palforge_[unknowncheats[.]me]_[.]zip

Resubmissions

18/07/2026, 14:02

260718-rb8b5sgv6w

18/07/2026, 14:00

260718-rbaqwac12n3

Sharing

Copy URL Twitter E-mail

General

Target
palforge_[unknowncheats.me]_.zip
Size 630KB
Sample260718-rb8b5sgv6w
SHA256 50808dc2a5ed308864a4909d122ff93c0e7dbd7f490c41e5bd72e53ee238cd15
MD5 f824f3a621bf29279e4cf4057ed99ec7
SHA1 e1f2db3e452c01102740d592e1632aebb61bfd08
SHA512 b2f084a9183328f2213461358c7607bbaee92e4dabd587e3a29c2acc1a4e5cdca39b2375584d5ca4eb1df6baa97c249fc2e7c8e3b774f3b1ba47e9c1da61dcbd
SSDEEP 12288:33oDQ4jtU1X2VwoxLg0S5Oum1WZfMX/Q9lLIh1Q2yoyGFykS:oDQ4jtI47w5ZUvklLIhmrfGRS
TLSH
T108D423761C6815021998403BBCD2EA592F583823187D974EAF5F23CD6CF88A933FF916
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PalForge.dll
unpack001/PalLauncher.exe

File Explorer

palforge_[unknowncheats.me]_.zip

.zip 630KB
PalForge.dll

.dll 1.4MB
PalLauncher.exe

.exe 29KB

palforge_[unknowncheats.me]_.zip

SHA256 50808dc2a5ed308864a4909d122ff93c0e7dbd7f490c41e5bd72e53ee238cd15
MD5 f824f3a621bf29279e4cf4057ed99ec7
SHA1 e1f2db3e452c01102740d592e1632aebb61bfd08
SHA512 b2f084a9183328f2213461358c7607bbaee92e4dabd587e3a29c2acc1a4e5cdca39b2375584d5ca4eb1df6baa97c249fc2e7c8e3b774f3b1ba47e9c1da61dcbd
SSDEEP 12288:33oDQ4jtU1X2VwoxLg0S5Oum1WZfMX/Q9lLIh1Q2yoyGFykS:oDQ4jtI47w5ZUvklLIhmrfGRS
TLSH
T108D423761C6815021998403BBCD2EA592F583823187D974EAF5F23CD6CF88A933FF916
MD5 SHA1 SHA512 SSDEEP TLSH

PalForge.dll

IMPHASH d8497cc1c900d94c8d3ff7c2cdefdd23
SHA256 4d0597dc7ba65b65106743afbadd70c2045f9e07725bdf4629c0d057a4469bba
MD5 5798006b64d2802376f7d155962d7742
SHA1 6648e9e358ada4c7f26d246ad9e6fe8ec9f59578
SHA512 ad657ede72978cb014d7a9d05a22a3d71f8f849ae94ed3b0d8d6bf34b22c331fd3f6167245cd2585e3fac6572147c893149516f9da6ad38c6cf35645dd255fba
SSDEEP 24576:VNEuUFOvAKJQAT7g0BaoxcM/3A+nNixWY5Zh5PwRoPcWfd84RIE+m4uQJSpvoWwN:L3AId73l2WY/3nxJ6WT9hIKCNo90OYzw
TLSH
T1A1657D4D76B405B8D0EAD0B9CBC66227E53230564372A9F33BE08795AFB93F01636D16
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1106848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Shadow\Downloads\Palworld(0.4.14.65422)\bin\PalForge.pdb

kernel32

GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress QueryPerformanceCounter VirtualFree VirtualAlloc GetSystemInfo VirtualQuery HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot Sleep HeapReAlloc CloseHandle HeapAlloc CreateThread GlobalLock GetCurrentProcessId FlushInstructionCache SetThreadContext OpenThread SetConsoleCtrlHandler SetConsoleTextAttribute SetConsoleTitleA GetStdHandle FreeConsole GetConsoleWindow AllocConsole K32GetModuleFileNameExA DisableThreadLibraryCalls InitializeSListHead GetSystemTimeAsFileTime WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleHandleA FreeLibraryAndExitThread WideCharToMultiByte GlobalFree GlobalAlloc GetThreadContext MultiByteToWideChar GetModuleHandleW GetModuleFileNameA

user32

GetKeyNameTextA MapVirtualKeyA GetWindowRect GetClassNameA GetWindowTextA CallWindowProcW SetWindowLongPtrW ShowWindow DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture SetCapture GetClientRect ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW GetAsyncKeyState SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard

msvcp140

_Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency _Thrd_yield _Query_perf_counter ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z _Mtx_lock _Mtx_unlock ?always_noconv@codecvt_base@std@@QEBA_NXZ _Thrd_join ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memcpy memmove memset __current_exception __current_exception_context __C_specific_handler _CxxThrowException __std_type_info_destroy_list strchr strstr __std_terminate __std_exception_copy __std_exception_destroy memchr

api-ms-win-crt-stdio-l1-1-0

fgetc fclose freopen_s _wfopen fflush fwrite fseek __acrt_iob_func __stdio_common_vsprintf ftell __stdio_common_vfprintf fgetpos setvbuf ungetc __stdio_common_vswprintf __stdio_common_vsprintf_s fputc __stdio_common_vsscanf _get_stream_buffer_pointers _fseeki64 fread fsetpos

api-ms-win-crt-heap-l1-1-0

free calloc _callnewh malloc

api-ms-win-crt-convert-l1-1-0

atoi strtoul atof strtod strtof strtol

api-ms-win-crt-string-l1-1-0

strncpy strncmp wcslen isdigit strlen tolower strncpy_s strcmp toupper _strdup

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

terminate _errno _initterm_e _initterm _cexit _beginthreadex _crt_atexit _execute_onexit_table _register_onexit_function _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

floorf sinf sqrt logf sqrtf log fmodf powf acosf atan2f ceilf cosf pow

PalLauncher.exe

IMPHASH abb6f547a8209431223b184ba08bfd0c
SHA256 f968ceb5ed19328b3646d8e04adb6d74cc7468e01a00c81e3d0048cfcecfb371
MD5 003920d604c757fb02c24a379f0347c5
SHA1 f9069e4f704a1fbd7abd3dcd3fbf0ad8d9bba6c8
SHA512 695c6cd53a0272f562181f608222a0402bf754b5aeef840f1dfff53089cd84d8094e6e75f8c0044611f7624df318695a7f85e0b3f10b1ed6e9dcb2415d9d04a7
SSDEEP 384:M+piUjHnPk5Yd7XQSu1ZM7wE+suZ1I0CaY7yRuZoijtBKYkOlCtNRuZoijtBKYke:x4Umn1y7dBuZ1IIS3G0xvN
TLSH
T163D25329CD6BA56FD35D8CB8D9034C05DD52ACD7CBD1B9C7AB800CD70CA5AE4AB39206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Shadow\Downloads\Palworld(0.4.14.65422)\bin\PalLauncher.pdb

kernel32

FormatMessageA LocalFree GetModuleFileNameA CreateToolhelp32Snapshot Process32FirstW CloseHandle Process32NextW Sleep VirtualAllocEx WriteProcessMemory VirtualFreeEx CreateRemoteThread LoadLibraryA WaitForSingleObject GetExitCodeThread OpenProcess GetLastError GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW InitializeSListHead

user32

GetWindowThreadProcessId IsWindowVisible GetWindow MessageBoxA EnumWindows

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memcpy _CxxThrowException __current_exception __current_exception_context memmove __std_exception_destroy __std_exception_copy __C_specific_handler

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _exit _set_app_type _initterm_e _initterm _c_exit _register_onexit_function _crt_atexit terminate _seh_filter_exe _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _initialize_onexit_table _cexit exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

palforge_[unknowncheats.me]_.zip

PalForge.dll

kernel32

user32

msvcp140

d3d11

imm32

d3dcompiler_47

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

generic

PalLauncher.exe

kernel32

user32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic