j�=�AלSsB\��a��z�c�dp1O�wW����֮Lt�Yp6���@8�p!���HM~��f��~�*��O ,w��WXBG�~杓gx�o���_���}��������z=p�d����p��8�g�)�$�_�<o��!�jNU�^���n�2�| }��F�?���k�1��|�ʥ �'�W�������i�e���n|�ގ>��X�)%�tǂ=k�v��U�}B�4A��T�T��Ҽ9^�(<r/�L"�O0����>�g�ܚBX/��8&C*)s}��X����0^a^}��������C���/\��W�s��1���h�8~��~Z�´��Kp#��&�{�#d�}�kp�����u�9�=��p}hB"Q���������H:ła2���0���Z��5�5���V�[�U����}*B�"H����a(�j�dPji����>���@4���:a@��Zs���I�*>�)��ګ�&Yhl�*��E*)ZU�[��V�>��;_�P�z%p8D�o�4��>���k!��9���R�| 0������bp�.��B��c��ɤ�����QP���}�U���Bo9b��K��]�Xz�^��1����g�?U��/&�d������ή �3�gr]���|�4�4���dR ��WpΤfK�����N}��QX�0���:�,�_������k��H����aRs.����I5��W����fq�D��\����L�CgQ���Eָ�������v5���nc�I&��������a�F��C�f��2�3}��T���Nj��I�8ts�{c)Ui~`+I�ty&O��)6_̌�i/)�9�� ��=1;�z�.�{C�S���\@�����!���'�;W,�����ג��!k�Z�T�����tb�C�ޣ� �� R��],A|h�OV?С'�ZO���h�-*+������1$t�b�ul�5ָɅ\ u�V0��M� ۹�KΧ��!ݚ���=L��=�>rI�GbKv�����y��v屗v����Sp��NɋU��+eUa���T�Ɖ_��I��(�P�q��kWݛ��ZMDp��8S ʮ���R�ܢ�(��|����T~1+e�m�b�*���{�.���r9���k��S�Χ1ʻ���o��ţr̼����!%PI�S��c�|��� q��D�hN�����HKXGu������[���`/��D�� ���(��o���as�Ʊi]̌!�x���#�Y��.�>�㗃����N�mO��8������^(��_N"u<���'�xx�d��Pf��mm�TF�+���vA!����*;���)`s�5�<����3�sZf���Q�,���V \��,!4H�,���X�}�n�z�-�ܔW�O��N!*GK緬^�"�X3/�a�vnA⻙�7ٷr��e;�Pe���mg��Y��Y��mm9~�ΘB!�%I�m;�]����h��_��G'�Xy��vb=x�,���蓽�l�A�'�Fl�y�#ۻ��N�! CUb�W�X�k�a��m�J�Э�=�:�)��MR�G7�Rf�Z�a�@r���m�� �ߥ;�Dټ��פ���MͅK�i��ŕo���a~q��xbɋ�4y���<R���]�xg�ۄ�4�����Y6�s��._S!���b� �G��v��h�q p�����b�����uh�I�-����+R�i��`�~�)��`C[�f� !ױ��;��a�����zc� ����3�01�wt���j�V���%�2�2�/a)�|���sެF���Z�A'�?;�U��=!bל��غk3�nM���H�~.��_��Pe����~n�w( V c���V>� �� ڔH�9M���$A� �F��!�P�=���#U�X@d��ҹ=GN0-.�T��������V�j ��/��R�rG:�l&��<TU�4���^"��__�j[x��j�+�x;_�N�=����n���`3�L��_4i�к��-%��f�P�ncQQ-��/6m�H���}ry��i2�É��������G���cb��i+^�&��S ͘DĆ_�Pg��K'�� VUv�����K�������95�!FUq�p3�z*��� m}2N��z�я�C#��6x� w���;9��7�)J��)�Y���d�p���.���M�f�Z0����d�*����RP�7���a��.y�li���;e�q�'��N��*��K�]6�6�3@�`�|b���,�;`=Ĕ_=�\4���?�[�9l�i�G�B6���$���b�:�����H�Ƃ�,��Gܿ�>�{zS�F������l��b���o��/ ��>�Z�3�7z��< ��wݥ������k&m�����ֲ���<՚m��h��p��Y6 2��1���[�iam�}���=d��s�C�[��H�Gؙ���b}�_�`�������y� ��e3�Jx5�%x�= b���=ȫc�wNn�¡�$��}�}�S�C�f+Q���W3+'m�{�M��lvF����)��N}�jU�CG�ԋeC�����sr��b�T��19��B�0�>q֙ow\*�4$j����'���"� �+*��:!M\� H8��|��*5��.��h���,�x�������Գ�k/@��e�֊{"&�/k#���5�\�ic�˻�o�r�*e'>�i:�kb?��auO;a���X,�,v�����=�f�7��.��}�_,�� �-��(%�x`.z\t�G_|������#������|#zn>H���FfP|'iL���9��/Ӎ�����$��3�OGS �L��Y�����DJ�ց���j���Sy�ȝ�\��-�1t�Bŀ���@�M�um�Q���J��z��eþ6]t�/3C�@P�Ѵө0c���}�ph�X���n9�W�./γ퓺�ő�9%f��=�D��ќ�)��>�<���>��*�i,Q��2X��K2Kl0C���p99[�`5;��cB�+��b�J��՝���)���BOPЖ;����L�=���ڙn��]�y�>���̈́����З�65Nˮ
Static task
static1
Behavioral task
behavioral1
Sample
notACheat.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
notACheat.exe
Resource
win10v2004-20240426-en
General
-
Target
notACheat.exe
-
Size
20.0MB
-
MD5
d59e7ebb0e8ce630c561b8b8ad6edb8c
-
SHA1
f94d4a05d71b08df5d1bb002d33f49c142292bb2
-
SHA256
cb9ad75dc33afadc63e4c093b9e81daf4683555290dbad6cbf2ea9f88970cf87
-
SHA512
ac7cef21cc6bedd9445406339edd36a831bf5a2195abc519b25cdbf15233268d0de74049627ec230dc11e37a4cd36490bcd1feb124f285decb9a08b389e62658
-
SSDEEP
393216:WhuHNh7QTX4rU97dbxbIqBZTo4r/stbUGxQhQ3HJlAuXwS39b3:WO6hByFxQUH1Xwy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource notACheat.exe
Files
-
notACheat.exe.exe windows:6 windows x86 arch:x86
b2f9bb3017c3c45cbc87e72c69244023
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
CharUpperBuffW
gdi32
DeleteDC
advapi32
GetLengthSid
shell32
ShellExecuteA
d3d9
Direct3DCreate9
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertOpenStore
ws2_32
gethostname
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
userenv
UnloadUserProfile
wininet
InternetOpenA
gdiplus
GdipSaveImageToFile
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
vcruntime140
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
_libm_sse2_acos_precise
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
Sections
.text Size: - Virtual size: 820KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.27A Size: - Virtual size: 16.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.O7t Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.+L, Size: 20.0MB - Virtual size: 20.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ