zayleakedthis[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
zayleakedthis.exe
Size 8.1MB
Sample260905-vbprksv1cw
SHA256 fe3526be2a2d74eed760a9750d130cdbc8b9557fe498955436f9752b1a2b552f
MD5 54e258ef3119d6de0d37d9db9f302cfa
SHA1 8bf0aea27326ef11dbc6e5cca8c638f8cc5b7424
SHA512 eb4b0199fcf50bbddae2f67d500c2f0455c6caa82ffe28430ccb102ce505561600b3b738975b78ba2183b37697192f07a7ddd7c56ac68c0676663f6a63ef16c8
SSDEEP 98304:9A/gxr9r8SiipaQsFUTVVic/zqzSFG5VJe94eHHQ3eP:9S2F8HicdkTHqzSFG5VJe9z
TLSH
T17286CD25A99C2BDCD239B27CA1934013A3F07F941720DEDBCAF0DE530E6F594752662A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zayleakedthis.exe

File Explorer

zayleakedthis.exe

.exe 8.1MB

zayleakedthis.exe

IMPHASH 93736490240c38e31c4d71cf01506e02
SHA256 fe3526be2a2d74eed760a9750d130cdbc8b9557fe498955436f9752b1a2b552f
MD5 54e258ef3119d6de0d37d9db9f302cfa
SHA1 8bf0aea27326ef11dbc6e5cca8c638f8cc5b7424
SHA512 eb4b0199fcf50bbddae2f67d500c2f0455c6caa82ffe28430ccb102ce505561600b3b738975b78ba2183b37697192f07a7ddd7c56ac68c0676663f6a63ef16c8
SSDEEP 98304:9A/gxr9r8SiipaQsFUTVVic/zqzSFG5VJe94eHHQ3eP:9S2F8HicdkTHqzSFG5VJe9z
TLSH
T17286CD25A99C2BDCD239B27CA1934013A3F07F941720DEDBCAF0DE530E6F594752662A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7932532

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\jakeb\OneDrive\Documents\Cheats\Cheat FiveM\Raax External FiveM\UI\examples\example_win32_directx11\Release\BytesLoader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW LoadLibraryW SleepEx GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerifyVersionInfoW GetFileSizeEx SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead DeleteCriticalSection InitializeCriticalSectionEx OutputDebugStringW GetLastError CreateFileW VirtualQueryEx SetFileAttributesA GetWindowsDirectoryA GetSystemInfo DeleteFileA SetFilePointer WriteFile GetCurrentProcess WriteProcessMemory GetModuleFileNameA VirtualFreeEx Module32NextW CreateRemoteThread ReadProcessMemory VirtualAllocEx VirtualProtectEx Module32FirstW WaitForSingleObject K32GetModuleFileNameExW GetComputerNameA GetModuleHandleW GetFileSize CloseHandle Process32FirstW CreateFileA Process32NextW Sleep CreateToolhelp32Snapshot OpenProcess GetCurrentThreadId FindClose FindNextFileA TerminateProcess FindFirstFileA ReadFile QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar OutputDebugStringA UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable IsDebuggerPresent

user32

IsWindowUnicode EmptyClipboard GetClipboardData SetCursor SetCapture LoadCursorW GetForegroundWindow SetClipboardData GetClientRect TrackMouseEvent ClientToScreen GetCapture ReleaseCapture SetCursorPos ReleaseDC GetCursorPos OpenClipboard GetKeyboardLayout mouse_event GetWindowThreadProcessId MonitorFromPoint EnumDisplayDevicesA GetWindowRect DestroyWindow SetActiveWindow EnumDisplayMonitors CreateWindowExW GetSystemMetrics UnregisterClassW GetWindowLongPtrW ScreenToClient GetDC SetProcessDPIAware RegisterClassExW ShowWindow GetMessageExtraInfo GetKeyState DefWindowProcW SetForegroundWindow UpdateWindow FindWindowA PostQuitMessage SetWindowLongW TranslateMessage SetFocus SetLayeredWindowAttributes MoveWindow EnumDisplaySettingsA IsWindow MessageBoxA AttachThreadInput SetWindowDisplayAffinity PeekMessageW GetMonitorInfoW MapVirtualKeyExW DispatchMessageW GetAsyncKeyState CloseClipboard

gdi32

GetDIBits GetDeviceCaps SelectObject CreateCompatibleBitmap BitBlt DeleteObject CreateCompatibleDC DeleteDC

advapi32

AdjustTokenPrivileges OpenProcessToken QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle LookupPrivilegeValueW CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW

shell32

ShellExecuteW

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Query_perf_frequency _Mtx_lock _Query_perf_counter _Mtx_unlock _Wcscoll ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A _Thrd_id _Thrd_join ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

winhttp

WinHttpCloseHandle WinHttpReadData WinHttpSetTimeouts WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest WinHttpOpenRequest WinHttpQueryHeaders WinHttpOpen WinHttpQueryDataAvailable

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore

ntdll

RtlCaptureContext RtlVirtualUnwind ZwWriteVirtualMemory ZwReadVirtualMemory RtlLookupFunctionEntry

ws2_32

getpeername gethostname ioctlsocket sendto setsockopt freeaddrinfo getaddrinfo listen htonl closesocket select socket htons WSAIoctl WSAGetLastError inet_pton WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt recv __WSAFDIsSet ntohs WSASetLastError inet_ntop getsockname bind accept connect recvfrom

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __C_specific_handler __current_exception wcschr strrchr memset memmove memcpy memcmp memchr _CxxThrowException __std_exception_copy __std_exception_destroy strchr strstr __std_terminate

api-ms-win-crt-stdio-l1-1-0

_lseeki64 fputc __p__commode __acrt_iob_func _read _write ftell __stdio_common_vsprintf _fileno _close _wopen fflush fclose fgets _set_fmode __stdio_common_vsscanf fread fseek feof _wfopen __stdio_common_vfprintf fgetc fputs _get_stream_buffer_pointers _fseeki64 fsetpos ungetc fgetpos fwrite setvbuf

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

_stricmp tolower _wcsicmp towlower strncpy _strdup wcsncpy strpbrk wcsncmp strncmp toupper strcmp strspn wcspbrk strcspn

api-ms-win-crt-heap-l1-1-0

calloc malloc free _set_new_mode _callnewh realloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _errno _initterm_e _wassert _beginthreadex __sys_errlist _invoke_watson exit __sys_nerr _register_thread_local_exe_atexit_callback _c_exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type abort _get_narrow_winmain_command_line _initterm terminate _exit

api-ms-win-crt-convert-l1-1-0

strtoul strtol wcstol strtoll wcstombs atoi atof

api-ms-win-crt-math-l1-1-0

sinf acosf pow atan2f sqrtf _fdopen log logf fmodf _hypotf cosf asinf __setusermatherr powf ceilf

api-ms-win-crt-time-l1-1-0

_time64 _localtime64 _gmtime64 strftime

api-ms-win-crt-filesystem-l1-1-0

_unlink _unlock_file _fstat64 _wstat64 _lock_file

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale