eService Free Internal.zip
- SHA256 2c81c565eb055b8d7c4d502107cd8487187b843b23853d46fe80410cd2ae1098
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eService Free Internal.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
eService Free Internal.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target eService Free Internal.zip
- Size 65KB
- Sample261024-y8dblab17w
- SHA256 2c81c565eb055b8d7c4d502107cd8487187b843b23853d46fe80410cd2ae1098
- MD5 a3aeead192cec768afd1163c92b82fd0
- SHA1 68d2598222a09303b5843ab41d8b9be40b07ec83
- SHA512 f4685dce9926b0d9a588b5a10178810f6a7392ee21ea7cc26938790cf4743ac74aa29917548e0935add51690913383b86f7541c7d40f50424cbdea21943b936a
- SSDEEP 1536:N6I6fpAm+vKCGkwlLRGr77B1XxHLahKGgRXywTr:ipAzSC3wlLUn7BHHGhKGgr
- TLSH T13E6302C9B38B432025B7AD97F0D629EA3482515F23577C05B0813DEA86C77CED8D6E62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/eService Free Internal/cheat.dll unpack001/eService Free Internal/injector.exe
File Explorer
-
eService Free Internal.zip.zip 65KB
-
eService Free Internal/Start me To cheat!!!.bat.bat .vbs 758B
-
eService Free Internal/cheat.dll.dll 65KB
-
eService Free Internal/injector.exe.exe 75KB
eService Free Internal/Start me To cheat!!!.bat
- SHA256 b91a35bda20bab937513299e422aae3811351ff478fbc364323d192dfca2c77e
- MD5 bb01ddfec95fc5e72996b7b905a7acf3
- SHA1 26546019d2672304e2adaf4c55ecdb4d14c5d96b
- SHA512 71c4b653ef796081e28a3c0994ced1eadc8b3c61978b4e9c0cbd99214851d16e5453a470f26b1782cf6aa64fdf80642222f14b4958c165ec8cc4f128bb37d17a
- TLSH T161016D004106825322E791B5C721345DF41FF14769254870F453A0F9EEBE6846BEFAE9
- MD5 SHA1 SHA512 TLSH
eService Free Internal/cheat.dll
- IMPHASH 6ace26ecdcec83a7875db85528363f4c
- SHA256 837febbc90f15d5adc75f10d2fde73337f39d4f279d83699e578bccd14e0ad31
- MD5 2df7cef0ecac4e2c135c21c9186fd4e4
- SHA1 9b90cca91e16eb5238fff5fde1bb843cdea79cba
- SHA512 2c4fce78f1347499cbf9ea3e6d00b5ea9bf329947c6b6554e06069ec56de8bf578c9f4d63e0e6ecf5defb5dddd24aa028a9453abf05d8fabd4125a916d4000a0
- SSDEEP 768:qY+wEbZHez1ENVtpuJK5hn0i5L7MSgq+4/ktaXVKRi+VHHeTZmDEk88g4W3M/UY4:qYybZH7rtg4/YaXDrZmFW88dKWQ+cD
- TLSH T18353190961D641B9E475A479CE772662C37138481720D7CF27E00A193FBBB906F7BB62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
48328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\elixxxooo\Desktop\eService Fn Internal\Build\cheat.pdb
kernel32
VirtualProtect
VirtualAlloc
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
user32
GetClientRect
FindWindowW
GetAsyncKeyState
GetSystemMetrics
ScreenToClient
GetCursorPos
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
__std_type_info_destroy_list
_CxxThrowException
wcsstr
__std_exception_copy
__std_exception_destroy
__C_specific_handler
memset
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-math-l1-1-0
sqrt
sinf
cosf
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_cexit
_execute_onexit_table
_configure_narrow_argv
_initialize_onexit_table
_initialize_narrow_environment
_seh_filter_dll
_initterm_e
_initterm
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=34321,
count=8, id=260, version=34321,
count=20, id=261, version=34321,
count=6, id=257, version=34321,
count=5, id=257, version=27412,
count=67, id=1, productName=Unmarked objects,
count=1, id=265, version=34444,
count=1, id=255, version=34444,
count=1, id=258, version=34444,
eService Free Internal/injector.exe
- IMPHASH 30b15ea1aaebefc34449c6885c0f7439
- SHA256 3b0703dd8c4b1e044c87331c9c630f5c11d39a47feebc5299f53697f4b0d0f03
- MD5 81cca5e3159c70db82d1b2d017389b7f
- SHA1 0c9f98d089239076da2cba83a5c2a150118e4588
- SHA512 d84c23ef9ecb2dd55708916c8740912e3fdd23789333d498b581fde8bea5ac3b579c4c0fdbf0d32a53d6fc8c47e4c647e1b2d205f8490a49d8074a50ea880c62
- SSDEEP 1536:Sc1y9nar6pBaEZ8K/ojiLLTgHb19bplRxyualtxKdfJG:R89nauzaRL2vTgHbPbplGlt+fJG
- TLSH T122732987BB9804E8D1B5D3B8D9E35A05E6B3B9410721ABCF0390911B0F277D5AE7F621
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\MarkD\Downloads\fortnite injector\fortnite injector\x64\Release\injector.pdb
kernel32
GetCurrentThreadId
GetCurrentProcessId
SetFileAttributesW
GetFileAttributesW
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetModuleHandleW
LocalFree
FormatMessageA
GetLocaleInfoEx
FindClose
FindFirstFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
CloseHandle
GetLastError
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
user32
MessageBoxW
advapi32
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
shell32
SHCreateDirectoryExW
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Id_cnt@id@locale@std@@0HA
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
__current_exception_context
__std_terminate
__std_exception_copy
__std_exception_destroy
memset
memmove
__C_specific_handler
memcpy
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
abort
_crt_atexit
__p___argv
__p___argc
system
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_cexit
_set_app_type
_seh_filter_exe
exit
_c_exit
terminate
_register_thread_local_exe_atexit_callback
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
fsetpos
ungetc
setvbuf
fgetpos
fwrite
_fseeki64
_get_stream_buffer_pointers
_set_fmode
fgetc
fputc
fclose
fflush
__p__commode
fread
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
_callnewh
api-ms-win-crt-string-l1-1-0
strlen
tolower
wcslen
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35721,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=28, id=261, version=35721,
count=9, id=257, version=33145,
count=188, id=1, productName=Unmarked objects,
count=2, id=264, version=36260,
count=1, id=255, version=36260,
count=1, id=258, version=36260,