CheatHub[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CheatHub.exe
Size 1.6MB
Sample260626-bjmgmsgv2v
SHA256 aefd36dd359836016eb02d7ea84f252a6e482ad5253d37684d9e8dc316c57c88
MD5 2008ca06d9c4ee0588310123f45c4071
SHA1 0a7318b83cd8e26ab4b5efc973163c96ff48734e
SHA512 f915e6133b52b5fc5d6d0cfa6ca4f65aef1ce303cafc8db8725b55a4f085e6cf42873f0f9d50dfb95a8c358c16ed70bc4e2098b7047006b222230756913b78d8
SSDEEP 24576:Aiu9Lbe8qWaiivomyF2GK3fOHznLQPdjbj/tZnYk7xoX31iupvEaA0Euj4x:Av9f3piwmyF2izn8pbbHnL7xo1iupB
TLSH
T10A757C57769442F8D067D139C9469E86EAB374094F30ABCB03E847AA2F233D54E7E361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CheatHub.exe

File Explorer

CheatHub.exe

.exe 1.6MB

CheatHub.exe

IMPHASH a0ecafadeb7ec353b9553ff0305e3d2b
SHA256 aefd36dd359836016eb02d7ea84f252a6e482ad5253d37684d9e8dc316c57c88
MD5 2008ca06d9c4ee0588310123f45c4071
SHA1 0a7318b83cd8e26ab4b5efc973163c96ff48734e
SHA512 f915e6133b52b5fc5d6d0cfa6ca4f65aef1ce303cafc8db8725b55a4f085e6cf42873f0f9d50dfb95a8c358c16ed70bc4e2098b7047006b222230756913b78d8
SSDEEP 24576:Aiu9Lbe8qWaiivomyF2GK3fOHznLQPdjbj/tZnYk7xoX31iupvEaA0Euj4x:Av9f3piwmyF2izn8pbbHnL7xo1iupB
TLSH
T10A757C57769442F8D067D139C9469E86EAB374094F30ABCB03E847AA2F233D54E7E361
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

472452

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\burne\OneDrive\Documents\GitHub\JJSploit-x-Xeno\build\CheatHub.pdb

kernel32

Process32NextW LoadLibraryA Process32FirstW CloseHandle CreateThread ExitProcess GetConsoleWindow AllocConsole SetConsoleTitleW GlobalAlloc GlobalLock GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter GetProcAddress VirtualProtectEx ReadProcessMemory VirtualQueryEx RtlCaptureStackBackTrace WriteConsoleW SetEndOfFile HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose CreateToolhelp32Snapshot HeapReAlloc SetConsoleCtrlHandler GetFileSizeEx GetConsoleOutputCP FlushFileBuffers ReadConsoleW GetConsoleMode SetFilePointerEx GetFileAttributesExW CreateProcessW GetExitCodeProcess GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue OpenProcess GetModuleHandleA FlsAlloc GetTempPathW HeapAlloc HeapFree WriteFile GetStdHandle ResumeThread ExitThread ReadFile GetModuleHandleExW RaiseException RtlPcToFileHeader RtlUnwindEx WaitForSingleObject LoadLibraryW WaitForMultipleObjectsEx UnregisterWaitEx FreeLibraryAndExitThread GetTimeZoneInformation Sleep GetLastError FormatMessageW WideCharToMultiByte DuplicateHandle WaitForSingleObjectEx GetCurrentProcess SwitchToThread GetCurrentThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW EncodePointer DecodePointer MultiByteToWideChar CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait OutputDebugStringW GetThreadTimes FreeLibrary GetModuleFileNameW LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList RtlUnwind

user32

GetForegroundWindow GetWindowLongA SetWindowLongA GetAsyncKeyState GetActiveWindow RegisterClassExA FindWindowA PostQuitMessage UnregisterClassA PeekMessageA GetClientRect LoadIconA FindWindowW TranslateMessage SetLayeredWindowAttributes CreateWindowExA mouse_event GetKeyState GetCapture ClientToScreen SetCapture SetCursor ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId DispatchMessageA LoadCursorA DestroyWindow ShowWindow MessageBoxA MoveWindow DefWindowProcA

gdi32

CreateSolidBrush

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXCreateFontA D3DXCreateLine

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpQueryDataAvailable WinHttpConnect

imm32

ImmSetCompositionWindow ImmGetContext

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

304KB

Virtual Size

303KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CheatHub.exe

kernel32

user32

gdi32

dwmapi

d3d9

d3dx9_43

winhttp

imm32

generic