d�z+�V|�0�kH�0�� ��.�"Z#�}�ꥈ$?�d5�m������r����J���Q�z�d��� 4|����v?�b��GV���+���륌�N �]Y"�Y������Wn�����7qC1��vڣ �=�~Hfϙ�;�jYAR�jPg�TK�V����{��X �i��Ƹev�ʄ��R�7�Vy���������+��]W��x�#�Qs�l`����T��U8�s��N���̣��߮�ka���Բ���5^撡-,��Ns�D�7�`�����w��$\TM��/���,�����@EQe:���w%@#���Y6p������v�c�)�p�a~��!���������o�� ��r����E�p��zQ:D���͗o���seE�X*���f����|�m��~�^-ӏ��+]_X��a<���b��=���Lj�4Q�Ҙ%����.N˝:�����T��u�L��b jE1զ�͓�vk��}R, z+�P���0�'���M�2N(O1F�g� �(]���]����\�8��{9 ����ؔ�8��{�q]��X70�!�?u�� ��D(���U��HA����yb(˃[���lb��-KZk �|�0��:Q#�$,�[N8��6r�#�ΨFX`�@��� 1s��;{��&��^�@�x?�H����0jhwr�N��險��H&��{=�_����[s�����E�H#�_a��j��02��C��SƜH��1}�c �q4��lp�;_��,D$�Վ��!0�֝^�MW�;0���+8:���z�)��R�]Z����'[�V���u,��������:b^���ꫵ7!i^����;����y�eZv���~fc�OW�`.�!��_�����q/T�b�j4𤊔��xE!���翹[�QX꾇Q���B��,����#[�Ӑ���I�ʎP��G��3����ߔW���J-��@�L^^~��aߪ1xe�=�-vr"�Rw@�zzo@r%f��A,��+h1�����m�̤�p}��[1(��C�W���Jy�:5F%w�aŐq�.Ae��'��),���\��U���B�Y��6�3�jy�T?[<��>�I���������A/v����Ӗ�P �����%�<�Q���%u�����dF�yK��/����5�'�̏�Z�\�� �Cs�扪0_��a�^S�w�a�n���Z���WO��@0�!�ׁ,N�;*���Ml��kȇ��G�+�1if2� �e|h�7,�K�%�%k��s�T����ͥS ��T�:�׃ā�B�t �dQ� �2oB���[5��3�g��D�?�һ�ŗ�K�K<�*c~�PI`���0}?����,<� "������P[���c�e���R���������[_n�ݣ֡<��1�}.x��0I��@,$��f�Q!�J�Ҽn����@R�3$��Z��0%q;���n2�LT���2]ܥцA:����U��58+<��q� �C��\���X9�EPCq��4 -5��D�O �O���O��M��[�ys�e��L�H)ac�av�o#v������T��d���.��¤�NE���%DhBM�L������x�I7%{d@�����NO}NI8z���n̟%:�θ�1���,�|b�ۭ$�πڷ�=����>�~S��d����m��36�i:� ��&��'a�*�)�0OqP����}K�?�g[���;"Dy�F ��ڇt�Ehg; ă����ϥ����I�]��a ��L̔eʗ癝U�HF�����x2%�U?���m�)�6Ui"KK��fp�W���%�j!��Ѐ 9��:"�E��B /��M�;����Ì�*_Tj��S����26w�|���u�l�k��M8��?���=*�_X.-� ������!��n2G0o=BЮ.����v�M����0PJ<k�~s�bq�,�1#%WH��A��DEM�*����Og�~d��{�G�=q9������[����b�L v2��]�5G�_��%�o�$ey�N`G�K�I̻�+A�Eϣ����7{R�&���=[oR;���XS�wfn�D|�`��Xރâ0C|��Z�FF��h$q�7��K'��������f����iK�(����A��" =W����4�l�����gij�N6��5E���;-w�8;妣j����]�Ȼ����A�!�������uj`֟"8j�v�ՕЋrP��.@����,��$)�7uD�M�$ͥ��ZF���߱����[���}ۊ�>X��p�oN���[K�&4�ۜlh�4�׳�C�i����Α%����K�����J�Q'j��y�����"��k���2b�-�zV:�G2���4��uV���z��q��g�����Cz2q��,��Y��Ok�IDxyA.&�2i�w��8��j h�i4,ϛV��c{���h��O��}�\2�� ���� B�����R�a?�`����9�S�L;��KE�^���M���"7B��\K��K�ߚ����#gP�x{trl���H�VQ��-��qg˦���2������J�-����@u�t��a��Q^!-��>�t���b�6����%�+�H��;�_��īl�+ʿJ�C�7�������kkE"�u)H���˪'h"�����g��q;��Q� a�w34@�.��$�����@�k�*� $��)�a��ҟ����|}5���g��{S�a���Ië7��M��N��JH+�̡����Q���8F½[��E��q���9ی3�����ՠ�����5+A�?팷�_�����l�hȇ�t��D�si�ZB���Tڍ;:�{���zK'�z�e�>Tz;�;���z�x����@�'-�,��-Ҧ���V,�j������������q��zT"*�|�X#� ��m��N�O��ZY���xJ���a���P]y�%��b��L���j+�'KyV�u�q$��!o� ,�����e�����:E���t,��1��쎥٣��%Հ`���@PEXdj�,���o\��M�*��LT[o�t��gqN���x�n�\~�����&���b�^��}E#��l�>)=�j�n��M���6�s}5�S�_K(��M�L�]B5E�/%3\�T̈�l�{H�n� ͔��+N�UǛ��{�AI~܁%V{�4e@Ua�R�D�����,����>��N#�~q�1�6�TQ�*��s�������Ђ��G7ۯ�v ���Pa��R�%&��o�,_z'MRj�}<�i"x�),C!���\�H�xsl�]��xvY{��t�=3�)Gk�����X����j��)�o�F2X怜�#�.��F���n��}3U ���r2�dD 6�pI��-D��l��"O�F֝�#J�l�_���W�
Static task
static1
General
-
Target
CheatoSpoofer.exe
-
Size
71.6MB
-
MD5
44d7a8259c8e1150b93aa779c6234f1b
-
SHA1
9452aabdda121b159285f30583f554f899142f3d
-
SHA256
a07fbd319713eaade17301180d413487e930d6168d3acc4e2715805417b00c10
-
SHA512
c0d5334521dbcdbda5484ec19865ae64e828f5924b3b6ddca24045b74cc2d2a11992cdc887fe264551d849a8904ef46f7bf52c9beded440598fd18c5f155d3e1
-
SSDEEP
1572864:VHo3nSJM6z8DTq8K5RUkcFnVCcCTBiyWrZthOKsA6H4n+SEjfvsO/8sI:iiJai8K5ilaTBiyWrZDOKGHq+bv8N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CheatoSpoofer.exe
Files
-
CheatoSpoofer.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: - Virtual size: 26.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 53.7MB - Virtual size: 53.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 11.5MB - Virtual size: 29.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE