valo_unknowncheats[.]me_[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

valo_unknowncheats.me_.dll
Size

68KB
MD5

048c05339725d031f79ebfc984707883
SHA1

dc96a3ce9e343533f3e9d469959d58e050c141af
SHA256

b0d0e226a26109a193b3e736c6d595ba5668dd332b99f3da6e90b321d83f3d0b
SHA512

afdeb8b87e051f6964697a25da68652aaea98338b44bf019e3fb64975141a9e63af98bd5436c6b00be3a6a41dd863d376be84fbcfdc842d559ab7f8507dac637
SSDEEP

1536:S3Gzb7npowyk7Hv7lmb2ban1zgrLZ/D5T8F:SWytk7P7eQ2grVZ8F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
valo_unknowncheats.me_.dll

Files

valo_unknowncheats.me_.dll
.dll windows:6 windows x64 arch:x64

b9596f961aacb2b178bc6f8843bd4296

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\AorSat\Downloads\norecoil_[unknowncheats.me]_\PINGUU-VAL-master\PINGUU-VAL-master\x64\Release\valo.pdb

Imports

kernel32

GetCurrentProcess
GetCurrentThreadId
Sleep
CloseHandle
GetProcAddress
GetModuleHandleA
GetCurrentThread
ExitProcess
IsBadReadPtr
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
RtlCaptureContext
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead

user32

DispatchMessageA
LoadCursorA
ShowCursor
ScreenToClient
DestroyWindow
GetCursorPos
GetWindowRect
GetSystemMetrics
SetRect
RegisterClassExA
FindWindowA
GetActiveWindow
GetAsyncKeyState
GetWindowLongA
GetForegroundWindow
CreateWindowExA
SetLayeredWindowAttributes
PeekMessageA
LoadIconA
TranslateMessage
DefWindowProcA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXCreateLine
D3DXCreateFontA

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140

memset
__std_type_info_destroy_list
__C_specific_handler
__std_exception_destroy
memcpy
memmove
__std_exception_copy
_CxxThrowException

api-ms-win-crt-time-l1-1-0

_time64
clock

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_cexit
_beginthreadex
_getpid
_seh_filter_dll
exit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

pow
acosf
powf
sinf
cosf
atanf
sqrt
sqrtf
trunc
tanf

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9596f961aacb2b178bc6f8843bd4296

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

d3d9

d3dx9_43

dwmapi

vcruntime140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

vcruntime140_1

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 50KB - Virtual size: 50KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 3KB - Virtual size: 10KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 132B

.text
Size: 50KB - Virtual size: 50KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 3KB - Virtual size: 10KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 132B