R6Dmp_[unknowncheats[.]me]_[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
R6Dmp_[unknowncheats.me]_.exe
Size 46KB
Sample260724-dmembaec72
SHA256 05f2a770a664f5ac2ea73c6bf961c9a8d9cf52200d5ee34e90b200c9ec67681c
MD5 09819c349176cfd63b354595708b3161
SHA1 e3f607d0633b8ce81d7368cedb09f040a459a1bc
SHA512 3c6664cfe2da7170d4a8f6ed9386269bd855143e79d75bd4950aeb5cdb500c0fee50a15900bec5fbcf4f3ec51bf357f2ae12c7a506b89bbadf68851bdd4834d2
SSDEEP 384:3lTmCJjJWCcb5x6mFHeNkigeTyYjHgGgMTXoZ3k1:/JtfcsnyYjPoZ3
TLSH
T1B82309825B5990B3D13B91BECEE2071991617160037327CF7718876E0FA36E8A83F68D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
R6Dmp_[unknowncheats.me]_.exe

File Explorer

R6Dmp_[unknowncheats.me]_.exe

.exe 46KB

R6Dmp_[unknowncheats.me]_.exe

IMPHASH 34b1e46cb567eb666b99b4943d5e7434
SHA256 05f2a770a664f5ac2ea73c6bf961c9a8d9cf52200d5ee34e90b200c9ec67681c
MD5 09819c349176cfd63b354595708b3161
SHA1 e3f607d0633b8ce81d7368cedb09f040a459a1bc
SHA512 3c6664cfe2da7170d4a8f6ed9386269bd855143e79d75bd4950aeb5cdb500c0fee50a15900bec5fbcf4f3ec51bf357f2ae12c7a506b89bbadf68851bdd4834d2
SSDEEP 384:3lTmCJjJWCcb5x6mFHeNkigeTyYjHgGgMTXoZ3k1:/JtfcsnyYjPoZ3
TLSH
T1B82309825B5990B3D13B91BECEE2071991617160037327CF7718876E0FA36E8A83F68D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4291

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\Rainbow6Proj Legit New\Offset_Dumper_[www.unknowncheats.me]_ (1)\Offset_Dumper\x64\Release\Offset_Dumper.pdb

kernel32

CloseHandle GetLastError SetLastError Sleep OpenProcess ReadProcessMemory CreateToolhelp32Snapshot Process32First Process32Next Module32First GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA AllocConsole GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW

user32

GetWindowThreadProcessId EnumWindows

msvcp140

?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ

vcruntime140

__std_type_info_destroy_list memset __CxxFrameHandler3 __std_exception_destroy __std_exception_copy _CxxThrowException __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

fopen __stdio_common_vfprintf __p__commode _set_fmode fclose _open_osfhandle __stdio_common_vsprintf __acrt_iob_func

api-ms-win-crt-math-l1-1-0

_fdopen __setusermatherr

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit __p___argv _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit terminate __p___argc _exit exit _initterm_e _initterm _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _get_initial_narrow_environment

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

_stricmp

Name

.text

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

344B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

R6Dmp_[unknowncheats.me]_.exe

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

generic