���BH�x��繠މڬm����y�zDQ�1�$�ݻ��������ǝA@K�m"FMy��&�Z����P];�j E۪}3������2��I����)e����]c��]a@>T������nxT��g�~���u f ��,�����c��H�E�_ɇq1�nܺ��R�OK�F-��3O��G�k�/�c��IN��dž��p��5��-�W��w�w`d��D,��H\|Wx���\�+I����0Կ��=ts���H��!�)0�,�3�6���w�jŭ���%�*�P�d@'�}��bl����gRÑc_�F��˒2,��s�V���;;���X������ґ��O8�����*%�����������$��@JP1�wNCzcXFU�@L:�*$Pݩ�B�8<@N<s�qM�ʮ���8�83�B�>�ˋ�R@6��g3��:MR�毽���� ת����D��7Q;��},�+=��a�MB�3lF�5Ȇ �a%O{�rԤ��S��,N ;K��KjQ���H���'��PQE�K�����}�Go����������[�|�/�ED�a�^bG���1$N�]�XABf ��#�vzЎ�5�4���h���D���� 8�P���x��?a�9l�]� �S���uB%�~|Vퟦ��[��`f�"���'��KU�x�H�S���]�w��B������d7+V�j��,��E d\ ��6����F���l�����vŭ�]��r�=�PشGO*�*���ۥ�{o�X���T�b����LA����W��eKx_z3�C��J���ؕ�����s��π��(�CJٕ���+��O� �OA��I�-�_W�X<�<�r6�3���y�p�ۂ�Y��$J�wa&�Z24Mt��θ\sm1��k�8��JJ�;�e c��1���W9S\4=xa�7�A;%b�a���H��W�g㔒$_?z��J�����8�#�gv~�v;^�0Z{�@Hy���Ob��U#�{3�^�C~Z�^?�ϱ�?S�b�Ld���3��d�8�ƭ�0��SX}���?���)�ؖj���2�5%1��C��ܜ���ʦ]x�]V�;(]��(θ>��K���'��lm���6 ��GD��x�Zc�t{B�/{��� �� 7��������i+uJI<�0��~���QQ6Bv�>E��ՃWWg�� |�.��4x=��K�� ��M�i��h� �ti��6a�����9m�8����n�Vt����֤U����p]Q�A��u�K�:������A ��!G&D��p�1\��?T��ؓ!�`(��Csn��-��8>댠]��|�&����'����fv^-]���<�ZF�@;�DrwO~GIZ�?�Q�哀+!FƟ̓������2���g��;n#�j��X�k#����������Q[��������`�^�=!l����=�&ѓ eya���-�Qc�q�A�q�l�g@��?۰<�[ʹ�������4���ZP�s}���,NlY�i,�����̟��R�ƕ4�h̉��ϗp'ju�'���['@?��vO4�� Z����]���q �9�G;���'X+�B�WF���K��Z5-�Ԇ�gBe��3+@~�(H��AM�+�$�f^�3/��~U10#�D\El�� pj+co ��R���O >��[�g� ���E��_ST����i}��?V �#��W���Y� q�=g���T�S*v�Nykr��m.{��v����95��&��^0j��ګ���Z�K�0��q�'#�O����6�y�lB>�YKS �����G�}����pG�2���0�Z*�`�]p�40f����gQ,v_�Q8TC]��C�[=� ��}�>sD��h^�eY �3��j��W�t�aFvl`�,���X�6�����zq�9!�� F�I~�~��0c�I��*������3WW�t4�ը��t����qӛ��������;2#��2G��ɅM����A�h�'ɵp��m �r|�@��0Nj���@�߶�\����/� $gEA*T�=O�������/H&����&d.����a�X-��v3$Ԋ���ý �1�� }B�y��=����\aH'���Ļ�z<�"Ϣ������$G���m�p!֣�*TL�VT��*Y"�|�{!%>�8�e]�eh� �<�}: ��wӍ!� ZAc�W jY��!�����kiS�&7��9�Vp4��w��i�,�GD����p�{���Sjn��U�2Q�� �I���g�qt���h�F�>蓃N�2��H+}eq2��/��j���U1$�a%֑����m�I� �de��5_���cE�o#�+�����IMZ_0�Zc�z��47�@Ut(��S�5�X�}Lϵ? �+���b�Ӌc��}u�Ώ�=h旍�Uq%2�"��j��K����<�QUA������ u���~)&�<s������7�i�������ʶ�7��1wt��`0}�� nC4�`ݙW�'��2��hE��킛9��(!B�S���5j�����v#"��).>��eK�j�<]��8W"������J3Ŗ�F :���; Tq��אC���2�[�3�5���N�rTY)9q(dËa�O�|v��[h� ��������%��K��ıJ[{9��T�li2�$�(�<���<LH���B=��rc�D٤و���$�Y �g�������O%�7-Z2������燲���]���qa����D�A����PPu鱸�g��=�Ŗ�$T|6gt����l�8NR��܌(4 T�����#�4���u�6m��r�=L��:g%��0��)k�[ ө ���\����$%Js�Y�3���t:2���3��p��g����ɮX��A�o��)��w�Z�������]�����w�]�IاF���u;_ț|��JG�iAb ���T��.�I�Hj+�:��)�W�#�}�����Z������1����%g�F���GɄ=�+��� ���T\1���,��n/|~�d�X��@8�Y��+����)�x�Y�Y>�yV�W};�!� �w|2��ޑ�D���v/
Static task
static1
Behavioral task
behavioral1
Sample
Blueberry_Free_Banana_Shooter_Cheat.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Blueberry_Free_Banana_Shooter_Cheat.exe
Resource
win10v2004-20230220-en
General
-
Target
Blueberry_Free_Banana_Shooter_Cheat.exe
-
Size
7.8MB
-
MD5
6f3fa7ec157805b98f9c9f58203ca668
-
SHA1
da525c3001ae0707ff07469685ce475e0d596bb8
-
SHA256
8cca19f96f20fe3a1af91356802580bee0aa23ed78f6946c512214cacb235b50
-
SHA512
8d589b8bdf2e7ec1d91cb3aeb5401591a3fcb9c93f97e9a00fd3b5adbebe806fa0cc14e06a2168e0f901313ab1856fb4dba74924e1f869572fdb0f1f70882e82
-
SSDEEP
196608:7wV6l03/za98eggcslxeo3J4NNSi5i9IXxaF0:74/zhegg7xTKrSSBaF0
Malware Config
Signatures
Files
-
Blueberry_Free_Banana_Shooter_Cheat.exe.exe windows x64
e1e2c1a7ac4bec6f5b9f37fc9a88c421
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
__WSAFDIsSet
wldap32
ord60
crypt32
CertFindCertificateInStore
advapi32
CryptEnumProvidersW
kernel32
GetFileInformationByHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
CharUpperBuffW
shell32
ShellExecuteA
rpcrt4
UuidCreate
bcrypt
BCryptGenRandom
Exports
Exports
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 780KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
./HZ Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.iG_ Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.>&$ Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ