noclip_[unknowncheats[.]me]_[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
noclip_[unknowncheats.me]_.dll
Size 3.0MB
Sample260919-szdccagg48
SHA256 a7d3e96f7397c5cb1bf0f9d47adffd072c6d00839fa76876118b55a05db9ec3d
MD5 14975d9e37021f3f3c1757b42c6105fb
SHA1 bd3f047a4b7fb47819bfac2967617d34d0a94068
SHA512 2faf8f2ae80d81437b8271d8f3288319017e40a79adab168da24f75a5f2208cc8a51cbe6ee612ac23c5a9c00e2bf110c6aff6d017716c5a483beb398b8b80f5f
SSDEEP 49152:wBC+PUS/kvyKA6gK4Kzic2kq0GUBBK8+oJ/iwGEawy06YOsawSc/KMCg2oScWomc:N9fG8PbwFp2
TLSH
T110E51905B37A00F5C13DC134DE83B12BF9A1389987B866EB9BC14E86AF197E4917E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
noclip_[unknowncheats.me]_.dll

File Explorer

noclip_[unknowncheats.me]_.dll

.dll 3.0MB

noclip_[unknowncheats.me]_.dll

IMPHASH b065a05d434bd27e7269300f026ae2b6
SHA256 a7d3e96f7397c5cb1bf0f9d47adffd072c6d00839fa76876118b55a05db9ec3d
MD5 14975d9e37021f3f3c1757b42c6105fb
SHA1 bd3f047a4b7fb47819bfac2967617d34d0a94068
SHA512 2faf8f2ae80d81437b8271d8f3288319017e40a79adab168da24f75a5f2208cc8a51cbe6ee612ac23c5a9c00e2bf110c6aff6d017716c5a483beb398b8b80f5f
SSDEEP 49152:wBC+PUS/kvyKA6gK4Kzic2kq0GUBBK8+oJ/iwGEawy06YOsawSc/KMCg2oScWomc:N9fG8PbwFp2
TLSH
T110E51905B37A00F5C13DC134DE83B12BF9A1389987B866EB9BC14E86AF197E4917E705
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1578568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject CreateEventA Sleep WaitForMultipleObjects OpenProcess GetModuleHandleA K32GetModuleFileNameExA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency GetProcAddress GetCurrentProcess VirtualQuery GetCurrentProcessId VirtualProtect VirtualProtectEx ReadProcessMemory WriteProcessMemory CreateToolhelp32Snapshot Process32First Process32Next SetEndOfFile WriteConsoleW HeapFree FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage DeleteFileW SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ExitProcess ReadFile HeapReAlloc HeapAlloc CloseHandle GetLastError DecodePointer RtlPcToFileHeader RaiseException InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW LocalFree FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection WaitForSingleObjectEx EncodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW InitializeSListHead FreeLibrary HeapCreate Thread32Next Thread32First SuspendThread ResumeThread GetThreadContext FlushInstructionCache SetThreadContext OpenThread VirtualFree VirtualAlloc GetSystemInfo OutputDebugStringW RtlUnwindEx InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind GetFileType

user32

UnregisterClassA GetAsyncKeyState GetWindowThreadProcessId EnumWindows MessageBoxA DestroyWindow CreateWindowExA RegisterClassExA DefWindowProcA LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetSystemMetrics SetCapture GetCapture GetKeyState IsChild EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetWindowLongPtrW MessageBoxW GetForegroundWindow ReleaseCapture

shell32

SHGetFolderPathA

d3d12

D3D12SerializeRootSignature

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

ole32

CoGetObjectContext CoGetApartmentType

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

787KB

Virtual Size

786KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

296KB

Virtual Size

615KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

noclip_[unknowncheats.me]_.dll

kernel32

user32

shell32

d3d12

imm32

ole32

generic