D:\VSProjects\cheatloader\Release\cheatloader.pdb
General
-
Target
cheatloader.exe
-
Size
1.2MB
-
MD5
79b6f064d75374a6a684d02be8bfda80
-
SHA1
8e0f8f9f70544bb5b7a5b46e4fd482f0039195b7
-
SHA256
3a000cdd0e7bbcb249b41e39e0f698c2eb416789303e671469abb45026936ac2
-
SHA512
9a73fd47aa47c762b253fbf1046ee09599ac1b8823cadf228816c1f7b283b5127c2f2f809eafcdf045535042c3661e28feb9db54a55e6afdd544e62facd4c9ab
-
SSDEEP
24576:dRgREUU9cEieHXV7yN0buhgYsbOlN9U3jaPsM:LyEy0b2lNy3jKsM
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 1 IoCs
Processes:
resource yara_rule sample family_lumma_v4 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource cheatloader.exe
Files
-
cheatloader.exe.exe windows:6 windows x86 arch:x86
7ce9b70d859b810111100802627bc077
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wininet
InternetOpenW
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
kernel32
ResumeThread
CreateToolhelp32Snapshot
Process32NextW
GetCurrentThread
Process32FirstW
CloseHandle
GetProcAddress
GetModuleHandleW
IsDebuggerPresent
CheckRemoteDebuggerPresent
WriteProcessMemory
Sleep
LoadLibraryA
VirtualProtectEx
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
GetCurrentProcess
GetExitCodeProcess
GetVolumeInformationW
WriteFile
GetModuleFileNameW
CreateMutexW
CreateFileW
OpenProcess
GetLastError
GlobalMemoryStatusEx
SetConsoleTitleW
IsWow64Process
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
InitializeSListHead
VirtualFreeEx
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
user32
CallNextHookEx
EnumDisplayDevicesA
FindWindowW
UnhookWindowsHookEx
SetWindowsHookExW
advapi32
CloseServiceHandle
OpenSCManagerW
RegOpenKeyExW
OpenServiceW
RegCloseKey
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?good@ios_base@std@@QBE_NXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Query_perf_frequency
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Xbad_alloc@std@@YAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??Bios_base@std@@QBE_NXZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
??Bid@locale@std@@QAEIXZ
?uncaught_exception@std@@YA_NXZ
shlwapi
PathFileExistsW
vcruntime140
_except_handler4_common
memset
__std_exception_destroy
memmove
__CxxFrameHandler3
__current_exception_context
__current_exception
__std_exception_copy
_CxxThrowException
memchr
memcpy
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
_initterm
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
__p___argv
_crt_atexit
_get_initial_narrow_environment
_controlfp_s
_set_app_type
__p___argc
exit
_invalid_parameter_noinfo_noreturn
terminate
_exit
_initialize_narrow_environment
_configure_narrow_argv
system
_initterm_e
_beginthreadex
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-string-l1-1-0
_wcslwr_s
wcscpy_s
tolower
_wcsicmp
wcscat_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
setlocale
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-filesystem-l1-1-0
_wrename
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ