0ace1201e4754c86d03639f6fe46dfa0N

Sharing

Copy URL Twitter E-mail

General

Target

0ace1201e4754c86d03639f6fe46dfa0N
Size

375KB
MD5

0ace1201e4754c86d03639f6fe46dfa0
SHA1

ee43857998f08634d032d47f0ccb6aa6ef63fc8c
SHA256

5cab861b77e8f11243f87d96b9c27c791ed667dfcf66170fcc4bd1bae0420479
SHA512

d209a01682bb92896f0e585ca5cce0a84fe93707b64684cc1715fcd0cca38beb4aba50ddfbf6f875c58074d5d97f66e8968113dd1b9ba2d9ae4243d22cf8fcea
SSDEEP

6144:X0YEZd8rnvENsN5MkWKJjysYHUq4wRNSnk1nP4x:jEZdonw8MYxq4YNSnk1P8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ace1201e4754c86d03639f6fe46dfa0N

Files

0ace1201e4754c86d03639f6fe46dfa0N
.exe windows:6 windows x64 arch:x64

befcd2fcaa57e2579f158111c6c854c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\tope\Overwatch-2-TOPE-EXTERNAL-CHEAT-main\x64\Release\production.pdb

Imports

kernel32

QueryPerformanceCounter
Process32First
GetCurrentProcess
Module32Next
Module32First
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32Next
CloseHandle
ReadProcessMemory
VirtualQueryEx
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetProcAddress
QueryPerformanceFrequency
FreeLibrary
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
RtlCaptureContext
ReleaseSRWLockExclusive

user32

OpenClipboard
GetCursorPos
SetWindowLongA
GetKeyState
UpdateWindow
RegisterClassExA
FindWindowA
PostQuitMessage
UnregisterClassA
PeekMessageA
TranslateMessage
CreateWindowExA
DefWindowProcA
EnumDisplaySettingsA
MessageBoxA
SetCursorPos
GetWindowThreadProcessId
DispatchMessageA
GetWindowRect
DestroyWindow
GetSystemMetrics
ShowWindow
GetAsyncKeyState
GetWindowLongA
SetClipboardData
GetClipboardData
LoadCursorA
ReleaseCapture
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
EmptyClipboard
CloseClipboard

imm32

ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmAssociateContextEx
ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_FExp
_Xtime_get_ticks
_Query_perf_counter
?_Random_device@std@@YAIXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
?uncaught_exceptions@std@@YAHXZ

winmm

timeBeginPeriod

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140

memset
__current_exception_context
__current_exception
_CxxThrowException
__std_exception_copy
__std_exception_destroy
strstr
__C_specific_handler
memmove
memcpy
memcmp
memchr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
_wfopen
fwrite
__p__commode
__stdio_common_vsscanf
fclose
fflush
__acrt_iob_func
_set_fmode
ftell
fseek
fread

api-ms-win-crt-string-l1-1-0

strncpy
_stricmp
strcmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free
_set_new_mode

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
__p___argv
__p___argc
terminate
_register_onexit_function
_beginthread
_initialize_onexit_table
_exit
_initialize_narrow_environment
system
_initterm_e
_initterm
_configure_narrow_argv
_get_initial_narrow_environment
exit
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-math-l1-1-0

fmodf
cosf
logf
atan2f
acosf
scalbnf
copysignf
ldexp
_fdsign
__setusermatherr
powf
sinf
sqrtf
ceilf
ilogbf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

vcruntime140_1

__CxxFrameHandler4

Sections

.text
Size: 305KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

befcd2fcaa57e2579f158111c6c854c5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

imm32

d3dcompiler_47

dwmapi

msvcp140

winmm

d3d11

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

vcruntime140_1

Sections

.text Size: 305KB - Virtual size: 304KB

.rdata Size: 54KB - Virtual size: 54KB

.data Size: 1024B - Virtual size: 5KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 268B

.text
Size: 305KB - Virtual size: 304KB

.rdata
Size: 54KB - Virtual size: 54KB

.data
Size: 1024B - Virtual size: 5KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 268B