�s~lZi���Ĉ��XT�m( B<�ߡa�F����N#� q��9nl�&{ؽ���Z�P��Ul�i�ci�����a׳ 8l�]W.�ؖu�@�-��t"FZ��̩��)ټ��g#Dx���ɀ�um�A��OՔ��>L�<�M�b�n��*��w���&��$&�� 稔T����p��z�~�j�����c�����C(y���i�yS�b7���_�U&�e4D%s�:G6����@c���a�q�Z:�D��d��NO��蜈��J8�ul�� )NQ6�'��%3�� f�N 7�i�u�Y{������mn~"�ʲ� !���I�e���9de�p��[ƃ̓����@��2m�������|������Wc��4��@u�����d�P?RЧ�q��jcj�T4�$��dMf��/YFR)��K��P�� ��)nߒi� ���t�:�I|L�-}4��Q�G)�Zb#�Js�.�o�~7OU,�.�K)x����y+����}2t����)� S�m Wu�%گ}I�TVbEO+lK��B�ҡe�B�����}��ؑ���~�o)O�UaʡĘ#�x<W*���G��D�WI��'�c��3U��=�uR\��ǧ��5|S�Ԡ���s��E?p����LPam��t_�KڗzL[צqtjx=��H{�%��ނ�����w��:�����:��������F!����� h��~ �����fGm�Y�\,o�m��� ��T��<&����k+6�5h~Eo���+�/��~�nj}/��tu+!]mO�����'h���,^�ł�<��� b��Q�/iѡt��/�0:��Kq�������.S�\.���uO{w�GJS�'Bՠ|��'��|n�yџ�\弥X�5��Cn఼����]�z���L�[#��0)�F����v�V�$�yM9\��p7�̀Ư��2,��❵پ�) B(o�S�o�oIY��e+(�lm'����~&���0�ل�����v/(�o�Q;�{/���@�`\C;�N��B��H�����ø�c�en��}ԃ[Z��&J+V��cʎB���<;{�?y����4����[l�^y<K�*x��WYS=MTvx!0&_�X�|�32Vy�I�ʺ�����(R�*�8mY�N��3�m؟G�P0��<�%�����!kQ�����-.E@/���}���h��P��O-�Q���<���� �0q���#��� *����c �;���)�"R?0�OY��_B���3�)������� �{��w����)}�Qp���G%�C��yǣf�cPE��)�5�g5�t'�q�x,!��*�v�6L �� ��`���w��1ѭ[;��B(��� M$x6�X3�<"���k�-*y�f�)_PGgW^��9 �"����}��ƚ����!��e��̇v��2߱ (�ћ2��Z�b䫷�s��L��1���4^�kq�d]�k���"V�]�ϿB�5�S~��\���i�4���:��BD i�BZ�����u��>\����A%�3� ��x��P������C4 i� #VXk!k�-�5i�6ǹ +J3g`�i���Y{ߚ.1�O����.��&6R��V�E.f��G���"����M0f7�b�NE%�������B�ž$qC��"�9����Vų� @[n�X����k�a�D!��,����MRy�-tڥ91[é��m\���0�T~��J�4��Z�����2]L�_T��o��H��Ѥ-VfA��c��و�F[�:E.R-f��� Ji��a2F�k��6tδ��<����pP�[������a��4=%W�ժ=�I��u�J��v�x<"^�=�� ���>w:�{ʼ`�þ��m-�'���H���5��{D|\�|���lVtA8��^g7��a��IœQ=��~���R�E3C s�G�h.�K;��ә(�xGQ#�/��/�ĩ�m�a��t>JQ4����3���� ke�'�-X��F�9q�VI�7��{�Ћ�h�dS ��F��!_e�w�ӰD�t����� ��!k��K��X�'�yM���'ݤ)�(AI㍂.FS����o�L�;OS|��9���p�YD�T�π%�t��@�OFee%��K�M����Ӱ��d�%�杳l��|�^Y�yY��9�f�Q���&��~dCW�E�c���L\[1R<����+��4���Fxo92h��7�\Iui @�&t�C�W�-)5����J=���m��Tw�-�1<p�/�vv1�v�䰛�'qG���F�y�o����-�z���������sX��92Ya�{�v�[�o���)Gݓ��e�ruS����^МXz*�pnр���U����z�9f�%�g7��)r�j0]��N��]���6�7�&U�wh|l���D ��^U���J�o)�8T�:�?G�%�e~�$=mR_z(\���`���I�ct�,�䎠��1��˜DL5�{jC�z���W�E�ʛP 4o���6A��'~۠RklC��q�N�����^'����5p�/r>r�rX\�3���w`A:&���tö�p��W��|],>������P��U��i�k!&ũ��fF<��ZU<;3泚�ln.�p�����"�{�Ac��cv�!)�ɔ�HL��Y�5�L�($K������($�S,�>ۛ�̴Ma�o�2\(�{��*]����E�3��<���h"�5z]+��#�<#t)Vs-zn��=Q䄕��1�"?��̝b�k���-i.�2�����w��_��To��x �I���>��'�J��x��#��_G�̫sW�������fk`�j�u�AlC�ݤ�oXcj�S�� #�6�g�p�N �~���0�s��Щ�>��]۲�қc���3��I�n�f�P!����i�]S�I����y[(Q<�w�^۷�ף�����<��E�on��%̎�����@ǰ�/����\���IT}NW�����!��AqX8��[�!_!���s)�ɐ��,5]M��T���v�zL|�h������f���=��i��R������f�B�+�6{qN9g�d5��7Ƒp_s�0�S��f��ak�{��֝YSR������"v��]���z�kA��������=�ȎKhމo��"��Έ�,�IS���9%$�������ؐ����6�3=2P�*I�E�~ iT{�sJy+ ��:�6�K2I�ύ�g��N����Ϩ~�4Ǚ���N��u��Q��r�JbC}d �������W_7�H^qk�_b)B Q�,��7]{�a�����oB���� ?M��� {�Hv�A"��H�x���@�ʙV=��;qdV�$��n��ѕj�����z��÷Ѡğ��ÓkWd�CT��#�̀�/�n5Ȣ�J�sΓ̕���-���O �dڜC�ۿ�^(XJ�Q�M�[lD���_"� 2���k^��R�^A�� ��ʒνAY�g�`j�~�5���i��h{a�����"���V��#&��8{��7�i^S;X��Q�f9x�N���Q0xP�,Jar/�[7����~�(���}��$��ϫ{�w����h%T��A���)�����B���t ��)�e��y|�u3 O+u�3qE�la}�O���ǧ��g��[б*f�b'��0�k��̾0C�wJ�\�"g?�y�_��S�IJ��i8��t�ׇ��kp2j��-����]��jx
Static task
static1
Behavioral task
behavioral1
Sample
CheatoSpoofer (1).exe
Resource
win10v2004-20230703-en
General
-
Target
CheatoSpoofer (1).exe
-
Size
32.3MB
-
MD5
7a8f3ff6b456e153499088a103d51145
-
SHA1
30f1fc37c25cd368594c0b8c9e416b3c5ed31d6f
-
SHA256
93d8134fa11201cecedac89d6c6af96afa83783aebf347ea3f6aefc925df8ceb
-
SHA512
e295568d314d88355ca1d681602ea00ac3419d3f583e6773eae74d6fd1eaa16789b01af8e35d4af9941ff57055d688d153bf9b2c14ffb8961c5359f2a11e31f0
-
SSDEEP
786432:BYMfV94+jxjRtMCKIvIGviTq1LZw2OhEyKYEVwSppnu:BYAVRxNWuQGviU1JzyKFV/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CheatoSpoofer (1).exe
Files
-
CheatoSpoofer (1).exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: - Virtual size: 13.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 25.8MB - Virtual size: 25.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 29.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE