C:\CHEAT_STUFF\GODMODE\LAUNCHER\ImGUI_Launcher\FTLT_Reborn_Launcher\Release\GODMODE_Launcher.pdb
Behavioral task
behavioral1
Sample
97ce7bfd9254be32d8c3d740d25adc2e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97ce7bfd9254be32d8c3d740d25adc2e.exe
Resource
win10v2004-20231215-en
General
-
Target
97ce7bfd9254be32d8c3d740d25adc2e
-
Size
8.1MB
-
MD5
97ce7bfd9254be32d8c3d740d25adc2e
-
SHA1
18c2b440c9ecdcefa63f856c720c4b8d21a15260
-
SHA256
4788530bdb29065cd582d6b078c85ce0c196317aa4024853f9bfb0bf636efbb0
-
SHA512
d268ef98a21ce290a5dc6a636035cabb611d64932259f8ecf4797a07e7885e343aa2d34e5a3ea7cef0a6564a4311e0eea11eb0e4c912bc22b7a63e8f335d0d3e
-
SSDEEP
98304:oZAenNAtJiiDgayjX6FHNc1gYNHnbAbn2iGlDATTE+DyqZAenNAFeIUTQpWaMm8C:u1NkXDgaz5a5nbAb2RcTQK1NT6Mm8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 97ce7bfd9254be32d8c3d740d25adc2e
Files
-
97ce7bfd9254be32d8c3d740d25adc2e.exe windows:6 windows x86 arch:x86
eb474bc19204e28038d360237bae3312
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
ws2_32
gethostname
kernel32
ReadConsoleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCursorPos
advapi32
LookupPrivilegeValueW
shell32
ShellExecuteA
imm32
ImmGetContext
xinput1_3
ord4
ole32
CoInitialize
wldap32
ord216
crypt32
CertFindCertificateInStore
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-string-l1-1-0
islower
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-filesystem-l1-1-0
_fstat32
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_libm_sse2_cos_precise
api-ms-win-crt-environment-l1-1-0
getenv
shlwapi
SHDeleteKeyW
Exports
Exports
??0Assembler@asmjit@@QAE@PAURuntime@1@@Z
??0CodeGen@asmjit@@QAE@PAURuntime@1@@Z
??0HostRuntime@asmjit@@QAE@XZ
??0JitRuntime@asmjit@@QAE@XZ
??0Runtime@asmjit@@QAE@XZ
??0StaticRuntime@asmjit@@QAE@PAXI@Z
??0VMemMgr@asmjit@@QAE@PAX@Z
??0X86Assembler@asmjit@@QAE@PAURuntime@1@I@Z
??0Zone@asmjit@@QAE@I@Z
??1Assembler@asmjit@@UAE@XZ
??1CodeGen@asmjit@@UAE@XZ
??1HostRuntime@asmjit@@UAE@XZ
??1JitRuntime@asmjit@@UAE@XZ
??1Runtime@asmjit@@UAE@XZ
??1StaticRuntime@asmjit@@UAE@XZ
??1VMemMgr@asmjit@@QAE@XZ
??1X86Assembler@asmjit@@UAE@XZ
??1Zone@asmjit@@QAE@XZ
??_FVMemMgr@asmjit@@QAEXXZ
?_alloc@Zone@asmjit@@QAEPAXI@Z
?_emit@X86Assembler@asmjit@@UAEIIABUOperand@2@000@Z
?_grow@Assembler@asmjit@@QAEII@Z
?_grow@PodVectorBase@asmjit@@IAEIII@Z
?_newLabel@Assembler@asmjit@@QAEIPAULabel@2@@Z
?_newLabelLink@Assembler@asmjit@@QAEPAULabelLink@2@XZ
?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B
?_registerIndexedLabels@Assembler@asmjit@@QAEII@Z
?_relocCode@X86Assembler@asmjit@@UBEIPAX_K@Z
?_reserve@Assembler@asmjit@@QAEII@Z
?_reserve@PodVectorBase@asmjit@@IAEIII@Z
?_x86CondToCmovcc@asmjit@@3QBIB
?_x86CondToJcc@asmjit@@3QBIB
?_x86CondToSetcc@asmjit@@3QBIB
?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B
?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B
?_x86ReverseCond@asmjit@@3QBIB
?add@JitRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z
?add@StaticRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z
?align@X86Assembler@asmjit@@UAEIII@Z
?alloc@VMemMgr@asmjit@@QAEPAXII@Z
?alloc@VMemUtil@asmjit@@SAPAXIPAII@Z
?allocProcessMemory@VMemUtil@asmjit@@SAPAXPAXIPAII@Z
?allocZeroed@Zone@asmjit@@QAEPAXI@Z
?bind@Assembler@asmjit@@UAEIABULabel@2@@Z
?callCpuId@X86CpuUtil@asmjit@@SAXIIPATX86CpuId@2@@Z
?detect@X86CpuUtil@asmjit@@SAXPAUX86CpuInfo@2@@Z
?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ
?dup@Zone@asmjit@@QAEPAXPBXI@Z
?embed@Assembler@asmjit@@UAEIPBXI@Z
?embedLabel@X86Assembler@asmjit@@QAEIABULabel@2@@Z
?emit@Assembler@asmjit@@QAEII@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@00@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@00H@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@00_K@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@0@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@0H@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@0_K@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@H@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@_K@Z
?emit@Assembler@asmjit@@QAEIIH@Z
?emit@Assembler@asmjit@@QAEII_K@Z
?flush@HostRuntime@asmjit@@UAEXPAXI@Z
?getCpuInfo@HostRuntime@asmjit@@UAEPBUCpuInfo@2@XZ
?getHost@CpuInfo@asmjit@@SAPBU12@XZ
?getPageGranularity@VMemUtil@asmjit@@SAIXZ
?getPageSize@VMemUtil@asmjit@@SAIXZ
?getStackAlignment@HostRuntime@asmjit@@UAEIXZ
?make@Assembler@asmjit@@UAEPAXXZ
?noOperand@asmjit@@3UOperand@1@B
?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KABUX86Reg@2@IHI@Z
?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z
?release@JitRuntime@asmjit@@UAEIPAX@Z
?release@StaticRuntime@asmjit@@UAEIPAX@Z
?release@VMemMgr@asmjit@@QAEIPAX@Z
?release@VMemUtil@asmjit@@SAIPAXI@Z
?releaseProcessMemory@VMemUtil@asmjit@@SAIPAX0I@Z
?relocCode@Assembler@asmjit@@QBEIPAX_K@Z
?reset@Assembler@asmjit@@QAEX_N@Z
?reset@PodVectorBase@asmjit@@QAEX_N@Z
?reset@VMemMgr@asmjit@@QAEXXZ
?reset@Zone@asmjit@@QAEX_N@Z
?sdup@Zone@asmjit@@QAEPADPBD@Z
?setArch@X86Assembler@asmjit@@QAEII@Z
?setError@CodeGen@asmjit@@QAEIIPBD@Z
?setErrorHandler@CodeGen@asmjit@@QAEIPAUErrorHandler@2@@Z
?sformat@Zone@asmjit@@QAAPADPBDZZ
?shrink@VMemMgr@asmjit@@QAEIPAXI@Z
?x86RegData@asmjit@@3UX86RegData@1@B
~ۋIY��[:����Q:����V�3�$��)=4�co&�� 6Z�oTOh�w���F7���ӝ���r�<�9k�= 0��E�F���-H�W�Fa)�;����C�!����,�X�ݍ7ۊ�����q ����"�}7���w�:qt]�p�����31�TA�?2`�d �;�i�ط�'�ۏ�k��0�����.K�#ڃ�F���7T}�f�6��s�֫v�lĤ����@(���� ���_r���c���#,b���ji�LgW��Yޠ柖���"� .xt�x�زu+ ��(���U%�F+��檟d�؉Yur�����Kg��䉵��%��:ʴ�-��3�H�y0\|��np��G˃�_cO������!����H�*z@{Q,,���:;�+�g�5J����6J����Bi�9ȋk뽕�t6n�!ФA=�D�|�m�/C����U�!i[����c�u=�X��>�,%QP�b�U��Cnc��e�C[]��R�?��2q�����]�=�63��J���.�"ʲ�A ց$!*y�;Jmz���0��lw�\�3�$W��4˅W�ugH/g/Tv�A@\�H�����W�P�������Α_��lȸ��Po#�cc��U���b�Щ\9B��G5C�������f�3����� \�S���5֖�p�|����#������!��o��*R� �ي(��$������T�!���D�g���^,?�.)�Լ7M�j�6�[�QF�dJ���>��W�7���6�~��(d�vD:܌�_|l �����n9��bV�����tKa#H����ƣ�.|%�|��Kp55�Eap08��±�rQ�8�;o���pdW������l� -�_�ʑAi��4�`�U�pd�2ղȜ��5s8�e���@���@���>n�[3�����$�d�R/�=8�k�R��u:K�\$�_��x��1���N�PiM5�D/�l���c��(`�1�׀o�'zv������ �9o�i��m��-������|��O[���$b��b8z��7�����9{��F��A��]M�����;݇�����/����U���xB�&,���J,��JFܲ_�u������"I�ll{�|��9�}.�7��P|��� 7]��P����!����dT��� �I�ɸmT!##�f<)��SH$��>�G��,��+1�J2*FO9(J��m�}��~���g�؏Ʀ�K�[���N��?��DT�Y'g$�������C��g�a�w�^���M��"t�wc�d��T1�]{W�@�9 j� �C,��u}��N��+���-��h����&���O,#��n��X�8�;�����F�es?ʬ��.ފ��|H�7͕N��.�T.�<(CP�X�ZZҏ�fvօ��9������ VR��^��'���d�x ؉$��w"�`)F�[�݇s�����v9:�>U�����vC��B�f%:�0«a�S���{��T)�!�k�\���3&�pFf��uZ����ȿ�x%9��/�}Qm<hePط��d�l˧��6gU�A�OѢPM\ohi��2{� ��.�r������`�ċk+��yg��6��Y/ɂʝ [`�Ch�C踈�r��k��7�lyE��#P����?��o_7�|HQ �Ɠ垐:��1�+V����~W�~��N��}Q�VT��5+/����v�&57�R���4G9��~�y~S�51B���Ң=#8g�@��%�V� ��|�����s!�J�^�w��o^}yX��oh����<��=�%��_�N� R���a�s��Tq%�Ux�פ����h{d��J? ���ie% �<c�&��=Aj� ���}x������)e/S���ܨ> @�uj�E�(�m�ɣ#�E�(�|KG#��KG�;��b[�=-��O$Z-@��5h/Cb��Cܸ���x��mTE���1�((\���lC��^���\+���@����c!��X�0'7@���nT]�YdM_�����VXX1��K7�0Ч�l�B�"?�,ja�d��'��4@�)��$��q�G���=%*qw�[��|�k"�ɦ5_��q`�*�D�n1l�#��ʄW��0�P��6!g:6��bb�E�L����>x<�u���M�ZZ�C�S���������>&$�1���U����U���T 4�������Cy���a1�g^�;�}�ה��̈́���>�K�'O����;9��d�|k� )��O�n�˯��,��O}9K`�������St1k����[�8-�.���Dn̤ � n�m���:����X54XAˡ�z�� bt�\[�.���k�I��٫������&�mgC�o,~�S�-���Ф >� �Zn8&_�my=V�����j�2�u�)��Ԏ���o� ��=�al�+:�!�B�>F��UZ�)-������dy�xI�̍����T��9}��x�"�"t�����8,�������n�fp�Mz_���� �O�&�Z��g���Wo�ܘ���a��wX����a��[R�����<�D�.#�*����S{�#)1�[2���O���qK���OӢ��6\2>���F87�����؍\��� .b�)ʴPF� �߇!�eL+�9�ø�IJy}�����/o�����&o7�ٚ'�~��Xy�pM��� �l�@�����g��� G�1!t4�Z��q�����:0����^Z>���2������t�eڙ����Kjv���\~4��ƈv�E����ɍֽzL������ʸ���Q����)�s����Hl_i��MT�������Hr���Z�8d,3� �r�� F�|:�(6��x�ؠ�Xn��>��!쪆�KO�ɳ ��W���Ov8 ����,���ă�����"��\���Ȩ&�BU�b��.dt������9�*�ґ����/w�Ĺޢ�`��a���v�4�Η����0�:@� _�1+��})���")��g亘�Y8,Sv,�F���kb^��$Nj�i��J��}���Kۯ<qCzum�M�` �bqLJ}��ҝ���"؈s�t
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 544KB - Virtual size: 544KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ