release.rar
- SHA256 c0c041052470df416578d78dd84329cd37139ecd4184f3237c24b00420045a92
Behavioral task
behavioral1
Sample
release/main/cheat.exe
Resource
win10-20240404-en
windows10-1703-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
release/main/loader.exe
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
release/map/map.exe
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
General
- Target release.rar
- Size 11.4MB
- Sample240603-2x6qjscc2v
- SHA256 c0c041052470df416578d78dd84329cd37139ecd4184f3237c24b00420045a92
- MD5 87e71b821a437599562b6e63c318e9bc
- SHA1 e9ff44893df8f92e0a3255aacd01bf2b5f5afec1
- SHA512 86d2b9bccb37b8cfaee1d67b8c79004ba7babda3a063abc3e9957acd057490574898e138619f0ac886988dd9597f77564b6d3a52e34ef76d9fefcac66831fbf7
- SSDEEP 196608:rRrWNMv2dFosg09xAvGUFi0gpuKLoqizxw139o3IVTiypXyGc:rRrOi2dFbdA+UA0gxLonzm9o3IB/sGc
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/release/main/cheat.exe themida static1/unpack001/release/main/loader.exe themida static1/unpack001/release/map/map.exe themida - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/release/main/cheat.exe unpack001/release/main/loader.exe unpack001/release/map/map.exe
File Explorer
-
release.rar.rar 11.4MB
-
release/main/cheat.exe.exe 4.1MB
-
release/main/loader.exe.exe 4.1MB
-
release/map/map.exe.exe 3.3MB
-
release/readme.txt136B
release/main/cheat.exe
- SHA256 76b1b8454998e24ad24dae0a57d4690914d95bde7a9eb643ef5a84a4325d6cd2
- MD5 ec8009d731e93bb6ecb76af357ff2757
- SHA1 350e2f8c5ece2bc66dd975ce03a9ab8821b94e29
- SHA512 e8e612c6939241a7fc1f05676c34228bb5b6cb0b125d58a7ee978671eea3fa7e4701e3d5572aaf58c70c4671fc84e69ec31b5642278311570d3b645ae0f5890b
- SSDEEP 98304:+KYLg3cgccbGxv8tH1yctNJLPwWmvpl7NWPZGQPRSUxCYDa:+KYLocgcg4EV0mJLojxdQPRSUwYDa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7667800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
479KB
Virtual Size
1005KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
102KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
94KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
21KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
275B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.imports
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=253, version=33731,
count=4, id=259, version=33731,
count=10, id=260, version=33731,
count=38, id=261, version=33731,
count=6, id=257, version=33731,
count=1, id=260, version=30795,
count=1, id=262, version=30795,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=2, id=260, version=32538,
count=2, id=261, version=32538,
count=43, id=257, version=30795,
count=595, id=1, productName=Unmarked objects,
count=40, id=265, version=33808,
count=1, id=255, version=33808,
count=1, id=258, version=33808,
release/main/loader.exe
- SHA256 60c57f14c2e0e0df0bda16646b21dddceaee0159dafbbb8daba310d4e1b5be6c
- MD5 9ecdc9ed1bea6c226f92d740d43400b9
- SHA1 b5b5066cd4284733d8c3f3d7de3ca6653091ae10
- SHA512 30bc705a2438288e3647d5adfc6119d751823970972b9c6b39a60384a2b7ac261986026b8d1c0b0ca7ee3d7e95363c97b873fdc5fad4096c903cb4e15bf57e43
- SSDEEP 98304:vnUGAC+hqc8lqvdzw2nsNKYYURyc9JirsN4JzmUPj:PTn2qcUzp6UYeJRCxPj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7561304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
393KB
Virtual Size
773KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
68KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
192KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
18KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
267B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.imports
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=261, version=32533,
count=8, id=253, version=32420,
count=10, id=260, version=32420,
count=4, id=259, version=32420,
count=35, id=261, version=32420,
count=6, id=257, version=32420,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=2, id=260, version=31629,
count=2, id=261, version=31629,
count=35, id=257, version=30795,
count=464, id=1, productName=Unmarked objects,
count=18, id=265, version=32538,
count=1, id=255, version=32538,
count=1, id=258, version=32538,
release/map/map.exe
- SHA256 04a72e5f734b6d97c78477d82b1bd24d45e47769b98d908920265a01bbde2d37
- MD5 a5a681b19458d693464f24f0d22d7b32
- SHA1 10b9edb6e510ee582815b3779064698ed9e90db8
- SHA512 e27f08721444474d7f37e45b6636f71cd5e9823ab197b6665f5c48106f8f84ec57bd5f1e953a3c2d0200ae0f9e80b72a261444bea6e828a62cd0b44bf128ab31
- SSDEEP 98304:GyVbJ5frOxTN0fAptwDUB+psfprlsg/zG3lC:f2JN0fG6wgsxrqQzGVC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6082648
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
21KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
21KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
274B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
159B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.imports
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=33218,
count=30, id=261, version=33218,
count=10, id=260, version=33218,
count=4, id=259, version=33218,
count=9, id=257, version=30795,
count=173, id=1, productName=Unmarked objects,
count=8, id=265, version=33519,
count=1, id=255, version=33519,
count=1, id=258, version=33519,
release/readme.txt
- SHA256 84e202ee56be41944643b1fa8b99b29450469d3bc64493edc37c5c6644c25b01
- MD5 fcebdd8b5fb2375817096c3ccaa7d983
- SHA1 9c74429eb7a9bdbd41da10f53e688e32db937f80
- SHA512 a2d58fce370788a77dbb8b33fd7227a5118aebd406dd9e945a80a3b8572420fff49d4621ffa37911074becf0ffdc655bf01cb6101e5e9bc60fa1036534da6813
- MD5 SHA1 SHA512