C:\Users\shaff\Documents\Shit\Sources\Cheat-Loader-Base-main\x64\Release\ConsoleLoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win10v2004-20240802-en
General
-
Target
Loader.exe
-
Size
4.6MB
-
MD5
1d6f005a8c9d157f5819a63e14187417
-
SHA1
c847566c023815693393b83e56fd916942961946
-
SHA256
d6cd78ffc616f94f1bf122792a05e3a01c5b3341c556ee394cddc80c1a641c18
-
SHA512
26d4cf2b3f0e898a91b68bf32bccfd1ba726942f87b6f50f7e3e0b0373b073bf3b012297755913bea0e8a581cce2c332fe6524d6595294817c8e22164fe2e138
-
SSDEEP
49152:PpgSA/WDm+fEaBKPKXEbLVi4UuRyHGt9OHbh/qNwffAj3g/bTqSk6wnC0ErvKISK:PpgSAuiABrXExKt/lgQ/6SZxScWcD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:6 windows x64 arch:x64
72563b067ded66ad9b6b8439392297ed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
urlmon
URLDownloadToFileA
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
FreeLibrary
GetSystemInfo
VirtualAlloc
VirtualFree
GetTickCount64
K32EnumDeviceDrivers
K32GetDeviceDriverBaseNameA
GetFileSizeEx
ReadFile
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
CreateFileW
HeapDestroy
HeapSize
InitializeCriticalSectionEx
DeleteCriticalSection
CreateFileMappingW
QueryFullProcessImageNameW
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
FormatMessageA
WriteProcessMemory
SetThreadExecutionState
QueryPerformanceCounter
GetCurrentThreadId
SuspendThread
SetThreadContext
FlushInstructionCache
OutputDebugStringW
SetEvent
CreateEventW
QueryPerformanceFrequency
RtlCaptureContext
VerSetConditionMask
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStdHandle
CreateFileA
IsDebuggerPresent
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
RtlCompareMemory
RtlLookupFunctionEntry
lstrcmpiA
Process32Next
Process32First
DebugBreak
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetConsoleWindow
SetConsoleTitleA
GetConsoleScreenBufferInfo
AllocConsole
VerifyVersionInfoW
QueryFullProcessImageNameA
CreateFileMappingA
LoadLibraryW
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameA
UnmapViewOfFile
MapViewOfFile
ReadProcessMemory
VirtualQuery
VirtualProtect
OpenProcess
GetThreadContext
CreateProcessA
ResumeThread
GetCurrentThread
CreateThread
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
SetLastError
GetLastError
CloseHandle
CheckRemoteDebuggerPresent
OutputDebugStringA
user32
GetForegroundWindow
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
MoveWindow
GetSystemMetrics
IsWindowUnicode
GetWindowRect
MessageBoxA
GetWindowLongA
SetWindowLongA
FindWindowW
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
TrackMouseEvent
GetKeyState
GetCapture
SetCapture
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
UpdateWindow
GetClientRect
ReleaseCapture
advapi32
InitializeAcl
GetTokenInformation
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
GetUserNameA
IsValidSid
GetLengthSid
AddAccessAllowedAce
OpenProcessToken
shell32
ShellExecuteA
oleaut32
SysFreeString
VariantClear
SysAllocString
vmprotectsdk64
VMProtectBeginMutation
VMProtectBeginVirtualization
VMProtectBeginUltra
VMProtectBegin
VMProtectIsVirtualMachinePresent
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?uncaught_exceptions@std@@YAHXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
_Thrd_detach
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?setf@ios_base@std@@QEAAHHH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
psapi
GetModuleInformation
dwmapi
DwmExtendFrameIntoClientArea
ntdll
NtRaiseHardError
RtlAdjustPrivilege
RtlInitUnicodeString
NtRaiseException
NtQueryInformationProcess
RtlVirtualUnwind
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
ws2_32
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
ntohl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
closesocket
WSAIoctl
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140
__std_terminate
strstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__C_specific_handler
memchr
memcmp
memcpy
strchr
__current_exception
__current_exception_context
memmove
memset
strrchr
longjmp
__intrinsic_setjmp
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_errno
terminate
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo
_c_exit
_resetstkoflw
_exit
_initterm_e
strerror
_initterm
_get_narrow_winmain_command_line
exit
_set_app_type
_getpid
_seh_filter_exe
_cexit
__sys_nerr
_crt_atexit
raise
_register_onexit_function
_initialize_onexit_table
system
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_beginthreadex
api-ms-win-crt-string-l1-1-0
tolower
_wcsicmp
_stricmp
_strdup
strcmp
strpbrk
strncpy
isupper
strspn
strcspn
strncmp
api-ms-win-crt-heap-l1-1-0
realloc
free
calloc
_set_new_mode
malloc
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-convert-l1-1-0
strtod
strtol
atoi
strtoll
strtoull
strtoul
api-ms-win-crt-stdio-l1-1-0
_pclose
fwrite
_fseeki64
fsetpos
fputc
fgets
fgetpos
fgetc
fflush
_wfopen
_lseeki64
feof
fclose
fseek
fputs
_set_fmode
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf_s
_popen
__p__commode
fopen
_read
_write
__acrt_iob_func
__stdio_common_vsprintf
_close
_open
setvbuf
_get_stream_buffer_pointers
fread
__stdio_common_vfprintf
ungetc
api-ms-win-crt-filesystem-l1-1-0
_unlink
_lock_file
rename
_access
_unlock_file
_fstat64
_stat64
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-math-l1-1-0
cos
sinf
sin
ceilf
powf
__setusermatherr
sqrtf
acosf
_dclass
cosf
fmodf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
wldap32
ord211
ord45
ord26
ord27
ord30
ord41
ord33
ord35
ord79
ord200
ord143
ord32
ord22
ord301
ord60
ord46
ord217
ord50
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
normaliz
IdnToAscii
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 832KB - Virtual size: 865KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ