umbral | zetcheats[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

zetcheats.rar
Size

234KB
MD5

9021e511366e5bca56a3aee33bcd02d1
SHA1

49d4ec33d0d1bc0f80560ce87ee751be559ade48
SHA256

732efb009641d9d8d38ad223649018ce8d0521f0e03c34112221d0525dda7855
SHA512

803fd74d45ad9acde6d74fb29b08ffc6906650e5d353d8da35bf4b4dc6021948879446efa58a099747db606573b6f42ed00add3d1d30f5f00be3cdd90484f2ae
SSDEEP

3072:QcJ0FH2Not2cvyAglXz4KtJ9BMqc7OBcERQP4/w6+TH2lFh2c5JHNYn1YJ60a:gdNqAgtz4KN5pBhRKx6gH4bzTHNY0a

Score

10^/10

umbral

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1276853076103397458/6HXVSbE_AkPTnHXPWSqE7R6BZEz8c-DN__uq16DZfNyzHcoPxLFW5-ZbkHlh1PYswhx8

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
static1/unpack001/zetcheats/zetcheats.exe	family_umbral

Umbral family
umbral

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/zetcheats/Configs/nfd.dll
unpack001/zetcheats/GAC MSIL/ngd.dll
unpack001/zetcheats/Mods/Wldap32.dll
unpack001/zetcheats/Mods/wlautil.dll
unpack001/zetcheats/zetcheats.exe

Files

zetcheats.rar
.rar

Password: zetcheats
zetcheats/Configs/LogitechLedEnginesWrapper.dll
.dll windows:6 windows x86 arch:x86

Password: zetcheats

d0299db702a12562e73d33f5a483ea90

Code Sign

04:5f:7b:84:0f:b7:4d:1c:d3:fd:99:20:33:5a:93:a0
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20-04-2015 00:00

Not After

24-04-2018 12:00

Subject

SERIALNUMBER=C1067879,CN=Logitech Inc,O=Logitech Inc,POSTALCODE=94560,STREET=7600 Gateway Blvd,L=Newark,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:44:a5:a6:ff:a6:9a:2f:a6:0b:63:67:31:43:2d:3d:26:3f:e5:23
Signer

Actual PE Digest

5a:44:a5:a6:ff:a6:9a:2f:a6:0b:63:67:31:43:2d:3d:26:3f:e5:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\BuildAgent\work\973e5fcef1adb603\Src\SDKs\LED\LogitechLedEnginesWrapper\Release\LogitechLedEnginesWrapper.pdb

Imports

kernel32

LoadLibraryW
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
DisableThreadLibraryCalls

advapi32

RegQueryValueExW
RegOpenKeyExW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

msvcr120

_malloc_crt
_initterm
_initterm_e
free
__crtUnhandledException
__crtTerminateProcess
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__clean_type_info_names_internal
_except_handler4_common
_amsg_exit
__CppXcptFilter
??3@YAXPAX@Z
??2@YAPAXI@Z
_crt_debugger_hook

Exports

Exports

LogiLedExcludeKeysFromBitmap
LogiLedFlashLighting
LogiLedFlashSingleKey
LogiLedGetConfigOptionBool
LogiLedGetConfigOptionColor
LogiLedGetConfigOptionKeyInput
LogiLedGetConfigOptionNumber
LogiLedGetSdkVersion
LogiLedInit
LogiLedPulseLighting
LogiLedPulseSingleKey
LogiLedRestoreLighting
LogiLedRestoreLightingForKey
LogiLedSaveCurrentLighting
LogiLedSaveLightingForKey
LogiLedSetConfigOptionLabel
LogiLedSetLighting
LogiLedSetLightingForKeyWithHidCode
LogiLedSetLightingForKeyWithKeyName
LogiLedSetLightingForKeyWithQuartzCode
LogiLedSetLightingForKeyWithScanCode
LogiLedSetLightingFromBitmap
LogiLedSetTargetDevice
LogiLedShutdown
LogiLedStopEffects
LogiLedStopEffectsOnKey

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zetcheats/Configs/key.dll
zetcheats/Configs/nfd.dll
.dll windows:4 windows x86 arch:x86

Password: zetcheats

a804ce09d591071859c4ef01d305dc33

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

_amsg_exit
_exit
_initterm
_iob
_lock
_unlock
_vsnprintf
abort
calloc
free
fwprintf
fwrite
malloc
memset
raise
realloc
strlen
strncat
strncmp
strncpy
vfprintf
wcscpy
wcslen
_snwprintf

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize

shell32

SHCreateItemFromParsingName

user32

MessageBoxW

Exports

Exports

NFD_GetError
NFD_OpenDialog
NFD_OpenDialogMultiple
NFD_PathSet_Free
NFD_PathSet_GetCount
NFD_PathSet_GetPath
NFD_PickFolder
NFD_SaveDialog

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 267B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 512B - Virtual size: 359B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/91
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zetcheats/GAC MSIL/EnginesWrapper.dll
.dll windows:6 windows x86 arch:x86

Password: zetcheats

d0299db702a12562e73d33f5a483ea90

Code Sign

04:5f:7b:84:0f:b7:4d:1c:d3:fd:99:20:33:5a:93:a0
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20-04-2015 00:00

Not After

24-04-2018 12:00

Subject

SERIALNUMBER=C1067879,CN=Logitech Inc,O=Logitech Inc,POSTALCODE=94560,STREET=7600 Gateway Blvd,L=Newark,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:44:a5:a6:ff:a6:9a:2f:a6:0b:63:67:31:43:2d:3d:26:3f:e5:23
Signer

Actual PE Digest

5a:44:a5:a6:ff:a6:9a:2f:a6:0b:63:67:31:43:2d:3d:26:3f:e5:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\BuildAgent\work\973e5fcef1adb603\Src\SDKs\LED\LogitechLedEnginesWrapper\Release\LogitechLedEnginesWrapper.pdb

Imports

kernel32

LoadLibraryW
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
DisableThreadLibraryCalls

advapi32

RegQueryValueExW
RegOpenKeyExW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

msvcr120

_malloc_crt
_initterm
_initterm_e
free
__crtUnhandledException
__crtTerminateProcess
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__clean_type_info_names_internal
_except_handler4_common
_amsg_exit
__CppXcptFilter
??3@YAXPAX@Z
??2@YAPAXI@Z
_crt_debugger_hook

Exports

Exports

LogiLedExcludeKeysFromBitmap
LogiLedFlashLighting
LogiLedFlashSingleKey
LogiLedGetConfigOptionBool
LogiLedGetConfigOptionColor
LogiLedGetConfigOptionKeyInput
LogiLedGetConfigOptionNumber
LogiLedGetSdkVersion
LogiLedInit
LogiLedPulseLighting
LogiLedPulseSingleKey
LogiLedRestoreLighting
LogiLedRestoreLightingForKey
LogiLedSaveCurrentLighting
LogiLedSaveLightingForKey
LogiLedSetConfigOptionLabel
LogiLedSetLighting
LogiLedSetLightingForKeyWithHidCode
LogiLedSetLightingForKeyWithKeyName
LogiLedSetLightingForKeyWithQuartzCode
LogiLedSetLightingForKeyWithScanCode
LogiLedSetLightingFromBitmap
LogiLedSetTargetDevice
LogiLedShutdown
LogiLedStopEffects
LogiLedStopEffectsOnKey

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zetcheats/GAC MSIL/ScreenShader.xnb
zetcheats/GAC MSIL/ngd.dll
.dll windows:4 windows x86 arch:x86

Password: zetcheats

a804ce09d591071859c4ef01d305dc33

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

_amsg_exit
_exit
_initterm
_iob
_lock
_unlock
_vsnprintf
abort
calloc
free
fwprintf
fwrite
malloc
memset
raise
realloc
strlen
strncat
strncmp
strncpy
vfprintf
wcscpy
wcslen
_snwprintf

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize

shell32

SHCreateItemFromParsingName

user32

MessageBoxW

Exports

Exports

NFD_GetError
NFD_OpenDialog
NFD_OpenDialogMultiple
NFD_PathSet_Free
NFD_PathSet_GetCount
NFD_PathSet_GetPath
NFD_PickFolder
NFD_SaveDialog

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 267B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 512B - Virtual size: 359B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/91
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zetcheats/How_to_use.txt
zetcheats/Mods/Wldap32.dll
.dll windows:4 windows x86 arch:x86

Password: zetcheats

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Programms\VS\PirateAPI\PirateAPI\bin\Release\Projects\Unturned\BeyondCheatFree\obj\Release\BeyondCheatFree.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zetcheats/Mods/wlautil.dll
.dll windows:4 windows x86 arch:x86

Password: zetcheats

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Programms\VS\PirateAPI\PirateAPI\bin\Release\Projects\Unturned\BeyondCheatFree\obj\Release\BeyondCheatFree.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zetcheats/zetcheats.exe
.exe windows:4 windows x86 arch:x86

Password: zetcheats

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 227KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: zetcheats

Password: zetcheats

d0299db702a12562e73d33f5a483ea90

Code Sign

04:5f:7b:84:0f:b7:4d:1c:d3:fd:99:20:33:5a:93:a0Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

5a:44:a5:a6:ff:a6:9a:2f:a6:0b:63:67:31:43:2d:3d:26:3f:e5:23Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

version

msvcr120

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 492B

Password: zetcheats

a804ce09d591071859c4ef01d305dc33

Headers

File Characteristics

Imports

kernel32

msvcrt

ole32

shell32

user32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 56B

.rdata Size: 14KB - Virtual size: 13KB

/4 Size: 4KB - Virtual size: 4KB

.bss Size: - Virtual size: 1KB

.edata Size: 512B - Virtual size: 267B

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 1024B - Virtual size: 820B

/14 Size: 512B - Virtual size: 88B

/29 Size: 33KB - Virtual size: 33KB

/41 Size: 1KB - Virtual size: 1KB

/55 Size: 2KB - Virtual size: 1KB

/67 Size: 512B - Virtual size: 56B

/80 Size: 512B - Virtual size: 359B

/91 Size: 1KB - Virtual size: 1KB

/102 Size: 512B - Virtual size: 144B

Password: zetcheats

d0299db702a12562e73d33f5a483ea90

Code Sign

04:5f:7b:84:0f:b7:4d:1c:d3:fd:99:20:33:5a:93:a0Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

04:5f:7b:84:0f:b7:4d:1c:d3:fd:99:20:33:5a:93:a0
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

5a:44:a5:a6:ff:a6:9a:2f:a6:0b:63:67:31:43:2d:3d:26:3f:e5:23
Signer

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 492B

.text
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 56B

.rdata
Size: 14KB - Virtual size: 13KB

/4
Size: 4KB - Virtual size: 4KB

.bss
Size: - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 267B

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 1024B - Virtual size: 820B

/14
Size: 512B - Virtual size: 88B

/29
Size: 33KB - Virtual size: 33KB

/41
Size: 1KB - Virtual size: 1KB

/55
Size: 2KB - Virtual size: 1KB

/67
Size: 512B - Virtual size: 56B

/80
Size: 512B - Virtual size: 359B

/91
Size: 1KB - Virtual size: 1KB

/102
Size: 512B - Virtual size: 144B

04:5f:7b:84:0f:b7:4d:1c:d3:fd:99:20:33:5a:93:a0
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

5a:44:a5:a6:ff:a6:9a:2f:a6:0b:63:67:31:43:2d:3d:26:3f:e5:23
Signer

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 492B

.text
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 56B

.rdata
Size: 14KB - Virtual size: 13KB

/4
Size: 4KB - Virtual size: 4KB

.bss
Size: - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 267B

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 1024B - Virtual size: 820B

/14
Size: 512B - Virtual size: 88B

/29
Size: 33KB - Virtual size: 33KB

/41
Size: 1KB - Virtual size: 1KB

/55
Size: 2KB - Virtual size: 1KB

/67
Size: 512B - Virtual size: 56B

/80
Size: 512B - Virtual size: 359B

/91
Size: 1KB - Virtual size: 1KB

/102
Size: 512B - Virtual size: 144B

.text
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 1024B - Virtual size: 704B

.reloc
Size: 512B - Virtual size: 12B