FV4working ImGui_[unknowncheats[.]me]_[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

FV4working ImGui_[unknowncheats.me]_.exe
Size

796KB
MD5

af66ab761c8788557df808e77ec8a90f
SHA1

e36d287b0a2bf2ea14441c8c1c48c30d992a25d1
SHA256

7eaa53aaeb426e66c651570de882b3162a71408729c5cc7a92e25d38e9188616
SHA512

8eee965b0ec538312445f946416443bdafc9b2adcefcc2cb2b31f456ef80e5d116fe2262ebc21b0b439b086f4c6474702febd4b8b0ff5ac09be33224c3baa64b
SSDEEP

12288:loL9pWVklO7qFbO/4kxUiilSzFgzKyg5eOyQIYOb9/6UJsu9wWDS8C3+:OLUk+wtlYguypQIYOb9yUJsu9wl8C3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FV4working ImGui_[unknowncheats.me]_.exe

Files

FV4working ImGui_[unknowncheats.me]_.exe
.exe windows:6 windows x86 arch:x86

d300ef9f1009bbfb95ebf36c91556b98

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\anyda\Desktop\Reverse engineering work\Programs\F1-V3-working imgui\examples\example_win32_directx9\Release\F1-V4working ImGui.pdb

Imports

d3d9

Direct3DCreate9

kernel32

QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
OpenProcess
CloseHandle
GetModuleHandleW
WriteProcessMemory
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
Module32FirstW
ReadProcessMemory
Module32NextW
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalLock
ResetEvent
GlobalFree
GlobalAlloc
MultiByteToWideChar
WaitForSingleObjectEx
IsDebuggerPresent

user32

ClientToScreen
GetCapture
GetClipboardData
EmptyClipboard
ScreenToClient
GetKeyState
UpdateWindow
PostQuitMessage
TranslateMessage
PeekMessageW
GetCursorPos
DefWindowProcW
DestroyWindow
DispatchMessageW
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
SetClipboardData
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
SetCapture
LoadCursorW
CloseClipboard
GetForegroundWindow
TrackMouseEvent
OpenClipboard

imm32

ImmAssociateContextEx
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow

msvcp140

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

vcruntime140

memset
_except_handler4_common
__current_exception
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memchr
strchr
strstr
__std_terminate
__CxxFrameHandler3
memmove
__current_exception_context

api-ms-win-crt-stdio-l1-1-0

ftell
__acrt_iob_func
fflush
fclose
__p__commode
fseek
_set_fmode
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
__stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

strncmp
_wcsicmp
strncpy
toupper

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
_callnewh

api-ms-win-crt-runtime-l1-1-0

_exit
_wassert
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_invalid_parameter_noinfo_noreturn
_controlfp_s
terminate
_configure_narrow_argv
_get_initial_narrow_environment
_initialize_narrow_environment
_set_app_type
_seh_filter_exe
exit
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-math-l1-1-0

_libm_sse2_acos_precise
_libm_sse2_cos_precise
_libm_sse2_log_precise
_CIfmod
_CIatan2
_libm_sse2_pow_precise
_libm_sse2_sin_precise
__setusermatherr
ceil
floor
_libm_sse2_sqrt_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 596KB - Virtual size: 596KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d300ef9f1009bbfb95ebf36c91556b98

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

kernel32

user32

imm32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 596KB - Virtual size: 596KB

.rdata Size: 139KB - Virtual size: 138KB

.data Size: 18KB - Virtual size: 23KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 32KB - Virtual size: 32KB

.text
Size: 596KB - Virtual size: 596KB

.rdata
Size: 139KB - Virtual size: 138KB

.data
Size: 18KB - Virtual size: 23KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 32KB - Virtual size: 32KB