VASILE_[unknowncheats[.]me]_[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
VASILE_[unknowncheats.me]_.exe
Size 2.4MB
Sample260627-3ch97aes5p
SHA256 b7e11110784167ae83cd951f3034e2beee7c47393af79bf9f6283b9bd66626f7
MD5 acfcff45f574e91af373615d2917987c
SHA1 6cb2e19cabf3c48d240a10b157c1f541767be4ab
SHA512 660d75fc63595ec050cebced419e0f07678554af1a48eea3d80c9b2147b2119e6250b3df827d03d9e6a0dbaeeca09b9b8d6bcad7bb56168cb753e6408714c3a2
SSDEEP 49152:93lBRCL7/TzJPKwa/6r6Qgp65hQyzZzVvnGov:rXwaJg53zBVe8
TLSH
T1B8C54803A79509D4C1269178CAA7DB17DB733C34072006DB3FE16A6BEE726D1AE7E214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VASILE_[unknowncheats.me]_.exe

File Explorer

VASILE_[unknowncheats.me]_.exe

.exe 2.4MB

VASILE_[unknowncheats.me]_.exe

IMPHASH 18b16e35a2f1e828596ad647a7935e96
SHA256 b7e11110784167ae83cd951f3034e2beee7c47393af79bf9f6283b9bd66626f7
MD5 acfcff45f574e91af373615d2917987c
SHA1 6cb2e19cabf3c48d240a10b157c1f541767be4ab
SHA512 660d75fc63595ec050cebced419e0f07678554af1a48eea3d80c9b2147b2119e6250b3df827d03d9e6a0dbaeeca09b9b8d6bcad7bb56168cb753e6408714c3a2
SSDEEP 49152:93lBRCL7/TzJPKwa/6r6Qgp65hQyzZzVvnGov:rXwaJg53zBVe8
TLSH
T1B8C54803A79509D4C1269178CAA7DB17DB733C34072006DB3FE16A6BEE726D1AE7E214
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1439608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetConsoleWindow SetConsoleCursorPosition GetModuleHandleA FreeConsole CreateThread GetProcAddress MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter OutputDebugStringA SetThreadPriority OpenProcess CreateToolhelp32Snapshot Process32NextW GetCurrentThread Process32FirstW CloseHandle ReadProcessMemory K32EnumProcessModules lstrcmpiW GetModuleHandleW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId IsDebuggerPresent WakeAllConditionVariable IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ExitProcess GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GetLastError AreFileApisANSI GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree FillConsoleOutputAttribute Sleep SetCurrentConsoleFontEx GetStdHandle SetConsoleTitleA HeapAlloc ReadFile SetConsoleTextAttribute GetConsoleScreenBufferInfo FillConsoleOutputCharacterA SetConsoleCtrlHandler CreateFileA GetFileSizeEx GetModuleFileNameA

user32

SetWindowDisplayAffinity GetMonitorInfoW ScreenToClient ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture MonitorFromWindow GetMessageExtraInfo SetCursorPos GetCursorPos MoveWindow GetKeyState CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState RegisterClassExW UnregisterClassW GetSystemMetrics SetWindowPos GetWindowRect SendInput SetForegroundWindow EnableMenuItem AppendMenuW DestroyMenu TrackPopupMenu CreatePopupMenu PostMessageW PostQuitMessage SetLayeredWindowAttributes LoadIconW OpenClipboard SetWindowLongW FindWindowA LoadCursorW TranslateMessage RegisterClassW PeekMessageW DispatchMessageW ShowWindow DefWindowProcW CreateWindowExW UpdateWindow SetWindowLongPtrW DestroyWindow GetCapture

gdi32

CreateSolidBrush

shell32

ShellExecuteA Shell_NotifyIconW

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Thrd_join ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Mtx_lock _Mtx_unlock ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Random_device@std@@YAIXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr __std_terminate strchr _CxxThrowException __intrinsic_setjmp strrchr __C_specific_handler longjmp __current_exception_context __current_exception memcmp memchr memset memcpy memmove __std_exception_destroy __std_exception_copy

api-ms-win-crt-heap-l1-1-0

malloc realloc free _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc abort _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _errno _cexit terminate _beginthreadex _crt_atexit _invoke_watson _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe

api-ms-win-crt-time-l1-1-0

strftime _localtime64 _localtime64_s

api-ms-win-crt-string-l1-1-0

isprint strncmp isdigit tolower _stricmp strncpy strcmp isxdigit strcpy_s wcscpy_s isalnum

api-ms-win-crt-math-l1-1-0

__setusermatherr fmodf floorf cosf pow roundf asinf acosf _fdclass _dclass powf nearbyint log _dsign logf ldexp sinf ceilf sqrtf

api-ms-win-crt-stdio-l1-1-0

fflush fclose fseek __acrt_iob_func __p__commode _set_fmode __stdio_common_vfprintf fwrite __stdio_common_vsprintf __stdio_common_vsscanf _wfopen _get_stream_buffer_pointers _fseeki64 fsetpos setvbuf fgetpos fputc fread ftell ungetc fgetc __stdio_common_vsprintf_s

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-convert-l1-1-0

strtoll strtod atoi strtol strtoull atof

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv