modest-menu_v1[.]0[.]1_modland[.]zip

resource	yara_rule
static1/unpack001/modest-menu_v1.0.1_[unknowncheats.me]_/modest-menu.exe	themida

resource
unpack001/modest-menu_v1.0.1_[unknowncheats.me]_/modest-menu.exe

modest-menu_v1.0.1_modland.zip

SHA256 2141ee2203a4029758710be351c84954ee8021f5158a7f978f34e04ec29360b7
MD5 556e97e1cde3e21214811a875b30db0f
SHA1 30f819df34ce50164f5f2926ef612058fe8d1961
SHA512 183998652e18e1baf0c757a1e0580268d987360522f9b67a00910e684ebfb08eb3a496892c6173202003c92239b2f8736c3a012b482314fda3a324885f22eedd
SSDEEP 393216:Rcfg/L1p5Q1gZyRq40RYY+pf5a36wz//D+YdaQ9ADMAWxKaWIENHkxY9X:Rmq5Q1UfrN+pf5aHX4JWxKa88Y9X
TLSH
T1C90733AB4192B46729BBFF1133E5601361AFDD5AE28702E00DDB7F3B542074D9836AB1
MD5 SHA1 SHA512 SSDEEP TLSH

modest-menu_v1.0.1_[unknowncheats.me]_/config.json

SHA256 a8732f591cbed2b2ab923236d22948f10cb7c4011d6a1018be2fe3c8e8fbf5f2
MD5 3bea77ef233e2e32636ba889ceb489e3
SHA1 6a0a6be2e24cd5497fbf0298e244234716f5419a
SHA512 c924567c6c683b90b6dd31af7e976a8222d164c99137b38149ef79d4a1222b35c8bdfef155ee071e66c38b1601f3868c22c30d477fbc5f2dcd7599cd7f4be707
TLSH
T1DB714059D8500DFEA4FA9AAD9A79E602E701631BB6800C5BB5FE010C3F324367198FC6
MD5 SHA1 SHA512 TLSH

modest-menu_v1.0.1_[unknowncheats.me]_/modest-menu.exe

SHA256 46e9fc89c3dac162635794c54300f77b661a870562aec4fdf2ea56a0c86f42c6
MD5 8734cb11cf7a85b52ad4febf9e7599e9
SHA1 305c6a73d8e8690f84a1c3da01f64cf745b15af0
SHA512 c8205874bced0c4f4de1870ac928d8138d5051307b69dab1edca539b3574ded7b267eb70bfecc50656b41a8abb6f8306fbca64f0d350832fa8ea7b47aedf25a4
SSDEEP 393216:tZovfvKZMsGirYu+ckzfiRCPCaYn+d26v6eg3u/d+/bHuRST:tiXvp/vpckzfiUgwS+/dwiRST
TLSH
T11B073372C4D2B553C64FC97D27E6801A681BDA5BE08FC289BD4E0A2B090685DDFB74F1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

28569688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

1019KB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

76KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

23KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

25.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

15.4MB

Virtual Size

15.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/Readme.api

SHA256 17d4d815a61beddb8df978ee460b67c6bb8822f1c1c91772feca8612214922bd
MD5 6223c7d85c530e22e365b30fba4aec33
SHA1 d137d947a8871d77ff9fdd4a5aa7239cab14e3e9
SHA512 616cbd6aa1c76fc75e57685ac9cc183d91e3a1b0443aa375a0f91433c52a434e4f24016d0e3b41ca53be55fd7afe49b0a3515ee316c850f0105f30207f665792
SSDEEP 192:qNzc4v05Feq0hHBjBCpGjem0uezAsNpGlk66WXxX5IS+wwSgU0FXxZujFS+JSayp:h5ChWGjemB266WXxX5MO0FrujPJSeOK4
TLSH
T13EB2AA087D0064A6FD96DE75F5562204EC2AB209A1F1B0CC7E6E84B52BF78E490FDF64
MD5 SHA1 SHA512 SSDEEP TLSH

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/demo.lua

SHA256 f2b354df9b4d661f6227132c39937b8f706626886cdcf65540ebc5b78f55f6ea
MD5 a0cdff1f4eaf5af121513b9885295341
SHA1 e40fc44c5b82a8c02e7248c8b104c0f8abdc4f97
SHA512 1bf19f211a11c6b88ca9583ff20c1c8ed3e14f8f7ff68622a37c5c151ef2473e41bfd2b503bcc99f6e6e3f79b6845678cecfd3e23406353f35883fbf9b2beecd
TLSH
T10BE05530250E47B15899A220383B19D1702071F2832E12C7F85AF2ED208D00C8EEDCEC
MD5 SHA1 SHA512 TLSH

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/menu.lua

SHA256 4a7d7886622501f6b6728a0e9860fe81a1c90fd0e5f2fbe7ff94524e05e0b6b8
MD5 9596bef3ecd38e99364eb58e56cd49be
SHA1 676b733db5bb30bdb7824024a1c2fc045a27b4f1
SHA512 f2d1b11964181b3017f12f381bc241688f18efb3901acd6697ce0ba462693ac947e1d576d88de08b8e8798680cc4e640c5ec1aa4b2a0f4ad6739904f48ce7665
TLSH
T18531FF12350F9AE10DE273C47D7B80C9A470F0B4482587CEEA8374EA9186A6D915FEFD
MD5 SHA1 SHA512 TLSH

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/sirius.lua.example

SHA256 d331a1344d7354019fdeb564a21f95f85f26458f91aa93d7af58affa9728cb1d
MD5 1fdd7bce4f24c51ec8267d7fe65b265e
SHA1 4f247776830fb30cf816f227f13d3645b8d3aa6d
SHA512 4bf9c85600dcab2ff532ef5f459c270d3197ea5a9d46677b4f7f1e0d2e3b3454bc5ba1f64bcb732448cbe37a71a2112511f46166ec4ba0f3db1ca14d4f685bb4
TLSH
T102F05C8D781143AD0D7271D1881F0070D573A08746555B2AB1ECB9803F7427F8F7F969
MD5 SHA1 SHA512 TLSH

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/vehicle.lua

SHA256 0cddccf554633f15fbc453cd0080469c3806d7bd13824f68e3a1ee0cfb2da20b
MD5 1eceb52600b875b85a169687fb62ed1e
SHA1 2d13ed39f1d757af9a5d07790065cc8c00c4984b
SHA512 23baa825d5c3dfb66d1582ce6332bee8272f345742ba50977c0622c7be4fb6b9b921b473a424a2453df3cbc0ff0b473cf7897955fe09a4fd7a10d0df2ef2188b
TLSH
T13FE0CD7FB003C481ACCFF20451B6054F855BF4D0E118C4D646D0259369270799ECEDF4
MD5 SHA1 SHA512 TLSH

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/weapon.lua

SHA256 20d2e8d52504c96dcb846b08da138418048ed3b58128b05ddf1bde09694c5c14
MD5 402a9279c76afb2c5977cf97d270c3d1
SHA1 4cd6474f3cbf9c3ca26277d5691460e8744aae59
SHA512 7357aff15e11de58da79a4eaa603c5ad7fb16ec426e71358e87dd14862d19c44b80896c0e66766479978bb0ba88704457b5356f9f86f6f4af41a39c52ffa45db
TLSH
T104D02BFC3049B9E3DD9D74CA263A0CF3FD2071D5160100DF11551E81A4851544AFF9EC
MD5 SHA1 SHA512 TLSH

modest-menu_v1.0.1_[unknowncheats.me]_/themes.json

SHA256 b5eeb2b5d8656f0399220039f15e50c2566bf13124681f67c65f8b042d8fdc4c
MD5 ecc97a512f2bee4c4344a7a4126b5a5b
SHA1 73cd4d3e586b17d307decebd1ba8bea105977e29
SHA512 4d411ea0b3c67f2b38034fc9c1491dca070801e6521cc7cd8cdf91e2343a7caa7861313445e3d53cbe8dc8f64a0ce8169b191a054536c186dc2d1dcfba25bd18
TLSH
T13E41BA5AE5800E70A1BB1E6B01FA636AF2877F5F108908DB75FC071C4F7C8598461685
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

modest-menu_v1.0.1_modland.zip

modest-menu_v1.0.1_[unknowncheats.me]_/config.json

modest-menu_v1.0.1_[unknowncheats.me]_/modest-menu.exe

generic

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/Readme.api

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/demo.lua

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/menu.lua

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/sirius.lua.example

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/vehicle.lua

modest-menu_v1.0.1_[unknowncheats.me]_/scripts/weapon.lua

modest-menu_v1.0.1_[unknowncheats.me]_/themes.json