cheat[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cheat.exe
Size 22.6MB
Sample260809-y2c29acc89
SHA256 c6fbb548272e6020ae730b14dc386f86c159d759eb04b9dbcbb00d51607707ba
MD5 319ff342f52356461cee2bf1895f1381
SHA1 8b722908968c6b43ee53e22285aa1b912b9462ed
SHA512 35f087bb59d9d84087e45c4c526245452e2ded2629d0a5c664363d4a2768844a716bc71e73b941a4298cbff4b8cea116ea8814fb6361378c77f6b8e3d65a8fb7
SSDEEP 393216:HvjqSk0sWPtwvqTVnR2ib7g+42tV3fA31IqAysEfYkg0C:HvDdjlNb7gzS1fAKqGQYr
TLSH
T1C03733A59BDF50B3FD34D6FDC432C1C9A7217E4284B26F3909889A95D9CB100BACE356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cheat.exe

File Explorer

cheat.exe

.exe 22.6MB

cheat.exe

IMPHASH 5f5c4d3663cd5c9660ea403fe416cb2f
SHA256 c6fbb548272e6020ae730b14dc386f86c159d759eb04b9dbcbb00d51607707ba
MD5 319ff342f52356461cee2bf1895f1381
SHA1 8b722908968c6b43ee53e22285aa1b912b9462ed
SHA512 35f087bb59d9d84087e45c4c526245452e2ded2629d0a5c664363d4a2768844a716bc71e73b941a4298cbff4b8cea116ea8814fb6361378c77f6b8e3d65a8fb7
SSDEEP 393216:HvjqSk0sWPtwvqTVnR2ib7g+42tV3fA31IqAysEfYkg0C:HvDdjlNb7gzS1fAKqGQYr
TLSH
T1C03733A59BDF50B3FD34D6FDC432C1C9A7217E4284B26F3909889A95D9CB100BACE356
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

43500

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\Projects\WinRAR\SFX\build\sfxzip64\Release\sfxzip.pdb

comctl32

ord17

kernel32

SetFileAttributesW GetFullPathNameA MoveFileA DeleteFileA DeleteFileW CreateDirectoryA CreateDirectoryW FindClose FindNextFileA FindFirstFileA FindNextFileW FindFirstFileW GetTickCount WideCharToMultiByte MultiByteToWideChar GetVersionExA GlobalAlloc lstrlenA GetModuleFileNameA FindResourceA GetModuleHandleA HeapAlloc GetProcessHeap HeapFree HeapReAlloc CompareStringA ExitProcess SetFileAttributesA GetNumberFormatA lstrcmpiA GetProcAddress DosDateTimeToFileTime GetDateFormatA GetTimeFormatA FileTimeToSystemTime FileTimeToLocalFileTime ExpandEnvironmentStringsA WaitForSingleObject SetCurrentDirectoryA Sleep GetTempPathA MoveFileExA GetModuleFileNameW SetEnvironmentVariableA GetCommandLineA LocalFileTimeToFileTime SystemTimeToFileTime IsDBCSLeadByte GetCPInfo FreeLibrary LoadLibraryA GetCurrentDirectoryA GetFileAttributesW GetFileAttributesA WriteFile SetFileTime GetStdHandle ReadFile CreateFileW SetLastError CreateFileA GetFileType SetFilePointer CloseHandle SetEndOfFile GetLastError GetLocaleInfoA

user32

LoadStringA CharToOemBuffA OemToCharBuffA CharLowerA wvsprintfA FindWindowExA GetClassNameA ReleaseDC GetDC SendMessageA wsprintfA SetDlgItemTextA EndDialog DestroyIcon SendDlgItemMessageA GetDlgItemTextA DialogBoxParamA IsWindowVisible WaitForInputIdle GetSysColor PostMessageA SetMenu SetFocus SetWindowPos LoadIconA CharToOemA OemToCharA MapWindowPoints CreateWindowExA UpdateWindow SetWindowTextA LoadCursorA RegisterClassExA SetWindowLongPtrA GetWindowLongPtrA DefWindowProcA PeekMessageA GetMessageA DispatchMessageA DestroyWindow GetClientRect CopyRect IsWindow MessageBoxA ShowWindow GetDlgItem GetWindowTextA GetSystemMetrics GetWindow GetWindowLongA SetWindowLongA CharUpperA GetWindowRect LoadBitmapA GetParent EnableWindow TranslateMessage

gdi32

GetDeviceCaps CreateCompatibleDC GetObjectA CreateCompatibleBitmap SelectObject StretchBlt DeleteObject DeleteDC

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegSetValueExA

shell32

ShellExecuteExA SHFileOperationA SHGetFileInfoA SHGetSpecialFolderLocation SHGetMalloc SHBrowseForFolderA SHGetPathFromIDListA SHChangeNotify

ole32

CreateStreamOnHGlobal OleInitialize CoCreateInstance OleUninitialize CLSIDFromString

oleaut32

VariantInit