Zeezy[.]Cheat[.]Scanner[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Zeezy.Cheat.Scanner.exe
Size 1.1MB
Sample260925-tt6blsfe96
SHA256 bf8c277dc23031bd21d77a1fd14473e19a7ae4dd3324aff51c00f15016da7627
MD5 0c8dab797d6a18d0f2464cf4ef2151b0
SHA1 3f88c22e64e4f1243210bc0f03e4e5af6e44e828
SHA512 b425b077b30346461a01c106ef3f424fe9dfc0ba50f5bf4736aa129d0bc3077e1a38edceb2463b8dbf215674f6f13ef2f3d92f0cbdc5756b73d034ee58f6572e
SSDEEP 12288:CZWonbD8DCfTAgwa7uKcswy0Gxs2+A+D218bqXl7T04xv0bRkNn6iCeor8:QESufLGObA+D26qV7TvVNn6iDR
TLSH
T109358D15A3B501EDD56B8037CA8BBA17D673740C2BE165DF27D00A992F23BE04ABE711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Zeezy.Cheat.Scanner.exe

File Explorer

Zeezy.Cheat.Scanner.exe

.exe 1.1MB

Zeezy.Cheat.Scanner.exe

IMPHASH 90f7fc17fe956e37d58e81f74834def9
SHA256 bf8c277dc23031bd21d77a1fd14473e19a7ae4dd3324aff51c00f15016da7627
MD5 0c8dab797d6a18d0f2464cf4ef2151b0
SHA1 3f88c22e64e4f1243210bc0f03e4e5af6e44e828
SHA512 b425b077b30346461a01c106ef3f424fe9dfc0ba50f5bf4736aa129d0bc3077e1a38edceb2463b8dbf215674f6f13ef2f3d92f0cbdc5756b73d034ee58f6572e
SSDEEP 12288:CZWonbD8DCfTAgwa7uKcswy0Gxs2+A+D218bqXl7T04xv0bRkNn6iCeor8:QESufLGObA+D26qV7TvVNn6iDR
TLSH
T109358D15A3B501EDD56B8037CA8BBA17D673740C2BE165DF27D00A992F23BE04ABE711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

550928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

opengl32

glViewport glClear

dwmapi

DwmSetWindowAttribute

shell32

DragAcceptFiles ShellExecuteA CommandLineToArgvW ShellExecuteW DragFinish DragQueryFileW DragQueryPoint

wevtapi

EvtNext EvtQuery EvtClose

advapi32

AllocateAndInitializeSid RegCloseKey LookupPrivilegeValueW QueryServiceConfigA RegQueryValueExW AdjustTokenPrivileges OpenProcessToken QueryServiceStatus OpenServiceA OpenSCManagerA CloseServiceHandle FreeSid CheckTokenMembership RegOpenKeyExW

kernel32

OpenProcess SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessMemoryInfo GetSystemInfo VirtualQueryEx ReadProcessMemory GetModuleHandleA GetProcAddress LocalFree CreateFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetLastError DeviceIoControl GetCurrentProcess GetSystemTimeAsFileTime GetWindowsDirectoryW Sleep GetStartupInfoW GetModuleHandleW GlobalAlloc GlobalUnlock GlobalLock GlobalFree SetThreadExecutionState MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree VerSetConditionMask GetModuleHandleExW FormatMessageW WideCharToMultiByte FreeLibrary LoadLibraryA OutputDebugStringA WaitForSingleObjectEx HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetProcessTimes LoadLibraryExW VirtualProtect GetTimeZoneInformation GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle TerminateProcess ExitProcess IsProcessorFeaturePresent ReadFile FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcessId SetUnhandledExceptionFilter GetCPInfo SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx FormatMessageA AreFileApisANSI GetFullPathNameW FindFirstFileExW GetLocaleInfoEx GetStringTypeW GetExitCodeThread CloseHandle GetModuleFileNameW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile CompareStringW RtlUnwind GetCurrentThreadId

user32

EnumDisplayMonitors EnumDisplayDevicesW EnumDisplaySettingsExW EnumDisplaySettingsW ChangeDisplaySettingsExW SetProcessDPIAware ToUnicode UnregisterClassW UnregisterDeviceNotification RegisterDeviceNotificationW ChangeWindowMessageFilterEx RegisterRawInputDevices GetRawInputData MonitorFromWindow SystemParametersInfoW CreateIconIndirect LoadImageW DestroyIcon LoadCursorW GetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect OffsetRect SetRect ClipCursor WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetWindowRect GetClientRect SetWindowTextW RemovePropW GetPropW SetPropW GetRawInputDeviceList GetDC SetForegroundWindow GetSystemMetrics GetMonitorInfoW ReleaseCapture SetCapture MapVirtualKeyW GetKeyState GetActiveWindow SetFocus EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsZoomed BringWindowToTop IsIconic IsWindowVisible SetWindowPlacement GetWindowPlacement SetWindowPos MoveWindow FlashWindow SetLayeredWindowAttributes GetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW WaitMessage PostMessageW SendMessageW GetMessageTime PeekMessageW DispatchMessageW TranslateMessage TrackMouseEvent SetWindowRgn GetMessageExtraInfo CallWindowProcW SetPropA GetPropA GetRawInputDeviceInfoA GetWindowLongPtrW SetWindowLongPtrW ReleaseDC MsgWaitForMultipleObjects

gdi32

DeleteObject CreateRectRgn CreateRoundRectRgn DeleteDC GetDeviceCaps GetDeviceGammaRamp SetDeviceGammaRamp ChoosePixelFormat DescribePixelFormat SetPixelFormat SwapBuffers CreateDCW CreateBitmap CreateDIBSection

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

746KB

Virtual Size

745KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

314KB

Virtual Size

314KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Zeezy.Cheat.Scanner.exe

opengl32

dwmapi

shell32

wevtapi

advapi32

kernel32

user32

gdi32

imm32

generic