Behavioral task
behavioral1
Sample
Invis Script - Cheat Engine Eddition/Windows10UniversalSTFO.exe
Resource
win7-20230831-en
General
-
Target
STFO_INVIS_METHOD_DROPPED_BY_DEX.rar
-
Size
3.0MB
-
MD5
dbfb34db17f49296d359148149eb4174
-
SHA1
11de2bea127bfebf0b1d7d9aa2a14a8a28269219
-
SHA256
47890a6aa20a87c0b18d8530e2069965d5c0484319cfa0532f18d6f57cb1fabf
-
SHA512
d2df7a7f175af7fbd974ec7c166ca85698812d09f3470bd34ff9bc06a48547daef367a0a183e51e19a979a8a4a91117de37ecd74e921578b5cc87441acbd90b7
-
SSDEEP
49152:1MK9xjnrOwbWoK8Bg6LJ7iiyReU4r8UYdqBo2UMNgFVWifuVKG/dq247+Cp:199xjnrs8+wXyXvUlo2DvifuQGG+c
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Invis Script - Cheat Engine Eddition/Windows10UniversalSTFO.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Invis Script - Cheat Engine Eddition/Windows10UniversalSTFO.exe
Files
-
STFO_INVIS_METHOD_DROPPED_BY_DEX.rar.rar
-
Cheat Engine Download/Download.txt
-
Invis Script - Cheat Engine Eddition/Windows10UniversalSTFO.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 79KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 16B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
README - Method tut.txt