y�>�氓�酓ys�5�T���`�]�C�)�L�C�T�������}��H�S��4��R����j�b��⼸[���P�� ]\��������IM���p�D@�Q�{�)�8X?���Aj�Vzg�wx�c0?E�\ '�,A疋�6Ҏ&��џ����p� (����Q�oC)>Ws��=��_6��n�]��Mr�{v����K��������]�l�jM%]�X���P�n�8ܮW0(�A�y���2io��$b��h�;�E���A��!c�����ce�C�N��rG*5��!%��� � !����}8H9�i`�h�uX�b���h�����K���d~\�zk�`�i����jT�@���2���r{#��f�����k������G��ט@��+Z$�� �\�V�i�zK��zHT�?��{kU����_Cc�v��-(צ��0�j�6vJ�"&J��\$�m/ݶ�j�P�7[�$y�B�k������{#́ڰ�������=�7�%���Cd��e`�2��Wr&�\�(�Ls�-�k�k�I��T���w��ESm+ϥ��z!��S�W���T.����l���{K}�C1�N���t����Ƕ8�^"��������o���:�/�.*����>rz9X�.��-D��������}��e��������-�avDc)E�Cr_��_Fʔ\�ݙ�^|)���(������&:�P��lv�qZ�ut>��O��Lv[�t%����,�SY��I�0Ʒ���T�* R�~�҃;C�}48��,�^lٷ��Bm�r�Tq�Q����)t��;��Xuy5���\���24c�]�D��ڒ���z ���s! �n 0���ݾ'��UrW�@dM�-�� �Q[B�M�M�%{]���hl��t2<�:g���"^��=E�z��^ nm�C�������´l7f<� 8��6*o7֘y�Z{ۀ,���a�yl��7�V컫u�j�v�����7�O �����XH�����(�)w���u�!r��h5�ə|@��ѭ43��#|.溫P�gy$�t�t��V���la��̶Yu6��,����" hY�nq���}|p:�uR��9|�C!��א&�{l��\���%o�-���V:�ϓ���x£���`��|8���NNK�i �ѐ���ڶg�)��܌��-�-��t����T�5�Ǹ�Q ��טDr[��k&�Y�Դį�*=�w ��� ;��E�LeDD��ϯ}���� }�q��<��X���yΚz�Z;`Ƿ5�j"�xiFTci\o�Y?�}�:^s��fDl�m{�V�' uS���W��n��T��PV�l|��h.���o֜E�b�Qg�fW�Dv?��*N�_\�#PV0Q��柹�Ld���O��� ]i��o������Z|���F�DO�����!�:�Ԍϓg�:�Q�8wt�' iXr�0����C�x���;���Τ5� �Z����1�4��/`R�n���e�%�_���G��vm��`�d�A��Ű�ʣ0�_!;���rȪ�K�S�*��I;�-K�}�X���h���,4G"�,�er����`������M ������δ���T�7���ľ}\.�6˒�c�h9=�\�v�y��Cg�ZAH��_��m#�]��c�f��O���������?=+I�a���:�m֧JJ)��,R�;P1��)��q��-��[��T<\Џ¦���PT?h�]�����ޜ��(�3��V]v6Ę��.?:dLV\��� �$U�^tu>����&31υ� sA:��nAe��l[���&���!����߅��H��̳%��U��Su������uqsk�(Enf�`bA��y?98��&�PQ�i���)Z`S�$�U��,�'�\��C�CU���)��䴔�ˌS~ïO��`۲���|"s��;&�����|F��bU��O;�����@ l�&��s��eG��N�/ܜN5A^j;��$�R������?8��P{kLaqc���I!��z'���/�>O3`3�+m���؞o'�?�8A��ق8����_[i���[?k%�R��3����-i�Z���������>��.��$~�]�&����x��f0��r�V�E<����YmϩOҕ���ߞ 7be���#�c����j��b���J ��4�UǸ�y�5�ry�t\۰�&�.n�Ւ��-鏈&E���z��0�;4\�� D� ��;2�]�e#.�[�]�9�t���OE���G��{����0�ܽڰ����4��;Aľ�Hn�Zf�ֻs��]�Ґ!~!�ۦ�� ����Y�{�7�z,^^Db|zY#�B�z��j�Ϸ?��Cg���\O;4R����y{S��W�����W���U���1J#�K[/� R���0]LE��_Â����<L��� L����������A�_�n��Pu�?ťU�ָ���R�g�ƕ���뵵�pD��oNj�$0��"��a�)�e���7VO��1�E��t�1�E#5Z�I�Z���}j:mrG�D���k�$��֪e8��ђ�������L:l"-����B QW�:Yr��e��#ڢ�sL� �K]G��v:=�R�3ƼZc^�] ���eb�3��-�{���V$�\��ߝ2C���s�/Ұ��)H��.�63[Sr髼KԽ�q�f�9��Z欢�Z�`���h!��ݎ)ͣ�Xk4����̜��J���l��V� �e����Qs�@����`�$8壽�@�i�� z��&ެT�Ű�����&3}ml�]Ro?Y��l���Ν�x`Q0�7-Rm���t��Rofi�cn��OI����Jބ��(�Ul>�v��mK�/b�iGֺ�1IWD�zBf#B�0<|�/i%�U���G���~!�c GLn�qki�.�ٜ<�������xO��o��_�v�Sza��s3A������V�1�L��ab��Z�s�B���&s�A.���Jϙ������0�b�1 �3��G�!��=��~�8�豄������K����v���H���^r���K�%�R�pe[=�$ �5՜�Q~H!& ��ϛW��"z�HYB��u:�+<��������W�/\�Ĥ$���%x�\�ЦՅķ�5v3��!�nJ:؞��6�Q�h�e�"b�����
Static task
static1
Behavioral task
behavioral1
Sample
sigma/CheatoSpoofer.exe
Resource
win7-20230831-en
General
-
Target
sigma.7z
-
Size
31.7MB
-
MD5
8fa98e3478284ae39658a793452b8df0
-
SHA1
afcb3a8b84e57a95683f90ba609654cb4d1d60bd
-
SHA256
6be2d2500804b8a1665a27d8ace969c18b11792d6585c4d5de7d43db445902fd
-
SHA512
0b6cf5505f187baaf6e26f840f23c316977aed224be41ee5e8981fd20ee4ef89accfafc624ac78714035bfb6a0d3102c71df65a59d0eae2b855e3c5a53e40cad
-
SSDEEP
786432:V57yM0r4Bd341TPEHgf07RKU87uM6EN994a:eL8LIByg24xPN9ia
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/sigma/CheatoSpoofer.exe
Files
-
sigma.7z.7z
-
sigma/CheatoSpoofer.exe.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: - Virtual size: 12.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 25.2MB - Virtual size: 25.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 29.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE