�rH�̹��(��ɓ6M�؏8Hf$�o۲z1��~%�#mر'�������p��d �G��rt�ԉO|��,c��B�\�l�c%�C!�$���t�$Y�"$(��s�Jb{ٹȓ�p-��'7D���q{���xf0���Z7�G�I.��4�ROp�� ߖK�(��7�|NVGu���0��@���@Q��\1��F�B������x9�����ݷM�R��C���A)��G�����B�o$* �dR���s��?��gNod��b�Zn@�����;��Vo��ƾ��le�U`i�fw��[�iȟ���s�wb�s$��4!�WGYj����?��<L�0��գ�W6#��|c� ��v��i�m4� �� �����;@K\=�) ������/:h� �2�噒X ��Q���T}'�cD6i�� =�/�T U����u1 ���p�B�b �������(���g0�����5�괧�����г�V������u�o��p�_�߷�G(����g7�� c�[ ������0_X�R��v�*0�����(�4mgɹ�7]B�oW.ld@9 �Xֲ�A�s��~�f�e�ry��̀J��?�Eᒰ�z��~�(����%(���"!�7zTơI����4z�]|�����l��pw���^zo�;B<����!�N��EPٗz�*Z�_ٸ,�6�j����/͙��X��)b:@������@��Ӏ�(�y�Ԛ�s~�M�F*��v��GSN-��C+���`n��talj;D�r�� �}�.�Y��'��*��*�_#a��$=�<���B3��w}����b�����+��]e�.��̯=�Y�œ���zׯ��MM�p�顉�o]�>�K��ʓ }�b�?o4|b�o20��E�bݰ�W�R�~k"�/�q<�\G������|h�=�O ���2�t�x��]���9x B���3Ow�����3��2O���U�ޗݍ�ƈ]-<��f��)��{w�D�W,k�kK)Y]��$��55�ܧ�O+� ��DWt=��6]��f�j\�Μ�4m,��t�糢�3�̋m&p��� Mw �o�!\Xr�F�Y�$ζzW�Kӏ` <�I�T���PS�N��i�bT��/��m�V������F�� �}2�jhQ�� p�H�Ķ�p]�"0�C�$�����?�b��!��Xt�ʀK�0���v&M�))7�Ѐ[�Y��{K$���YY�d �X769y�dq�̆���(hH�I���s_����Pf5J��iIR���ev�F�����-0�x���� o�~��o��$@�?�7����B��̨W�r)�D��0�l r�C��t�6�P#�[w�E� _PJ�Ѹ}�2����M���BQ����3��Y� �2�j�*5d�(�G3�3���,�Wo�`�ߪ��=iDK�rsb!ZFb������>�f��S�e�1��X�*4����8W���5�l¢(v���Oj6���`��'�6jʃ� �2�h��zS�JI�^�wS�)ё��F2���BaCa��}�g��5Kc��<T�z ��Id��Ҁ�r2�?-�3L����Rk$�٠9W�q3�8�QY,2�8��Y8^�-����{���h:a�|�5����2ʴ�[e87��?�<�旌j�Y3��1Nc��o~�W�x�S��:�L^.�l��@��4p��\{��ƹߕ�\rwH�1��Tr�Njz�\���X���u������㡊�%���9yR�b>hTFi�Gг/*���W{�u��E@�O����(Wl��c���(T�Ɣ~k�D|����Ϗ(��3t�7@�4S���$�AAiL���u� ���<K���$�z��Ls�+L�<(�D.�+����oijR�r=�d9`�ӧ���ѡd��qp~8Y����qy�"O�s7dw�Iu ��L�&��d2$CD?E(P�mVE��%��:q��7G�6|=!� �y����d���t6F�����ȅ���Q�Z�j�u�v&,6ڣx��.' � a����Wj����/�iPN�������'��.l ]�h�C&�6��}eB��QtU3�%�UJ6�ߛ�{Z�O��F6�wazMV��Ә�s��e�|1�!�-K���|'��zC_1�g��l�-��:�$��ţ?��j���zX�h?����$Ƣ�m�����ك�g����XtBŻ��p�Ǡ>���9*S����PJăD���{�43p��^�v���z1/O�顈�ڂ����ɗ� �v�R5��=i��>3����ěL �?mT�/2T=nX$`S&w��� �_H���&V6"�������$�����N,�t����,�M����~{��FUVb�$GlcI�m/˔U!�-2�� q�Y�I�V]�����9ʿ�-Y�}��^ �Q<Z˴�����N�@0��Y}�Ә�����b�������tG]�b���bUڪ�6���Ԓb2�P��|��a8c����k������t4PS��:,�T�p��0��p+r �����9N���@?qBwk�t�g���D��x����Y���M-��e�B��b�-Aq� 7͑#�z�d�$�9#�<����.�����a�d 5:����1�:o������z�J�]s_�ik_Q��;N��-��L�Ζ}u�Xo���8��Y$?)��Pc�j%����i�J�|g��Л>�R(�.=Ӱ��!�����x9RM�͞���h��V���N[��G�����h�E�/g���BxJ��_K,Ô���y�[���8�G@ �����Ze�F�g�Օy�;�%�E1��t�f��;���E�+F$���w�,�����Cec�#�J�0����b�jQ��J%���TB�x�"#ՠN8�?�nI۹����ѨAY%�8S��N�TD��=���1M��?߱<� ʚ��|�u��L�G\�)��|����K}��naH��S+_�y�=x��t4�R�C��,}�g�� o� AH�$��SlZ�\V����)�vCw6)3תS�ɚ��F�p�o��@F�H�����"�c�`�����l8�˝a/er��0�'�)rpt�
Behavioral task
behavioral1
Sample
[ + ] Gang Cheats Free.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
[ + ] Gang Cheats Free.exe
Resource
win10v2004-20240508-en
General
-
Target
[ + ] Gang Cheats Free.exe
-
Size
5.9MB
-
MD5
84b913b5f85fc513cf3a78d247d39433
-
SHA1
eb414a1b2f5d55ff69d4698600554d8161fa1a5a
-
SHA256
b15e977cb7b133fe7b99a86cadc33f3a018d674f432edbc71103173f3c16c035
-
SHA512
428a6e4bd0b234e729444f737b8d80bf7ba15440372110c637c9223ca9623effbdb766eab0dce901aa6a75fa27933fae7c665d812a83c68fd453ca6253e7ba99
-
SSDEEP
98304:C9soDMU5ob+7FYBBCMmJwUPRT7e/qgkTtlumoTN/2Qliw9x1a5LIxKvhFb:CNffyBBCPwMniotlu3+89q5cAn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource [ + ] Gang Cheats Free.exe
Files
-
[ + ] Gang Cheats Free.exe.exe windows:6 windows x64 arch:x64
331636a61ec173512f699f810c4a6ad1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
IsDebuggerPresent
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SelectObject
advapi32
RegSetValueExW
shell32
ShellExecuteA
ole32
CoCreateInstance
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
urlmon
URLDownloadToFileA
winmm
sndPlaySoundA
ntdll
RtlAdjustPrivilege
shlwapi
PathFileExistsA
gdiplus
GdipFree
winhttp
WinHttpQueryDataAvailable
crypt32
CertFreeCertificateChainEngine
normaliz
IdnToAscii
wldap32
ord217
ws2_32
listen
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
sqrtf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 349KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 725KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ