Bloodstrike EXT Jinx9_[unknowncheats[.]me]_[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Bloodstrike EXT Jinx9_[unknowncheats.me]_.exe
Size 1.7MB
Sample260905-zql2fsserf
SHA256 908950335e40ce00dafb7f1a37313868156935b181fa43a1edbd942d3e048f44
MD5 61f529e2f489dcab7ed36335b4facb0f
SHA1 2c08a5d5c0c0fada6681341dfa4047d2779caae2
SHA512 64119f6f11fc6f5e1e405b7f353fe21b40810a14ce5d3f77a6eb11d599b5b95eadc04a2e6624679db49c2f4edaecf4916cb6351c43db6ee2fbe1e869ad9890a0
SSDEEP 24576:JMkngHxFKCmQCmnEWsbmtUsfDWq1lg7j97fdK3ZviTnGYdmL1Q:JFg4QC5jsrW2edRKYTn3dmL
TLSH
T1C285AE43F3A502ECC12B9138C656D71BF732380417249ADB67A41A956F63BF06FBA391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Bloodstrike EXT Jinx9_[unknowncheats.me]_.exe

File Explorer

Bloodstrike EXT Jinx9_[unknowncheats.me]_.exe

.exe 1.7MB

Bloodstrike EXT Jinx9_[unknowncheats.me]_.exe

IMPHASH c57c1a72972689cb3dfb73a7cc832a32
SHA256 908950335e40ce00dafb7f1a37313868156935b181fa43a1edbd942d3e048f44
MD5 61f529e2f489dcab7ed36335b4facb0f
SHA1 2c08a5d5c0c0fada6681341dfa4047d2779caae2
SHA512 64119f6f11fc6f5e1e405b7f353fe21b40810a14ce5d3f77a6eb11d599b5b95eadc04a2e6624679db49c2f4edaecf4916cb6351c43db6ee2fbe1e869ad9890a0
SSDEEP 24576:JMkngHxFKCmQCmnEWsbmtUsfDWq1lg7j97fdK3ZviTnGYdmL1Q:JFg4QC5jsrW2edRKYTn3dmL
TLSH
T1C285AE43F3A502ECC12B9138C656D71BF732380417249ADB67A41A956F63BF06FBA391
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

908544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

d3dcompiler_47

D3DCompile

winmm

timeBeginPeriod

dinput8

DirectInput8Create

kernel32

GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle FreeConsole Module32FirstW ReadProcessMemory GetModuleHandleW Module32NextW lstrcmpiW AllocConsole lstrcmpW SetConsoleTitleW QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA IsDBCSLeadByte GetProcAddress FreeLibrary CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetVersionExW GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileType LCMapStringW CompareStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleFileNameW TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry SetStdHandle CreateFileW HeapSize SetEndOfFile GetOEMCP GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetLastError WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

user32

UpdateWindow SetForegroundWindow PostQuitMessage GetKeyState GetMessageExtraInfo ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData mouse_event GetKeyNameTextA MapVirtualKeyA GetWindowLongW GetWindowThreadProcessId GetClientRect GetWindow SetProcessDpiAwarenessContext DestroyWindow IsWindowVisible CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW ClientToScreen PeekMessageW EnumWindows SetLayeredWindowAttributes TranslateMessage LoadCursorW SetWindowLongW DefWindowProcW

gdi32

GetStockObject

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

312KB

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

347KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Bloodstrike EXT Jinx9_[unknowncheats.me]_.exe

d3d11

dwmapi

d3dcompiler_47

winmm

dinput8

kernel32

user32

gdi32

shell32

imm32

generic