ArgoCheatosu!FREEv2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ArgoCheatosu!FREEv2.exe
Size 746KB
Sample260806-epln3sff66
SHA256 c2c15b14d41b315e1052fdb05579c9c72abc30800163da6537f894bd4eaaa601
MD5 59f4e9d73a6c7f978b3aaf50f01d4c73
SHA1 17a24ac8582047b2d941b8689785944eb3e8adf3
SHA512 90ca248834fad06a6a2b278ca04130d376ceebdc05e30273ce5f12e2b552974880162c723b9e4c084ad7fc6a1cb54e3125a3748250bf97d2af582c1aa2e2e52a
SSDEEP 12288:AFNgF3WP8+5VrrhPYFHmZ9vUMaGmDpoQFr1UBy3cNiZnoVironitdhm38:AFSUbVXhJUMyDpoEr1My3oiZn/hm
TLSH
T1F2F49E4DB1BC51F9C07AD17DD687551BFA36380407309AEB23E45A642FA7BE09B7A302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ArgoCheatosu!FREEv2.exe

File Explorer

ArgoCheatosu!FREEv2.exe

.exe 746KB

ArgoCheatosu!FREEv2.exe

IMPHASH 9c8a53254b5c73cd05066c8ead150664
SHA256 c2c15b14d41b315e1052fdb05579c9c72abc30800163da6537f894bd4eaaa601
MD5 59f4e9d73a6c7f978b3aaf50f01d4c73
SHA1 17a24ac8582047b2d941b8689785944eb3e8adf3
SHA512 90ca248834fad06a6a2b278ca04130d376ceebdc05e30273ce5f12e2b552974880162c723b9e4c084ad7fc6a1cb54e3125a3748250bf97d2af582c1aa2e2e52a
SSDEEP 12288:AFNgF3WP8+5VrrhPYFHmZ9vUMaGmDpoQFr1UBy3cNiZnoVironitdhm38:AFSUbVXhJUMyDpoEr1My3oiZn/hm
TLSH
T1F2F49E4DB1BC51F9C07AD17DD687551BFA36380407309AEB23E45A642FA7BE09B7A302
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

569096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Argo\Desktop\wdwdwdw\builds\x64\Release\lame.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmGetWindowAttribute DwmExtendFrameIntoClientArea

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind VerSetConditionMask

shell32

SHBrowseForFolderW SHGetFolderPathW SHGetPathFromIDListW ShellExecuteW

kernel32

CreateFileW OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep Process32NextW GetCurrentThread QueryPerformanceFrequency Process32FirstW CloseHandle LoadLibraryW Module32FirstW GetProcAddress GetFileSize ReadProcessMemory GetModuleHandleW FreeLibrary WideCharToMultiByte Module32NextW QueryFullProcessImageNameW QueryPerformanceCounter IsWow64Process VirtualQueryEx GetExitCodeProcess GetCurrentThreadId GetTickCount GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetModuleHandleA ReleaseSRWLockShared LoadLibraryA VirtualAlloc GetFileInformationByHandleEx GetLastError AreFileApisANSI GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA LocalFree IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetThreadPriority VirtualFree ReadFile AcquireSRWLockExclusive AcquireSRWLockShared SleepConditionVariableSRW WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter ReleaseSRWLockExclusive GetCurrentProcess TerminateProcess GetLocaleInfoA IsProcessorFeaturePresent

user32

ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture IsWindowUnicode ReleaseCapture OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowLongW GetMessageW DefWindowProcW PostMessageW DestroyWindow GetAsyncKeyState DispatchMessageW ClientToScreen GetMessageExtraInfo SetWindowLongPtrW CreateWindowExW CallNextHookEx GetWindowLongPtrW PeekMessageW SetWindowDisplayAffinity MapVirtualKeyA UnhookWindowsHookEx SetLayeredWindowAttributes TranslateMessage LoadCursorW SetWindowsHookExW SetCursor SetWindowLongW PostQuitMessage UpdateWindow SetCursorPos GetCursorPos SendInput GetWindowThreadProcessId GetWindowRect IsWindowVisible GetKeyState MessageBoxW GetSystemMetrics GetKeyNameTextA IsWindow ShowWindow RegisterClassExW SetWindowPos GetWindowTextW SetProcessDPIAware EnumWindows GetClassNameW PostThreadMessageW GetClientRect

comdlg32

GetOpenFileNameW

advapi32

CryptReleaseContext CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam GetUserNameW CryptAcquireContextW

ole32

CoTaskMemFree

msvcp140

?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ

winmm

timeBeginPeriod timeEndPeriod

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr memset memcmp memmove strstr wcsstr _purecall __std_exception_copy _CxxThrowException __current_exception_context __current_exception __C_specific_handler __std_exception_destroy memcpy

api-ms-win-crt-stdio-l1-1-0

fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf __stdio_common_vsscanf fwrite fgetwc __stdio_common_vfprintf fgetc __stdio_common_vsprintf_s ungetwc __p__commode fputwc fclose fflush _set_fmode fputc _wfopen

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-convert-l1-1-0

strtoul strtol strtof

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback exit _initterm_e _beginthreadex _invoke_watson _get_wide_winmain_command_line _initialize_wide_environment terminate _configure_wide_argv _set_app_type _seh_filter_exe _initterm _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _errno _exit

api-ms-win-crt-string-l1-1-0

isspace strncpy_s toupper tolower _wcsicmp strcmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-math-l1-1-0

powf sqrtf lroundf ilogbf sinf roundf _dclass acosf logf __setusermatherr _fdclass fmodf cosf ceilf round scalbnf atan2f

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale