"\����*���ˬ./���g�a���p�Q���y@7M��n؏�������ݓn�$ӺbB 4?�Յ8&" V�}/��Zg����c���nr��
Static task
static1
Behavioral task
behavioral1
Sample
cheese_itz_free_internal_cheat.exe
Resource
win10-20230220-en
General
-
Target
cheese_itz_free_internal_cheat.exe
-
Size
5.7MB
-
MD5
796c72650f2ae0423d4c9db1190e0ce1
-
SHA1
61f317b74d79297752830c1a3be63b5b1aff3a91
-
SHA256
049cfd5fcb6b355aa9fe60a7e696fe94cdc69699143ac2d68bb379811a9de5a5
-
SHA512
544819fd9e06c93fff12b1113ce2cb9cf1de4821f71dfa5585c49847fa763e9f1d1bf52ef6de0f471acdfd4f39e04e7c8a99488f4e82c74bcda410edc695ac8f
-
SSDEEP
98304:LBtgDxvouTtjn++T7tjsxwCgUSnKPlDg9g/CSS5nyuG3UgsvTNZxJyxL:LBmDloGz+atjsxdgUiIDgBC7sv5Zx4
Malware Config
Signatures
Files
-
cheese_itz_free_internal_cheat.exe.exe windows x64
7999401b894f67efcdf1bb7ebe7ce297
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DeviceIoControl
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnhookWindowsHookEx
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteW
ntdll
RtlCaptureContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 257KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 677KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cheese0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.cheese1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ