�L��E{�fႌ�(�H�<��b/l��E>�d�b���=�'��AAQ�Sz/�e��%�&b�1���Sx�3�S%�\��B%��G�$�)�'<�� y'-;o�r�X4��{���������^�}}���'V�d�yK6�^�4De��,5�FE>���N3��m^���8n/�]V���b�,����v�ô���r�9�� 38O#��$e��q ����ፖ���]�J�.k�s����"�h���ȓ%�6RE<�t����p�����H��:Ɣ���5z���>����G�uY?Q�,�xY�u~M e�5����Q���#�=ߟ� `Y����\��o}�����{P� 7�^��+�^�[�� ?�Yb��/g?��J��Q�m:�ь�&��X��i�ˍ)~b�"MI�k,�������Q��9��&-� �v ^���cw��/��!M)��7�E��)@�"{ʋ,�8n�ߜ��]�6�-�Tb����pcn?^�� U�ߍ��K��Z���c��6�)��n=)9���W��p~�G���P�����[˷��xdG���T����DF����zG�i���;����tP���w �2���@,���T)����'����D�SFݎj����I����ά�'n�_4��Mbg��g�LYzo�̯ o�GAm�6�'���G rK�lC�3Z���)��h�Ј?beBQ��0�n B�(�HG6r�v={�C����l Z�4ݢ5$CDw����_��:M�uP��Ȏufy����-d�ۋ�P��|�^0�j�ܢ`�67�i�5)��I�>��;(R�<����3�i�$��W}!$֢�O$��S�5�'t��k�xZE��BmE�K�Fn��l����9f����S��p���5m���a5� ˳K6C������s�'B��.<�8<���=���ot�����C��H�����|"�V��{��;4 �ƧضB�B�����m�Z�����(.�},d Q�� !�4�M�]#34T�0T��$�6d�qU�݆��;��\�}*��p#$��)��~�f�_�����}����A�{%����ҙj]������^XV������S�uv�`���^�$�3R'v+@V��j��cjt�a��2)Q@��+��^[�AԠ᰽�A���Ǡ V������'�0!e �1wyӄ����r$B�`v�l���Ӗu�ߩbĺyE�ʼnYթZ�+��<���a[Qw/]�<x��眔Nb-I�۸��r��fT����Y웨mm�! \�>��҂�\Y�?@�}�:'$����Ns���g�xR�9X�\��5B.^� ۪��7R-����� � �������)����&���W��,X�$��&��0�����W�1?[��mHo8�V�A�c��R��ϩ�b��u��|�\�W���R�h��+®�0I�G�m���ڢ�۽���G�u�w�Fl�߉�u�y�Q��e�t�B��K[ĿW�eq^K��T��Y�H �p�:z�seN��T��@Y�C��8�Œ��l�ֹKX��T+�P,K�x_C�݄����1�|��|+�Ó �]D&�\�ۉ�_`�s��@Yu�߄Oh��B�`*.J�?���+��Rd��Z���+�,�!2�%]t��u�!4���X ��1D7z���xҪPx��N����lE2�iJU���^�SȌ�ͺͧ�M�猻'A�A�����@XZ�ڇ�|r_��qJ�M�7⯘���@-�ϰ��H�Δ(�գ,���0Hج76J����2�u�!�҆[#&`��"�u��p� �ŔMO����:��6Q ����Ȍm0���� �i<_0�Gmk��T-�����Ho_�Bx`Au-3�WZ2�O{���\���O ��Z�s�9I%�S�lI�V��K��s� ,��\y�������[�?�uRT��O��>�#!b�RZ��������_�tu ��~ �M@�����Dr�����{v�.�)� <Z�4�. �I��H�p'x�5;Y����/� "�P�ێ���6Rqwʼn勒���"/� �Ѐz`,��%?�Jvr�,����(QQ"��-���RGj� �E�U��$0���a�#�jX�d���a�6��1��P2��������'C�q�H����&���@��2�/���F̌K��N,]͒�4#l���Sq� #6Nl��(���;�����|�ܮ��a��J�Y�mVG�#����M��-���Ys�� ��M�popAQh,ް�t�q�cG������K�x�x\�|Fx��Y8qsz��+p�����Y��٨�z�G�5w� W�r'���7�B*�V����������.�6rS�h�p�����S��m[6c}p d�M���b�z�gVT���f�O��*Ø�kPN��!�)�1bS��O1~�+w�c "��E��6�x������D�Ƀ2h���)X<L`*��n 5� �&�>��#p7�d >����$\)��:�,��*��f���C�:��L��.t��C�/'8(vW�\�|���^�&\������u$vg�Q���l����6� �u�d> �W;��T��Λ�{��0">O*o*�N�t���7o�b��� �xؖ+������j� V��9��V�, ����a�Ħa�b1��ư�� �ї5˲aI \[������y��aL9�r�� �DL���'�yړ��y�ҙg��g}��W� X�V��2F���G�t�6a�ӑ K\���-�������dQ�x�6���$��>�.�e����u�Df���[�T�u�=��@C�9�aPm坩y��=���r��|IK����A6^毯֜䦗E�O����7�6��0!�_�h��^,G*dϾ�Nv<;�!t�>҄R�N�*��9���uk�"�z�8����4h,��*�����zaDg){��LU�h>g�ِJ� r�5����utqBi�ݽG�z]��Lj��+���^Yi&��a�~IU�[�pc��6��G%�pҁ����[&�fp�z�Κ��}<�]k��'��H�k�[��?��{�DE�Ek�M��Qc6K�
Behavioral task
behavioral1
Sample
CidiaCheats.com.exe
Resource
win10v2004-20240221-en
General
-
Target
CidiaCheats.com.exe
-
Size
5.6MB
-
MD5
299df21df027c1ebeb0c40c830cfd1f0
-
SHA1
a74ebec32324daa54499db3e62e66064c4e18122
-
SHA256
67227e462f48aeaeeef1cde49d3ea4f6dd45ac0bb6bd06f47b5f181defb41212
-
SHA512
212ae79994c2b4dacb7b3553a118a768c1bac830a3e20a636c92e8d50be9bead22c7bfd4b2fa34075fe69fdd536f14f6aa3edf99283877773221534030e81daf
-
SSDEEP
98304:KQlH+vyy3BDcPxVQlgZNt9BEb+/D/py+ltRBxgABZk04Gatyy:zHsyyRD+Qkt8+/DxyqKqd4NtB
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CidiaCheats.com.exe
Files
-
CidiaCheats.com.exe.exe windows:6 windows x64 arch:x64
Password: sss
aaf8abda66b202aa91b3337b9488c2c1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LocalFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
comdlg32
GetOpenFileNameW
msvcp140
?_Xbad_function_call@std@@YAXXZ
ws2_32
htons
xinput1_4
ord4
imm32
ImmReleaseContext
d3d9
Direct3DCreate9
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-string-l1-1-0
isprint
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-utility-l1-1-0
rand
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 323KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 314KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ