n.rar
- SHA256 1a33c5c6f599336ac34ee24957c1cd72704129aec660134120cbde98691ca873
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release/RetracCheat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release/RetracCheat.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
Behavioral task
behavioral3
Sample
Release/RetracCheat.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
Release/RetracCheat.pdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
Release/loader.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral6
Sample
Release/loader.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target n.rar
- Size 1.8MB
- Sample261017-2dhvdaet8w
- SHA256 1a33c5c6f599336ac34ee24957c1cd72704129aec660134120cbde98691ca873
- MD5 d64655fd3bf5d18bf856030c9d1aad0e
- SHA1 52afd3e70a3be1548aaf103a2e05c814b435ca03
- SHA512 7e06631e614f36628cbd97dfd911e9797e9061fc767d2fbf0c24cd20c3eb43da95901fdf0ecbdd3ae42286491c4457d8b87865d7d281e399f0f84e18d47dba64
- SSDEEP 49152:zimzvHSTe3l49i+iWleLiM8GzqD2iKX66oe0hsd:zHzvyC3YwLc3MX6Zq
- TLSH T184953373FAF11514468CC90EF358D8F111A1F5E0AD2F353A3E6671B68A1BE903B944AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/RetracCheat.exe unpack001/Release/loader.dll
File Explorer
-
n.rar.rar 1.8MB
-
Release/RetracCheat.exe.exe 1.3MB
-
Release/RetracCheat.pdb4.8MB
-
Release/loader.dll.dll 108KB
Release/RetracCheat.exe
- IMPHASH 5e9e9b357f4fa74695e3bbdada0b9740
- SHA256 f12ed9be6610ed57fcd424c3a500eaa0b4360a5e6074c0285d121c6cf5f954d5
- MD5 e44226455bee4b5a57ee8648c9739cdf
- SHA1 d55599ea193df2a233ab2337b1afb417e1ef251f
- SHA512 57884da8447188484a313f544c45032ba885fb801bf2749039c0dd877315050543f224eaec82e942dc02ce3c44d5c9a41dbf02732629458113f81c4c8ffff0fb
- SSDEEP 24576:jq1hxFBLRoxolqHxxUAJRFsKa6jJBenV3ZRZbVZul3B9r:jqrxFFRsolYZJED6CnDRZs3
- TLSH T1A155BF5EF9E950FCD036E478D666A91BFB317819071059EB33E048981F2A6D06FBB603
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
566576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\zyro\Desktop\coding\PulseRetrac\PulseRetrac\x64\Release\RetracCheat.pdb
dwmapi
DwmExtendFrameIntoClientArea
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
_wfopen
_kbhit
__stdio_common_vsprintf_s
fgetc
__acrt_iob_func
_get_stream_buffer_pointers
fwrite
fclose
fflush
_fseeki64
__stdio_common_vsprintf
fgetpos
fputc
_set_fmode
ftell
setvbuf
ungetc
__stdio_common_vsscanf
fread
__p__commode
fsetpos
fseek
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
realloc
_callnewh
free
api-ms-win-crt-string-l1-1-0
tolower
strlen
_stricmp
strcmp
toupper
strcat_s
strncpy_s
strcpy_s
isalnum
isxdigit
strncmp
_wcsicmp
strncpy
isalpha
isspace
api-ms-win-crt-runtime-l1-1-0
system
terminate
_c_exit
__p___argv
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_beginthreadex
_register_thread_local_exe_atexit_callback
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-math-l1-1-0
tanf
roundf
acosf
asinf
atan2f
ceilf
cosf
floorf
fmodf
__setusermatherr
pow
powf
sinf
sqrt
sqrtf
ldexp
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
strtol
atof
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
__C_specific_handler
strchr
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
__current_exception_context
__current_exception
_CxxThrowException
memcmp
memmove
memcpy
memchr
kernel32
AcquireSRWLockExclusive
GetModuleHandleW
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
GetCurrentProcessId
GetTickCount64
GetCurrentThreadId
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
SetUnhandledExceptionFilter
QueryPerformanceCounter
FreeLibrary
GetProcAddress
QueryPerformanceFrequency
GetLocaleInfoA
GlobalUnlock
WideCharToMultiByte
GlobalLock
WriteProcessMemory
FindFirstFileA
SetConsoleTextAttribute
SetConsoleTitleA
GetCurrentProcess
GetStdHandle
WriteFile
DeviceIoControl
VirtualAlloc
FindNextFileA
FindClose
WaitForSingleObject
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetTempPathA
CopyFileA
GetLastError
GetFileAttributesA
Process32NextW
CreateFileA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
Process32FirstW
CloseHandle
WritePrivateProfileStringA
FlushConsoleInputBuffer
CreateFileMappingA
ReadProcessMemory
CreateProcessA
CreateDirectoryA
MapViewOfFile
GetPrivateProfileIntA
lstrcmpiW
GetPrivateProfileStringA
VirtualQueryEx
MultiByteToWideChar
GlobalAlloc
GlobalFree
user32
GetMessageExtraInfo
GetKeyState
GetKeyboardLayout
GetForegroundWindow
SetCapture
SetCursor
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetWindowThreadProcessId
DispatchMessageA
GetWindowRect
DestroyWindow
IsWindowVisible
SetWindowPos
SetMessageExtraInfo
keybd_event
GetSystemMetrics
ScreenToClient
GetCapture
TrackMouseEvent
OpenClipboard
ShowWindow
IsWindow
GetKeyNameTextA
GetAsyncKeyState
IsHungAppWindow
SetWindowLongA
GetWindowLongA
SetWindowDisplayAffinity
MapVirtualKeyA
MessageBoxA
EnumWindows
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
LoadIconW
FindWindowW
LoadCursorW
GetClientRect
PeekMessageA
PostQuitMessage
GetDesktopWindow
RegisterClassExA
UpdateWindow
SetForegroundWindow
ClientToScreen
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
shell32
ShellExecuteA
ole32
CoCreateInstance
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Mtx_unlock
_Thrd_detach
_Query_perf_counter
_Mtx_lock
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
_Thrd_id
_Thrd_join
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
d3d11
D3D11CreateDeviceAndSwapChain
gdiplus
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipGetImageHeight
GdipGetImageWidth
GdipAlloc
GdipFree
GdipBitmapLockBits
shlwapi
ord12
imm32
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
555KB
Virtual Size
555KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
574KB
Virtual Size
581KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=1, id=260, version=35222,
count=31, id=261, version=35721,
count=6, id=257, version=35721,
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=27, id=257, version=35222,
count=394, id=1, productName=Unmarked objects,
count=8, id=265, version=36260,
count=1, id=255, version=36260,
count=1, id=258, version=36260,
Release/RetracCheat.pdb
- SHA256 80e8f179b8609c1fffc2a8f5afebd873d9dc581d1eb46bdec46a0a68919d5d7e
- MD5 257ff68d929a929a6c368641e434b6e9
- SHA1 d3df08f43c310ecdc5f4c17fdfe65581005bb24b
- SHA512 c9938e94bcfa6f3dbebc5b9b6fee965cf11b43a712ab983c258eb24b06a2ee7c315b156014e00a31b65ce0e72d484ff7901cf9db7ac34137aa1e3c8abd144fa9
- SSDEEP 98304:qkdDiJawvqyZEzjs81F2mwHBwyltkBeIkBgWS6VdFDkBX9TBlBdBqBZBzB1BhBri:qpF3pVri9u
- TLSH T1EE366D72F6499D23D43F023AA19B0F1C63A9991297EF67C7890DE25C9CCA344DF1E681
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/loader.dll
- IMPHASH 1b5b5b4032908bbd119ef7f7d2031445
- SHA256 a05d2429feac58d11614452baf855fc2a544d358f9c921c4af72f6de2b930eca
- MD5 4cb8b0d078ebbf7c665f97e6b8751569
- SHA1 b54ce3fc6ca38128a70acd790a07e096d0388767
- SHA512 0bc49f43894f16d34f826d508018189336a7227f5b2699aa29c5cb95eb4f7f6a74dfdf24848fb236fead4642be64afd788f49bc8c06c2e2a827ed9fd34f463a7
- SSDEEP 1536:wzp5OlwlrLjodwS5bgkYYLAtRTqPKb2c+gPINHspglNYy3fCYYmzPiHi:XKFwnPYltZqPKpINMpgl6mZYmzPi
- TLSH T1FFB30297B20048DAC67846F916831E01F9D0BC1447A5B3D32B3BA7DF9DA03C8A175EA9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileW
CreateProcessW
CreateThread
GetTempPathW
GetTickCount
WriteFile
DllMain
_DllMainCRTStartup
__xl_a
__xl_z
_tls_end
_tls_index
_tls_start
_tls_used
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.CRT
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
2B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ