SastashaFied Iw5 v1[.]2_[unknowncheats[.]me]_[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
SastashaFied Iw5 v1.2_[unknowncheats.me]_.zip
Size 3.8MB
Sample261011-ea9gladv8q
SHA256 b9051ba3c60a0a09bf1ad7b1b2d1960d2672bda033d85d981d58fcb719ce877b
MD5 c758e9bf31beabd4255b5ee2bbd1cc1e
SHA1 aaa85552affdbdb190eea01a8a1f9c5da94aebf8
SHA512 037e38eea5c4e57f515e7d650dfdb59b37ae1d539e67514e5325d43a328069941a1fc8dd7dc94271b9ecba467d97efe38bd613704cea022d84354adf429679ff
SSDEEP 98304:JQ3MeTEdtcpTXvo4XT1nizFgS3ig+ddAqn7Mrw:C8elpTXDXwaTg+ddZn7Mrw
TLSH
T19416336903B5383D1499B32E725C279DAD140AC4B11AE63B4674BC72DF22616FBA10FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SastashaFied Iw5 v1.2/SastashaFied Iw5 v1.2.dll

File Explorer

SastashaFied Iw5 v1.2_[unknowncheats.me]_.zip

.zip 3.8MB
SastashaFied Iw5 v1.2/SastashaFied Iw5 v1.2 Patch Notes.txt

1KB
SastashaFied Iw5 v1.2/SastashaFied Iw5 v1.2.dll

.dll 441KB
SastashaFied Iw5 v1.2/SastashaFied Iw5 v1.2.png

.png 3.6MB

SastashaFied Iw5 v1.2_[unknowncheats.me]_.zip

SHA256 b9051ba3c60a0a09bf1ad7b1b2d1960d2672bda033d85d981d58fcb719ce877b
MD5 c758e9bf31beabd4255b5ee2bbd1cc1e
SHA1 aaa85552affdbdb190eea01a8a1f9c5da94aebf8
SHA512 037e38eea5c4e57f515e7d650dfdb59b37ae1d539e67514e5325d43a328069941a1fc8dd7dc94271b9ecba467d97efe38bd613704cea022d84354adf429679ff
SSDEEP 98304:JQ3MeTEdtcpTXvo4XT1nizFgS3ig+ddAqn7Mrw:C8elpTXDXwaTg+ddZn7Mrw
TLSH
T19416336903B5383D1499B32E725C279DAD140AC4B11AE63B4674BC72DF22616FBA10FB
MD5 SHA1 SHA512 SSDEEP TLSH

SastashaFied Iw5 v1.2/SastashaFied Iw5 v1.2.dll

IMPHASH 1bebe65d7beb5ae91c76a79144f455cb
SHA256 8a882d039e5b0a3577aeec6a0ec3b614ee3a53adc8a767e477c966095268bf56
MD5 893b7e490ba99643d2785eb26e16bd5e
SHA1 ee412b8f0355c11f7335122c7bd530fba8ae77b7
SHA512 c39449588167c8dbfd2db28b4f766b4d02301f4ff104e3e5b659b7fe969849b51ea606b6d2757a73b34fd1e5a381d1f9536465fb7597d9c9bb06bcee2316f4e9
SSDEEP 12288:N0UEx+T+IIFVZBedFZABENqu3hHH9VbTIwyCzqbuPiM3p6:N0JLdFVZBedFZABENqu3xH9VbTZyCzd
TLSH
T1EBA48E90F4A290B5C15C0070B5EE379F5A7D1D640B1469E3B3F82DA4A7F12F229F6EA1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

392765

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\Emmanuel\source\repos\iw4x SastashaFied v0.1\Release\Dll1 test test.pdb

kernel32

LoadLibraryA CloseHandle GetProcAddress GetLocaleInfoA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter VirtualFree VirtualAlloc VirtualQuery HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread GlobalAlloc GlobalUnlock HeapReAlloc HeapAlloc HeapDestroy GetThreadContext GetCurrentProcessId FlushInstructionCache SetThreadContext OpenThread MultiByteToWideChar InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateThread DisableThreadLibraryCalls WideCharToMultiByte GlobalLock GetLastError GlobalFree Sleep CreateToolhelp32Snapshot FreeLibraryAndExitThread

user32

GetClipboardData CallWindowProcW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW GetWindowTextW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos SetClipboardData GetCursorPos OpenClipboard GetAsyncKeyState EmptyClipboard EnumWindows SetWindowLongW CloseClipboard

shell32

ShellExecuteW

d3d9

Direct3DCreate9

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?good@ios_base@std@@QBE_NXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPBD@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140

strchr _CxxThrowException _except_handler4_common memset __std_type_info_destroy_list __std_terminate wcsstr __std_exception_copy __std_exception_destroy __CxxFrameHandler3 strstr memcpy memchr memmove

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _execute_onexit_table _cexit _initterm _initterm_e _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _invoke_watson

api-ms-win-crt-stdio-l1-1-0

fread _wfopen fwrite __stdio_common_vfprintf __stdio_common_vsscanf fclose fflush ftell __stdio_common_vsprintf __stdio_common_vsprintf_s fseek __acrt_iob_func

api-ms-win-crt-string-l1-1-0

strncpy strncmp strcpy_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

_libm_sse2_cos_precise _libm_sse2_sin_precise _CIfmod _CIatan2 _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_acos_precise _libm_sse2_sqrt_precise ceil