FiveM External_cracked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FiveM External_cracked.exe
Size 4.4MB
Sample260909-bqq4eaae56
SHA256 2c3e285c72a31314150db93c80d09ca6d0121f8f798482ab959a334d8bac5b83
MD5 7f0fe7feece01b9776327e21584c2f65
SHA1 c2c967af5bc38bfe4dbc01ca924bd1dfcf37d255
SHA512 23ad25aaa7b57c96f45e8485ab07c1971711142fbb58ecc226477db6a4e8454757949c5f9cb5a997cf308fabbd76e4b759bb3b40aca8a551cd7f48f882b78f3d
SSDEEP 49152:DjcS3bwFiwEa3uz0hn/gj8KTXF/T8p5Qo4y3VkT8+HE3uxuMvAKrTZrNyA+2d5YD:Deiw0zd+rjVMxdAGTZ36dAI
TLSH
T13226DF46E29601E8DFA6D77C88965223D2B17CC80370D7D75ADC8E656F93AF06A3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FiveM External_cracked.exe

File Explorer

FiveM External_cracked.exe

.exe 4.4MB

FiveM External_cracked.exe

IMPHASH d52cd426b2748224b79152c508dfacde
SHA256 2c3e285c72a31314150db93c80d09ca6d0121f8f798482ab959a334d8bac5b83
MD5 7f0fe7feece01b9776327e21584c2f65
SHA1 c2c967af5bc38bfe4dbc01ca924bd1dfcf37d255
SHA512 23ad25aaa7b57c96f45e8485ab07c1971711142fbb58ecc226477db6a4e8454757949c5f9cb5a997cf308fabbd76e4b759bb3b40aca8a551cd7f48f882b78f3d
SSDEEP 49152:DjcS3bwFiwEa3uz0hn/gj8KTXF/T8p5Qo4y3VkT8+HE3uxuMvAKrTZrNyA+2d5YD:Deiw0zd+rjVMxdAGTZ36dAI
TLSH
T13226DF46E29601E8DFA6D77C88965223D2B17CC80370D7D75ADC8E656F93AF06A3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1660180

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\konoh\Downloads\pjeto bw segices\projeto\FiveM External1\x64\Release\FiveM External.pdb

d3dx9_43

D3DXVec3Transform D3DXMatrixTranspose D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetCurrentProcessId IsDebuggerPresent SetUnhandledExceptionFilter GetStartupInfoW GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx LocalFree GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA SetLastError WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA GetModuleFileNameW DuplicateHandle GetProcessId VirtualAlloc SetPriorityClass TerminateProcess WriteProcessMemory QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA WideCharToMultiByte GlobalFree MultiByteToWideChar ExitProcess GetLastError GetModuleHandleA GetCurrentProcess GlobalUnlock CreateRemoteThread GlobalLock GlobalAlloc Sleep WaitForSingleObject GetVolumeInformationA WakeAllConditionVariable GetTickCount VirtualAllocEx VirtualFreeEx GetModuleFileNameA Module32Next Module32First OpenProcess CreateToolhelp32Snapshot K32GetModuleFileNameExA GetWindowsDirectoryW Module32NextW DeleteCriticalSection FlushInstructionCache SleepEx Module32FirstW CloseHandle VirtualProtectEx ReadProcessMemory InitializeSListHead GetSystemTimeAsFileTime

user32

GetForegroundWindow SetWindowPos GetWindowThreadProcessId GetWindowRect IsWindowVisible GetWindowTextA EnumWindows GetWindowTextLengthA GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture GetAsyncKeyState ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetClipboardData DispatchMessageA DestroyWindow EnumDisplayMonitors CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow mouse_event SetClipboardData MessageBoxA GetMonitorInfoA MoveWindow DefWindowProcA SetLayeredWindowAttributes TranslateMessage PeekMessageA GetWindowLongPtrA SetWindowDisplayAffinity EmptyClipboard CloseClipboard SetWindowLongA OpenClipboard PostQuitMessage keybd_event GetSystemMetrics VkKeyScanA UpdateWindow FindWindowA InvalidateRect

advapi32

CryptGetHashParam CryptReleaseContext CryptAcquireContextA GetTokenInformation OpenProcessToken AdjustTokenPrivileges RegQueryValueExW RegOpenKeyExW LookupPrivilegeValueA RegCloseKey QueryServiceStatusEx OpenServiceW CryptEncrypt CryptImportKey CryptDestroyKey OpenSCManagerW CryptDestroyHash CryptHashData CryptCreateHash CloseServiceHandle QueryServiceStatus OpenSCManagerA ControlService OpenServiceA CryptGenRandom

shell32

ShellExecuteW SHGetFolderPathW

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z _Wcscoll ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z __crtLCMapStringA __crtLCMapStringW ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Random_device@std@@YAIXZ _Mtx_unlock _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ _Query_perf_counter

ws2_32

setsockopt WSAStartup send ioctlsocket socket inet_ntoa gethostname recv htons listen closesocket bind accept WSAGetLastError WSACleanup connect getpeername getsockname getsockopt ntohs WSASetLastError WSAIoctl gethostbyname htonl __WSAFDIsSet select getaddrinfo ntohl sendto recvfrom freeaddrinfo

normaliz

IdnToAscii

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertOpenStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertAddCertificateContextToStore

wldap32

ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr wcsrchr wcsstr strrchr longjmp memcpy memmove memset memchr memcmp __RTtypeid __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException __std_type_info_compare __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler strchr

api-ms-win-crt-heap-l1-1-0

realloc _callnewh malloc calloc free _set_new_mode

api-ms-win-crt-string-l1-1-0

tolower toupper strncmp strcmp _strdup strncpy wcscpy_s wcslen isupper strspn strcspn _wcsicmp isalnum strpbrk strcpy strlen wcscat_s

api-ms-win-crt-convert-l1-1-0

atoi strtol atof strtoul strtoull strtod mbstowcs strtoll

api-ms-win-crt-runtime-l1-1-0

_errno _configure_narrow_argv exit _register_onexit_function _initialize_narrow_environment _crt_atexit _beginthreadex _cexit abort strerror _register_thread_local_exe_atexit_callback terminate __sys_nerr _c_exit _exit _getpid _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _initialize_onexit_table _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fseek __stdio_common_vsprintf fwrite __stdio_common_vfprintf _wfopen __stdio_common_vsscanf fgets _lseeki64 fgetc _set_fmode __p__commode fclose _read fflush _write fputc fopen _close fputs _open feof ftell

api-ms-win-crt-math-l1-1-0

log logf sinf pow fmodf sqrtf floorf _dsign __setusermatherr cosf ceilf acosf _hypotf powf _dclass

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_lock_file _fstat64 _access _unlock_file _stat64 _unlink

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func _configthreadlocale ___lc_codepage_func localeconv ___lc_locale_name_func

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

api-ms-win-crt-environment-l1-1-0

_wgetenv getenv