Static task
static1
Behavioral task
behavioral1
Sample
library.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
library.dll
Resource
win10v2004-20240802-en
General
-
Target
wf-cheat_[unknowncheats.me]_.zip
-
Size
1.1MB
-
MD5
2e6a900e170efb643d67945f6725c574
-
SHA1
ed2e79089302fe0324e1fffdb7ad701b326aa0a2
-
SHA256
290777465ab8a25aef3a70ce41c0878c3455998a4d5ec85a8eff2051e5cf7bdf
-
SHA512
1cbd5b3e9aad7b01dbb89a851a70b3920ae8f268817dc850805225e75f7846af70d05568686f46ea69f8f0e97d3b09c5572e1676877950a1f08e0f2f75b61011
-
SSDEEP
24576:tXadByhgPv7FcYdzAV1OUy2odpjkjMVz1+yH1C:ghPzFcYdzAnOooHaMLc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/library.dll
Files
-
wf-cheat_[unknowncheats.me]_.zip.zip
Password: asdasdasd
-
library.dll.dll windows:6 windows x64 arch:x64
Password: asdasdasd
4787c69188699ae0c15c2c602f404df7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
user32
GetForegroundWindow
SetWindowLongPtrA
KillTimer
IsWindowUnicode
FindWindowA
GetAsyncKeyState
OpenClipboard
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
CallWindowProcA
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
kernel32
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
GetCommandLineW
SetFilePointerEx
GetConsoleOutputCP
WriteFile
FlushFileBuffers
ReadConsoleW
GetConsoleMode
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileSizeEx
GetProcessHeap
IsBadReadPtr
Sleep
VirtualAlloc
VirtualProtect
GetStdHandle
SetStdHandle
CreateFileA
AllocConsole
SetConsoleMode
CloseHandle
OpenProcess
GetModuleFileNameA
K32EnumProcessModules
CreateFileW
GlobalUnlock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryA
GetLocaleInfoA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LCMapStringW
HeapSize
SetEndOfFile
GlobalAlloc
WriteConsoleW
FlsFree
GlobalLock
IsProcessorFeaturePresent
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
d3dcompiler_47
D3DCompile
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 157KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ