BILAL CHEATS[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BILAL CHEATS.exe
Size 8.0MB
Sample260804-2ezvaasamd
SHA256 8de784125b8fd047cb57b6bcad5111c5a70ca40f9e88e3a7de7470fc40f9d9c3
MD5 47b042551aba4bf005ec80214b7964ff
SHA1 fb4dd90cbc598a547d0d1df94cc703b1439f8fb0
SHA512 e797ef3f2efbf0de81add6a712cd3e215a720fb1b98bcc55c7a84fd059e5b5a647143af6083db7298d80a4aa211712ffbff28d30217c8f0dc3aabfb134a56156
SSDEEP 98304:5NX10do7jfrE6NXloW5x/K5kUE4R9Ztz7tObN+fS7/MYrtuVLm6QN4nlV:rJjB+WHVh4R9ZdtSMk/MYrtuVK6QNe
TLSH
T1FC86E012B184C28BF365B4B3B1A394B2D76D54926B5B4D03E62DD372E6930C0AF4B673
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BILAL CHEATS.exe

File Explorer

BILAL CHEATS.exe

.exe 8.0MB

BILAL CHEATS.exe

IMPHASH c900ff393eb595e41c327e1572d0e4b4
SHA256 8de784125b8fd047cb57b6bcad5111c5a70ca40f9e88e3a7de7470fc40f9d9c3
MD5 47b042551aba4bf005ec80214b7964ff
SHA1 fb4dd90cbc598a547d0d1df94cc703b1439f8fb0
SHA512 e797ef3f2efbf0de81add6a712cd3e215a720fb1b98bcc55c7a84fd059e5b5a647143af6083db7298d80a4aa211712ffbff28d30217c8f0dc3aabfb134a56156
SSDEEP 98304:5NX10do7jfrE6NXloW5x/K5kUE4R9Ztz7tObN+fS7/MYrtuVLm6QN4nlV:rJjB+WHVh4R9ZdtSMk/MYrtuVK6QNe
TLSH
T1FC86E012B184C28BF365B4B3B1A394B2D76D54926B5B4D03E62DD372E6930C0AF4B673
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

317088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\BILAL LOADER\examples\EXE\BILAL CHEATS.pdb

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameA Process32First WriteProcessMemory TerminateProcess WaitForSingleObject CreateFileW OpenProcess GetCommandLineA CreateToolhelp32Snapshot Sleep GetTempPathA Process32NextW DeleteFileA Process32Next Process32FirstW CloseHandle VirtualAllocEx ExitProcess CreateRemoteThread CreateProcessA CreateDirectoryA VirtualFreeEx GetTempFileNameA WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleHandleA WideCharToMultiByte GetModuleHandleW GetLastError AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId LoadLibraryA GetFileInformationByHandleEx GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess GlobalUnlock GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar SleepConditionVariableSRW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter

user32

DispatchMessageA ShowWindow SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetWindowLongA GetWindowRect DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW GetWindowLongA DefWindowProcA SetLayeredWindowAttributes TranslateMessage LoadIconA PeekMessageA PostQuitMessage UnregisterClassW UpdateWindow GetKeyState LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetSystemMetrics GetForegroundWindow RegisterClassExW

gdi32

CreateRoundRectRgn

shell32

ShellExecuteA SHGetFolderPathA

msvcp140

??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundA

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

iphlpapi

GetAdaptersInfo

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memcmp memchr strstr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

setvbuf _fseeki64 _get_stream_buffer_pointers _set_fmode __p__commode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fputc fgetc __stdio_common_vfprintf fseek fclose fflush fsetpos __acrt_iob_func ftell fgetpos ungetc

api-ms-win-crt-runtime-l1-1-0

exit _exit abort _c_exit _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _set_app_type _initterm_e _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table terminate _seh_filter_exe _register_onexit_function _invoke_watson _cexit system _wassert _beginthreadex _initterm _crt_atexit

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

_stricmp strcmp _strdup tolower _wcsicmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

acosf fmodf powf ceilf cosf sinf sqrtf __setusermatherr