Release(1).rar
- SHA256 2a8f4f58e2a29681ffa12f83b60f681d7ae9bbb50ab1b62ef6bf1f6e8286f0c3
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Cheat.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Cheat.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Launcher.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Release(1).rar
- Size 253KB
- Sample260622-wgpjfae16w
- SHA256 2a8f4f58e2a29681ffa12f83b60f681d7ae9bbb50ab1b62ef6bf1f6e8286f0c3
- MD5 70c59ed28a1ce243680f43c31aa1e1f7
- SHA1 f8d32c4eee1a62513bb6f1f5daa6e13ae445b041
- SHA512 11ff580d0ddbea925c28db39548b4032a64869b36d08f4c7e3020e8843d809093a3147f1afeb2c52499ff5b783c54e646b8e42ed46b39737a2f589080747ca8a
- SSDEEP 6144:M986gbmcj7sfBLCDc2OAW63f/t2u9hvFeQA:dtP4BCDcADd2uUQA
- TLSH T16B4423C920B02BDD2650571CE91D914F7A79E2F8375F98AD7E48477A6AEF9000EC04AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Cheat.dll unpack001/Launcher.exe
File Explorer
-
Release(1).rar.rar 253KB
-
Cheat.dll.dll 461KB
-
Launcher.exe.exe 97KB
Cheat.dll
- IMPHASH d122e5d1fea01e21672ec9b6fa6a93b2
- SHA256 4af5d2bebbd5a9d9e56fba3a3e93d1d4ccafec70bdb383a071435fe654ce5540
- MD5 0d16cd638178a641e37e2844e96e064c
- SHA1 9189b1c287ce9f126c82c09ff379f903b9646837
- SHA512 2c77a55ddefc88f3582c72569607eb1a62e4d1760ac9dc2e8fc945d1408d0c3dfcfb874b900f2ef28cb5af2575962e48bd4d3e0d8706a9c4f3a53f8b7714c155
- SSDEEP 6144:fYBZAtiTrmPqw49Jmvb9r3qbKBQAg37xxJB9cwwHZzte64Sd/N+THLMJswj5/KuB:fEA0Em0iAglBOpBte6vyHLMJswViun
- TLSH T17CA49E95B1A844F9C066A0389157BA0BE975385D0310DAC737E5E9B83FE37E4AB7B301
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
365032
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VirtualProtect
CreateThread
FreeConsole
AllocConsole
SetLastError
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitOnceBeginInitialize
InitOnceComplete
GetModuleHandleA
ReadFile
VirtualFree
GetFileSize
CloseHandle
CreateFileA
WriteFile
TerminateProcess
IsBadReadPtr
GetTickCount64
QueryPerformanceCounter
user32
CallWindowProcA
GetMessageExtraInfo
GetKeyState
LoadCursorW
SetCapture
SetCursor
GetClientRect
DestroyWindow
DefWindowProcA
CreateWindowExA
UnregisterClassA
SetWindowLongPtrA
RegisterClassExA
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
IsWindowUnicode
ReleaseCapture
SetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
MessageBoxA
GetCursorPos
shell32
ShellExecuteA
ole32
CoUninitialize
CoInitialize
CoCreateInstance
msvcp140
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
d3d11
D3D11CreateDeviceAndSwapChain
wininet
InternetOpenA
InternetReadFile
InternetOpenUrlA
InternetCloseHandle
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
__std_exception_destroy
__std_exception_copy
strstr
memcpy
memset
memchr
memcmp
_CxxThrowException
__std_type_info_destroy_list
__C_specific_handler
memmove
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
freopen_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
fread
_wfopen
fwrite
ftell
fflush
fseek
fclose
api-ms-win-crt-string-l1-1-0
strcmp
strncmp
strcpy_s
strncpy
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
abort
_invoke_watson
_beginthreadex
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-math-l1-1-0
cosf
logf
ceilf
atan2f
powf
sinf
sqrtf
fmodf
acosf
Name
.text
Size
357KB
Virtual Size
357KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=35207,
count=25, id=261, version=35207,
count=6, id=259, version=35207,
count=6, id=257, version=35207,
count=1, id=260, version=33145,
count=21, id=257, version=33145,
count=182, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=42, id=265, version=35227,
count=1, id=255, version=35227,
count=1, id=258, version=35227,
Launcher.exe
- IMPHASH ca86897df0624adf575899778718e801
- SHA256 1652756f7d43ee121b411c670a4b7cde221852118438304c7bb04f3eb4882870
- MD5 b391375fe54a6f8d44265a7c429ed6a7
- SHA1 a69437b2f409e312be791fd352567e69334a74d1
- SHA512 8afa17b10d2180cedb3d31139aaa407ec2d21319f5f02c0a9025e4a6859afeaa83c6d64240cf2ed71a15f67fb2b22893358c9fe707d1b3b4c82106935f6e3838
- SSDEEP 3072:/sjGXhFs/CtPJ7NhSPWtdRyMWPhpGuVf:/TXhFs/CASu
- TLSH T144A3192BE92610BAD17EC5B8C9935D02FB71BC8A03A5A7CB57414DD70E35AD0AE3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
61220
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\USER\source\work\Alya-StarRail\x64\Release\Injector.pdb
kernel32
CloseHandle
CreateProcessA
GetTickCount
IsWow64Process
VirtualFree
VirtualAlloc
DeleteFileA
GetModuleHandleA
LoadLibraryA
GetProcAddress
ReadProcessMemory
GetExitCodeProcess
FormatMessageA
GetLastError
GetFileAttributesA
CopyFileA
Sleep
ResumeThread
TerminateProcess
GetCurrentProcess
RtlAddFunctionTable
GetModuleFileNameA
GetLocaleInfoEx
FindClose
FindFirstFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
comdlg32
GetOpenFileNameA
advapi32
AllocateAndInitializeSid
LookupPrivilegeValueA
OpenProcessToken
FreeSid
CheckTokenMembership
AdjustTokenPrivileges
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
_CxxThrowException
__C_specific_handler
memset
memmove
__current_exception_context
memcmp
__std_terminate
__std_exception_copy
__std_exception_destroy
memcpy
api-ms-win-crt-stdio-l1-1-0
fread
fsetpos
ungetc
setvbuf
fgetpos
fwrite
_set_fmode
_get_stream_buffer_pointers
__p__commode
_fseeki64
__stdio_common_vfprintf
fgetc
fputc
fclose
fflush
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-runtime-l1-1-0
system
__p___wargv
__p___argc
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_wide_argv
terminate
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
exit
_initterm_e
_initterm
abort
_get_initial_wide_environment
_initialize_wide_environment
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
strcpy_s
strlen
strcmp
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35403,
count=10, id=260, version=35403,
count=34, id=261, version=35403,
count=6, id=257, version=35403,
count=7, id=257, version=33145,
count=206, id=1, productName=Unmarked objects,
count=2, id=265, version=35728,
count=1, id=255, version=35728,
count=1, id=258, version=35728,