cheatoffset[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cheatoffset.exe
Size 2.0MB
Sample261003-vyfgestbqd
SHA256 cebdd05f23bacaf1b30c557e197192939e94b91d126690fe8936f0b645906b1f
MD5 95862f78d484fd4cefdd94abae938096
SHA1 300c24238d5259a864e825290fece6bbc857d13d
SHA512 b52ba419de92f82325fdce7f9470ee3f570c6671462c5c0b9f35bcb7619c1f273f36c8dfc565d5676143841a9b848cbc655492a1cfeacb020419a312ef8de941
SSDEEP 24576:kedYp6voCMKWIh0lhSMXlUBnOlH7EFmIkeT7BckATvAnBw:k5OoFWnu1ifATY
TLSH
T10BA5BF03F352839DD4162D3987A2D366F373BC502F15928BF7982A98EA8B5F40D672C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cheatoffset.exe

File Explorer

cheatoffset.exe

.exe 2.0MB

cheatoffset.exe

IMPHASH 6660d44058201e0dc1eef3542d3066d9
SHA256 cebdd05f23bacaf1b30c557e197192939e94b91d126690fe8936f0b645906b1f
MD5 95862f78d484fd4cefdd94abae938096
SHA1 300c24238d5259a864e825290fece6bbc857d13d
SHA512 b52ba419de92f82325fdce7f9470ee3f570c6671462c5c0b9f35bcb7619c1f273f36c8dfc565d5676143841a9b848cbc655492a1cfeacb020419a312ef8de941
SSDEEP 24576:kedYp6voCMKWIh0lhSMXlUBnOlH7EFmIkeT7BckATvAnBw:k5OoFWnu1ifATY
TLSH
T10BA5BF03F352839DD4162D3987A2D366F373BC502F15928BF7982A98EA8B5F40D672C5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

475920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos UpdateWindow GetWindowLongW GetClipboardData GetWindowRect SetWindowPos CallNextHookEx GetSystemMetrics GetClassNameA ShowWindow IsWindow DispatchMessageW RedrawWindow GetWindowTextA SetClipboardData GetWindowThreadProcessId SetWindowDisplayAffinity UnhookWindowsHookEx EnumWindows SetLayeredWindowAttributes TranslateMessage InvalidateRect GetAsyncKeyState GetKeyState GetDesktopWindow FindWindowA PostQuitMessage GetWindowDisplayAffinity ScreenToClient PeekMessageA ClientToScreen GetForegroundWindow LoadCursorW SetWindowsHookExW SetWindowLongW GetClientRect SetCursor

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

kernel32

SleepConditionVariableSRW GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetFileAttributesExW GetCurrentThreadId FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree QueryFullProcessImageNameW K32EnumProcesses Module32FirstW OpenProcess CreateFileW DeviceIoControl SetUnhandledExceptionFilter GetModuleHandleW AcquireSRWLockShared ReleaseSRWLockShared CloseHandle Process32FirstW GetModuleFileNameA AcquireSRWLockExclusive GetCurrentThread Process32NextW WakeAllConditionVariable GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead FindNextFileW ReleaseSRWLockExclusive GetLastError Sleep CreateToolhelp32Snapshot SetThreadPriority SetConsoleTitleA SetConsoleCtrlHandler MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter InitializeSRWLock

msvcp140

??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Xtime_get_ticks _Thrd_join _Mtx_unlock

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

winmm

timeBeginPeriod

xinput1_4

ord2

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception memset memmove memcpy memchr memcmp wcsrchr strstr __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vsscanf fread __stdio_common_vsprintf fwrite setvbuf __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func ftell _wfopen _set_fmode __p__commode getchar

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-heap-l1-1-0

calloc malloc free _set_new_mode _callnewh

api-ms-win-crt-math-l1-1-0

sqrtf asin atan atan2 atan2f ceilf _dsign cosf fmodf pow powf __setusermatherr _fdsign acosf _dclass roundf sin cos sinf sqrt _ldsign

api-ms-win-crt-string-l1-1-0

strncmp strlen strcmp strcat_s strncpy strncpy_s strcpy_s wcslen _wcsicmp

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_c_exit __p___argv __p___argc _configure_narrow_argv abort _register_thread_local_exe_atexit_callback _initialize_narrow_environment _exit _initialize_onexit_table exit _initterm_e _register_onexit_function _initterm _get_initial_narrow_environment _set_app_type terminate _crt_atexit _seh_filter_exe _cexit _beginthreadex

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func