ArgoCheatosu!FREEv2[.]2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ArgoCheatosu!FREEv2.2.exe
Size 753KB
Sample260828-3wy5ravalh
SHA256 f0dc2e4b018403e28987422aec6d2fe03a832392c60a0e854b6793c1739a7776
MD5 62e206f4c25dfe7b849fdd69fc180184
SHA1 7a73a6016452bafb68e7ea7ebfa26e68950a7ac8
SHA512 372882685e5e47365dc6f131ff63e0b90c1e7f287fba7fe4e4444628c64cdc7009da1f11ae6e1876dee9c8c7d144d78c4d74337ff865e9c10814d15a3b22d7ec
SSDEEP 12288:Y9q1QC6LsSyqDg4ZEq3HrVyjRF+PC0GO/yss7ezRFpfZGhKYidno1MuhG:YImYAV3GOHs7eXpfUhKYidnbuh
TLSH
T11CF49D4DB1BC41F9C07AD13DD687551BFA36380407649AEB23E45E652FA3AE09B7E302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ArgoCheatosu!FREEv2.2.exe

File Explorer

ArgoCheatosu!FREEv2.2.exe

.exe 753KB

ArgoCheatosu!FREEv2.2.exe

IMPHASH 36fd598249eb4f0c4fd76ed03e709229
SHA256 f0dc2e4b018403e28987422aec6d2fe03a832392c60a0e854b6793c1739a7776
MD5 62e206f4c25dfe7b849fdd69fc180184
SHA1 7a73a6016452bafb68e7ea7ebfa26e68950a7ac8
SHA512 372882685e5e47365dc6f131ff63e0b90c1e7f287fba7fe4e4444628c64cdc7009da1f11ae6e1876dee9c8c7d144d78c4d74337ff865e9c10814d15a3b22d7ec
SSDEEP 12288:Y9q1QC6LsSyqDg4ZEq3HrVyjRF+PC0GO/yss7ezRFpfZGhKYidno1MuhG:YImYAV3GOHs7eXpfUhKYidnbuh
TLSH
T11CF49D4DB1BC41F9C07AD13DD687551BFA36380407649AEB23E45E652FA3AE09B7E302
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

574312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Argo\Desktop\lame\builds\x64\Release\lame.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmGetWindowAttribute DwmExtendFrameIntoClientArea

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind VerSetConditionMask

shell32

ShellExecuteW SHGetFolderPathW SHGetPathFromIDListW SHBrowseForFolderW

kernel32

CreateFileW OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTickCount64 Process32NextW GetCurrentThread QueryPerformanceFrequency Process32FirstW CloseHandle LoadLibraryW Module32FirstW GetProcAddress GetFileSize ReadProcessMemory GetModuleHandleW FreeLibrary WideCharToMultiByte Module32NextW QueryFullProcessImageNameW QueryPerformanceCounter IsWow64Process VirtualQueryEx GetExitCodeProcess GetCurrentThreadId GetTickCount GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive GetLocaleInfoA VirtualAlloc ReleaseSRWLockShared GetLastError AreFileApisANSI GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA LocalFree IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetThreadPriority VirtualFree ReadFile GetFileInformationByHandleEx LoadLibraryA AcquireSRWLockExclusive AcquireSRWLockShared SleepConditionVariableSRW WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetModuleHandleA IsProcessorFeaturePresent

user32

ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture IsWindowUnicode ReleaseCapture OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetMessageW DefWindowProcW PostMessageW DestroyWindow SetWindowPos SetWindowLongPtrW GetMessageExtraInfo SetWindowLongW PostQuitMessage UpdateWindow CreateWindowExW CallNextHookEx GetKeyState RegisterClassExW ShowWindow MapVirtualKeyA IsWindowVisible MessageBoxW GetSystemMetrics IsWindow EnumWindows GetClassNameW UnhookWindowsHookEx GetClientRect PostThreadMessageW SetLayeredWindowAttributes SetProcessDPIAware GetWindowTextW GetWindowThreadProcessId GetWindowRect SetCursor SetWindowsHookExW SetCursorPos GetCursorPos SendInput GetKeyNameTextA LoadCursorW GetAsyncKeyState DispatchMessageW TranslateMessage ClientToScreen PeekMessageW SetWindowDisplayAffinity GetWindowLongW GetWindowLongPtrW

comdlg32

GetOpenFileNameW

advapi32

CryptReleaseContext CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam GetUserNameW CryptAcquireContextW

ole32

CoTaskMemFree

msvcp140

?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ

winmm

timeBeginPeriod timeEndPeriod

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memmove _CxxThrowException __current_exception_context __current_exception __C_specific_handler memset memcpy memchr strstr wcsstr _purecall __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

_wfopen fputc __stdio_common_vfprintf fseek __acrt_iob_func ftell fflush fclose fputwc __p__commode __stdio_common_vsscanf _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf _set_fmode fwrite fgetwc _get_stream_buffer_pointers fgetc __stdio_common_vsprintf_s ungetwc

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoul strtol strtof

api-ms-win-crt-runtime-l1-1-0

_errno _c_exit _register_thread_local_exe_atexit_callback exit _initterm_e _beginthreadex _invoke_watson _initterm _get_wide_winmain_command_line abort _initialize_wide_environment _configure_wide_argv _set_app_type _exit _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table terminate

api-ms-win-crt-string-l1-1-0

strncpy_s isspace _wcsicmp toupper tolower strcmp

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-math-l1-1-0

round ilogbf lroundf _dclass atan2f ceilf cosf logf scalbnf powf __setusermatherr roundf sinf sqrtf acosf _fdclass fmodf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func