E:\cheat\Overwatch Hack\x64\Release\Imperial.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bd3c4dc68c581b5c9b815f08feb7e98940a7c4ec732dcb995d4571c853cd4b61N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
bd3c4dc68c581b5c9b815f08feb7e98940a7c4ec732dcb995d4571c853cd4b61N.exe
Resource
win10v2004-20240802-en
General
-
Target
bd3c4dc68c581b5c9b815f08feb7e98940a7c4ec732dcb995d4571c853cd4b61N.exe
-
Size
357KB
-
MD5
b90890f6abfd0dc8f526ad5aae276680
-
SHA1
3be079ad0a36f33e227ccd330332f7e5e28a8b59
-
SHA256
bd3c4dc68c581b5c9b815f08feb7e98940a7c4ec732dcb995d4571c853cd4b61
-
SHA512
c698f384e5a1b84627ea8a2bfe6866d4a3ebbc6f850b36e3632240e4e9bff3095da691b3526dee51b79f33cec15547638bbe01df80f086bbc96691a068287a42
-
SSDEEP
6144:7hGPcf+3740+dj+eLYm1M6ei6CzesI7pl2EgtxtmuWTOGne/8:Is+3U7j+eL2s60IZgtDGnQ8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd3c4dc68c581b5c9b815f08feb7e98940a7c4ec732dcb995d4571c853cd4b61N.exe
Files
-
bd3c4dc68c581b5c9b815f08feb7e98940a7c4ec732dcb995d4571c853cd4b61N.exe.exe windows:6 windows x64 arch:x64
e2831305eb4534eacd4c34f7b6f4d346
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
interception
interception_create_context
interception_receive
interception_wait
interception_is_mouse
interception_send
interception_set_filter
kernel32
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
Process32First
GetCurrentProcess
Module32Next
InitializeCriticalSectionEx
Module32First
OpenProcess
CreateToolhelp32Snapshot
Sleep
K32GetModuleFileNameExA
GetLastError
Process32Next
MultiByteToWideChar
WritePrivateProfileStringA
CreateThread
DeleteCriticalSection
ReadProcessMemory
GetConsoleWindow
GetPrivateProfileIntA
GetTickCount
VirtualQueryEx
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OutputDebugStringW
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
CloseHandle
InitializeSListHead
user32
GetClipboardData
EmptyClipboard
CloseClipboard
GetForegroundWindow
GetWindowThreadProcessId
GetWindow
DispatchMessageA
GetWindowRect
DestroyWindow
SetWindowPos
GetClassNameA
ShowWindow
GetAsyncKeyState
SetWindowLongA
GetWindowTextA
DefWindowProcA
SetClipboardData
CreateWindowExA
SetFocus
TranslateMessage
LoadIconA
PeekMessageA
UnregisterClassA
PostQuitMessage
FindWindowA
RegisterClassExA
UpdateWindow
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
IsChild
OpenClipboard
GetCursorPos
SetCursorPos
SetCapture
SetCursor
GetClientRect
ReleaseCapture
TrackMouseEvent
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_FExp
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
d3d9
Direct3DCreate9Ex
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
memset
_CxxThrowException
__current_exception_context
__std_exception_copy
__std_exception_destroy
strstr
__std_terminate
memmove
__current_exception
memchr
memcpy
memcmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
ftell
__acrt_iob_func
fflush
_wfopen
__p__commode
_set_fmode
__stdio_common_vsprintf
fclose
fwrite
__stdio_common_vsprintf_s
fseek
fread
__stdio_common_vsscanf
api-ms-win-crt-string-l1-1-0
strcmp
strncpy
api-ms-win-crt-utility-l1-1-0
qsort
rand
srand
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoul
atof
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_seh_filter_exe
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
_crt_atexit
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_errno
_invalid_parameter_noinfo_noreturn
terminate
_beginthreadex
exit
_register_onexit_function
api-ms-win-crt-math-l1-1-0
fmodf
_fdsign
ldexp
cosf
round
copysignf
atan2f
scalbnf
roundf
sinf
ilogbf
sqrt
sqrtf
logf
powf
acosf
ceilf
__setusermatherr
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-filesystem-l1-1-0
_access
Sections
.text Size: 286KB - Virtual size: 285KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ