not a cheat loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
not a cheat loader.exe
Size 751KB
Sample260826-b3m8aabd47
SHA256 4d0b625be71c4ada00a5282ff2829dc089271987da5ca33afb861e7a362ab4c1
MD5 ef4289ff8fdbbef013e4b70e55db2886
SHA1 0a338bcd9114e9a83b2f51c971b6f4138743048b
SHA512 94e02bccae6599c2d07090c48fad5e8cc5a94dcadddb386fc2ee6c032ff396b19109154d89883c2e470e99a4f6a009510f6e56b8d7085c1e88c65f164869bc2b
SSDEEP 12288:3WXJgJeGouzkmzpmWmo1O1qW7Sq38xAVIQmrI9d/U+lslfLzjcYJB1iz9cAKZO9z:GWJdqUE8Oxm4qAVIHrypsRBmgZMfD
TLSH
T150F48B55AAE55A78C8A7F376E0C7423AB32A3E08D3B1B7D60C5D094538756A333E4336
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
not a cheat loader.exe

File Explorer

not a cheat loader.exe

.exe 751KB

not a cheat loader.exe

IMPHASH 454275cf4645839c438a28404e6d7f40
SHA256 4d0b625be71c4ada00a5282ff2829dc089271987da5ca33afb861e7a362ab4c1
MD5 ef4289ff8fdbbef013e4b70e55db2886
SHA1 0a338bcd9114e9a83b2f51c971b6f4138743048b
SHA512 94e02bccae6599c2d07090c48fad5e8cc5a94dcadddb386fc2ee6c032ff396b19109154d89883c2e470e99a4f6a009510f6e56b8d7085c1e88c65f164869bc2b
SSDEEP 12288:3WXJgJeGouzkmzpmWmo1O1qW7Sq38xAVIQmrI9d/U+lslfLzjcYJB1iz9cAKZO9z:GWJdqUE8Oxm4qAVIHrypsRBmgZMfD
TLSH
T150F48B55AAE55A78C8A7F376E0C7423AB32A3E08D3B1B7D60C5D094538756A333E4336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

149776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Hunter\OneDrive\source\NeroBurningROM\ia64\Bench\NeroBurningROM.ipdb

bcrypt

BCryptCloseAlgorithmProvider BCryptExportKey BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptEncrypt BCryptImportKeyPair BCryptGenRandom BCryptImportKey BCryptCreateHash

kernel32

HeapAlloc FindClose FreeEnvironmentStringsW EnterCriticalSection IsValidCodePage InitializeCriticalSectionAndSpinCount CreateSemaphoreW TlsSetValue UnhandledExceptionFilter InitializeCriticalSectionEx RtlVirtualUnwind VirtualProtectEx LoadLibraryA SetFilePointerEx GetModuleHandleA FreeLibrary GetEnvironmentStringsW FlsSetValue GetTickCount WaitForSingleObject InitializeSListHead VirtualProtect LCMapStringW HeapReAlloc RaiseException LeaveCriticalSection FlsGetValue GetFileAttributesExW FlsAlloc WriteFile WideCharToMultiByte GetCommandLineA GetModuleFileNameA GetModuleHandleW GetStartupInfoW LoadLibraryExW SetFilePointer HeapSize RtlCaptureContext GetCurrentProcessId CreateEventA SetUnhandledExceptionFilter CreateFileW GetSystemTimeAsFileTime SetEnvironmentVariableW GetTempFileNameA TlsFree GetConsoleMode TlsGetValue RtlLookupFunctionEntry GetCurrentProcess GetLastError GetStdHandle CompareStringW GetCPInfo OpenMutexA SetLastError GetOEMCP RtlPcToFileHeader IsDebuggerPresent GetExitCodeProcess GetFileType GetACP GetStringTypeW GetVersion TlsAlloc ReadConsoleW GetFileSizeEx FlsFree ResetEvent FindFirstFileExW SetStdHandle ReadFile ExitProcess WriteConsoleW AllocConsole MultiByteToWideChar RtlUnwindEx CreateProcessW IsProcessorFeaturePresent ResumeThread GetProcessHeap SetConsoleTextAttribute TerminateProcess TerminateThread DeleteCriticalSection FlushFileBuffers VirtualAlloc GetProcAddress GetSystemDirectoryW VirtualFree GetSystemDirectoryA GetSystemInfo HeapFree GetWindowsDirectoryA GetModuleHandleExW InterlockedFlushSList GetCommandLineW Sleep FindNextFileW EncodePointer GetConsoleOutputCP SetEndOfFile GetModuleFileNameW CloseHandle

advapi32

OpenProcessToken GetTokenInformation RegCreateKeyExW RegFlushKey RegEnumKeyExA CryptCreateHash RegOpenKeyW RegEnumValueW GetUserNameW SetNamedSecurityInfoA StartServiceW GetNamedSecurityInfoW RegDeleteValueA CryptGenRandom AdjustTokenPrivileges

ucrtbase

wcstombs_s strcpy_s strncpy_s strnlen strstr memcpy qsort strcmp strcat_s _aligned_free strchr strlen wcslen strncpy _aligned_malloc

user32

PostMessageW CreateWindowExA RegisterClassExA GetCursorPos DispatchMessageW GetKeyState SendMessageA

ws2_32

closesocket send WSAPoll closesocket WSACleanup inet_pton getaddrinfo WSASocketA recv htons send WSAGetLastError socket WSASocketW getsockopt WSAStartup recv select connect

shell32

ShellExecuteExA

msvcrt

_wfopen fread _aligned_malloc calloc _snprintf free _beginthreadex fwrite realloc

ntdll

RtlAnsiStringToUnicodeString RtlRandomEx RtlCaptureContext RtlInitAnsiString NtWaitForSingleObject NtResumeThread RtlFreeUnicodeString