C:\Users\RIZKA\Downloads\emotion cheats\emotion cheats\bim_imgui\bim_imgui\examples\example_win32_directx11\Release\1444X.pdb
Static task
static1
Behavioral task
behavioral1
Sample
RIZKA FU@KED BY EXTRA.exe
Resource
win10v2004-20240802-en
General
-
Target
RIZKA FU@KED BY EXTRA.exe
-
Size
2.0MB
-
MD5
7cd59a970801f671291150c5645189d2
-
SHA1
d1f06328087086339a1512c35f2f68b03aca7340
-
SHA256
6824887fa67d1564f5ab124086a8b4e7f15b621ba0a83e6690b59ce68baab0af
-
SHA512
a1183cccbdcdf73011eab84e2a6fe95e020d11f54ad70f33c714251bcf2fa464b0baaf7b3a38c36f8c254fd4ed13024730faca1cd739845e7c6a22b04d818869
-
SSDEEP
49152:q7TVlZGHvUNV89mVEGBluDuD/Kt0y7Anoapl:q7TPZGHvUvVXBT8ipl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RIZKA FU@KED BY EXTRA.exe
Files
-
RIZKA FU@KED BY EXTRA.exe.exe windows:6 windows x64 arch:x64
7f3a72af54c22a0b85f0dd0e2dfaaac7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
HeapAlloc
ReadFile
GetFileSizeEx
CreateFileA
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesExW
VirtualProtectEx
SetFileInformationByHandle
HeapReAlloc
HeapFree
GetProcessHeap
MapViewOfFile
CreateThread
UnmapViewOfFile
CloseHandle
Process32FirstW
AreFileApisANSI
VirtualAllocEx
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetCurrentThread
Process32NextW
GetTickCount64
Sleep
CreateToolhelp32Snapshot
OpenProcess
ResumeThread
WaitForSingleObject
TerminateProcess
VirtualAlloc
OutputDebugStringA
GetCurrentProcess
WriteProcessMemory
QueryPerformanceCounter
CreateFileMappingA
GetLastError
HeapDestroy
HeapSize
CheckRemoteDebuggerPresent
VirtualQueryEx
IsDebuggerPresent
Beep
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
GetTickCount
VirtualFreeEx
CreateRemoteThread
GetSystemInfo
ReadProcessMemory
LoadLibraryA
GetLocaleInfoA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
DeleteCriticalSection
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetModuleHandleW
GetThreadContext
InitializeCriticalSectionEx
user32
SetClipboardData
GetClipboardData
EmptyClipboard
DefWindowProcW
CreateWindowExW
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetSystemMetrics
UnregisterClassW
GetWindowRect
RegisterClassExW
ShowWindow
DispatchMessageW
PeekMessageW
MessageBoxA
SetLayeredWindowAttributes
TranslateMessage
LoadIconW
PostQuitMessage
GetDesktopWindow
FindWindowA
UpdateWindow
GetAsyncKeyState
GetKeyState
GetMessageExtraInfo
DestroyWindow
SetWindowPos
LoadCursorW
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
advapi32
CryptDestroyKey
CryptImportKey
CryptEncrypt
CopySid
GetLengthSid
GetTokenInformation
IsValidSid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
OpenProcessToken
CryptDestroyHash
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?good@ios_base@std@@QEBA_NXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xbad_function_call@std@@YAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAdjustPrivilege
NtRaiseHardError
normaliz
IdnToAscii
wldap32
ord301
ord30
ord217
ord46
ord211
ord60
ord45
ord200
ord143
ord50
ord79
ord41
ord35
ord33
ord32
ord27
ord26
ord22
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertFreeCertificateChain
CertEnumCertificatesInStore
CertCloseStore
PFXImportCertStore
CertOpenStore
ws2_32
WSASetLastError
WSAStartup
socket
setsockopt
ntohs
gethostname
htons
getsockopt
getsockname
getpeername
ntohl
connect
bind
sendto
WSAGetLastError
send
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
recv
htonl
accept
WSACleanup
closesocket
WSAIoctl
shlwapi
PathFileExistsA
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
__intrinsic_setjmp
strchr
_CxxThrowException
memcmp
memchr
memset
__current_exception_context
memcpy
longjmp
strrchr
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
memmove
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
fwrite
_lseeki64
fread
fclose
__stdio_common_vsscanf
_set_fmode
feof
__p__commode
fputs
fopen
fputc
fflush
_read
_write
_close
_open
__stdio_common_vfprintf
ftell
fseek
_wfopen
fgets
__stdio_common_vsprintf_s
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-string-l1-1-0
_wcsicmp
_strdup
strncmp
strncpy
tolower
strpbrk
isupper
strcspn
strspn
strcmp
api-ms-win-crt-heap-l1-1-0
malloc
realloc
free
_set_new_mode
calloc
_callnewh
_msize
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_beginthreadex
terminate
_errno
abort
strerror
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
exit
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
_wassert
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
system
_configure_narrow_argv
_getpid
api-ms-win-crt-convert-l1-1-0
atoi
strtoul
strtoull
strtoll
strtod
strtol
atof
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
fmodf
ceilf
atan2f
acosf
sqrtf
powf
__setusermatherr
_dclass
sinf
cosf
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_stat64
_fstat64
_access
_unlink
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 331KB - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 449KB - Virtual size: 456KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ