Dunt0_[unknowncheats[.]me]_[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

Dunt0_[unknowncheats.me]_.dll
Size

423KB
MD5

58af6eb30c3fa9fa32637577b410cdea
SHA1

daaa002c1219d46c96129f6874154b8806cd1a54
SHA256

02b49b33040b2ba82677905c88f61e7d5a18811ac081f71aea25fd2ae40d4721
SHA512

ab17fcf6489460d628cdc84bc09362ab8810436a17864bcaef2473196d3b6aa58ab9b3b25995b6d2c0867804a2e4ec4225ad6033d5400bc633c14785392fe858
SSDEEP

12288:VfjDEovCzBlVhuYmrEljG3yz2CAVx0ZA4n1eQIkvfKHin2w:REovCzBlVhuYmrEljIyCBxB4n1efCn2w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dunt0_[unknowncheats.me]_.dll

Files

Dunt0_[unknowncheats.me]_.dll
.dll windows:6 windows x86 arch:x86

a825f1ee171e609c575f920e7c181e93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\резерв ААА\все с рабочего стола\АНТОНА ПАПКИ\антон\папки Антона\Recodes\Dunt0cheats_l4d2\New Dunt0 SDK\Release\Dunt0cheats[csgo].pdb

Imports

kernel32

GetTickCount
VirtualQuery
MultiByteToWideChar
QueryPerformanceCounter
EnterCriticalSection
SetLastError
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlushInstructionCache
GetProcAddress
CreateThread
QueryPerformanceFrequency
DisableThreadLibraryCalls
Sleep
GetModuleHandleA
GetCurrentProcess
VirtualProtect
GetPrivateProfileStringA
CreateDirectoryA
WritePrivateProfileStringA
GetModuleHandleW
CreateEventW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
CloseHandle
WaitForSingleObjectEx

user32

SetWindowLongA
CallWindowProcA
GetForegroundWindow
GetKeyState
GetCursorPos
ScreenToClient
FindWindowA
GetAsyncKeyState
CallNextHookEx

shell32

SHGetFolderPathA

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?_Xlength_error@std@@YAXPBD@Z

d3dx9_43

D3DXCreateFontA
D3DXCreateSprite

vcruntime140

memcmp
memcpy
__CxxFrameHandler3
memset
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
__current_exception_context
__current_exception
strstr
memmove
_purecall
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

api-ms-win-crt-stdio-l1-1-0

fgetc
fwrite
__stdio_common_vsprintf_s
fgetpos
__stdio_common_vsprintf
setvbuf
ungetc
fputc
fopen
fflush
fclose
fread
_get_stream_buffer_pointers
_fseeki64
fsetpos

api-ms-win-crt-convert-l1-1-0

atoi
atof

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_execute_onexit_table
_crt_atexit
_initialize_onexit_table
_initterm
_initterm_e
_seh_filter_dll
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_cexit
_configure_narrow_argv
terminate

api-ms-win-crt-string-l1-1-0

strcpy_s
strcat_s
_stricmp

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

_libm_sse2_cos_precise
_libm_sse2_atan_precise
_libm_sse2_acos_precise
ceil
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise

Exports

Exports

NextHook

Sections

.text
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a825f1ee171e609c575f920e7c181e93

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

msvcp140

d3dx9_43

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 186KB - Virtual size: 186KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 2KB - Virtual size: 70KB

.rsrc Size: 172KB - Virtual size: 172KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 186KB - Virtual size: 186KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 2KB - Virtual size: 70KB

.rsrc
Size: 172KB - Virtual size: 172KB

.reloc
Size: 12KB - Virtual size: 12KB