c�F.ܿ��� ;WN�&Le�s��w��7?�3T�Gݵ����p~ � �d1ʛ���jg��i9��&z�|�]��#%:�����=YÓPR(��KO+� }������S ���!�y�,&M�A����G�����v���ab�\������wb��7�t!�tA��%����D���{X:��S����G�����6u?fR�i�8̕ΜQP�e��L�t�����W�h�$v��'aq�,��F`��<�D:���*��d����?��,����+&�.���7�C�s�m�%J�v�o��1AB��p�7����N��F������� �F��f'�D��W��#QPj��8(�&�{���2w�b���̙n�����Z�Ԙ�fHs�L���u���� T�ԃ'Ob�D�o�0��O��R�#W<��c=tl���5<� � t��@���L!���f�t��H,���'#��d�ڙ��[���L��t��M�����9N����D�Y�t�DT�Z'Äa�_�3Q.���SD�vglXU���n%���s�ƻ|����+�t�CR0~�����n�dz�"��!�'�������[lC����R�g��ie|�S�ў�� �%��5ҷ�/"��vȴ��gp.\���[�*�,o#ꯖ����h��]q%X_�;�}}H��D��iJ�,�1��L�7kS��A�k�������(D��+�}�3Z���WL�����.� �\!�}�ņe�Y欫|rt�{ ZTJ�rYO�[g{�ۦ�iu�6���jξ�� �<�4��gf�:ߔ����y�>t�V���u�8���~oD�8�ܭ��� 8s�A��Z���h{�� �.8�R R ����E�3`� �舶W8T~����R�Ȍ�g3GB����i�b��*�\���� ��Hz���O�4^���+�h�xt�������U�~��rń$�"_� źl��4+��G� C�a�M���� i���[��G�<ܯ�h#n�Љ�dt�G<%#���H���&���Q��4hT���ŝE��/��z�yP]����.��+���� '!����m�<�\N�U 9����u�M�?N�ޡM�� �+L8'� N�a�*XN��1>������������)� W���s2u.�߇��9Y���:z�lS�<õi��!{�~����$��p7W,���0�����R}ϰ��c�C�y5��=��^��ɽN��m5[�5)Չ gI�ͮ No����$�0m@���9��1b��D��8!�2�$܉NTS���~���*�ӛ����� �B�S��h[��,���]�+%o�����w��`��e�%!G��� ;]�����vڵ�ݜl��p݄S�y�<�?$�.y�O�[ ��LڇGLq�� �/�|L�)R�0c��5qc4H<��C�����Qb�ׄ���)��PO�r�HX���Y0�?`@ u�(y�^Ȩ;�#��f~�*�<�J`�5�)���:�ܔ���|,�i��� ���_�'���jg�r�[~-���^���,��S>><�J�9y�G����(����-O3bΰ��:ȹncO����7����n�? A��߭(%A��;z��� �u\����Rne�«[v��ӕJ(�v<�F�)�{L��o�:��h�������Ywf�m�N�+\(VH1g����QVf���K*}���+{uvqQ�\�.A��I9�-���b0��䠪f,�wVݺ�SHW�WIu�ܙD�Q�����HZN�]�]B�~�%�;�|d��#i��W�lФ��u��H�@ �X�6��p�;"SB�l����&� ��RW��b ���s�̣x�� ���_Y�y����L� �q.��ǵ�R<�.@RC����+�p0Ÿ�w|[��v������\e��KZ�u�-Ej1��#������@ ��om�Ǵ9�ٕG5}��v��r��(f��r��������~!�g��$T{ϺZ�>�S���������3U�>��������2e�a�v]�{ j��<�:�����8���bW��+it���T�v�Wjf��:P��%��S3&�|���\�,��1�sג�ȩPx��2����dnD9��x�\�[ܩ��0�H�ĖM�Z�ΐ��V(��Y�LZ�#-�Up��%^�@%�_G�z�[^x���H����E,[R �AΗ*4�͔$����wV��S�@=��{y%��&�FP|e�M�V�yS�=Yxᩄ\�|�:��?�7U^��Q1��G��G!��m�}��U��3�/� *�p�و�F��q� hM������x���E��@�~@�������!�khsr�S`~�\�������P[`�����=c�P���J �q�twf9���E�gc+N���<'.��_�cY�M���+���l�*��`��=����sq���+KvQ�����e�QP3k�Q!]�MI<YL3�X�:�z�N`��q�v{'��{�S�~4���n��P�9�c?]�L����t�q����w��G�&�9ŒF�f'��̷�l*���?z�c�v�~h� k](l���ڼ�d_[�� qE�T��[�83S4�:���oM�a� ������˞il�#I��$V�ύOX�铒��۹��M=�az����T[�q�N40J��#�C���b���Wrs�G��;����z��=K�i;�:r���ЦB���Q�'����*����>�ȹ��� �!��^� ���(�?}�P��d^~�QU��n�����d�-i�e�`2����;�����{�&4ӎ�V�wudnnci+&�R8w��̔��%���c�=t�A�J���B��(g:A.Z_>}��.C��Q�q�-0� IBō,WCo@,�3(N�%C�a�'s��Ιꏑ>L �����`���y;˄��Z�[z�f2ƥh!W.��:���ٿ���ڒ��]xH��_�7Nk��j��a�m���[��[������i[�ג�x��}�o�i��u�i/a\��#��R<�>𰘦3���*�˛}{��� X��צff����O
Static task
static1
Behavioral task
behavioral1
Sample
Yonko_Cheats_ByPass.rar
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Yonko_Cheats_ByPass.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Yonko_Cheats_ByPass.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Yonko_Cheats_ByPass.exe
Resource
win10v2004-20240802-en
General
-
Target
Yonko_Cheats_ByPass.rar
-
Size
12.2MB
-
MD5
adeb20324611fb51fb3cfc5084d4cd3d
-
SHA1
5739df786fa3af77e82351dd8ebcb78750a05696
-
SHA256
ad73f0a4beb3c3e3a4349c8734a8f8e28e3e86d17b4bd3c1d3a080422b3b6361
-
SHA512
0b316c5857b9144a3168cf84d0d662d7f4f6898cbf0163c0d8c098b3f4754c42347c07267c0efd6e659acea3e8069a69a156d22ae98601d4dfb085a4a4ebaaaa
-
SSDEEP
393216:1kp/llyw4d9CwKCzlp6TZMrQR0zeqzwAF5cCw:1q/llyTfCDCJp6TZMrQRMeqzPi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Yonko_Cheats_ByPass.exe
Files
-
Yonko_Cheats_ByPass.rar.rar
-
Yonko_Cheats_ByPass.exe.exe windows:6 windows x64 arch:x64
b15316e8e635119d19d9394bf80d2cca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
GetProcessHeap
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCapture
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRoundRectRgn
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
dwmapi
DwmExtendFrameIntoClientArea
d3dx9_43
D3DXCreateTextureFromFileInMemory
imm32
ImmGetContext
ntdll
RtlLookupFunctionEntry
shlwapi
PathFileExistsA
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertCloseStore
ws2_32
htons
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
powf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 909KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ilzyffx0 Size: - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ilzyffx1 Size: 12.6MB - Virtual size: 12.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ