0J�ѾRΚ��b3>9�������@��Q�4jOy��6����4A(*�껫��iv��[Ca �Cp�7]A>m�����܍���� M=�w���Z� �ҕ�`F�=�4ʬ7�I)�t��f�~@�jl��J�k��o��? �3ۯ��B��Ͻb�}�!��3��P�����t��M�e�R��';��L�~��%l4RNս/SR\�6/$ɧB���qh�¤dLR��RJͯ�~t�D,OV9]��\����@4�tĥsv����̨��K��<=C"R��}�&ʗ1!*��.:A���V;>����� >�,�I$1�5.��#�����ƥO���^A�����U]�_�F ����������6po�-H�E� �v�$�c��Y(Iȼo4�b(4�+�^�B��~�� ��.����7�ԑ���x�pT�0��G1�H���d�=ݮ��ջ�����c��`��:,p\��B�2*l�AL�K��;����թU�]��{���EP��J����sF����^U���@�v�h�Xڧ,mL^!�����G�9�T�� ��:�V��JH���S����M2~q�/,���N�b'f`�A_N�sa��Lt�WkmR���{�u]V�:�?�*k�� }o�e������>4��Y\0���U���M�e2C04 T|f�)�4�W�؈�C��9�6��������� aN#����\����r�yqw[Ѱv�\��:{Y���qmk���O/v/�띱���4"�'��E /�¼��Kf�eNx����?Ra�VBY ��r �;"՛��z�[�:�e��9P ڤ�����*�A�d�T�q��LE��_"� g��3��=cNϸP�2].��qc�:�4��c����O"�=���:cP ��b��>�JRk�c���'/��yٓ�}A\"zh �`1ӵj�4Q����������Y��i"E�M��t � ��7NU}"��\���ut��e�����0z��dQ�#�������LI6 �k�v��g�|�B�tE��&��2����{�T�W�.�!�����N>hEi�+�qԱ%���a������{���a�Ȍ�)6l�"Yv�B��N� ���]Y`�Rfd��'i�ؾ� k��Z����^/��������9��ev�N��A�ޞwN�H���s\I{n]M����ŗs� �j{n�9n�HoQ ��}�u�BGIw�P�6cHo�وi�D����*ݸk�=x��ٌ�=>Qw1�u1"����2�4�pZ|tJ���q^��\ؼ��ꅔ�Y�����w��?ɡ�F ��i��_��������y�bBTҫ��j|�\��/�X��/���l15���m/�㠸���Tn�Zv��3��+B ��*ˆK>3��m~NJύzQ�Wn�<���u�AZ3·{���'ǏZ���U�������jިd�4�kc��!`#e����FŤ����� ��o�#q��j�ҩ\x#�&�p��T��X>O� ��0�j�0�+�� ,Ez:�e�P��HҏX6�O���U��M��\�~o" Y��Ǫ���;f����Z�4�L.q�$2.O�:�� ��l b����tP� �}/��䨐�w�a=���X�e���Y��<1����9oXݝ��� ������sjo��ֺ�|����nj�@�E��Z����c�fL���qm������Ƹ0��=�6�Rx�� ����g�ӭ�4�����}�b�u�ȋ,�b���.AS��{ET�!���@�f��� #�����W�#��ߵ��{z�[�]�R�R3띷��"b��:�� _%U����,�/F�g#O��Q�ὃ�7|��f͡�m�-ы6��^��!����"3�1�3��������Xw�&�hu{CDJ7K8�}�����/^�u{��_���vÎ`<4�dtu��^Y�Dû�Xw ��De�1cP�yA!^N0iW�,���WO�ӭG�1�K�0�~��a�7�OE�yw<��an�1$C_����ÀKWm�r+i|�E���z�y�yu���9֥?&:�5�e��R�ݒ��0l"I���c�cK����A��vXJ��z~n��(�r��pjT)���@.6��W�LߘBkIӳ�*bwB��=���'J�=F�e� 5�иg��PW��wϒ]��I�o6�k{�x�@��X�f�x� ��IB�ٶ� �#�ެ�\�Y���$Ń-k����S���L��)Oj���z��>Ȉ)q��~����&"1<y�[��Zo���W\o��+W(~���ה�G�&ύMY�1�u<;ꭸ��:����5�9��iA8|����p-����\�[Q,���G���4`���)J�$V�Ȗ�R�/�,;@�ԕa#�|�%�?Ŏ��[��<��z��J=I�<��=��� ��t;����еtzY��#���b�@���a�ū?�ϒB���IvLcSL���p�p�����t����m%GQ?�v�!D@Q���-,�N6�����p�퐮VH��ӹ"Ւ�l�o"��l��`��uCQ��|{���-)/����j�?.���Y:�jL�U�u�iF����pb�gN�Z�J�� �s�i�B�}< �)���L�c[\��a1�����.����[Dw�z_����,]�W�K��\,�3/��p��%禋��SƷ�P\ ���x��[� �.>xX�my3C���i4X��@�G�����-1*>�1��?�9���~\=§�,"6\�GO�����)���0ÃЁ�]g�t�GCd��9nԌ�t�21�0��Ƥt_�o�ܛ<���pE�YDqЄ��Վ�^G}`ص����[�En��+�/��r������T�#nC���,v����<��>r`GH�ݘ+�1���� (�\����Ŵ����Co�1��X5&���@?�$kT���xo��0VT���Y8�ڰX�fû��`G7��vx�ќ�m�LԴܳ��c���y�7-J�&G�~���f�|-y3*�(��ς=40S�nQ)��{�̿���$���92��D%�4ذpҷRp��[N��G�m��,��������� �4̏��@=��=�wa�4=]�1
Static task
static1
Behavioral task
behavioral1
Sample
apple_cheats_loader (1).exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
apple_cheats_loader (1).exe
Resource
win10v2004-20240802-en
General
-
Target
apple_cheats_loader (1).exe
-
Size
18.2MB
-
MD5
a2fe286bda18fad4c4808948c05f98d4
-
SHA1
93568e47febf183e68673733658317be80c58906
-
SHA256
807918bb6623895a26aa49bc696957aba37da245c73190573e157695bf23fbf3
-
SHA512
592362fe397509e04afca4c1f93bd7a8306735968190f5387cc95ae1649a909c205656df9ba8a0291835b09994d6a76321dd7cf4c0b74db080ddac14065050a1
-
SSDEEP
393216:SYQuBk0C7NPpPImr9aWCr8WlaqLNRoDRA39qBN4azq0:bQuq/kWCzjLNRkRAKVq0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource apple_cheats_loader (1).exe
Files
-
apple_cheats_loader (1).exe.exe windows:6 windows x64 arch:x64
9e02f2f2c562a8819299f15230ef0fbc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
iphlpapi
GetAdaptersAddresses
cfgmgr32
CM_Reenumerate_DevNode
httpapi
HttpReceiveRequestEntityBody
kernel32
TerminateThread
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsCharAlphaNumericW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCloseKey
ole32
CoInitializeEx
oleaut32
SysAllocString
ntdll
RtlVirtualUnwind
shlwapi
SHDeleteValueW
wininet
InternetCheckConnectionW
dxgi
CreateDXGIFactory
setupapi
SetupDiDestroyDeviceInfoList
winhttp
WinHttpSetCredentials
bcrypt
BCryptGetProperty
crypt32
CertFreeCertificateContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 33.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vtext0 Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vtext1 Size: 18.2MB - Virtual size: 18.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ