C:\Users\Zyad\Downloads\мб приватка\PrizrakX!ters\examples\example_win32_directx11\Release\RIZKA CHEAT Basic.pdb
Static task
static1
Behavioral task
behavioral1
Sample
RIZKA CHEAT Basic.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
RIZKA CHEAT Basic.exe
Resource
win10v2004-20240802-en
General
-
Target
RIZKA CHEAT Basic.rar
-
Size
722KB
-
MD5
3b9d72cbe0660d0dac1a9666d3baac17
-
SHA1
65caf2978712a1e35990b2c3d6cc283b27552146
-
SHA256
086383df23285ea6619a9f73d8d16f40558382922c5fe03a5e40109ffc421315
-
SHA512
e4028eb78fe8cfa23d5e29f9a33d2c9bd3fb57284eea676174d9bc43753433e60a9f69d27dffd5267594b94e51577dc7aee4a9cf43d67d9d180f1b7a653b2a1a
-
SSDEEP
12288:AHSK9Rjw3kKgZWADHqs/SpFBrMg41fQ7UoOTKR2u+HdFORG1pyphrIVc4:x+RYaNDKs/IB4uCKAuUKG6hiV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RIZKA CHEAT Basic.exe
Files
-
RIZKA CHEAT Basic.rar.rar
Password: 1
-
RIZKA CHEAT Basic.exe.exe windows:6 windows x64 arch:x64
Password: 1
b7c53f3584636cc0e76ba35acec3f6f6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetLocaleInfoEx
GetFileAttributesExW
GetFileSizeEx
CreateFileA
SetFileInformationByHandle
AreFileApisANSI
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetFileInformationByHandleEx
GetEnvironmentVariableA
WaitForSingleObjectEx
FindFirstFileW
VerifyVersionInfoA
ReleaseSRWLockExclusive
GetSystemDirectoryA
AcquireSRWLockExclusive
SleepEx
LeaveCriticalSection
SleepConditionVariableSRW
EnterCriticalSection
GetCurrentThreadId
WakeAllConditionVariable
FindClose
CheckRemoteDebuggerPresent
VirtualQueryEx
IsDebuggerPresent
AllocConsole
GetTickCount
VirtualFreeEx
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
UnhandledExceptionFilter
LocalFree
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
FormatMessageA
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
CreateRemoteThread
GetProcessHeap
ReadProcessMemory
DeleteCriticalSection
VirtualAllocEx
Beep
GetThreadContext
HeapDestroy
VirtualProtectEx
HeapAlloc
CreateThread
GetSystemInfo
CloseHandle
HeapReAlloc
Process32Next
SetLastError
QueryFullProcessImageNameW
GetCurrentThread
GetLastError
Sleep
CreateToolhelp32Snapshot
HeapSize
OpenProcess
ReleaseMutex
WaitForSingleObject
CreateMutexA
InitializeCriticalSectionEx
TerminateProcess
VirtualAlloc
GetCurrentProcess
HeapFree
WriteProcessMemory
Process32First
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
CreateFileW
MoveFileExA
GetModuleFileNameA
GetModuleHandleW
user32
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
OpenClipboard
LoadCursorA
GetKeyState
UpdateWindow
FindWindowA
PostQuitMessage
TranslateMessage
SetLayeredWindowAttributes
DefWindowProcA
MoveWindow
MessageBoxA
SetWindowDisplayAffinity
CloseClipboard
EmptyClipboard
GetWindowLongA
GetClipboardData
SetClipboardData
ScreenToClient
DispatchMessageA
PeekMessageA
GetWindowRect
DestroyWindow
SetWindowRgn
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
GetActiveWindow
ShowWindow
GetAsyncKeyState
SetWindowLongA
LoadIconA
gdi32
CreateRoundRectRgn
advapi32
CryptEncrypt
OpenProcessToken
SetSecurityInfo
AddAccessAllowedAce
GetLengthSid
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
IsValidSid
InitializeAcl
CopySid
GetTokenInformation
ole32
CoInitialize
CoUninitialize
CoCreateInstance
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlAdjustPrivilege
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtRaiseHardError
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
shlwapi
PathFileExistsA
userenv
UnloadUserProfile
normaliz
IdnToAscii
wldap32
ord60
ord46
ord50
ord211
ord22
ord26
ord27
ord32
ord217
ord41
ord143
ord33
ord35
ord79
ord30
ord200
ord301
ord45
crypt32
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFindCertificateInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertEnumCertificatesInStore
ws2_32
WSAStartup
closesocket
recv
send
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAGetLastError
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
memset
memmove
memcpy
memcmp
__current_exception_context
_CxxThrowException
strchr
strstr
__C_specific_handler
__std_terminate
__std_exception_copy
__std_exception_destroy
__current_exception
memchr
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
_set_fmode
_lseeki64
fread
fclose
__stdio_common_vsscanf
__p__commode
feof
fflush
fputs
fopen
_wfopen
__acrt_iob_func
_read
_write
_close
_open
_popen
_pclose
fgets
__stdio_common_vfprintf
ftell
fseek
fputc
fwrite
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-string-l1-1-0
_stricmp
_strdup
strncmp
strncpy
tolower
strpbrk
strcmp
strcspn
strspn
isupper
api-ms-win-crt-heap-l1-1-0
calloc
realloc
_callnewh
_set_new_mode
malloc
free
_msize
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
terminate
__sys_nerr
_errno
strerror
exit
_invalid_parameter_noinfo
_resetstkoflw
_invalid_parameter_noinfo_noreturn
_wassert
_register_thread_local_exe_atexit_callback
_c_exit
_getpid
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
abort
system
api-ms-win-crt-convert-l1-1-0
strtod
atoi
strtol
strtoll
strtoull
strtoul
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
ceilf
cosf
atan2f
acosf
powf
_dclass
sinf
__setusermatherr
fmodf
sqrtf
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlink
_stat64
_fstat64
_access
Sections
.text Size: 761KB - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 474KB - Virtual size: 485KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ