14[.]40Cheat[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
14.40Cheat.dll
Size 354KB
Sample260708-sp43baas9n
SHA256 4c048b256c4ca31ac5cba0f015827078c696e91f152c911d7a866dc04a0204c8
MD5 2ae88521dd7da748080d7436daa31fc0
SHA1 d94a525bf396338a8d1fe8b5acbc94bf8704dd46
SHA512 75f8b009ec5ef4cdaca9662ba91d098ef0146f6e18f04b970d0285ec7f39f9dda2db663928d3efef67d6608c1ad69a3f83e22ddfce26c86dc36d67198a904558
SSDEEP 6144:O636tfVAjl2b1vAcZXWyzsrWvJ4+YMPEdgvA8txRrY1wPK:zKTAjCGcd5zsrWvJ4+ogvA8txRrW
TLSH
T1ED74392CB5A04585F076C579DC92C817FA72388247B096DB27E04E6A5F33AE4B97EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
14.40Cheat.dll

File Explorer

14.40Cheat.dll

.dll 354KB

14.40Cheat.dll

IMPHASH 63f0d09b12fe70092f66e40a49a5651d
SHA256 4c048b256c4ca31ac5cba0f015827078c696e91f152c911d7a866dc04a0204c8
MD5 2ae88521dd7da748080d7436daa31fc0
SHA1 d94a525bf396338a8d1fe8b5acbc94bf8704dd46
SHA512 75f8b009ec5ef4cdaca9662ba91d098ef0146f6e18f04b970d0285ec7f39f9dda2db663928d3efef67d6608c1ad69a3f83e22ddfce26c86dc36d67198a904558
SSDEEP 6144:O636tfVAjl2b1vAcZXWyzsrWvJ4+YMPEdgvA8txRrY1wPK:zKTAjCGcd5zsrWvJ4+ogvA8txRrW
TLSH
T1ED74392CB5A04585F076C579DC92C817FA72388247B096DB27E04E6A5F33AE4B97EF40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

bd:9b:1d:e6:31:04:43:03:e5:bb:60:ac:6f:33:4d:39:9e:7f:00:ae:29:a7:8a:5a:9e:2f:6c:a6:85:1e:cc:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=22178368,CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,STREET=NO.69\, LI-DE ST.\, ZHONGHE DIST.,L=New Taipei,ST=New Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 15, 2025

PE Signature issue

Digest

bd:9b:1d:e6:31:04:43:03:e5:bb:60:ac:6f:33:4d:39:9e:7f:00:ae:29:a7:8a:5a:9e:2f:6c:a6:85:1e:cc:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

Apr 15, 2025

Subject

Serial Number

16:32:e2:02:76:e1:b1:b1:41:55:54:c3:81:a0:99:ef

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 21, 2023 - Dec 19, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

243936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\thavi\Downloads\thavipah kernel inj\x64\Release\winmrm.pdb

kernel32

VirtualProtect VirtualAlloc Beep IsBadReadPtr GetModuleHandleA GetLocaleInfoEx FormatMessageA LocalFree CreateDirectoryW CreateFileW FindClose FindFirstFileW GetFileAttributesExW AreFileApisANSI CloseHandle GetLastError GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead

user32

SendInput GetAsyncKeyState GetCursorPos

msvcp140d

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

vcruntime140_1d

__CxxFrameHandler4

vcruntime140d

memcmp __std_exception_copy __std_exception_destroy memcpy memset __C_specific_handler _CxxThrowException __std_type_info_destroy_list __std_terminate memmove

ucrtbased

_initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _callnewh _malloc_dbg _free_dbg abort ___lc_codepage_func malloc free _get_stream_buffer_pointers _wassert _fseeki64 _initterm_e fsetpos ungetc setvbuf fgetpos strtoull __stdio_common_vsprintf _errno fwrite localeconv _lock_file _unlock_file fgetc __stdio_common_vsprintf_s strtoll fclose strtod _dsign mbstowcs _invalid_parameter fputc _CrtDbgReport fread sinf fflush cosf pow sqrtf

Sharing

General

Malware Config

Signatures

File Explorer

14.40Cheat.dll

PE Signature issue

PE Signature issue

kernel32

user32

msvcp140d

vcruntime140_1d

vcruntime140d

ucrtbased

generic