Client5M[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Client5M.exe
Size

15.6MB
MD5

595ee65e86d62e5d6183b06b26f4cd77
SHA1

de32d13188f0c63ef65fc33e53fd4d1e94b95ed0
SHA256

113ae8b0eb9aec76651ba5f814a361db646567261787abd3ebb9a7b71eb6d0d4
SHA512

93f470918013b374da0465a0281ad90f76536b87b26fad9beddc6670ad201d2f2da2fec6d2765ef8f9460ced3d6653fea965febe35006941aaabcbd929bd9fc5
SSDEEP

393216:gErYXyJw19yIzUwMnSpY9XP1TwNA86GgCXGGK+QnkawR2:gErYi2yFBSpWdQASz2TVfy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Client5M.exe

Files

Client5M.exe
.exe windows:6 windows x64 arch:x64

31bc15f5961cbb097bfeda5a9e24d1bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\source\repos\Project - FiveM Spoofer\x64\Release\FiveM.pdb

Imports

ws2_32

select
__WSAFDIsSet
inet_pton
shutdown
WSASetLastError
bind
getnameinfo
gethostname
sendto
recvfrom
ntohl
freeaddrinfo
getaddrinfo
ioctlsocket
listen
htonl
socket
send
recv
closesocket
accept
WSACleanup
WSAStartup
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
WSAGetLastError

wldap32

ord45
ord211
ord46
ord60
ord50
ord41
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord143

crypt32

CertFreeCertificateChainEngine
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertAddCertificateContextToStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CopySid
IsValidSid
ConvertSidToStringSidW
GetLengthSid
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

kernel32

InterlockedPushEntrySList
RtlUnwindEx
RaiseException
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
RtlPcToFileHeader
LoadLibraryExW
GetSystemInfo
VirtualQuery
ExitProcess
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCommandLineW
SetFilePointerEx
SetConsoleCtrlHandler
GetModuleFileNameW
GetCommandLineA
GetConsoleOutputCP
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
CreateProcessW
HeapQueryInformation
SetStdHandle
FlushFileBuffers
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetEndOfFile
WriteConsoleW
OutputDebugStringW
ExpandEnvironmentStringsA
WriteProcessMemory
GetCurrentProcess
RtlAddFunctionTable
OpenProcess
Sleep
GetLastError
LoadLibraryA
CloseHandle
VirtualProtectEx
GetProcAddress
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
GetExitCodeProcess
ReadFile
GetModuleFileNameA
VirtualProtect
HeapFree
SetConsoleTextAttribute
GetStdHandle
VirtualAlloc
TerminateProcess
CreatePipe
InitializeCriticalSectionEx
GetEnvironmentVariableA
WaitForSingleObject
DebugActiveProcessStop
SuspendThread
ResumeThread
HeapSize
HeapReAlloc
LoadLibraryW
CreateThread
HeapAlloc
DecodePointer
AddVectoredExceptionHandler
HeapDestroy
GetThreadContext
LocalFree
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
GetConsoleWindow
CreateProcessA
SetThreadContext
HeapWalk
GetCurrentThread
FreeLibrary
IsDebuggerPresent
CheckRemoteDebuggerPresent
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageA
GetTickCount
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
WaitForSingleObjectEx
RtlUnwind
GetFileType
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
MultiByteToWideChar
FormatMessageW
WriteFile
GetSystemTimeAsFileTime
RtlVirtualUnwind
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
FindClose
FindFirstFileW
FindNextFileW
GetSystemTime
SystemTimeToFileTime
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCPInfo
GetStringTypeW
WakeAllConditionVariable
LCMapStringEx
EncodePointer
GetLocaleInfoEx
GetCurrentDirectoryW
CreateFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
FlsSetValue
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA

user32

MessageBoxA
GetWindowTextA
GetWindowLongPtrW
EnumWindows
GetUserObjectInformationW
SetWindowLongPtrW
MessageBoxW
SetWindowTextA
GetProcessWindowStation

shell32

ShellExecuteA

bcrypt

BCryptGenRandom

userenv

UnloadUserProfile

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

Sections

.text
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data0
Size: - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data2
Size: 15.6MB - Virtual size: 15.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

31bc15f5961cbb097bfeda5a9e24d1bc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wldap32

crypt32

advapi32

kernel32

user32

shell32

bcrypt

userenv

rpcrt4

Sections

.text Size: - Virtual size: 3.7MB

.rdata Size: - Virtual size: 3.1MB

.data Size: - Virtual size: 7.4MB

.pdata Size: - Virtual size: 119KB

.fptable Size: - Virtual size: 256B

.data0 Size: - Virtual size: 5.3MB

.data1 Size: 4KB - Virtual size: 3KB

.data2 Size: 15.6MB - Virtual size: 15.6MB

.reloc Size: 512B - Virtual size: 152B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 3.7MB

.rdata
Size: - Virtual size: 3.1MB

.data
Size: - Virtual size: 7.4MB

.pdata
Size: - Virtual size: 119KB

.fptable
Size: - Virtual size: 256B

.data0
Size: - Virtual size: 5.3MB

.data1
Size: 4KB - Virtual size: 3KB

.data2
Size: 15.6MB - Virtual size: 15.6MB

.reloc
Size: 512B - Virtual size: 152B

.rsrc
Size: 512B - Virtual size: 480B