Static task
static1
General
-
Target
Forza Horizon 4 V1.295.960.2 Trainer +1 MrAntiFun.exe
-
Size
766KB
-
MD5
486cd9b1a7214dfaa41e3faf8bf07797
-
SHA1
a2ed37a56e2f965848d905f8105b6c17b2ccd878
-
SHA256
cd5b4c6e7be1340604360b2dca573864719fe0e2264fb23b912bb238d1fc9507
-
SHA512
1feb2513593d0b6f1d6913e51dbacba8f794f1c4cb479ccf9fe65323b67face2d222310190ef41d1a0fd91f5e603cfdd0e9a5120819cc02160152494ce1b1637
-
SSDEEP
12288:f+5jLjqux1ANWEEsoO8CHieL1GbsdAWp03Vng/6Bl5JX5VV9:G1n1ATNH7xGbsyg0ZFlfX5D9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Forza Horizon 4 V1.295.960.2 Trainer +1 MrAntiFun.exe
Files
-
Forza Horizon 4 V1.295.960.2 Trainer +1 MrAntiFun.exe.exe windows:6 windows x64 arch:x64
f53f717b43d8d2fb130b53421227b99c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
OpenProcess
GetLastError
CloseHandle
CreateToolhelp32Snapshot
Process32First
Process32Next
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
Module32First
Module32Next
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
VirtualProtectEx
VirtualProtect
GetCurrentProcess
Beep
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
Sleep
user32
CallNextHookEx
SetWindowsHookExA
winmm
PlaySoundA
vcruntime140
memset
__C_specific_handler
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxExceptionFilter
__CxxUnregisterExceptionObject
memmove
__CxxQueryExceptionSize
__FrameUnwindFilter
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-runtime-l1-1-0
abort
_crt_atexit
_initialize_onexit_table
_register_onexit_function
_c_exit
_cexit
terminate
_exit
exit
_initterm_e
_initterm
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_get_narrow_winmain_command_line
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
_callnewh
malloc
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
mscoree
_CorExeMain
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nep Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 398KB - Virtual size: 397KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 500.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 708B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 335KB - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ