���R�=*N�4��n��z�#~�=�Yʑ��܉��Tk\wP����8�D>��!A�r�����A���2)?�S�'��˕h��?�"!�o�GB{uQt�Bx������/@g�7a:eW;`��SNn�SXڂ� ����i��xg�`�m�gS��ft�U���3�u^���,ΪSLX)|m�ce�~�$����w��+RK����ϒx@0��&����1�O��fki��R�}����\'��@%��>� )M��UtD\�ϟ�T�i�`�8ګ���/٤5�#K��\��{0m�guN���?�*ˌ�"���r�.٧�>�_�G~�����A�\��� <�q�B�'J������P�>,k��,�T�H�V�Q�-M��3#أ�[��A��p����&<Q}t�S��{E[�Z~�πځ�5{��?����IJ�I�u�`�����z���vl oe8E�isQg���b*]|��Q��j(آ4�A���B��`�=Z�%�<8_m}��N�U��i�*ԴAkř�W �����c�n,��.`��6I�&�6����C a����X�����(�k�{��l�u���?�F���GcGy��G�p_kϝUQ��4@�|�� d;L�y�����0����M.�`1�`p��2wv:�M�Z.���.�̹g�#��$�`��j*��~»"?Ux���D dQ\����`$]{ ���~�����؛e����Z���EuB�E�j�y��2{N��/�C���)@b��K��ny�m�P2� n�cj��� �}��R�����1H�,p7�� b��eI ����Fn��F�R�����E�*iGyLy��ы�䕭+VK�y�A��NpaH�NsNkY p�NO�{�-9�MOp�c��3�<��Ju�����n�Ee����9o�6�A(������L��H�����@��S��!(�o@��6��=-���*�؋���OF1{�A�� ��=Oj�>�/�L[p�r���[;$��U�p��_���zu�T6-�E�1��@p�����a���oS� �6W�B��f�^���ɷi�T(]iA�??ی�mH��������oZ�^���z���q�߿tD��31����*��>q+f����C��䱢�Z�T=gI�C �Fc�C���@E�lEG�������~9�����Iw�ݍғ% #��� �PAu�\uG`#��ӻ&^�?��E�[�L)�O{���,xM�C>����dG�1�wO�S�a���t���A�� (#��6�($yf�@�`xo@�2��l��h�'V]����������&%`�=M4��!kb��V�����שZkO�y2^쉸�.�N�.[����N�p��.�쀚{��Z��.�C����� ��? ���F�����`�«�*����:<�e���{݈�\�������G�+}T{�=���Ɯ�كN_L��-�cUf[�l���iS���r�)9.:�+�w���Ǥ��n�,;�Z�'��4�oX-k��k���Nz��l�=�����gB<62S�;��sǒ뎳�wt e��,���_U�t�,\�N�a[_��IZ�q�G�`=�������iO����U�V��Τ�;o���S��Ԇw���?��)�U�e��io���D3! ����pe<��e��H�#Ưdp�1��!H�(���g5��Ψt%��!*������)�i��8G�ݠ-��߾X������Zˇ�e:$`�0j��T R�{����0���Up��c����ū�:*�{F�b�谸 �^�FJ[�a<�i$�����8�F+�U���y;�������P� tiv>���5�/�=� �E�o�D��o��Ѩ���[��df�^���W5Gۍ�����n�<4�c����Ga�O����a��@Mh�!i���{~��P�Ψ��#������7 Q$����#�S�*_��3%�W1��P�:=�����)ܵ�r������y#�j-���$ܵŪ��ٲ]�gUI00O =��8K��5�/w>\p�e:����aE�!� �鑫7�^u�(��N���^�:ex@��U6�W?����5�i�x�-���@�m��Y6��:"��y�T�0�q��j9��\���=�Fesbln'��5q�~�C�N�`�����?�(&���T��L�.�k����e\G���j��� �D�)Rbh�6'8�Q�Vs��( Mu�<����O����rA��cJX8���.lG6�wX6�D��V��Թ�g�ش����&-X�O=,��͂f�:0�w/u���r{լW`�־d:�<|�"8.V��A�8�cR��B� c1H^7�j�5E���)5��^`�� ��G�c.Vk��ᤍ��C�D��͘��`�W�� �_����Of�i���Ymdp&@"�ɑ��lC1ʟ�;~t�&l�������BR2��ƅ��iNW)q<����D����B�CR��_2HՇ�a�ӇjjA�z���ُ�~o��P1�{��UzUc-���H�嗋m=p9ԃ�^P���wy'�:s>N���Bm�u�]���`�W4�K�qY�u��ꛇ:>)�d -�ῡ}�1�7���|�%>E�[��U�;�ʼO��&!���5��Oz��+��9�N�'\���eH )�#��"����"����%իLșVH,��*�:���P{ �����9�_��D�X��sÅ�(n'�m�^7���J�`��uS�eS�.�}�B��'�(O���)��{�~W P_J)��4�����-a������P�j��� g|���g�b�+E����8]u�E-g���t�jcs>����V��'�Ӱ�_`)���N���f[#�%�����8�n��ؼ��!����W� �����<�-_��<1RS�����W��ο������ .d�$48s�0d�.�m�a������@y �d*C�e�?8E5pjź�/���ח�v-������3-��x�i2t0�21E���&���r�08���=����'`�ͮ�w��z���cY�P��Q���:���G���@]oB�s��#�d�}�ڍ-�7�>>>y�
Behavioral task
behavioral1
Sample
cheat without worldesp.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
cheat without worldesp.exe
Resource
win10v2004-20240802-en
General
-
Target
cheat without worldesp.exe
-
Size
8.8MB
-
MD5
ef293b479cb5559019727ab7a7f0d719
-
SHA1
cba3f326bf278c8df088c7a7dd60a72aa559eebb
-
SHA256
b5ed95e4d8360227141449d0de4dbd3696521f2eb10141a6f02e95ec4264e4f5
-
SHA512
1bd8f3e9c306135be4d3c05d61e8bb8422e550b177b79a8466e9e64ba7579bcc988babdb99808fdc5e04edd38f872046deca3c09ac694e47d01bb183147e8cbc
-
SSDEEP
196608:BGaLfiEM0p3mkBQJ/G0Z4hWaVXsynRuIu888VoaIUUad:8Chr5Ja/tihWqXsyRuIvVoBa
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cheat without worldesp.exe
Files
-
cheat without worldesp.exe.exe windows:6 windows x64 arch:x64
16650155c420c05ddd3281ca0d13508f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
GetModuleFileNameA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PeekMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
IsValidSid
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
ws2_32
WSACleanup
d3dx9_43
D3DXCreateTextureFromFileInMemory
winmm
PlaySoundA
ntdll
RtlVirtualUnwind
xinput1_3
ord2
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord41
crypt32
CertFindCertificateInStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-math-l1-1-0
atan2f
api-ms-win-crt-runtime-l1-1-0
perror
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-stdio-l1-1-0
_close
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ