cheat[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cheat.exe
Size 1.0MB
Sample260815-a5mtvsda64
SHA256 1233e76ea63866340aca4c8b887df4134c5fa0e741ce9440c3f47e24adfa1ec5
MD5 de34ff500c8a600e3a7643d4e17b872d
SHA1 05d8018199d5740744992d27c8dbe3a1d23336f6
SHA512 3270cbb88bf318b9a7d0ce55480fc451e5418145f146b93e580b64f1d79e6bec97568a3db0ada1be8a648ed8a4a4d07010cfdff9ca979d11a64bc695fa5114ae
SSDEEP 24576:roNoDz8gUyKflvBm4PdeOlGP1LnKNMGcjMZzUfiu3akcvS:DX8jfLm6AEbzLu3vcv
TLSH
T1A635D080F992A0B2C38001B4B5BE3B3F5D7D5C18876469C3F3D45D6A99B02D127FAB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cheat.exe

File Explorer

cheat.exe

.exe 1.0MB

cheat.exe

IMPHASH 6b65f404a348b2b91e49957c0874c3d9
SHA256 1233e76ea63866340aca4c8b887df4134c5fa0e741ce9440c3f47e24adfa1ec5
MD5 de34ff500c8a600e3a7643d4e17b872d
SHA1 05d8018199d5740744992d27c8dbe3a1d23336f6
SHA512 3270cbb88bf318b9a7d0ce55480fc451e5418145f146b93e580b64f1d79e6bec97568a3db0ada1be8a648ed8a4a4d07010cfdff9ca979d11a64bc695fa5114ae
SSDEEP 24576:roNoDz8gUyKflvBm4PdeOlGP1LnKNMGcjMZzUfiu3akcvS:DX8jfLm6AEbzLu3vcv
TLSH
T1A635D080F992A0B2C38001B4B5BE3B3F5D7D5C18876469C3F3D45D6A99B02D127FAB5A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

625402

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

CryptReleaseContext OpenServiceA QueryServiceStatusEx CryptGetHashParam RegOpenKeyExA CryptDestroyHash CryptHashData CryptCreateHash OpenSCManagerA RegQueryValueExA CloseServiceHandle RegCloseKey CryptAcquireContextA CryptEncrypt CryptImportKey CryptDestroyKey CryptGenRandom

ws2_32

WSAStartup WSACleanup WSAGetLastError socket __WSAFDIsSet getaddrinfo WSASetLastError recv send bind closesocket setsockopt ntohs htons getsockopt getsockname connect getpeername freeaddrinfo accept listen recvfrom ioctlsocket gethostname htonl ntohl WSAIoctl sendto select

crypt32

CertFreeCertificateContext

wldap32

ord60 ord211 ord41 ord27 ord46 ord143 ord26 ord50 ord301 ord200 ord30 ord79 ord22 ord32 ord35 ord33

normaliz

IdnToAscii

d3d9

Direct3DCreate9

kernel32

IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExpandEnvironmentStringsA IsDebuggerPresent AcquireSRWLockExclusive ReadFile GetStartupInfoW GetModuleHandleW GetFileType GetStdHandle WaitForSingleObjectEx FormatMessageA VerifyVersionInfoA GetSystemDirectoryA SleepEx DeleteCriticalSection ReleaseSRWLockExclusive WakeAllConditionVariable PeekNamedPipe SleepConditionVariableSRW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetLastError GetLastError GetTickCount64 QueryPerformanceCounter FreeLibrary VerSetConditionMask IsDBCSLeadByte QueryPerformanceFrequency GetCurrentProcessId GetCurrentThreadId InitializeSListHead LoadLibraryA WaitForMultipleObjects GetLocaleInfoA GlobalUnlock OutputDebugStringA WideCharToMultiByte GlobalLock GlobalFree GetSystemFirmwareTable GetModuleFileNameA SizeofResource Process32First GetFileAttributesExA WriteProcessMemory GetCurrentProcess TerminateProcess FindResourceA GetEnvironmentVariableA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetExitCodeThread Sleep GetTempPathA LockResource DeleteFileA Process32Next CloseHandle LoadResource GetProcAddress VirtualAllocEx CreateRemoteThread CreateProcessA GetSystemTimeAsFileTime CreateDirectoryA VirtualFreeEx GetTickCount GlobalAlloc

user32

GetKeyState GetMessageExtraInfo TrackMouseEvent ClientToScreen GetCapture GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetDC IsWindowUnicode LoadCursorA ReleaseCapture SetProcessDPIAware UpdateWindow PostQuitMessage PeekMessageA GetClientRect LoadIconA TranslateMessage SetLayeredWindowAttributes MessageBoxA ShowWindow GetActiveWindow RegisterClassExW UnregisterClassW GetSystemMetrics ScreenToClient CreateWindowExW PostMessageA SetWindowPos DestroyWindow GetWindowRect DispatchMessageA MonitorFromPoint DefWindowProcW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos ReleaseDC SetCursorPos

gdi32

GetDeviceCaps

shell32

ShellExecuteW

ole32

CreateStreamOnHGlobal

msvcp140

_Mtx_unlock _Thrd_join _Thrd_detach _Thrd_id _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Throw_Cpp_error@std@@YAXH@Z

gdiplus

GdiplusStartup GdipGetImageHeight GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDisposeImage GdipFree GdipBitmapLockBits GdipGetImageWidth GdiplusShutdown

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140

memset strchr strrchr __std_terminate memmove __std_exception_copy __std_exception_destroy __CxxFrameHandler3 strstr memchr _CxxThrowException __current_exception __current_exception_context _except_handler4_common _set_se_translator memcpy

api-ms-win-crt-stdio-l1-1-0

_lseeki64 __p__commode _read feof ferror fputs _set_fmode fgets _write __stdio_common_vsscanf _wfopen _close _open fflush __acrt_iob_func fread __stdio_common_vfscanf fputc __stdio_common_vsprintf fwrite __stdio_common_vfprintf fseek fclose fopen ftell

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _initterm_e _beginthreadex exit _initialize_narrow_environment _invoke_watson _get_narrow_winmain_command_line _exit _initterm _configure_narrow_argv _initialize_onexit_table _errno _controlfp_s _register_onexit_function system _crt_atexit _cexit terminate _register_thread_local_exe_atexit_callback _c_exit _getpid strerror __sys_nerr

api-ms-win-crt-string-l1-1-0

isprint islower isupper isalnum tolower isspace isdigit strpbrk isxdigit isalpha _strdup wcscat_s strncmp strncpy _stricmp isgraph

api-ms-win-crt-convert-l1-1-0

strtoll strtoul strtol atoi atol

api-ms-win-crt-heap-l1-1-0

realloc free _set_new_mode _callnewh malloc calloc

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-filesystem-l1-1-0

_stat64 _fstat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_libm_sse2_sin_precise _libm_sse2_cos_precise _libm_sse2_acos_precise _CIfmod _libm_sse2_sqrt_precise __setusermatherr ceil

api-ms-win-crt-locale-l1-1-0

_configthreadlocale