C:\Users\Denis\Desktop\cheats\nightflex\x64\Release\PisiValo.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PisiValo.exe
Resource
win10-20240404-en
General
-
Target
PisiValo.exe
-
Size
1.2MB
-
MD5
8d3d5a1d29ddfb4fdbef90f09f9f54de
-
SHA1
a22da1d825e52f59f045c776a9d20393f74d8df0
-
SHA256
62ea8ac2927d5de142414964ba812d8fbd18b890569f39d2ed9ef79a538eac49
-
SHA512
ea9d6d285d51fdc3848a8fa8834bb0775d297bf416985c507e5eaaf7fc290863defc1e126f361d35acee9b196e5da64e10b80cc12987738ffa12c2d3e3036757
-
SSDEEP
24576:WkQhavMUptl7Ko60OegX7AonnJXnMvQo:WkSodM0Ervnn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PisiValo.exe
Files
-
PisiValo.exe.exe windows:6 windows x64 arch:x64
bace0bd2e9744a69e6fe6d64c3bef23d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
SetConsoleTitleA
GetCurrentProcess
SetConsoleScreenBufferSize
GetStdHandle
WriteFile
DeviceIoControl
SetConsoleWindowInfo
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
DeleteFileW
Process32FirstW
CloseHandle
CreateThread
GetWindowsDirectoryW
SystemTimeToFileTime
GlobalMemoryStatusEx
GetSystemTime
lstrcmpiW
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
GlobalFree
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GlobalLock
GlobalAlloc
VirtualAlloc
LocalFree
user32
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
SetClipboardData
SetCursor
SetCapture
LoadCursorW
ClientToScreen
GetCapture
GetActiveWindow
ScreenToClient
GetClipboardData
GetClientRect
GetKeyState
GetWindowThreadProcessId
DefWindowProcW
GetWindow
DestroyWindow
SetWindowPos
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
GetAsyncKeyState
DispatchMessageW
PeekMessageW
GetWindowTextA
GetForegroundWindow
TranslateMessage
mouse_event
SetWindowLongW
PostQuitMessage
FindWindowA
UpdateWindow
shell32
ShellExecuteW
msvcp140
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Throw_Cpp_error@std@@YAXH@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
imm32
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
memcpy
__std_terminate
memcmp
_CxxThrowException
memset
__C_specific_handler
__current_exception_context
__current_exception
__std_exception_copy
__std_exception_destroy
strstr
memchr
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
_fseeki64
_set_fmode
__stdio_common_vsscanf
fputc
__p__commode
__stdio_common_vsprintf
_wfopen
fwrite
fsetpos
ungetc
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
setvbuf
fread
__stdio_common_vsprintf_s
fgetpos
ftell
fgetc
api-ms-win-crt-string-l1-1-0
strcmp
strncpy
isprint
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
abort
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
terminate
system
_get_initial_narrow_environment
_initterm
_initterm_e
_register_thread_local_exe_atexit_callback
_beginthreadex
_c_exit
__p___argv
__p___argc
exit
_exit
api-ms-win-crt-math-l1-1-0
atanf
ceilf
tanf
cosf
__setusermatherr
floorf
fmodf
pow
powf
sinf
atan2f
sqrtf
asinf
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
_dupenv_s
Sections
.text Size: 298KB - Virtual size: 297KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 783KB - Virtual size: 783KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 145KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ