ad601310e1e7f0a91b0ae27accc81500b662fb33b157956e83a6d88d0d9786b6
- SHA256 ad601310e1e7f0a91b0ae27accc81500b662fb33b157956e83a6d88d0d9786b6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
чичи пз/Extreme Injector v3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
чичи пз/Extreme Injector v3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
чичи пз/Prototype5/MinHook.x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
чичи пз/Prototype5/MinHook.x64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
чичи пз/Prototype5/Prototype5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
чичи пз/Prototype5/Prototype5.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target ad601310e1e7f0a91b0ae27accc81500b662fb33b157956e83a6d88d0d9786b6
- Size 11.1MB
- Sample260727-x52pcach66
- SHA256 ad601310e1e7f0a91b0ae27accc81500b662fb33b157956e83a6d88d0d9786b6
- MD5 74b6af05255470d5ce48b96ee0c41408
- SHA1 c0e3f3a75bd5af900edafd77b7d9db1b38e0f7df
- SHA512 d12f67fabe5baef6497ee740b7022b76f4ec03e70371c7e9c06f8e83832c1c3430162ece37729dec0f7fb85f9d464208a8b6ec3cc9bd636781713432c6d5a997
- SSDEEP 196608:znf73O1FpJc37xxzY0zsXnWEvrZPIvKp+fHs4Xw5WBPuYW75gQ6TjcOL0YyrAHTQ:HopJIx1YvpVIvi+Hsj0tuoTjcO170
- TLSH T150C63374A8A7FA2214C4853B709C93E2E0183DD37FA9EB347944CC777888C69495BD6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/чичи пз/Extreme Injector v3.exe unpack001/чичи пз/Prototype5/MinHook.x64.dll unpack001/чичи пз/Prototype5/Prototype5.dll
File Explorer
-
ad601310e1e7f0a91b0ae27accc81500b662fb33b157956e83a6d88d0d9786b6.zip 11.1MB
-
чичи пз/Extreme Injector v3.exe.exe 1.9MB
-
чичи пз/Prototype5/MinHook.x64.dll.dll 15KB
-
чичи пз/Prototype5/Prototype5.dll.dll 12.7MB
-
чичи пз/settings.xml3KB
чичи пз/Extreme Injector v3.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
- MD5 ec801a7d4b72a288ec6c207bb9ff0131
- SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
- SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
- SSDEEP 49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9a:NNEVJyZlng4p2V
- TLSH T1B8956D997650B69EC89BC932CAE51C2CF760A07B571BC343A46325EC9D4DA9BCF041B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1955422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
чичи пз/Prototype5/MinHook.x64.dll
- IMPHASH 1421f4ff18ec2193e24871829e161edf
- SHA256 bddd6adaee8ab13eabaa7c73c97718cee1437db2054ca713ec7cc86e8002a300
- MD5 9ed71db2c29203e785fa532a6261e416
- SHA1 77e9aa544efce588b70b2f7841e80d77ea773cb3
- SHA512 ca3d81e5cab227d43ca06d9c66e22f51a5976e1fc541bc7a0b627acb97c02db6fcc1e1cd090b5f68d004844cc426ca17af57d20d542e84c9ff20d19557657678
- SSDEEP 192:8Ff48texc+160hdtQAq7XtwGR13mfupYp+XNJ3q8UJM5oaaBLKnMJA4yzTMW:/8V+k0rtQztwGR13mf3WNT5ILKzPMW
- TLSH T173627C047B2455B9E2AFC0B5E6338A2EE7B27A410A90D32D15B439582F977C1783D72E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
MH_ApplyQueued
MH_CreateHook
MH_CreateHookApi
MH_CreateHookApiEx
MH_DisableHook
MH_EnableHook
MH_Initialize
MH_QueueDisableHook
MH_QueueEnableHook
MH_RemoveHook
MH_StatusToString
MH_Uninitialize
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=260, version=24610,
count=2, id=259, version=24610,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=1, productName=Unmarked objects,
count=4, id=264, version=24629,
count=1, id=256, version=24629,
count=1, id=255, version=24629,
count=1, id=151,
count=1, id=258, version=24629,
чичи пз/Prototype5/Prototype5.dll
- IMPHASH 38f55a2d314b1450f11a925862c73a4d
- SHA256 12d4428c8df3bf566a172b2988bb09c6aec8e9089f87a4933ded636f07932588
- MD5 c60d22a6e3b639098d173161b9c76fc5
- SHA1 88e14e9fbc490ad39e7772bbea25d40c1f18fc02
- SHA512 13368392b01d2ed7da08f88836c5dd11021bbf846142855564bfa331dee1b3ff4c0339f735fd9409602b18fa1c9c7c879d6972f91fc9bfe852fa7f3345968642
- SSDEEP 196608:a68U1QWwYoyahjC0F/Hip1OY+3a64JGySo2u3MUTUMSL/cs0ixVklSFxwziSA+tS:suaZ1/Hi5+ftyrbGMSL0FyySFxHn2Ib
- TLSH T120D6E03FD7A2AC09C992213098A552656195344B0B5EE2FDB30FCB596FEC27B4E793C0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
556036
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\redfa\OneDrive\Skrivebord\GameHacking Projects\Public Cheats\Esd.CollabPZ\Prototypes\Prototype5\x64\Release\Prototype5.pdb
minhook.x64
MH_CreateHook
MH_EnableHook
MH_DisableHook
MH_Initialize
shell32
SHGetFolderPathW
ShellExecuteA
user32
ClientToScreen
ScreenToClient
LoadCursorA
CallWindowProcA
GetAsyncKeyState
SetWindowLongPtrA
EnumWindows
GetWindowThreadProcessId
CallNextHookEx
SetCursor
ReleaseCapture
GetCapture
GetKeyState
IsChild
EmptyClipboard
GetClipboardData
SetClipboardData
SetCapture
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
GetClientRect
GetForegroundWindow
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
CreateEventW
GetModuleHandleW
DisableThreadLibraryCalls
CreateThread
GetCurrentProcessId
Sleep
InitializeSListHead
CloseHandle
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
msvcp140
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
_Query_perf_counter
_Query_perf_frequency
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bios_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
opengl32
glViewport
glTexParameteri
glTexImage2D
wglGetCurrentDC
wglGetProcAddress
glPolygonMode
glPixelStorei
glIsEnabled
glGetString
glGetIntegerv
glGenTextures
glEnable
glDrawElements
glDisable
glScissor
glBindTexture
vcruntime140
__current_exception_context
__std_type_info_destroy_list
__current_exception
__C_specific_handler
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
memmove
memcpy
memchr
strstr
__std_terminate
memcmp
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strcmp
strncpy_s
strncpy
api-ms-win-crt-runtime-l1-1-0
_errno
_execute_onexit_table
_wassert
_initterm_e
_initterm
_cexit
_crt_atexit
_invalid_parameter_noinfo_noreturn
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
ferror
__stdio_common_vsprintf_s
fgetc
fgetpos
ungetc
setvbuf
feof
__acrt_iob_func
_get_stream_buffer_pointers
_wfopen
fputc
fclose
_fseeki64
fsetpos
__stdio_common_vfprintf
fflush
fread
fseek
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf
fwrite
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
log
atan2f
ceilf
acosf
logf
pow
cosf
_dclass
sinf
sqrtf
fmodf
powf
api-ms-win-crt-convert-l1-1-0
strtoull
strtol
strtod
atof
strtoll
api-ms-win-crt-filesystem-l1-1-0
_lock_file
remove
_unlock_file
api-ms-win-crt-locale-l1-1-0
localeconv
setWindowsHook
Name
.text
Size
660KB
Virtual Size
659KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
706KB
Virtual Size
706KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11.4MB
Virtual Size
11.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=260, productName=VS2015 UPD2 build 23918, version=23918,
count=6, id=257, version=31823,
count=23, id=261, version=31823,
count=8, id=260, version=31823,
count=4, id=259, version=31823,
count=16, id=257, version=29395,
count=3, id=257, version=24629,
count=258, id=1, productName=Unmarked objects,
count=8, id=261, version=31937,
count=1, id=256, version=31937,
count=1, id=255, version=31937,
count=1, id=258, version=31937,
чичи пз/settings.xml
- SHA256 8000990b8682b8bb1a79638012ee36b626429bd08599599c3194e1063c727f7a
- MD5 f6d73091ca7a6056e40ca8a24ef327b6
- SHA1 7e7a29a39a0c497e7c4e6e24458e16f6c34de9e8
- SHA512 d6acbdeec12341f3d59aa235ec85df5e94c919cb8861acfe600ccf9fe33dabee216e6bb80caac8ad4072a8bef03ebd8eaa906973c1014194d620e3ef247bb751
- TLSH T11A81C5D06BC7750CF6EF669F5339A507C86D40A2833238D1B46C521A6F2B0576B23D36
- MD5 SHA1 SHA512 TLSH