cheeto[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cheeto.exe
Size 3.4MB
Sample260422-webjssds2m
SHA256 918e668a703b2e36b54e8b0bf298727573cbef677dfdbbdfb44f76875947a0c1
MD5 dc4482e00ea2708ac7dfec144096cd99
SHA1 1b5d368fa22c0edb80962446e543fb4eef505bc0
SHA512 57d25f6527dca223ca326aa015d0bc6c9285a9c1b9942057d5b7c185cadbf98e5520f522e511e8061b1db4a6589bb9ec2c21b9159132aad7305428565ad0c8e2
SSDEEP 49152:DnZ/gSN0SiyI6OWiB13BBSDGgvPJ+msrEPUbCramnHzTDRdIaiIRu0:t/tiM0j3PSDJvPErEMbCramTTM30
TLSH
T163F50103F36283ADC02BA8398B92D366F2737C81171292CBB7A45A548B975F41F7B5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cheeto.exe

File Explorer

cheeto.exe

.exe 3.4MB

cheeto.exe

IMPHASH f7ec93f9e07b6a3a42fbe6f4872f6dbd
SHA256 918e668a703b2e36b54e8b0bf298727573cbef677dfdbbdfb44f76875947a0c1
MD5 dc4482e00ea2708ac7dfec144096cd99
SHA1 1b5d368fa22c0edb80962446e543fb4eef505bc0
SHA512 57d25f6527dca223ca326aa015d0bc6c9285a9c1b9942057d5b7c185cadbf98e5520f522e511e8061b1db4a6589bb9ec2c21b9159132aad7305428565ad0c8e2
SSDEEP 49152:DnZ/gSN0SiyI6OWiB13BBSDGgvPJ+msrEPUbCramnHzTDRdIaiIRu0:t/tiM0j3PSDJvPErEMbCramTTM30
TLSH
T163F50103F36283ADC02BA8398B92D366F2737C81171292CBB7A45A548B975F41F7B5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

466128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\game\EXTERNAL STUFF EHREERERERE\Celex source\Celex builds\cheeto.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

InitializeSListHead GetSystemTimeAsFileTime SetConsoleTextAttribute SetConsoleTitleA GetStdHandle Process32First Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle GetModuleHandleA GetConsoleWindow MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId Sleep SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW SetFileInformationByHandle AreFileApisANSI GetLastError GetCurrentProcessId

user32

GetMessageExtraInfo LoadCursorA GetAsyncKeyState GetCapture TrackMouseEvent GetForegroundWindow SetCapture SetCursor SendInput GetCursorPos FindWindowA ScreenToClient GetKeyState RegisterClassExA PostQuitMessage UnregisterClassA PeekMessageA GetClientRect TranslateMessage SetLayeredWindowAttributes CreateWindowExA DefWindowProcA SetWindowDisplayAffinity ClientToScreen SetWindowLongA ShowWindow GetSystemMetrics IsWindowUnicode DestroyWindow GetWindowRect DispatchMessageA SetClipboardData UpdateWindow GetClipboardData EmptyClipboard CloseClipboard OpenClipboard ReleaseCapture SetCursorPos

shell32

SHGetFolderPathA

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xbad_function_call@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr memcmp memcpy __std_terminate memset __std_exception_copy __C_specific_handler __std_exception_destroy _CxxThrowException memmove __current_exception_context __current_exception strstr

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback __p___argc _exit exit _initterm_e _initterm system __p___argv _get_initial_narrow_environment _set_app_type _beginthreadex _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _invoke_watson abort terminate _errno

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-math-l1-1-0

roundf fmodf fmaxf fminf cosf logf ceilf __setusermatherr powf sinf acosf _dsign sqrtf _dclass

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fputc __acrt_iob_func __stdio_common_vsprintf __p__commode _set_fmode fflush __stdio_common_vsscanf _wfopen fclose fgetc fseek fwrite ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

strncpy strncmp _stricmp strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoll atof strtod strtoull

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale