Static task
static1
Behavioral task
behavioral1
Sample
fuck.bat
Resource
win10v2004-20240709-en
General
-
Target
Desktop.zip
-
Size
22.3MB
-
MD5
7e5ffa7e8747068783580ae1212d7bd4
-
SHA1
084c995c75cf04875443f36e7feace739a75e70b
-
SHA256
4f8c0bfb9f0fa9f36dd8ee03afd179b9ed21d901ebe12f43381e979ca4a1a46d
-
SHA512
62c50aed0f4524857da324f22d0daff162cb882988adfa420c5eba03186fb72a851a23f4507a1ffec289853a399b595e9b2a3adbf8f3d44b39ae439c0b9fa8c2
-
SSDEEP
393216:cOMXoDaA1I9PtVrDcawpjUyGsa0L3aKKOhwQCy6oeXj+mnM29SWAblJugAPt+MGo:csEvJwpfnFraKBh6oeXjPM298lJ3AEh4
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/xx-cheat.exe unpack001/xx-spoofer.exe
Files
-
Desktop.zip.zip
-
fuck.bat
-
server.crt
-
xx-cheat.exe.exe windows:6 windows x64 arch:x64
93fde42db7b6022f5c72190f6a85fb91
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateProcessA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostQuitMessage
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteA
dwmapi
DwmSetWindowAttribute
urlmon
UrlMkSetSessionOption
wininet
DeleteUrlCacheEntry
userenv
UnloadUserProfile
Sections
.text Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 11.8MB - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
xx-spoofer.exe.exe windows:6 windows x64 arch:x64
564ed17ed95bf3fc8295fbbccb805a64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentThreadId
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadIconA
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteA
dxgi
CreateDXGIFactory1
dwmapi
DwmSetWindowAttribute
urlmon
UrlMkSetSessionOption
wininet
InternetOpenA
userenv
UnloadUserProfile
ntdll
NtQuerySystemInformation
Sections
.text Size: - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 12.0MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
xxru.txt