S:\Projects\csgo-fake-cheat-master\ScriptKidAntiCheat - CSGO Edition\obj\Debug\MyFirstProgramDpp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0d7b3a0614cb508554b09ecd96789e4e13c0abe7fedaa32de4cac61da8d83621.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0d7b3a0614cb508554b09ecd96789e4e13c0abe7fedaa32de4cac61da8d83621.exe
Resource
win10v2004-20240508-en
General
-
Target
0d7b3a0614cb508554b09ecd96789e4e13c0abe7fedaa32de4cac61da8d83621
-
Size
1.8MB
-
MD5
482180997c942189d259bc56f3467b53
-
SHA1
e9a0425e6ce1ccc7446bfda7c2b1d0d8694ef7c7
-
SHA256
0d7b3a0614cb508554b09ecd96789e4e13c0abe7fedaa32de4cac61da8d83621
-
SHA512
37ddb7b9cf4e39f7c03620e1a8f7d72f655749e1d6966de3e9503fee181fc90737da309b5b712ae521785b5dcaced11aec08c5c2b4f1ee281b9443df3b93f4a7
-
SSDEEP
24576:nTl5v2XM5hXGrKbC/KAjpTcbDF0w7U3sqAmWvbuhZUTd50KKM2r9R+:p5v2XM5jCyOTwDqsU3Fh2biKKM
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
Detects executables manipulated with Fody 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Fody -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d7b3a0614cb508554b09ecd96789e4e13c0abe7fedaa32de4cac61da8d83621
Files
-
0d7b3a0614cb508554b09ecd96789e4e13c0abe7fedaa32de4cac61da8d83621.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ