pipsi-nte-0.3.5.zip
- SHA256 1053ffc0cbb14fd42ab22aae23cd7266cc1124fb4765acb2734ef9407dd3e19e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Global/Cheat.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Global/Cheat.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral3
Sample
Global/Launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
Global/Launcher.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
General
- Target pipsi-nte-0.3.5.zip
- Size 1.6MB
- Sample260709-c77cdsb13l
- SHA256 1053ffc0cbb14fd42ab22aae23cd7266cc1124fb4765acb2734ef9407dd3e19e
- MD5 3782f98e285ad1ef16e581172545cf67
- SHA1 b97942e5eeed1ba38fbe5ebba217006704346fb9
- SHA512 3cb0827fa27bddd173c1b5b7b56bb0ee4be063f54f0c3566557cfc7c7ba86f32165310fe6a13fbeb125f406970228c4ecd286d95328922111c0987eb78796a97
- SSDEEP 24576:CRFen9IRILdUEBvGNhYBK58ZtizVmR9JRuWY+Fd8W2KgRkq+QKmPwN5nD9zgq8D2:C1RuUlTwc0Ce6W2PkhfNxBV8D3X2
- TLSH T1A2753303B85037F87099AC4A9FF9DABC2175395E2937E2C75CC9CC89DE06B664C66212
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Global/Cheat.dll unpack001/Global/Launcher.exe
File Explorer
-
pipsi-nte-0.3.5.zip.zip 1.6MB
-
Global/Cheat.dll.dll 1.8MB
-
Global/Launcher.exe.exe 721KB
Global/Cheat.dll
- IMPHASH 4eaae5b36487ee954656d9a4551e2449
- SHA256 f46dddab868a06746b41e74b29251fc78f5c39df07d6851a083a4de8daa70fd2
- MD5 1b04a5264248771ceec4efe0026908e9
- SHA1 257531a6a020cc8dd50fbc8ad3396442a776bacb
- SHA512 9de490f07af9d387e346f74bf282fa322d40fd2bba36faf4ef6fb1fdf877f027cdaaeb7c3afef082fffc4b64ad5b4aa6739c6de1b4a0d7b3db121382a0f503ba
- SSDEEP 24576:3gUwlhp0MbCrwxN/OlDupYs4iXnbqQumErHTVoVprlghu8G2oS4Ph+2wa0KfLWD2:xwlhppPN/ADupnXnOfzT2mpR2wozA24
- TLSH T13385AFA3E85164BAE87CA0349AD31B5FB27A7480572086C727C8252D5FD2BE01F77F85
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
591120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalLock
WideCharToMultiByte
GlobalUnlock
GlobalAlloc
GlobalFree
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
CreateEventW
GetLocaleInfoA
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibrary
IsDBCSLeadByte
GetProcessHeap
HeapAlloc
GetModuleHandleW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
LoadLibraryW
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetLastError
VirtualQuery
VirtualFree
VirtualProtect
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetCurrentProcess
GetLastError
ReadFile
CloseHandle
GetCurrentThread
WriteFile
CreateFileW
GetProcAddress
RtlPcToFileHeader
Sleep
GetTickCount64
user32
SetCapture
GetClipboardData
ReleaseCapture
IsWindowUnicode
TrackMouseEvent
GetMessageExtraInfo
GetClientRect
ScreenToClient
GetCursorPos
SetCursorPos
ClientToScreen
GetForegroundWindow
GetKeyState
LoadCursorW
SetCursor
GetKeyboardLayout
SetClipboardData
EmptyClipboard
CloseClipboard
GetCapture
OpenClipboard
SetWindowLongPtrW
DefWindowProcW
CallWindowProcW
shell32
ShellExecuteA
ShellExecuteW
msvcp140
?_Random_device@std@@YAIXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exceptions@std@@YAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
dxgi
CreateDXGIFactory1
imm32
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
strchr
memcpy
memset
memchr
__std_terminate
__std_exception_copy
__std_exception_destroy
memcmp
memmove
__std_type_info_destroy_list
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
__stdio_common_vsprintf
_wfopen
fclose
ftell
_get_stream_buffer_pointers
fgetpos
_fseeki64
fsetpos
setvbuf
ungetc
fputc
fgetc
fseek
__stdio_common_vsscanf
fflush
__acrt_iob_func
fread
fwrite
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
wcscpy_s
strcmp
wcsncmp
strncmp
strlen
strncpy
wcslen
api-ms-win-crt-convert-l1-1-0
strtof
atof
api-ms-win-crt-runtime-l1-1-0
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_errno
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-math-l1-1-0
logf
log
sqrt
sinf
powf
fmodf
pow
cosf
ceilf
atan2f
sqrtf
acosf
Name
.text
Size
592KB
Virtual Size
591KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
449KB
Virtual Size
448KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.z^?
Size
703KB
Virtual Size
703KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Global/Launcher.exe
- IMPHASH 2721d9b6b0980a8f1c2dbfec2fc6e6e6
- SHA256 8fae1221edcec2a848b25f1186d5a3a8b99688e5cbaaaf94011dc59b969ddd3e
- MD5 f00683dc2796aa18066ead45c749ee31
- SHA1 b4745033734b0593bb5e088a7622cae40fd4d486
- SHA512 9cbad06c193bddaf77ab6cf3c47caac1d5290bcb6d8e1fbbd403ce6e9c65f5c3ecd4cc1eb897e292de658ce897dee6d786c3acf31796141d1ec0350a2edad0e5
- SSDEEP 12288:rHOw9UCxcbm/3hK2aqzZwFBYKi0ChgH4Dp7ldfs/aqwECxxyoh8yVrO93wpGmoh1:rH72Wsm/Rhaqz0BFi0K33seECxJ8ia9p
- TLSH T1FEF40286039A43F6C0C20EB4D84E72D5F341B385486D4A9E1AC7FF464677A82C7A9F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
56880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
Sleep
CloseHandle
ReadProcessMemory
HeapAlloc
GetProcessHeap
ReadFile
GetStdHandle
SetConsoleMode
WaitForSingleObject
CreateFileW
CreateToolhelp32Snapshot
GetExitCodeThread
OpenProcess
GetLastError
Process32NextW
Process32FirstW
Module32FirstW
VirtualProtectEx
VirtualAllocEx
GetFileSize
CreateRemoteThread
Module32NextW
VirtualFreeEx
GetCurrentProcessId
TerminateProcess
WriteProcessMemory
GetConsoleMode
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
advapi32
GetTokenInformation
OpenProcessToken
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
_CxxThrowException
memset
memcpy
__std_exception_copy
__C_specific_handler
__current_exception
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
__p___argv
_initterm_e
_seh_filter_exe
__p___argc
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_set_app_type
system
_exit
exit
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
wcscmp
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.#0Y
Size
654KB
Virtual Size
654KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ