D:\STUFF\Sources\UWP\autoexe\FurkUltra\FurkUltra\obj\Release\FurkUltra.pdb
Overview
overview
6Static
static
3Furk Ultra...ra.exe
windows7-x64
6Furk Ultra...ra.exe
windows10-2004-x64
6Furk Ultra...it.dll
windows7-x64
1Furk Ultra...it.dll
windows10-2004-x64
1Furk Ultra...on.dll
windows7-x64
1Furk Ultra...on.dll
windows10-2004-x64
1Furk Ultra... V2.js
windows7-x64
3Furk Ultra... V2.js
windows10-2004-x64
3Furk Ultra...ock.js
windows7-x64
3Furk Ultra...ock.js
windows10-2004-x64
3Furk Ultra...der.js
windows7-x64
3Furk Ultra...der.js
windows10-2004-x64
3Furk Ultra...ipt.js
windows7-x64
3Furk Ultra...ipt.js
windows10-2004-x64
3Furk Ultra...rer.js
windows7-x64
3Furk Ultra...rer.js
windows10-2004-x64
3Furk Ultra...Hub.js
windows7-x64
3Furk Ultra...Hub.js
windows10-2004-x64
3Furk Ultra...ass.js
windows7-x64
3Furk Ultra...ass.js
windows10-2004-x64
3Furk Ultra...ode.js
windows7-x64
3Furk Ultra...ode.js
windows10-2004-x64
3Furk Ultra...ce.dll
windows7-x64
1Furk Ultra...ce.dll
windows10-2004-x64
1Furk Ultra...er.dll
windows7-x64
3Furk Ultra...er.dll
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
Furk Ultra UWP v2.582.400/FurkUltra.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Furk Ultra UWP v2.582.400/FurkUltra.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Furk Ultra UWP v2.582.400/ICSharpCode.AvalonEdit.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Furk Ultra UWP v2.582.400/ICSharpCode.AvalonEdit.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Furk Ultra UWP v2.582.400/Newtonsoft.Json.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Furk Ultra UWP v2.582.400/Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Furk Ultra UWP v2.582.400/Scripts/Dex Explorer V2.js
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Furk Ultra UWP v2.582.400/Scripts/Dex Explorer V2.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Furk Ultra UWP v2.582.400/Scripts/FPS Aimlock.js
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Furk Ultra UWP v2.582.400/Scripts/FPS Aimlock.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Furk Ultra UWP v2.582.400/Scripts/Hitbox Extender.js
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Furk Ultra UWP v2.582.400/Scripts/Hitbox Extender.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Furk Ultra UWP v2.582.400/Scripts/Kick Off Script.js
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Furk Ultra UWP v2.582.400/Scripts/Kick Off Script.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Furk Ultra UWP v2.582.400/Scripts/Old DEX Explorer.js
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Furk Ultra UWP v2.582.400/Scripts/Old DEX Explorer.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Furk Ultra UWP v2.582.400/Scripts/TopKek ScriptHub.js
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Furk Ultra UWP v2.582.400/Scripts/TopKek ScriptHub.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Furk Ultra UWP v2.582.400/Scripts/[FE] Chat Bypass.js
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Furk Ultra UWP v2.582.400/Scripts/[FE] Chat Bypass.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Furk Ultra UWP v2.582.400/Scripts/[FE] God Mode.js
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Furk Ultra UWP v2.582.400/Scripts/[FE] God Mode.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Furk Ultra UWP v2.582.400/System.Diagnostics.DiagnosticSource.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Furk Ultra UWP v2.582.400/System.Diagnostics.DiagnosticSource.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Furk Ultra UWP v2.582.400/bin/Helper.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Furk Ultra UWP v2.582.400/bin/Helper.dll
Resource
win10v2004-20240802-en
General
-
Target
Furk Ultra UWP v2.582.400.zip
-
Size
7.6MB
-
MD5
a871927f4f100feca272736004388dbd
-
SHA1
71c1e4405261b544f07feb9f1a2f71a6ff8dca06
-
SHA256
e0e21cca1a8e51c7259886d93a38cf2d226d37aba853c80aa614203bf8f1b5e8
-
SHA512
0f8d689ea00dabdad006602def92cbe19fc047e21e4de1b7c3ce2d952ff11ffe920cbfee6dd4ac682edd5a79d86d3348a7902ff65a07d13d680843ba74a3022b
-
SSDEEP
196608:d1/6DS3XbanHrEVDs93MIWQ9fyoL0xMb6:d1/6sXbGS6zppgxMO
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Furk Ultra UWP v2.582.400/FurkUltra.exe unpack001/Furk Ultra UWP v2.582.400/ICSharpCode.AvalonEdit.dll unpack001/Furk Ultra UWP v2.582.400/bin/Helper.dll
Files
-
Furk Ultra UWP v2.582.400.zip.zip
-
Furk Ultra UWP v2.582.400/FurkUltra.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 920KB - Virtual size: 920KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Furk Ultra UWP v2.582.400/ICSharpCode.AvalonEdit.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
/_/ICSharpCode.AvalonEdit/obj/Release/net462/ICSharpCode.AvalonEdit.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 603KB - Virtual size: 602KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Furk Ultra UWP v2.582.400/Newtonsoft.Json.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Code Sign
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate
IssuerCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before10/11/2006, 00:00Not After10/11/2031, 00:00SubjectCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23Certificate
IssuerCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before27/04/2018, 12:41Not After27/04/2028, 12:41SubjectCN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7eCertificate
IssuerCN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=USNot Before25/10/2018, 00:00Not After29/10/2021, 12:00SubjectSERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate
IssuerCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/10/2019, 00:00Not After17/10/2030, 00:00SubjectCN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before07/01/2016, 12:00Not After07/01/2031, 12:00SubjectCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81Signer
Actual PE Digest8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 673KB - Virtual size: 673KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Furk Ultra UWP v2.582.400/Scripts/Anti-AFK.txt
-
Furk Ultra UWP v2.582.400/Scripts/ClickTeleport.txt
-
Furk Ultra UWP v2.582.400/Scripts/Dex Explorer V2.txt.js
-
Furk Ultra UWP v2.582.400/Scripts/Enable Reset Character.txt
-
Furk Ultra UWP v2.582.400/Scripts/FPS Aimlock.lua.js
-
Furk Ultra UWP v2.582.400/Scripts/Headless.txt
-
Furk Ultra UWP v2.582.400/Scripts/Hitbox Extender.txt.js
-
Furk Ultra UWP v2.582.400/Scripts/Infinite Donuts.lua
-
Furk Ultra UWP v2.582.400/Scripts/Infinite Jump.txt
-
Furk Ultra UWP v2.582.400/Scripts/Invis.txt
-
Furk Ultra UWP v2.582.400/Scripts/Kick Off Script.txt.js
-
Furk Ultra UWP v2.582.400/Scripts/Old DEX Explorer.txt.js
-
Furk Ultra UWP v2.582.400/Scripts/PrisonHax.txt
-
Furk Ultra UWP v2.582.400/Scripts/PrisonHaxx.lua
-
Furk Ultra UWP v2.582.400/Scripts/Spawnkill.txt
-
Furk Ultra UWP v2.582.400/Scripts/TopKek ScriptHub.txt.js
-
Furk Ultra UWP v2.582.400/Scripts/Unrestricted Btools.txt
-
Furk Ultra UWP v2.582.400/Scripts/[FE] Chat Bypass.txt.js
-
Furk Ultra UWP v2.582.400/Scripts/[FE] E to TP.txt
-
Furk Ultra UWP v2.582.400/Scripts/[FE] Fly.txt
-
Furk Ultra UWP v2.582.400/Scripts/[FE] God Mode.txt.js
-
Furk Ultra UWP v2.582.400/Scripts/[FE] Infinite Yield.txt
-
Furk Ultra UWP v2.582.400/Scripts/[FE] Invisible Character.lua
-
Furk Ultra UWP v2.582.400/Scripts/[FE] Invisible Fling.txt
-
Furk Ultra UWP v2.582.400/System.Diagnostics.DiagnosticSource.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Code Sign
33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9Certificate
IssuerCN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before07/09/2016, 17:58Not After07/09/2018, 17:58SubjectCN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40Certificate
IssuerCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before18/08/2016, 20:17Not After02/11/2017, 20:17SubjectCN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:33:26:1a:00:00:00:00:00:31Certificate
IssuerCN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6dNot Before31/08/2010, 22:19Not After31/08/2020, 22:29SubjectCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:16:68:34:00:00:00:00:00:1cCertificate
IssuerCN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6dNot Before03/04/2007, 12:53Not After03/04/2021, 13:03SubjectCN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64Certificate
IssuerCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before28/10/2015, 20:31Not After28/01/2017, 20:31SubjectCN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:0e:90:d2:00:00:00:00:00:03Certificate
IssuerCN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before08/07/2011, 20:59Not After08/07/2026, 21:09SubjectCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
d6:fb:4d:67:72:14:08:d2:75:46:a0:06:cb:be:f9:d3:5f:db:20:bd:97:db:cd:de:3c:cd:a0:78:2f:b1:93:7fSigner
Actual PE Digestd6:fb:4d:67:72:14:08:d2:75:46:a0:06:cb:be:f9:d3:5f:db:20:bd:97:db:cd:de:3c:cd:a0:78:2f:b1:93:7fDigest Algorithmsha256PE Digest Matchestruebc:c6:7a:ba:4c:c6:19:72:95:75:c0:52:c5:b2:9c:4b:5f:0f:69:2eSigner
Actual PE Digestbc:c6:7a:ba:4c:c6:19:72:95:75:c0:52:c5:b2:9c:4b:5f:0f:69:2eDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\System.Diagnostics.DiagnosticSource.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Furk Ultra UWP v2.582.400/bin/Helper.dll.dll windows:6 windows x86 arch:x86
8d5d2984e07c57cda0cd5720ad3d2aef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteProcessMemory
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?_Xout_of_range@std@@YAXPBD@Z
vcruntime140
__std_exception_copy
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
user32
CharUpperBuffW
Exports
Exports
_is_injected@12
_run_script@16
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.flux0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.flux1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.flux2 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Furk Ultra UWP v2.582.400/bin/Untitled 0.lua
-
Furk Ultra UWP v2.582.400/bin/lua.xshd.xml