?present_hk@@YAJPEAUIDXGISwapChain3@@II@Z
Static task
static1
General
-
Target
noclip_[unknowncheats.me]_.dll
-
Size
3.0MB
-
MD5
14975d9e37021f3f3c1757b42c6105fb
-
SHA1
bd3f047a4b7fb47819bfac2967617d34d0a94068
-
SHA256
a7d3e96f7397c5cb1bf0f9d47adffd072c6d00839fa76876118b55a05db9ec3d
-
SHA512
2faf8f2ae80d81437b8271d8f3288319017e40a79adab168da24f75a5f2208cc8a51cbe6ee612ac23c5a9c00e2bf110c6aff6d017716c5a483beb398b8b80f5f
-
SSDEEP
49152:wBC+PUS/kvyKA6gK4Kzic2kq0GUBBK8+oJ/iwGEawy06YOsawSc/KMCg2oScWomc:N9fG8PbwFp2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource noclip_[unknowncheats.me]_.dll
Files
-
noclip_[unknowncheats.me]_.dll.dll windows:6 windows x64 arch:x64
b065a05d434bd27e7269300f026ae2b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
CreateEventA
Sleep
WaitForMultipleObjects
OpenProcess
GetModuleHandleA
K32GetModuleFileNameExA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
GetCurrentProcess
VirtualQuery
GetCurrentProcessId
VirtualProtect
VirtualProtectEx
ReadProcessMemory
WriteProcessMemory
CreateToolhelp32Snapshot
Process32First
Process32Next
SetEndOfFile
WriteConsoleW
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
DeleteFileW
SetStdHandle
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
ExitProcess
ReadFile
HeapReAlloc
HeapAlloc
CloseHandle
GetLastError
DecodePointer
RtlPcToFileHeader
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
LocalFree
FormatMessageA
GetLocaleInfoEx
InitOnceBeginInitialize
InitOnceComplete
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
EncodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
FreeLibrary
HeapCreate
Thread32Next
Thread32First
SuspendThread
ResumeThread
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
OutputDebugStringW
RtlUnwindEx
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
GetFileType
user32
UnregisterClassA
GetAsyncKeyState
GetWindowThreadProcessId
EnumWindows
MessageBoxA
DestroyWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
GetSystemMetrics
SetCapture
GetCapture
GetKeyState
IsChild
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
SetWindowLongPtrW
MessageBoxW
GetForegroundWindow
ReleaseCapture
shell32
SHGetFolderPathA
d3d12
D3D12SerializeRootSignature
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
ole32
CoGetObjectContext
CoGetApartmentType
Exports
Exports
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 787KB - Virtual size: 786KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 296KB - Virtual size: 615KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ