Y*F��`�����1䷆Ż��-�#:E��塄<��qS� ^x�4��X�Y[�f�UA֕~*!��i�4E�֫�r�9Qe����5Aɇ����%h�,,�B�64Y�B�.1|[J�VΣ_�`a�G)ə7�1���Z-QVfG�E��*��K�HY�d�n8_�IM7m����+���߲�qB��!��7�;�b��q�u<n��2�dp�}�����t��>&��;�+� Sn�ٸN�p�s���>d��7����٥T���dl�z�g�+�4!��f�;����s��g����P��G�.�����'Cá�2��2n]>��I.���|3°�Z%x�3�X|��x�K�8b��频�����HA�a�H�7+�U��ǟ�JQ�||�_�"[������Ήo�^��@��?n�\_�=������� ��,��Ŋ: �g�������5���¶�wb�*c�����n���2���~�s�/�CN�W� ���٘T�*�M�_��<��u�H:��k=-����*�� !3T��Ws�J�X����.�-ȯ�t��o��,�XKƶkyde�F/�����J��Q5�FH-1��C��H/_�UX{j��u"0]�O7�7���c877y���uhP��0���jT����g�����rW:�.&�%6d)j�%|(�>Q�|vQ�$L~���n,��2xf3ĸ�b1R��n_K��'bK�����!iq� �!����mM�ڠ�}"Y�º-v�Crl6�y�M|�`��p�����ىnܡ��=0xaG�4X�fN�]u���2���`�Q��Gu�*����[�&��J�ZLfhM�n˱�����7�qS ���F ��=��i`;��1��,�4�B �} �k8f� �5c8��H� �]����y����ff�u��.N��Z������>]mC� �����.�^L�l��s�YC"����p�1\��<>_'�����iw]E��`KuP!�rlO1�0�v��ͨ`*�^R�/>q��~@�h>@�|j�,'���UZ_%l̿Q-;m-l�"��R#����H?��5������[P �8*ҹ���Z����F�j��T����I�~��]^(=��+T�F+�M6��=4Vm���M����8�2�����\1=mF��9��"+X�Ҵ0�)��Z��D%ϙ �H�� :�0��Q&,�P�l;C�+�a�b���>_$�� H�������� �Yi@����Mj�Y=��>ރD���NQG���>�}r�����;��M�Bk��%���p[�����h|G�j�V2g��@�O�;ۚ�����w�!L�c-~X�{h��Y��e���v�ő�WW��|�נ��ͦ�F+�R�+����t�/W�"���/\��w�jD?A9.�<���<�$�q�Ct�nb�������2Z3�����({�Y�j`��>��3�#*ف +lQ��Ȋ����V���P�\+RȎ�.��������&��6|YK�b4��~G��:�@�� �s�y�*o({�% �8��w��� 2c�/������o��z#�g��a��e^��y� �&���`��q%<~�~�O�7����t���Q�o�������N��G&ct�NB��ʳ�O��o�5.���\���{�M��O� �PT[H�H�dž7SGd~�CbF�Bc�sTs����$�x�?h����3<�bK{h��@�3ئ�*D��|�龗�@�7�Y4gQ<��߽�������Y9����������Q��At��3�tX�w�.�r!����w&����,�^".��j:�GډY=�C%�̋B�Af�;����wV@�Ec�B;�E�z���|��~�Լ/:����#�T*6Q���Ȝ�ם!"��������g�@�t�A9'��"?<�]Q��L�8��oӐ��&p��J~�}�|5���.�ǕR��$�6�"7[���~��DK�eB�We`۩'Hsr��ͯ��y��S�~�T|��徕%�4>���Vxu����w�G?^N((�}9uޅb69�L���̲���RlΫ�E��l��c��t.c��#�����1(L�Ԛ����CR�������p�e�M�~�������m� �3"�8�|�3��/T��<k�,��*T����O[���$�@fNߤ7�&�hJ�k��j/��3w����G�%ݽ�n:���m'$� l�ʸ�9����(�8��;�C�y2*�#��s�]p����£�Ŀ)��^�yH�Ƞ��A8U����m�q�&⊷PHq�� HJ\b�飘k_y��%�v~V�}fV*7�+Uj�ae�0����e}��U�jx(� �]������#o�������|c��4{C�W}t�t&���B͈��m;l���@��/�:vx酤x#�InONr�r��Q���=���`�e�eg����ɛ������粠�z��(�x>.��,� {w��EWZ�C���k���8��c"���2K�1�:G�:_Nn��Q$T7��D�)]ⓗ;$�T���X�"�f^���1�X�C�{��*�N,��\��4�U�I�p������d�I��Q��N�w�X��q�L'�!D��)[�ԗ ��R�w�ۙ��$Q$�9c�[� �DIe�͝lh���V���;n�L�X�_¹h��֛�X��"/�N� ��ƹ۲�;uA�Uap�c��˲y��t�����~���G�u��)���>�H�yn� �� �O�#�-��_��yFɃA�X�+7�t��hN��B$��51�㹞���p�OH@�Lî�5b�[�"��ק;�ɫu@ƪG<[7��b�u�sg��u�Qf9��k����q���%KAM��U��cu�F��y�n{��������yiȆ��(a�R�sAQ��Z�?�l!��(1 ���� 0��c�/�8����,�O�s� ��������㧭�����c�D�)\� d �۾���X�{���C��䨥Z��"�2˥�.<����h䱗���,ζ�����×�����7(�S�+�n���o1���j�)6ԥ��iϤ{n�L!�&���=�)úy1Q�,��YtvzN��˅�
Static task
static1
Behavioral task
behavioral1
Sample
virus_cheat.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
virus_cheat.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
virus_cheat.exe
Resource
win11-20240802-en
General
-
Target
virus_cheat.exe
-
Size
6.9MB
-
MD5
785f27f9eff57cf1f2a4a10df2c4a58c
-
SHA1
9ea201215881fd9761e2a93ee5a04ccc389526fc
-
SHA256
899f31682baf6ff341eae8d3c3645a589906e19e622ff82f84abf5031caf7e88
-
SHA512
a9033d49181e98492e9bfa4496e2f708ceed4b6c5a9b171c722f86305c945bf6914357267c8997ff3a11b1d3791889ffd1f8452093becc78614dc4d499e38f49
-
SSDEEP
196608:jCagNihtJtrCmBJJonmM5ynD7u5ne8zePX:G3Nih1JBJJomM5UJ8ze
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource virus_cheat.exe
Files
-
virus_cheat.exe.exe windows:6 windows x64 arch:x64
991092408f10fd7a3669ae63632fe0c9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFullPathNameW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
RegSetValueExA
msvcp140
?_Incref@facet@locale@std@@UEAAXXZ
imm32
ImmReleaseContext
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
wininet
InternetOpenUrlA
ws2_32
closesocket
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-stdio-l1-1-0
fgets
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
fmodf
Exports
Exports
Sections
.text Size: - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
code Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.OGa Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.J!d Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.g7E Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ