Static task
static1
Behavioral task
behavioral1
Sample
FPSChessCheats_[unknowncheats.me]_.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
FPSChessCheats_[unknowncheats.me]_.exe
Resource
win10v2004-20231023-en
General
-
Target
FPSChessCheats_[unknowncheats.me]_.exe
-
Size
548KB
-
MD5
6a628a97af9638c0bca25b8edd6c1f91
-
SHA1
69df30cdcb95ea9b6ff80989f8942dabe1f38030
-
SHA256
03e8ca0c59e3598f0a960dfd2bb895f1aae877357a0ba981adf653619965e044
-
SHA512
ad8a9a30bfd3afe8c814fe9db134ddff59dcd8489e98b433d942997c0d6ccbeffd23e75fa35692c27633c3fd0d7d678906986d08f6508c6a4c2d90caafd105da
-
SSDEEP
12288:jJ4+WRqhz8HjQIHF/+9pWH4+3noMQA/nBoqMuH:l4fRU8xlGj84+3oMQA/nB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FPSChessCheats_[unknowncheats.me]_.exe
Files
-
FPSChessCheats_[unknowncheats.me]_.exe.exe windows:6 windows x64
5c2b51e22e59139b6cbdfae613ad1db9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9Ex
Direct3DCreate9
d3dx9_43
D3DXCreateLine
kernel32
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
Sleep
GetLastError
LocalFree
GetConsoleWindow
FormatMessageA
ReadProcessMemory
Process32First
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CloseHandle
Module32FirstW
Module32NextW
WriteProcessMemory
GetProcessId
CreateFileW
GetStringTypeW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
WideCharToMultiByte
FindNextFileW
FindFirstFileExW
FindClose
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
LCMapStringW
CompareStringW
HeapFree
HeapAlloc
GetFileType
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
IsValidCodePage
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ReadFile
user32
EmptyClipboard
LoadCursorA
SetClipboardData
CloseClipboard
GetWindowThreadProcessId
GetAsyncKeyState
SendInput
GetMessageA
GetWindowRect
MoveWindow
DefWindowProcA
SetLayeredWindowAttributes
FindWindowA
DefWindowProcW
DispatchMessageA
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
TranslateMessage
PeekMessageA
PostQuitMessage
UpdateWindow
GetKeyState
GetMessageExtraInfo
OpenClipboard
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
GetClipboardData
gdi32
CreateSolidBrush
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
Sections
.text Size: 401KB - Virtual size: 401KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ