Static task
static1
Behavioral task
behavioral1
Sample
tfghost v2_[unknowncheats.me]_.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tfghost v2_[unknowncheats.me]_.exe
Resource
win10v2004-20240508-en
General
-
Target
tfghost v2_[unknowncheats.me]_.exe
-
Size
110KB
-
MD5
bb02000d02ecbb1be74be0d892e4d75c
-
SHA1
bd080bc8e104b90f8123cbba763618f6ac6c6923
-
SHA256
d12015c722dc46c42a1d446e56c4e96a60525314de358ad0e0410f7a037baef1
-
SHA512
0e7a082f8cd276ed34beeb96986c8c2295d89ced1f183246f26489eebfa28480939483e93e774a773fb8344043afadd0f22f64d2750df003cd18f5a9f0bad659
-
SSDEEP
3072:PYMEWromwPS5jVRhR6OkFZoCDj2W6EWNfynxjpY0DLIS3JT:PFSPw6DoCPAOLII
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tfghost v2_[unknowncheats.me]_.exe
Files
-
tfghost v2_[unknowncheats.me]_.exe.exe windows:6 windows x86 arch:x86
108c6edea2305b1b83fd390f20149efe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
AreFileApisANSI
GetLastError
LocalFree
FormatMessageA
SetCurrentDirectoryW
CloseHandle
GetModuleHandleA
OpenProcess
GetModuleHandleW
WaitForSingleObject
GetProcAddress
Sleep
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
UnhandledExceptionFilter
InitializeSListHead
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
user32
GetAsyncKeyState
BeginPaint
GetCursorPos
InvalidateRect
RegisterClassExA
GetDesktopWindow
PostQuitMessage
LoadCursorW
LoadIconW
TranslateMessage
CreateWindowExA
DefWindowProcA
GetMessageA
DispatchMessageA
GetWindowRect
SetWindowPos
FillRect
MessageBoxA
SetTimer
DrawTextA
EndPaint
gdi32
BitBlt
CreateCompatibleBitmap
CreateFontA
SelectObject
CreateCompatibleDC
DeleteDC
SetTextColor
SetBkMode
DeleteObject
CreateSolidBrush
SetTextAlign
comdlg32
GetOpenFileNameA
advapi32
RegOpenKeyExA
GetUserNameA
RegQueryValueExA
msvcp140
?_Throw_Cpp_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPBD@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
winmm
PlaySoundW
vcruntime140
memset
__current_exception_context
__current_exception
_CxxThrowException
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
memmove
memcpy
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
_exit
_initterm_e
exit
_get_narrow_winmain_command_line
_c_exit
_set_app_type
_register_thread_local_exe_atexit_callback
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
_controlfp_s
_initterm
system
_invalid_parameter_noinfo_noreturn
terminate
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
_set_new_mode
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ