contractors_gui_cheat[.]exe

General

Target
contractors_gui_cheat.exe
Size 267KB
Sample260905-2hphqa1sct
SHA256 21da696ee8150be6fad6b50d13eb9f37ef1f15b385e3d717a610880659f240d5
MD5 14afe69c1a013b8a02814c7ee492e4b0
SHA1 8952aeaf60fe8ffa34e3e4f1efe7371dbdce87bb
SHA512 fd084d2035bcc879f1dac547ef220e37afae07810d3955368b8bf6dcffdfb8449ccc0088922f1cd4dfae7ee7d81fac08b38961c371e2491ebfdeecd202f92e70
SSDEEP 3072:ZT0UWHPGkjjnaDX6smcsZ0DEZ2aHczmuk4NIMzwKwSaU9Dw1knf3M/F9KktMJM8t:hobjLx32aHczmukM7YFUZTfXkEeny3
TLSH
T11B447D55B6A51CFAED7BC57DC9524905EA72BC024760EADF03A00A971F237E08D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
contractors_gui_cheat.exe

File Explorer

contractors_gui_cheat.exe

.exe 267KB

contractors_gui_cheat.exe

IMPHASH 3d24980470ef422462b42527effa0560
SHA256 21da696ee8150be6fad6b50d13eb9f37ef1f15b385e3d717a610880659f240d5
MD5 14afe69c1a013b8a02814c7ee492e4b0
SHA1 8952aeaf60fe8ffa34e3e4f1efe7371dbdce87bb
SHA512 fd084d2035bcc879f1dac547ef220e37afae07810d3955368b8bf6dcffdfb8449ccc0088922f1cd4dfae7ee7d81fac08b38961c371e2491ebfdeecd202f92e70
SSDEEP 3072:ZT0UWHPGkjjnaDX6smcsZ0DEZ2aHczmuk4NIMzwKwSaU9Dw1knf3M/F9KktMJM8t:hobjLx32aHczmukM7YFUZTfXkEeny3
TLSH
T11B447D55B6A51CFAED7BC57DC9524905EA72BC024760EADF03A00A971F237E08D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

40784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

user32

SetWindowLongA GetWindowLongA FillRect MessageBoxA InvalidateRect EndPaint BeginPaint ReleaseDC GetDC GetMessageA GetAsyncKeyState SetLayeredWindowAttributes ShowWindow CreateWindowExA RegisterClassA DefWindowProcA DispatchMessageA TranslateMessage GetSystemMetrics

gdi32

TextOutA MoveToEx SetTextColor SetBkMode SelectObject Rectangle LineTo GetStockObject DeleteObject CreateSolidBrush CreatePen

kernel32

ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize CreateFileW WriteConsoleW HeapReAlloc CloseHandle DuplicateHandle Sleep GetCurrentProcess CreateThread GetProcessId OpenProcess ReadProcessMemory GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetConsoleOutputCP RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetFileType VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP FlushFileBuffers RtlUnwind

Name

.text

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

contractors_gui_cheat.exe

advapi32

user32

gdi32

kernel32

generic