Release_[unknowncheats.me]_ (1).zip
- SHA256 a86b64da4f26970edd16dfae3ce7afdb0f6c03ba3e920353ed52cbff98afc811
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
upx_fivem.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
upx_fivem.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
upx_fivem.pdb
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
upx_fivem.pdb
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Release_[unknowncheats.me]_ (1).zip
- Size 3.1MB
- Sample260723-msxjraz1ft
- SHA256 a86b64da4f26970edd16dfae3ce7afdb0f6c03ba3e920353ed52cbff98afc811
- MD5 0fd3e6aef002d27cd7378082067d5386
- SHA1 85164fecd03b9f7923380db46714704ba2919c49
- SHA512 3a0c7f756bdd013d698eb7490afd991944aec4e2c5e83c82c404493f0b90af9ed63836098a47aad0572e983bd7af11addd7f738138a046c46bc0a095b57065c1
- SSDEEP 98304:eolMSyZCTEyyC7G4t9SWsDk3zrOxVNDP2mw5:eof0uEZC7t9SWuGrYj2h5
- TLSH T1E2E533FD51B7A0DAF7685000BA6B298D0C386CFFA4EDEE7A14B785B512C9A90155FC0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/upx_fivem.exe
File Explorer
-
Release_[unknowncheats.me]_ (1).zip.zip 3.1MB
-
upx_fivem.exe.exe 907KB
-
upx_fivem.pdb11.7MB
upx_fivem.exe
- IMPHASH 4c37c6defeff5b76b995c4603f1ddaac
- SHA256 8f2b4e07a3569c9f88351bfebe0ac749eea3772ab655d03d8899e3fbbba2b39f
- MD5 5705c9b7b052bf883b8f7a37acbe52dd
- SHA1 8f6ba0f8a7670357eddaeda13d5d073c61a834db
- SHA512 0a4bb45be7c04163ad04598e64abba9c6aa81f7325a418ef361b2f7fd09ef3ef0fd64e2c55ee40da902fe3b8adce88fd52ee4e66332b8a6bb5605c70208b674e
- SSDEEP 12288:BYLrh4EUaEHIHUaDgZj+Ioyir6bOQ3YWOi/0CoyZPK7sDc8:BY3hfUayYb8ZjlLwMOEai/0CxZPK7sD
- TLSH T15B15BF46B6A840F9D07B9135C5977A0BEA3238150B2086DB13F4566A3FA77F19F7E302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
442756
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\-\Desktop\5m_external\x64\Release\upx_fivem.pdb
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
VirtualProtect
TerminateProcess
CreateMutexA
ReleaseMutex
CreateThread
GetCurrentProcessId
IsDebuggerPresent
FindClose
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetTimeZoneInformation
GetFileType
SetFilePointerEx
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
ExitProcess
FlsGetValue
FlsAlloc
HeapAlloc
HeapFree
GetCommandLineW
WriteFile
GetStdHandle
GetModuleFileNameW
ReadFile
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
WakeAllConditionVariable
GetStartupInfoA
GetProcAddress
LoadLibraryA
GetLastError
GetCommandLineA
GetModuleHandleA
OutputDebugStringA
GetCurrentProcess
VirtualFreeEx
CreateRemoteThread
VirtualAllocEx
Sleep
ReadProcessMemory
VirtualProtectEx
CloseHandle
RtlUnwind
Process32Next
K32GetModuleFileNameExA
CreateToolhelp32Snapshot
OpenProcess
LCMapStringEx
WriteConsoleW
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
Module32First
Module32Next
Process32First
SetEndOfFile
FlsSetValue
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetCurrentThreadId
InitOnceComplete
InitOnceBeginInitialize
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
FindFirstFileExW
user32
GetWindowThreadProcessId
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
SetCapture
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
DispatchMessageA
GetWindowRect
LoadCursorA
DestroyWindow
PostMessageA
CallNextHookEx
UnregisterClassW
RegisterClassExW
ShowWindow
SetWindowLongA
SetWindowsHookExA
PeekMessageW
SetWindowDisplayAffinity
MessageBoxA
MoveWindow
UnhookWindowsHookEx
DefWindowProcA
SetLayeredWindowAttributes
SetFocus
TranslateMessage
SetCursor
SystemParametersInfoA
GetWindowLongPtrA
PostQuitMessage
FindWindowA
UpdateWindow
SetForegroundWindow
GetAsyncKeyState
GetForegroundWindow
advapi32
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
DuplicateTokenEx
SetThreadToken
LookupPrivilegeValueA
SetTokenInformation
RevertToSelf
CreateProcessAsUserA
PrivilegeCheck
shell32
ShellExecuteA
ole32
CoInitializeEx
d3dx9_43
D3DXMatrixTranspose
ntdll
ZwWriteVirtualMemory
ZwReadVirtualMemory
imm32
ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
Name
.text
Size
636KB
Virtual Size
636KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
158KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
79KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33140,
count=35, id=260, version=33140,
count=23, id=259, version=33140,
count=18, id=260, version=35207,
count=12, id=259, version=35207,
count=95, id=261, version=35207,
count=18, id=257, version=33140,
count=7, id=156, version=21202,
count=264, id=1, productName=Unmarked objects,
count=15, id=265, version=35217,
count=1, id=255, version=35217,
count=1, id=258, version=35217,
upx_fivem.pdb
- SHA256 908a441c2ebf5939e0a19479e9296f8504ad37a47e89ec6e9a5d36fc16417a87
- MD5 ebc887a1cf2b428d11a70a9ed950ecfc
- SHA1 ab44bd902418bf343703483e92a654f840f86b0a
- SHA512 5316e66c587490da8365e051474729f70d66cca2390aa1fedb2f1047fa043de7a7a3681d77750939c7ecf167f5af0947a157567dc14486caf22896768af7609a
- SSDEEP 98304:kv6kQtTN+QQW4XPlADNE4XnZ/EnDtkDpbKv0Bpk653rRn9xuqXJyY8RErLl/mDfL:ttTH7DsD+
- TLSH T1D3C68D91F2544D17DC6F12759297071C63AAA402EBCF2BEB858A933D5CC7344EFAE680
- MD5 SHA1 SHA512 SSDEEP TLSH