$j��3�L�����u�]iW�:'4���l�j%�������؍D��NV�OX�@�����X�֢]�5E�A�["k���(�p�uR�<������Ȱ��Ji�Os��� �=��(�_O,J\�@ų�s�����>�ڲ<��B_�᨟F�y�����NGˑ�7�5PDL�1�8���k�C���p�a���?�?an� �"��vxG �p f0Ϲ#9�b酈m���l%NZh��R�������J����H�<t]��]�A��)�܅H��v��� ㌡ʐ=/��G� ������V=.�Q�Y��n<>���ӘR�0�3���tOyPo~N��(FK�6 �Ж��٫h�M�>�&~�<�[4���dz��( ' �j�&uc EAH�JD���Z瘛��,����^,t�z��H��}� Z��UC~��b��3S��Ŷtx��Y�8w������%�,8��.���$�$9��T�b����,����P������9� ��XLBĒ�S}�ݿ{�2ӄowSΓ�2��Wt�-V�=� �82e1}���t-Ǚ6 ��gtLZ� D�B�@�!O�Ʃ�x���Ujh����|Ő�<PGo��:��UD�������&4,v�Xس9%�R�-R=?�1a�i�@`��\.J���ȶ��V��ߜ�xu���cȓ}���]�h4�?B�����˅ ��긆^��SF��W(�����]`#����NW���4I�yٚ Is6S)em|z�����}��J�]���0I��5Y��B�p���n���@ �wa�i���_m�s#X*uq6�ɻ�:8�z���R"�_A�Z���7W�_�S�2gG�Y����ۦ#�f�F%��ײQ$w �~'�tR-�R;��c>t3jVݠgj���ֽ�'0t������QWM אGUN�~�����9[8�o �34�c��`A!C��]�ssZ��x ����e�� 7?�JA<�">����v:8�(����h���S� ��Ij�K�σ��[��Cq���M�1��u�GGǁ�3 @�͵���"�Zh2�qvv�F�cB �a�"�ψ�=cO͝�{������~I|'~��v]��oEP8�����7��E�F�E�E%x�=��8�v���� �Ѩ%t<��1e����:��w�1��e��������h祮)��N��qDq�$��l�����T�U p�P?z������m�g��-�6hz����g;��M�4E ��$N��� U�R�����F*Н��?��J_̝��8{��X��;��Y=������-XK��P���N����z�L'0���!S�C4IQ�:`�2����ڕ�ө�Љ���إ:i�:��m��Nї5�H+k�q�����1E���mv`�9�z�be�_k�K+j�� ��}M�o]�оޠ����6?�21d�����!�e��[��2����� a����<�]��Tfڞ�C搷Zb�qZ�f��fUh5)����\��ōU���P�x��#�e,D�;��_p���}�ЖC�!v�8�V_(1 �����L+�s��v�k]C<y�d˩8���걔T��}7=O�\���6ߞƱW7�GЙSݍ^Q��I��o��0!�[���>j���d��м>��9���;�f��>�S�o��uN�;?>z�!��`t�/i˾a��[B��B����%�,��F�w�t�*=p�[�fԆD��+Q������ ��u܈�w���r�VԈ�Ԡ&Z,g��^N1q@�`q��(x������o)*��KӪx�s��ru;�!��eCBOV�u���S7\����Z�e�4�s��"+lT�V�H���A����V�j6���bG�D]��tЂk�d�^f�����U�M�AZ2K�.�1��uh��lr&�% >��+�����Q=����_�٨���ٿf�]e��͝�'��T���$k@R}�g�}�"^P�L53���&���+�)��\�+�P�1;Y�Q���eT;:2; f����]�������o�����G��d���Q�]�� ��Oوv�?>ߵo�����f��x ,��\X�Ix��^]ڨ�c��qa���$�� ���mz�A�bYpÙ�i��$ׂ�jf:b@�Qp�g"D`��S�ul���S�Z���T����uğ�����%�i�3ju�������Ik�Yu��m�Y�2�E��P0H�^��mO7&�����rRm/!��1uޘ�^U����H�dϮ`<���<X���V�����w�?���[�F��˅��D! A��hF~S�����ic��L������𫎀'Q�Z�0/coh�;�tK��,����Ҙ�"��k;��-`�9m|�W�\$�Rb( Sb$ rOl!=]������WJ��4@�u�V�b���Ȋ�̟雒�����1mQ5��Cvp�:��ּ����Ϫ1�3���ϖ|V�Μ۾�5���Ųb��0݊�A�&�$��1֢A6���e.pEu��v��20������A�ի1X�W4391� zv��� >o�5��ȸ2�)r ���j:��*�!�n�h�,�Ɂ.0Fc�{۰�M�>��Z�c(&����;�ˬO�˖+V��^��C�`��y����;�������ڡ�I>���v��5�g��Z�'�E��g7P3aqV��L��7�����lde�dɡw�UzŬ@3pg��cGc�a)n���eHs�~�/f�/���ٶ���̓�K�f4��_kP=��5W[z i���`q.y(izI!2��dʶ�Z���&�W�#����'X�q�Z��u>��R��>w��g� luD�m}F?a���t�2iFc�����n���y}�3h�Cl�) N�r�ֻZڷp颋�͍�j��z�à҈Z�f�À�\�/�9*^t��lq�u�M�M� ��ed,�$�ʗ� ��$�+� ~p�᰿�>|��~ %��?�6���e?7����@�����]ݳuQ�k������FZ���k���2�(N:9�ˑ�ȃEL!<�.� e$�bWuRT}#�AR$��G���SP�,��5d�����e�
Static task
static1
Behavioral task
behavioral1
Sample
Ultimate Cheats.exe
Resource
win10v2004-20240802-en
General
-
Target
Ultimate Cheats.rar
-
Size
5.6MB
-
MD5
8c597096ab08d482eec887e70eab5f0c
-
SHA1
e65872fb9cf7877032977204c05d6a81e3495fa8
-
SHA256
51487df7b6b5833967e530c0be51c257d195e9a7cb15578c7f5c274ea2a7f236
-
SHA512
2021207468205476f514499340850670493447efd47938b041bc9bbf655aa22e420bfe76100232f91f24121a59aac1ad2f2a2f048ddca6bd9c2abf78448b0b54
-
SSDEEP
98304:Ea4qtXr2h5/+8GmjRDylsA2ivypB65giKU9Cs3H9fq3Ei9ZbpOVq:F448VU524y6aqCipqwVq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Ultimate Cheats.exe
Files
-
Ultimate Cheats.rar.rar
-
Ultimate Cheats.exe.exe windows:6 windows x64 arch:x64
159cc40632dc9e83159f06ec21ddb3ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
MapViewOfFile
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
TranslateMessage
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetPixel
advapi32
CryptEncrypt
ole32
CoCreateInstance
msvcp140
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
wininet
InternetGetConnectedState
ntdll
RtlLookupFunctionEntry
urlmon
URLDownloadToFileA
shlwapi
PathFindFileNameW
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertCreateCertificateChainEngine
ws2_32
getaddrinfo
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
acosf
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
STREET2& Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREET1) Size: - Virtual size: 342KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
STREETmY Size: - Virtual size: 920KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
STREETJ: Size: - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
STREETxG Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREET=$ Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREET_9 Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ