Resubmissions
01-06-2023 18:05
230601-wn9g7aga6t 3Static task
static1
General
-
Target
fontesie_[unknowncheats.me]_.exe
-
Size
620KB
-
MD5
e259e03318d5b8539b3f4a555338ef39
-
SHA1
2f52a2b512d07d72f4e0081b03c42c5f9d4344bc
-
SHA256
c8a9c890a0e6656e10f67ab971a20535d60e5ae25175bda2ddbd5bb7f362d78c
-
SHA512
81d680f4bf174a198030e854d0b85d5039df96bedfb1544e71dd4f9f3fda33aa7f1097d5e4d9dcb3108a2b04e508ecbd720b988070128087ffc248036d47011b
-
SSDEEP
12288:S8ea1uqOC8YRY+DfO9UEJUulDOGHzRsnMf:RmaRPbilE2lsnM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fontesie_[unknowncheats.me]_.exe
Files
-
fontesie_[unknowncheats.me]_.exe.exe windows x64
27eeb70ed75a298e8fcfb9ff06567b7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
DefWindowProcA
PostQuitMessage
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
ShowWindow
SetWindowPos
GetAsyncKeyState
UpdateWindow
GetWindowRect
SetWindowLongA
FindWindowA
GetWindow
LoadIconA
PeekMessageA
OpenClipboard
DispatchMessageA
TranslateMessage
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
TrackMouseEvent
GetKeyState
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
GetClientRect
SetCursorPos
SetCursor
GetCursorPos
LoadCursorA
ScreenToClient
ClientToScreen
kernel32
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
K32EnumProcessModules
Process32Next
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
Sleep
OpenProcess
ReadProcessMemory
WriteProcessMemory
LocalAlloc
LocalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Process32First
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmAssociateContextEx
ImmReleaseContext
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
_Thrd_yield
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?setf@ios_base@std@@QEAAHHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
d3d9
Direct3DCreate9Ex
vcruntime140
__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
memset
__C_specific_handler_noexcept
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memmove
memcmp
memchr
strstr
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strcpy_s
strncmp
strncpy
strcat_s
_stricmp
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_wfopen
fclose
__p__commode
fflush
fread
_set_fmode
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vfprintf
fwrite
ftell
fseek
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
logf
cosf
sqrtf
fmodf
pow
powf
__setusermatherr
ceilf
acosf
sinf
log
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_register_onexit_function
_cexit
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
system
exit
__p___argc
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 477KB - Virtual size: 476KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 1024B - Virtual size: 859B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ