Cheatshub Spoofer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Cheatshub Spoofer.exe
Size 2.5MB
Sample260718-wbpl9act3t
SHA256 fa713e35980e33ce05721596e056af9232ef87479f8eda7b5061d265614f5f73
MD5 c04a2de06f42b7c36e2af4a924a64095
SHA1 f6728c3c32cb44358e795abbbc397d40eab78a83
SHA512 efe7212809cfa980f55aa4537620e79f25df1968ae667401984f66742495ab1d2bf3d3c89e801c1d286173864af236ef9d5d754382aeb4d374bed6ce66950c60
SSDEEP 49152:45s5I58wDOw2z6/0Erv3nI/j2S9NerDudkuXPOJ:Q5POk898rDcrP4
TLSH
T174C5BE47E3A111DCC56BC5788652C706FB32BC6883209BC776CC4A561F27AE85E3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Cheatshub Spoofer.exe

File Explorer

Cheatshub Spoofer.exe

.exe 2.5MB

Cheatshub Spoofer.exe

IMPHASH ad17539f1db1f0000629e3f3fb00a5b0
SHA256 fa713e35980e33ce05721596e056af9232ef87479f8eda7b5061d265614f5f73
MD5 c04a2de06f42b7c36e2af4a924a64095
SHA1 f6728c3c32cb44358e795abbbc397d40eab78a83
SHA512 efe7212809cfa980f55aa4537620e79f25df1968ae667401984f66742495ab1d2bf3d3c89e801c1d286173864af236ef9d5d754382aeb4d374bed6ce66950c60
SSDEEP 49152:45s5I58wDOw2z6/0Erv3nI/j2S9NerDudkuXPOJ:Q5POk898rDcrP4
TLSH
T174C5BE47E3A111DCC56BC5788652C706FB32BC6883209BC776CC4A561F27AE85E3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

8OjMk1YNzqsz

Minor OS version

Major OS version

Entry point

754308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\pilip\Desktop\projects\cpp\Cheatshub Spoofer\x64\Release\Framework.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

Process32NextW Process32FirstW ExitProcess GetModuleHandleW CreateProcessA GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent GetFileSizeEx WriteFile GetTempPathW CreateFileW GetFileAttributesA DeleteFileW GetSystemTime GetEnvironmentVariableA HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW Sleep GetModuleFileNameW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetTempPathA CreateToolhelp32Snapshot FindClose IsProcessorFeaturePresent GetCurrentProcess CloseHandle CreateFileA GetModuleFileNameA ReadFile LoadLibraryW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WaitForSingleObject HeapAlloc FindFirstFileW

user32

GetCursorPos CloseClipboard OpenClipboard EmptyClipboard ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetKeyState GetClipboardData SetClipboardData SetCursorPos MoveWindow GetWindowLongW DefWindowProcW DestroyWindow ShowWindow GetWindowRect UpdateWindow FindWindowA PostQuitMessage LoadIconW TranslateMessage SetLayeredWindowAttributes MessageBoxA PeekMessageW SetWindowLongA DispatchMessageW RegisterClassExW UnregisterClassW GetSystemMetrics SendMessageW CreateWindowExW

advapi32

CryptCreateHash RegQueryValueExA RegCloseKey CryptReleaseContext CryptGetHashParam RegCreateKeyExA RegSetValueExA OpenProcessToken RegEnumKeyExA GetTokenInformation CryptAcquireContextA CryptDestroyHash CryptHashData RegOpenKeyExA

shell32

ShellExecuteW SHGetFolderPathA ShellExecuteExW

ole32

CoCreateInstance CoUninitialize CoInitializeSecurity CoInitializeEx

oleaut32

SysAllocString SysFreeString VariantClear

msvcp140

?good@ios_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Thrd_id _Thrd_join ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpCloseHandle

wininet

InternetOpenA InternetOpenUrlW InternetOpenUrlA InternetOpenW InternetCloseHandle InternetReadFile

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

iphlpapi

GetAdaptersInfo GetAdaptersAddresses

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy _CxxThrowException __intrinsic_setjmp __C_specific_handler __current_exception_context __current_exception memcmp memchr memset memmove memcpy longjmp strrchr strstr __std_terminate __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

ftell __acrt_iob_func _set_fmode fwrite __stdio_common_vswprintf_s _get_stream_buffer_pointers _fseeki64 _wfopen fsetpos ungetc __stdio_common_vsprintf setvbuf fgetpos fread fgetc fflush __stdio_common_vfprintf fclose fputc __stdio_common_vsscanf __stdio_common_vsprintf_s fseek __p__commode

api-ms-win-crt-runtime-l1-1-0

_get_narrow_winmain_command_line _initterm _initterm_e _exit terminate _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _cexit exit _errno signal _beginthreadex abort _configure_narrow_argv _crt_atexit _invoke_watson _register_onexit_function _initialize_onexit_table _set_app_type _initialize_narrow_environment

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-string-l1-1-0

isalnum strcpy_s _stricmp strncmp strlen strcmp strncpy _wcsicmp

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode realloc _callnewh

api-ms-win-crt-convert-l1-1-0

strtol wcstombs_s

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

sqrtf cosf fmodf acosf powf ceilf sinf __setusermatherr