eliteCheats cracked[.]rar

Resubmissions

17/08/2026, 17:14

260817-vsanzswsfv7

17/08/2026, 17:13

260817-vrqc2swsdx

Sharing

Copy URL Twitter E-mail

General

Target
eliteCheats cracked.rar
Size 11.6MB
Sample260817-vrqc2swsdx
SHA256 a43a7749f98030db2f34cddeb63cf5ee26d08010946ffbf19c937af0d3d90d07
MD5 1eb42a49aa787c0b9e5825f1a8f522be
SHA1 b0a59e1eea487d7ca20749caf81c7405c8662501
SHA512 317c633dbdcbf1bb6466d61e5fb67b393d62d18fd37bc56581d1aeb8b3720038f19a75aaccf755062109377629414474a4a4bc66eca16dfe896b890b78759432
SSDEEP 196608:+PYf0u4ObRHcLhMZ0SpDb3KrOf1UlSiMSUDhykyjVSzmQ/1+Q3eYbfP8sD:cu4ObZcfW/3Ky1UlTY9y2t8u
TLSH
T100C63359F013074579CC974A19AADD640A90F04F0BEDEA5263EEB4B83DD037A58C7B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/eliteCheats cracked/External.vmp.exe	vmprotect

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/eliteCheats cracked/External.vmp.exe
unpack001/eliteCheats cracked/crackedneege.exe

File Explorer

eliteCheats cracked.rar

.rar 11.6MB
eliteCheats cracked/External.vmp.exe

.exe 12.0MB
eliteCheats cracked/crackedneege.exe

.exe 57KB

eliteCheats cracked.rar

SHA256 a43a7749f98030db2f34cddeb63cf5ee26d08010946ffbf19c937af0d3d90d07
MD5 1eb42a49aa787c0b9e5825f1a8f522be
SHA1 b0a59e1eea487d7ca20749caf81c7405c8662501
SHA512 317c633dbdcbf1bb6466d61e5fb67b393d62d18fd37bc56581d1aeb8b3720038f19a75aaccf755062109377629414474a4a4bc66eca16dfe896b890b78759432
SSDEEP 196608:+PYf0u4ObRHcLhMZ0SpDb3KrOf1UlSiMSUDhykyjVSzmQ/1+Q3eYbfP8sD:cu4ObZcfW/3Ky1UlTY9y2t8u
TLSH
T100C63359F013074579CC974A19AADD640A90F04F0BEDEA5263EEB4B83DD037A58C7B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

idfk

eliteCheats cracked/External.vmp.exe

IMPHASH 97eb599c9ad09a716d07ca1362b0f732
SHA256 44c1edf1a83406694f390f6d5abe4ecb86c230215da9239e4c23a9c3fd44bbcd
MD5 5e5bdbe0454259015d15c74c4bcddd98
SHA1 13a83c79c8dc2902bd1080935681eff5eb08f67a
SHA512 337d195161a42d95ae865e20c42264a95de1411862a6d2e3e646b3b42a41f682bdce9b8ca487859dd1a56edea598e674037f0c3517c5ff12488ab49598c3faaa
SSDEEP 196608:Kyp+gdG3pe2W6QgfkW8ED/TsGGqF8PZGBkA3jYzFZGZW6kFur1boxHrW+3x:Ko+oG5NQgMCoDNhGBp3jayZuH
TLSH
T1FAD6336D618D375CC45EC8B09A33AD08B3B1562E4BF9F67A71DB76847ACB420E706B01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Password

idfk

Minor OS version

Major OS version

Entry point

20156770

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

GetProcessHeap FlsSetValue LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetClientRect GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

CreateRoundRectRgn

advapi32

CryptEncrypt

shell32

ShellExecuteA

ole32

CoInitializeEx

oleaut32

VariantClear

msvcp140

?__ExceptionPtrDestroy@@YAXPEAX@Z

imm32

ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

wininet

InternetCloseHandle

shlwapi

PathFileExistsA

urlmon

URLDownloadToFileA

ntdll

RtlCaptureContext

userenv

UnloadUserProfile

winhttp

WinHttpReceiveResponse

bcrypt

BCryptCloseAlgorithmProvider

crypt32

PFXImportCertStore

ws2_32

gethostname

psapi

GetModuleInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate

api-ms-win-crt-stdio-l1-1-0

fflush

api-ms-win-crt-runtime-l1-1-0

_set_app_type

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

isspace

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

fmodf

api-ms-win-crt-time-l1-1-0

strftime

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

localeconv

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

12.0MB

Virtual Size

12.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

212B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

eliteCheats cracked/crackedneege.exe

IMPHASH c63e0a028fb9ec27eb2fac754523173a
SHA256 9f05cb0e4e7f2da7a2ef32f44105612404addddf5eefc56d9836130747b37954
MD5 c9ea36dc773bc61655484011e0d3800c
SHA1 56ceb6f029714582c0d0591ffb4b332c1a7cc02f
SHA512 b585393e4ee40da17eb1337293a916fc6768039b142f4c480a4303ce562e8af01fb69649d5f43fb31fba3db8eeb6124fd8e1af605b2ba2afa761fd28f7c13c3b
SSDEEP 768:CPFgHoGMrx4KpI1BcIViwpjKl1rRoFMbaczlEZ7Dt6+TDufFxp4ejHM:CPFk4Qjgwpu1R7aczlq0ssFseY
TLSH
T183431B27CE1A40AFD35A9DB4D5070902DA72BC8647B1AACFD7814CE60F256D8EB3BD01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

idfk

Minor OS version

Major OS version

Entry point

29920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\0x21\Downloads\runtime-memory-patcher-2-main\x64\Release\RuntimePatcher.pdb

kernel32

SetConsoleMode Thread32Next Thread32First SuspendThread ResumeThread OpenProcess CreateToolhelp32Snapshot GetConsoleMode GetLastError GetStdHandle Process32FirstW CloseHandle GetSystemInfo Module32FirstW VirtualProtectEx Module32NextW SetConsoleTitleW OpenThread VirtualQueryEx GetCurrentProcess SetConsoleTextAttribute Process32NextW WriteProcessMemory Sleep GetCurrentThreadId SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAK@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __current_exception_context __current_exception __std_exception_copy __std_terminate memcpy memmove memset __C_specific_handler _CxxThrowException

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback exit terminate __p___argv _configure_narrow_argv _initialize_narrow_environment __p___argc _c_exit _initialize_onexit_table _beginthreadex _initterm _get_initial_narrow_environment _initterm_e _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _exit

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

eliteCheats cracked.rar

eliteCheats cracked/External.vmp.exe

d3d11

d3dcompiler_43

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp140

imm32

dwmapi

winmm

d3dx11_43

wininet

shlwapi

urlmon

ntdll

userenv

winhttp

bcrypt

crypt32

ws2_32

psapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

generic

eliteCheats cracked/crackedneege.exe

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic