&�����(���y�\�W��%���9I]p�e@A3�s}�e�sYt����Q����&%��`��^�S�OT� IC���F`s��G1��������q`���u����Ο�S�b��14�]J�}�y�Q5 ��q�R�&9A��1�s<�� ��R"�t�wNj�����}�t��AX}Mu]��u7�o v����Ů!ok�A�U6Ǟ�q��9���Z��!�1�{�S��>s��)���u��s��fh˸�rg \���֘������ZNgQr�e�\κ����"��j���"�^�]MXحj��-�kj�n\$?�@o��I�~^����fB����&iL�PH�>,�j苽�~H����u�B�z�G��;NJ��ǂ����/�Qy�m/,W,/E� �y���'��&'��5�n@���(9��'��4�'"ɻ�W��b��,���e��:C��ev�{Up�\�ąa%����a�U�k�2w�~�;\~��K�'�9 f���l�o^����0Q��o�(/c�B���2�\��z�Y�I�\�4W��vV�D(~L1�=|� <�C���=�f bD*��?���/��^{�x1�u����ڳ��%�J��u&�SV�&��׃��0��bu���t<��˧c��T����= X���rZrzTC6�s�$\��~�-�@��!����"���侀~#�s�;��UcK�FX?�r�5���-���v�����|���uoL)`5]�5��jp�-�����iĭc��Qb����+�����G6c����v�'=�W��C=��/���h��R�Kuo �����I~�t���U>8bP�|~���/��È.@W< �2�Ex��!^����&�E[+�Iv�G��>�=�+Zn�4���](Q_j8ހ�}�l�Ե"2���� !��K���0�K��n�D.���Kڝ��IV��p$)�CJ�k|�2>km�ˑ� ev���K��KX���D�|��[�*���.=�,{<�5�"��%n��n`2�B'#���m~�=����=gR������c5�{;b��L�OpТZ�&��L�����5D�( M��y���l�)|j����).�F�c-�͋��Z%o�~&���x�^(�X�tR��;QI�Qb��.�.�����w��cE��q�;���1��qΝ�O��H[!���4s�����!E[�Lg����g�v�c���3��Tf��.Z�j�ӊ�J>�!a{{(�1��vO�4�6IgP������?�aYjmD=�}��4��y������D~>��_�*b�g�Tt5��}ϓ�p�V���'r���S��ym\�l������c�/V����~y;�N���P�W%���_����u�&V�d2�S���������lt���҇�;�<47:�����S�a������l�*�-`N�8,���}�uX�-�:�|�7H��-�(��N�0�s���z��tx�#%��O�wK�1��7�RH?/O|�Y.V������Ղ^5b�����D!Y>J���1��E��Q���k��'��~+'�5?��[=�*>��J��d-�w��O�ʬͽ�x|D �vtP���C���H�)`ȩ�Ѱ�����A� )��9��S��ug2�f-�@\���� VB�3o�T�YS����x]�Z3i5 �U'�C��#ac��r�t����K|�ȟ:h�:)��H�pi��Rci��u#LU�R@�� m���������L/¡0x6$R�n��P�0�6O[S��p3��gm���6(dm�~}�������u�G�Y����R��A+{e����p<&)Wor��s�J2������K��`��qv��i�A���(�))/�1Yd�Yٰ5s,Jc�t�E�a(�3���^5�U���2�T���:��x�+�5� �R��y�y������"Mp�y�\���ݓ����\L���)Hd��y��c�r�4r����7��p��tTX��u�ۮn+���Y�hf�^�8h������V9 �[��jB�c�Z�U���=݂�Q_�E��6R�>������8��~��[�6]C���� �el9� ��t����D�$l�1M�`^�(�+[��7��Պw` 9�F��{�'�����t�%b]���I)3k%<��h]\ �ac"��6�-�5?�Q#C�O���CuZ�jN_=��]� )]��4�Q��:ԑ��������������9�M0��*�s���/��0�>[.����gђkچ͏Bλ�͐`�b]x=�Ԭ��.�y(ؖ �6����o:��H�e����'�.�^�;:m�;M�)�C̾O������C�$o~#s��*~zq-���!Lr;<f��v�6�^]���g�=�G��"���Ҿ|������u�$)�C�����qC�v,s��t��)v�EpG�E'luP^�ʀ���0UZ�DW�0��P9��1�����A��ٻ�TN�R %� D�(x�'��d�������1�R�<��R1i0m�T2�����pF0��@�<B���em��v��)a=�[���^o�ZECEП����g�a6�C�������(ҋ���5�FK�+�_W��r'�:7>��8�%s4_������o1%� "��w_�n/u����Z;����|���:2Ը��3m�̝9�\�h�-m�r��r '�_ą9i�-����� �;1OЫ��#A��=��jzFm�F�7Vn� {�&���H��C+�%Qy�R���~�����[/Q3����M���@'>��5��%:���!)àC%o�s��3<Hs<,�A�8��@(�ֈMca"���¢R9�4�x� ��p\�\����-�i�j�3<��%-�������;�㳢HX� X-��1����|�tk���XҲ<y�����A��� ���=��<�G9W�����8��3H��q�rEt��w|J�`z�����ֶ���e�MZ�4.���F_dX��X�kr,������$����G����I��vH���%����a,e�&���:�۹ Vk)Nswc�W.?���[����5��Zj�>��<��!O�A���CJ��k�x_�����D�F� �mJ:H��-���H�SDA,�s阓��Kw;���
Static task
static1
General
-
Target
CheatoSpoofer.exe
-
Size
31.7MB
-
MD5
d55cc4db0fc8dbffe183f78205ec03fa
-
SHA1
f02664f6276a1b88ecb14efb4e7c7d9b0747c7d6
-
SHA256
a3c5ad53ca0367b79c56cb0dc0c42484b9a4e7fa77290ca6ec233f94cacf1e8b
-
SHA512
b26aaae019111d5e23fb293de30380646770dcd31e146edfaff37904f5dc78ac2504050d647d4f212ad42f14a9193a7dc6ef7171f30f356b023fd129e94ec251
-
SSDEEP
786432:0lH0ByeGkm9QxG774aXrKE/Awx7PL/PlTe0P98qtyXU:s6yesGWnbK5EPL/PlCk60q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource CheatoSpoofer.exe
Files
-
CheatoSpoofer.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: - Virtual size: 12.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 25.2MB - Virtual size: 25.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 29.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE