w6bcg3[.]bin | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
w6bcg3.bin
Size 909KB
Sample260930-bb42qaztey
SHA256 cd2f7b4e5d2b9d38a18c4a79050d010cb8ef0e5982235f0cece57f8f0c9ae185
MD5 ce3bcaf3542bdaa93030c966fe2a4d07
SHA1 68d4bc02e631cf5902b20360c8e82397f76171cc
SHA512 7075f17943435efed6983b44694e765f876f93c9c285780d57b7472e7fc4ea751b752a65b90c4010c157b00c20c8f59745729a15fa626795d0f90b366c699713
SSDEEP 24576:9pftRqZLyW+9/M1BPQx9Sk0qP+O93l0fZ:n76yH90Yx9SlI+O93+x
TLSH
T148159D57A7A511FAD167C139C5438613F772B86A13209BDF03A09AB91F23AE42F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
w6bcg3.bin

File Explorer

w6bcg3.bin

.exe 909KB

w6bcg3.bin

IMPHASH c54d8a62ae74153a6ed269db49d0cf77
SHA256 cd2f7b4e5d2b9d38a18c4a79050d010cb8ef0e5982235f0cece57f8f0c9ae185
MD5 ce3bcaf3542bdaa93030c966fe2a4d07
SHA1 68d4bc02e631cf5902b20360c8e82397f76171cc
SHA512 7075f17943435efed6983b44694e765f876f93c9c285780d57b7472e7fc4ea751b752a65b90c4010c157b00c20c8f59745729a15fa626795d0f90b366c699713
SSDEEP 24576:9pftRqZLyW+9/M1BPQx9Sk0qP+O93l0fZ:n76yH90Yx9SlI+O93+x
TLSH
T148159D57A7A511FAD167C139C5438613F772B86A13209BDF03A09AB91F23AE42F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

493348

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ItzGo\OneDrive\Desktop\gordex\mw19\Mw19 loader\MULTI COD LOADER + BLOCKER\x64\Release\Huron Cheats\! Arxvestiy.pdb

kernel32

CreateThread HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap WinExec LocalFree SetLastError FormatMessageA EnterCriticalSection LeaveCriticalSection SleepEx VerSetConditionMask QueryPerformanceFrequency GetSystemDirectoryA VerifyVersionInfoA QueryPerformanceCounter GetTickCount MoveFileExA WaitForSingleObjectEx MultiByteToWideChar GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx WideCharToMultiByte OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId SetConsoleTitleA IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive HeapReAlloc SetConsoleTextAttribute SetConsoleScreenBufferInfoEx GetConsoleScreenBufferInfoEx GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode LoadLibraryW LoadLibraryA LoadLibraryExA GetProcAddress GetModuleHandleA FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetWindowsDirectoryW OpenProcess GetFileInformationByHandleEx GetModuleHandleW AreFileApisANSI GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx HeapSize InitializeCriticalSectionEx HeapFree GetModuleFileNameA Process32Next Process32First CreateToolhelp32Snapshot GetConsoleWindow GetCurrentProcess Sleep WaitForSingleObject GetLastError Beep IsDebuggerPresent WriteFile ReadFile DeleteFileW CreateFileW GetStdHandle DeviceIoControl CloseHandle

user32

SetLayeredWindowAttributes IsWindowVisible PostThreadMessageA GetWindowThreadProcessId GetWindow SetWindowsHookExA UnhookWindowsHookEx MessageBoxA GetAsyncKeyState EnumWindows

advapi32

CryptEncrypt CryptReleaseContext CryptGenRandom GetUserNameA GetTokenInformation GetLengthSid OpenProcessToken IsValidSid CopySid ConvertSidToStringSidA CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptAcquireContextA

shell32

ShellExecuteW ShellExecuteA

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?flags@ios_base@std@@QEBAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlImageNtHeader RtlVirtualUnwind

normaliz

IdnToAscii

wldap32

ord79 ord30 ord200 ord33 ord211 ord46 ord217 ord143 ord50 ord32 ord27 ord301 ord26 ord22 ord60 ord41 ord35 ord45

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CryptStringToBinaryA CertOpenStore

ws2_32

ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind send recv closesocket WSAGetLastError

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

__C_specific_handler strchr strrchr strstr __current_exception __current_exception_context memset memmove memcpy _CxxThrowException __std_exception_destroy __std_exception_copy memcmp __std_terminate memchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

system _invoke_watson abort exit _beginthreadex _getpid _errno _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _resetstkoflw _invalid_parameter_noinfo _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit strerror _seh_filter_exe _set_app_type __sys_nerr _get_initial_narrow_environment _initterm _initterm_e _exit terminate __p___argc __p___argv _c_exit

api-ms-win-crt-string-l1-1-0

_stricmp strpbrk strlen strcspn strcpy_s strcmp strspn wcslen isupper strncpy tolower strncmp _strdup

api-ms-win-crt-heap-l1-1-0

realloc calloc free malloc _set_new_mode _callnewh

api-ms-win-crt-stdio-l1-1-0

fputs fopen __p__commode fsetpos _fseeki64 __stdio_common_vsscanf _read _write _close _open _set_fmode fwrite setvbuf ftell fread ungetc __acrt_iob_func fputc feof fgetpos fgetc _popen __stdio_common_vsprintf fflush fgets _pclose __stdio_common_vfprintf fseek _lseeki64 fclose _get_stream_buffer_pointers

api-ms-win-crt-filesystem-l1-1-0

_lock_file _access _fstat64 remove _stat64 _unlock_file _unlink

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _gmtime64

api-ms-win-crt-convert-l1-1-0

strtoll atoi strtoull strtod strtol strtoul

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

_dclass __setusermatherr