C:\Programming\oxware\build\cheater.pdb
Static task
static1
1 signatures
General
-
Target
cheater.dll
-
Size
1.8MB
-
MD5
77abd618eadb1767cc1efb818a56cfc8
-
SHA1
188c316564074f665df69b4b4c6f34ce0e051797
-
SHA256
957e20e124ccdbc4c743e8073447aee38bb8f8e8aa29011f265433acf9a20884
-
SHA512
efd2e64f45fe1855663946da1df316cd64e378d79f2b1858ca27d7ae93027a8c26a3d920b1aeafc15e762a9ad346a6e928501790bb2182aef96c986786de4cdd
-
SSDEEP
49152:ZqacRm3IRuagpQoapCpqU9k8ITAua7mNRKiyCSiyCSik:02bagpWC
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cheater.dll
Files
-
cheater.dll.dll windows:6 windows x86 arch:x86
1259384dad4c9c6819a16f76843c7974
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
opengl32
glColor4ub
glTexEnvf
glColor3ub
wglCreateContext
wglGetCurrentContext
glClear
wglMakeCurrent
glVertex2f
glFogfv
glHint
glFogf
glFogi
glColor4f
glPolygonMode
glShadeModel
glVertex3fv
glEnd
glVertex3f
glBegin
glColor3f
glLineWidth
glDisable
glDepthMask
glEnable
glBlendFunc
glReadPixels
ntdll
NtClose
NtWriteVirtualMemory
kernel32
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
MoveFileExW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
OutputDebugStringA
GetTickCount
GetProcAddress
GetModuleHandleA
GetCommandLineA
CloseHandle
VirtualFree
VirtualAlloc
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
FlushInstructionCache
VirtualProtect
IsWow64Process
GetModuleHandleW
GlobalAlloc
GlobalUnlock
GlobalLock
GetCurrentProcess
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
GetThreadContext
SetThreadContext
VirtualQuery
SetLastError
GetFileInformationByHandleEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetFileInformationByHandle
user32
EmptyClipboard
GetWindowRect
CloseClipboard
OpenClipboard
MessageBoxA
SetCursorPos
GetFocus
SetClipboardData
GetDesktopWindow
GetClientRect
WindowFromDC
SetCursor
shell32
SHGetKnownFolderPath
ShellExecuteA
ole32
CoTaskMemFree
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
_Query_perf_frequency
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_Thrd_sleep
??_7_Facet_base@std@@6B@
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
_Mtx_destroy_in_situ
??_7facet@locale@std@@6B@
_Mtx_init_in_situ
_Xtime_get_ticks
??1facet@locale@std@@MAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
??1_Facet_base@std@@UAE@XZ
?_Xbad_function_call@std@@YAXXZ
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?uncaught_exceptions@std@@YAHXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Syserror_map@std@@YAPBDH@Z
_Mtx_lock
_Mtx_unlock
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
_Query_perf_counter
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
vcruntime140
memmove
memset
memchr
__current_exception
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
__CxxFrameHandler3
__std_exception_copy
_purecall
strstr
__std_exception_destroy
_CxxThrowException
memcpy
api-ms-win-crt-heap-l1-1-0
_callnewh
free
calloc
malloc
api-ms-win-crt-string-l1-1-0
_wcsicmp
strncpy
strcpy_s
isprint
toupper
_strnicmp
_stricmp
strncmp
api-ms-win-crt-math-l1-1-0
_libm_sse2_atan_precise
_libm_sse2_acos_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_CIatan2
_dclass
_dsign
ceil
floor
_fdclass
_fdsign
_ldclass
_ldsign
_libm_sse2_cos_precise
api-ms-win-crt-runtime-l1-1-0
terminate
_errno
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
exit
api-ms-win-crt-stdio-l1-1-0
ungetc
fsetpos
fread
fflush
fclose
fgetc
_fseeki64
_get_stream_buffer_pointers
fwrite
fgetpos
__stdio_common_vsprintf_s
fputc
__stdio_common_vsprintf
setvbuf
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-convert-l1-1-0
strtol
atoi
strtof
api-ms-win-crt-time-l1-1-0
_localtime64
_gmtime64
asctime
_time64
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
CommunicativeDllEntryPoint
GetInterfaceInstance
PreDllLoad
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 460KB - Virtual size: 459KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ