Hazar Full Fivem Hack by satans cheat.rar
- SHA256 a879f8b4edb1a455125f5678220792baed1c3bc8aeca9e9003ea23cb8800d866
Behavioral task
behavioral1
Sample
Fivem W00fer/1} Injector.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fivem W00fer/1} Injector.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
Behavioral task
behavioral3
Sample
Fivem W00fer/2} Built.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral4
Sample
Fivem W00fer/2} Built.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target Hazar Full Fivem Hack by satans cheat.rar
- Size 15.0MB
- Sample261024-xdvrqabx4v
- SHA256 a879f8b4edb1a455125f5678220792baed1c3bc8aeca9e9003ea23cb8800d866
- MD5 46c5d47072e430ac82388e20d7ff444f
- SHA1 7b09bc6f4cab195be3fd8ed218c77f4735d120be
- SHA512 916ba66d0fb9f4bde13c0e2e9ce6c5681e5ded0d8c315d01cf3c07650e7a6d95e8469d6b71ede9ece831fc03504329de65797de29802d686474f8b41959b843a
- SSDEEP 393216:MwnvsL1e9JHqyVDqCZrq/9FtHdCWDwV7WPEgeYcTfm7M:MwkRKNqCZrcFtHdlDwh5ggyM
- TLSH T105F633B5219056580D34C8CE36CCCAFDC855ED923D279C8DEC42FF2ACDA6507AA96732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- A stealer written in Python and packaged with Pyinstaller 2 IoCs
resource yara_rule static1/unpack002/� �衦�.pyc blankgrabber_exe static1/unpack003/H��t@�n.pyc blankgrabber_exe - Codesign digest Mismatch 2 IoCs
File was altered after it was signed.
resource unpack001/Fivem W00fer/1} Injector.exe unpack001/Fivem W00fer/2} Built.exe
File Explorer
-
Hazar Full Fivem Hack by satans cheat.rar.rar 15.0MB
-
Fivem W00fer/1} Injector.exe.exe 7.6MB
-
� �衦�.pyc1KB
-
Fivem W00fer/2} Built.exe.exe 7.6MB
-
H��t@�n.pyc1KB
-
Fivem W00fer/desktop.ini114B
Fivem W00fer/1} Injector.exe
- IMPHASH 965e162fe6366ee377aa9bc80bdd5c65
- SHA256 472c0a80a665c8c28fc8906fd18bd3badbc95806ce09b4afc6a5bcc1aa21579a
- MD5 7010cbf732cb8351b28009392ba96a72
- SHA1 4aa7a5f55d3acd3f25d861453c30668fc957118e
- SHA512 3912c035c593aea53b94c3da3f16cb499dba8bc977f5dc768423fc34b2de84b1470d4397d0513a83e7f2aa05ae9880f2c19d719c8e3f75d15b67da3ea8d9d221
- SSDEEP 196608:2WMD5hv5CwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWt:MNhvDIHL7HmBYXrYoaUNC
- TLSH T14E863355AA8004F6F967A83ED4C28D5FCB327D649770DAE743744BB54EA39F0483A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
23:41:0c:84:e8:74:88:3e:a1:24:db:af:a5:8e:a3:fb:8a:0d:9d:eb:58:f8:a5:bb:ab:e2:86:cf:09:77:2b:dc
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Chains
Apr 25, 2023
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Serial Number
bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 29, 2021 - Sep 28, 2024
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
6
Entry point
52768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
LCMapStringW
CompareStringW
VirtualProtect
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSectionEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
169KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33138,
count=12, id=260, version=33138,
count=8, id=259, version=33138,
count=3, id=253, version=34321,
count=9, id=259, version=34321,
count=17, id=260, version=34321,
count=40, id=261, version=34321,
count=11, id=257, version=33138,
count=158, id=1, productName=Unmarked objects,
count=25, id=260, version=34436,
count=1, id=258, version=34436,
� �衦�.pyc
- SHA256 52346f7d5ca7d1e89df6c9c0c5b79deb9137f33e5ef3858ae4d87862661071a5
- MD5 5bbff4a91d64cfd73b1cf510bc17db02
- SHA1 9ca91d3a1dbd0edf94afca28d9f4ed65f5e894c9
- SHA512 096115d83abd540dc719bc56015a45ce055ddb45aea69f783df6fb470e66e6769483a0883f46bb2a290454c903eaf341e3518023d8adfab2080a4734e0c450c6
- TLSH T17E3121F44E483A57DBCCA271C4276C19D26E8932B01A2743671E62F99DCF72DC528624
- MD5 SHA1 SHA512 TLSH
-
A stealer written in Python and packaged with Pyinstaller
Fivem W00fer/2} Built.exe
- IMPHASH 965e162fe6366ee377aa9bc80bdd5c65
- SHA256 aa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638
- MD5 d88ce7357a239ada102b6d161379673f
- SHA1 695e92f476c02bebcb573bbdb5f859556aa16153
- SHA512 4cea591a06278a3544966d31376ea28f0eeb6c1223f176f792081af76436a02f2ab366936ff8f45bc12070490f5e4b350cdf861d5240b8a4d12752c415677d5a
- SSDEEP 196608:vWuDh6Q5wfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWs:pFoIHL7HmBYXrYoaUN7
- TLSH T1738633466A8044FBF977A43DC9C14A1FCA327E215760E9E74374876A4EA36F04C7A327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
08:22:75:30:4b:4f:0d:3d:3d:1e:31:e2:ca:42:25:83:09:68:dd:39:53:5f:87:ad:4a:55:6c:27:51:98:c9:81
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Chains
Apr 25, 2023
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Serial Number
bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 29, 2021 - Sep 28, 2024
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
6
Entry point
52768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
LCMapStringW
CompareStringW
VirtualProtect
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSectionEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
169KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33138,
count=12, id=260, version=33138,
count=8, id=259, version=33138,
count=3, id=253, version=34321,
count=9, id=259, version=34321,
count=17, id=260, version=34321,
count=40, id=261, version=34321,
count=11, id=257, version=33138,
count=158, id=1, productName=Unmarked objects,
count=25, id=260, version=34436,
count=1, id=258, version=34436,
H��t@�n.pyc
- SHA256 9a3a310ac056959c6e01f75c946032cb885626ad90d3ce9796c6ab9bade3172a
- MD5 d91c4cd2337409eb422926d238f15654
- SHA1 c55385e2e53a39600556b3682b5efd347d7d6926
- SHA512 54bfc2ac854efbf65a4a30aa71a66069b3baae4699e8e401eb0666f3fcdd9777ca8d6872a334301a499db1abfcb25ea252028bb0a223a15320e40fe5b4e9f65d
- TLSH T10A31F1F04E183A43EBCCE671852B5C25A25EDA32B01A2783671E77F94CCF66DC528520
- MD5 SHA1 SHA512 TLSH
-
A stealer written in Python and packaged with Pyinstaller
Fivem W00fer/desktop.ini
- SHA256 5b75499bc8d4b3adabc8b46a56039efcd8bde48de42d14c512a679b4b096acf9
- MD5 b6000bad4811573953f1a88b13e81b12
- SHA1 d6f5258c500356fb2223b9e6552dca2d4f901344
- SHA512 0970daa84c1513b527b913ae7a8c3ec76258905373cada8ad8c2fadafb2414a726a9c4a990890118f29beddbf9c5448e62949d0d597226f31379c1e85c6f00eb
- TLSH T11FB09213A53EC0F0C117C84BE00D8A689A286C2BA87BA41085D46192D8A86184E9CA6E
- MD5 SHA1 SHA512 TLSH