��&IP�/"���~���'UZ�����˘mU�ܻ�.�XS쓵�o#���a��]���8wZ��{��>�(}Q����&A��*���ɽs�Sa�b�p?����C"�$Kn�� pQ�:�0� �kUoO:�{#��NTY)e���%/�K�K���� ��!2��Wwٵ��~����VI�ѥ��%jUc�v���r��"�gڮz\4�<|#1��`:��ؒd1��6��E,d�@���̣O��<���J#7{��&TV��Ԯ#�{�aSIO�9JQpI-�"�ӬUp.���t����Mě� D����V�F.�ʪ���p�T��L���}6��^���Q�f��J����z�I?K�>i��k���F)�8�"|�Ε3ؓ�V�>�'n ?T���C�&M��}�����)X/t'���/m��R���@t RPR�[�"7Jvz����{��Y�ԝ�n�3�z�C�S�XP=��LV�b�$)�K���1J,������H�k� ���z�`7'3�|U&��aB��{�3yTѶ �4F)�����|����<�@��go87y��탳����孖t��f҂#����I��/�ļQ@ʽ�9�b����Cge��2�Y�mڶT>e���`�N�L�S�'�u�J��$��`̶ͮ�PP�t���닔!���ǃ1��W(�w�X-�j�� �y4�+�������`�� 3;0�1S��P ��E"�+^] UX�Nf۾��ny����qG��m�N���mO�-�P�a QђP��=�+�y �ܫ���'/�q":o ���9��._�X^9�G%��� jdÁ�;�4Bä�6i�}�����(:���*(���2X��lNxr{ 9����o�V{���[Vt������� ����6P��`E�ݑ�-���Q<�?7�۞2��f5 9��C��є4�X;,��v��q���-����Ƚ����UGW��~ 3��e�n����Cc�ⵎN���ه�pij�7���o��g;}v@���p�ۚa�����A�]����/Հ3�-�6�؇��(��x���2� ��ܬ��ؿ�ZBC�O�I�j�1���K�:���K�闆one��(t���12���ŹO�t�Swu��SPs�N!�V"�=�s'?F��\i��J���٪1�dK u��I���y�,�A%2t�W�aUl�����L��,�Q� �/x6�y�Ͼ�������7ĞO~s�Y�o�2&�E�:`���SR�,.���R��C�f�L���kh�L���!2���.|u�)� �� ��L@!H��J;O��h@����&3��>9F��"��T=����W��U�әx�x[މ�@:��v�g�;D��@*��{@�y�yH�"̈1�t�J�"Р������Ds��G`4��q��T,(�YUP(X�g����v��8)���3}���q.�>���Qc���!�������2~���O�Kr��6����Z���b�ޓg�W��EL����~Q�X���`��)���HM�6k�l�usJ�Ʌ,�]�d]���v���!+��d���t���l�l~���j�-)�w�ţY=�*b:se��p� W{-�q4� X �'"P���xh�#KojMHX��$�]�ri�M�6r�kѭ0��O��4�C��-"fH�O�t����Ll�{ۗ���O��[R����,�[�`y椣VT]�U����2�|>H~j�JL��O*�&Q��C%wY�>zF\��F)��/71Ͱ��WG-\w���(�����rpTpq�YcRAc�:8��3��Ml��0"�6߉V�l�_�\��~���){��2_~��' ~H��3@��m�Ӝ|C���Ai'Jdy���z�BG���N�e���/#��O�y�1]��;P�� ��=�l��ȔD>�L7IX�ꍭ5�`���+����~�����g�D�Ӳm4˗5h��IL ��)y� �a\�$�e�PI�MC����ƷG3Ϸ�tTOI����Nvsoi�rl��H��x��D��]"b�Cȩ�C�6o}� T�{A�%�:�3(�xZ(��fʻ_�S�1.�~�*R�F!�%0�h'Q �e�%��y[ �u��7�%���[��<� �=L�������*e3? ������8d{���nDqoo�=x�u'�7̝���`߮�!X�/�f�֜�ݫ:"�J��8�XqB\8���l�!f��Xt�{(� �y2"�Yo�O0mv�uI����it �<�f���6�"�(Ct��8��I{W�ۑz��l�����q ��Q�q>��l�:�&�r������=$xd:.y�O��ԘPR�q� %Y�SR�'��Y'}YWq��@"[:���Z�y���7˦���I����bg$�Q֗4����c�ZVb�cl��rY�����n~\kg�YQG����r����T��l��A���ҐSt�*~�5[��7(�Ҷ{����6o�������2��� ��@�y�%��wex���d��C��2�9 ���#�+�6Q5E�$V�p#X%�BY2N�ؐ���h�e6��6χ���0�����X7x ,a�F�d�+ꃛܠN�_�rc�r'F����y��p�7�(�2���]P����)��i�:m����f"�A1'�� ��6N���d��|��%k+N�nL`���~�;��G��~�����n��j��i�TԾ�����Q�*T@�Ʀ݁��`c��b.>G�@���u� ���H"�\s�Y#��>�T�S&l�����B �*"$�J��TaLv�BNf���X���)ơ�I���tpwo+�or�Z���d�W�cmdwٖ]�@��s���,���S=��z�*�8��H��(����Wj�ǽ�z�,�Ldl�!�� �u��谗�JV�;���;T��oR�U�k�T�UjR,��1:��K��SWe=n0�1�|���R�\"]���3]A� ]ރP�N*s�t�����T� ؔ����N���[�MkD�T*������ؽx�Z'c��ɱ1����??���Xl7�L^>����L�n��%;�BL�K1����wU-p�z�)��e���_T�;.
Static task
static1
Behavioral task
behavioral1
Sample
mairajcheats.exe
Resource
win11-20240802-en
General
-
Target
mairajcheats.rar
-
Size
5.2MB
-
MD5
062c6e932cea52359d18458dd00ca949
-
SHA1
6d1ea78a3f042f4ac345d9aaa1cb7f0e019afcd7
-
SHA256
97babca4a12af0bf2ee95dc1e3d5250dcff1dcd46c10ca5c73febcd3cf25ff46
-
SHA512
c2419e5bd78a55ce1715cee8aae7d8d76468ac5b9b8b5583c2cfd80e9ebb4ad7dcb02ac4acf3cd97139d1878fe7831b54fa9ac0d8e9fd083c150baa66961c9bb
-
SSDEEP
98304:2qM4KvFLwNd1xf3rf1yPvT5G5i7l/RNTw5MKJtmu7vOSKIej8jiiXdpDUCK34DQI:2q0Lmd1lfw1pluMUk6v8IQ82iNjOYQI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/mairajcheats.exe
Files
-
mairajcheats.rar.rar
Password: 1
-
mairajcheats.exe.exe windows:6 windows x64 arch:x64
Password: 1
9926f0de7eb224dc97a9716243ba1967
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
urlmon
URLDownloadToFileA
d3dcompiler_43
D3DCompile
kernel32
ReleaseSRWLockExclusive
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRoundRectRgn
advapi32
CryptCreateHash
ole32
CoInitialize
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord217
crypt32
CryptStringToBinaryA
ws2_32
getpeername
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_unlink
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
STREETH> Size: - Virtual size: 849KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREET8n Size: - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
STREETje Size: - Virtual size: 698KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
STREETdq Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
STREET*o Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREET;S Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREETCE Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ