C:\Users\Vox\Desktop\_0x\Binaries\Release\Source.pdb
Static task
static1
Behavioral task
behavioral1
Sample
online_enabler_[unknowncheats.me]_.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
online_enabler_[unknowncheats.me]_.dll
Resource
win10v2004-20241007-en
General
-
Target
online_enabler_[unknowncheats.me]_.dll
-
Size
746KB
-
MD5
e6a449dd0836d487dff4fef6618a65fb
-
SHA1
6281b6b51eea695a146eb96979ae72bfbf241343
-
SHA256
95d090730e2bd2552cef3472306580608caa1f6e7f37f98db232c918b616d6c1
-
SHA512
515194636dfc0196d95c69f5b1554730d4d9d4a90e5c413593fdca08d1ebba03aa7957a5bfc8bb008b8f1f36527ae52fd56c284555b8a630e8d9c4c230c56e64
-
SSDEEP
12288:TktGoqmcmfYeIuWQqSTUPph0lhSMXl+yW1jn4Hd973zm97DB:Tkt+mfYejtqhh0lhSMXlRWNn4H/73G7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource online_enabler_[unknowncheats.me]_.dll
Files
-
online_enabler_[unknowncheats.me]_.dll.dll windows:6 windows x64 arch:x64
0c6d496c63b5c738245d8c29a7ac2f8a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
WideCharToMultiByte
GlobalUnlock
GlobalAlloc
GlobalFree
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryA
GetProcAddress
FreeLibrary
FreeLibraryAndExitThread
CreateThread
AttachConsole
GetCurrentProcessId
AllocConsole
SetConsoleTitleA
GetConsoleWindow
SetConsoleCP
SetConsoleOutputCP
FreeConsole
CloseHandle
GetLastError
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
MultiByteToWideChar
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
GetLocaleInfoEx
FormatMessageA
LocalFree
GetFileInformationByHandleEx
AreFileApisANSI
GetCurrentProcess
ConvertThreadToFiber
SwitchToFiber
DeleteFiber
CreateFiber
AcquireSRWLockExclusive
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
ReleaseSRWLockExclusive
GetFileAttributesExW
GlobalLock
GetModuleHandleA
GetStdHandle
InitializeSListHead
SetConsoleTextAttribute
user32
SetCapture
SetLayeredWindowAttributes
ReleaseCapture
IsWindowUnicode
TrackMouseEvent
GetClientRect
ScreenToClient
GetCursorPos
SetCursorPos
ClientToScreen
GetForegroundWindow
GetKeyState
LoadCursorA
SetCursor
FindWindowA
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
GetCapture
d3dcompiler_47
D3DCompile
msvcp140
?uncaught_exceptions@std@@YAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Random_device@std@@YAIXZ
_Query_perf_counter
_Query_perf_frequency
?_Xbad_function_call@std@@YAXXZ
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Thrd_yield
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?always_noconv@codecvt_base@std@@QEBA_NXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Winerror_map@std@@YAHH@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xbad_alloc@std@@YAXXZ
?good@ios_base@std@@QEBA_NXZ
??1_Lockit@std@@QEAA@XZ
imm32
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
__current_exception
strstr
__std_terminate
memcmp
__C_specific_handler
memmove
__std_exception_destroy
__std_exception_copy
__std_type_info_destroy_list
_CxxThrowException
__current_exception_context
memset
memchr
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_crt_atexit
_cexit
abort
terminate
_initterm
_seh_filter_dll
_initterm_e
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fread
fseek
fgetc
ungetc
fclose
fflush
_fseeki64
fgetpos
fsetpos
setvbuf
fputc
_get_stream_buffer_pointers
__stdio_common_vfprintf
__stdio_common_vsscanf
__stdio_common_vsprintf
__acrt_iob_func
fwrite
_wfopen
ftell
api-ms-win-crt-math-l1-1-0
cosf
ceilf
acosf
_fdsign
sinf
_dsign
sqrtf
_ldsign
api-ms-win-crt-string-l1-1-0
toupper
strncpy
strcmp
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Sections
.text Size: 377KB - Virtual size: 376KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 106KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ