BILAL CHEATS[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BILAL CHEATS.exe
Size 14.1MB
Sample261027-vafsaas18q
SHA256 be7eb1e4fc2e08024a0db9b8bf71d2b8ab6dae6a39165de6752123ee9b86d502
MD5 f6e1e3a22958e6077c12a8ee6eea0c44
SHA1 129822202a4d2ab04a357e62d10e27b9b08bba7c
SHA512 1c8568a31feb9e6c1c7b96e91030547d1967cb5edb44dc6c2e06a89c7e03a6a20fd3db662653bdf7d2d0c17f41eb9c3126ab629846f093cebfb30e020d799ce7
SSDEEP 393216:JjTDMP24IFiImwxOyGY1ExxV5LeIihrz:ZeIvmwqPxb5Lenhrz
TLSH
T14BE62342F28987ACF013247E59729703E32578659F91878EA3547F16DFD30A09F7AAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BILAL CHEATS.exe

File Explorer

BILAL CHEATS.exe

.exe 14.1MB

BILAL CHEATS.exe

IMPHASH 20729a7ee0315ceaae8096b70364ce7a
SHA256 be7eb1e4fc2e08024a0db9b8bf71d2b8ab6dae6a39165de6752123ee9b86d502
MD5 f6e1e3a22958e6077c12a8ee6eea0c44
SHA1 129822202a4d2ab04a357e62d10e27b9b08bba7c
SHA512 1c8568a31feb9e6c1c7b96e91030547d1967cb5edb44dc6c2e06a89c7e03a6a20fd3db662653bdf7d2d0c17f41eb9c3126ab629846f093cebfb30e020d799ce7
SSDEEP 393216:JjTDMP24IFiImwxOyGY1ExxV5LeIihrz:ZeIvmwqPxb5Lenhrz
TLSH
T14BE62342F28987ACF013247E59729703E32578659F91878EA3547F16DFD30A09F7AAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

323728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\BILAL LOADER\examples\EXE\BILAL CHEATS.pdb

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameA Process32First GetFileAttributesExA WriteProcessMemory TerminateProcess WaitForSingleObject CreateFileW OpenProcess GetCommandLineA CreateToolhelp32Snapshot GetExitCodeThread Sleep GetTempPathA GetLastError GetFileAttributesA Process32NextW DeleteFileA Process32Next Process32FirstW CloseHandle GetWindowsDirectoryA VirtualAllocEx ExitProcess CreateRemoteThread CreateProcessA CreateDirectoryA VirtualFreeEx GetTempFileNameA GetStartupInfoW GetModuleHandleA WideCharToMultiByte IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GetModuleHandleW AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree LoadLibraryA SetUnhandledExceptionFilter InitializeSListHead GetCurrentProcess GlobalUnlock GlobalLock GetSystemTimeAsFileTime GlobalFree GlobalAlloc MultiByteToWideChar IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId UnhandledExceptionFilter

user32

DispatchMessageA GetWindowRect SetCapture GetForegroundWindow TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetKeyState UpdateWindow DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW PostQuitMessage PeekMessageA SetCursor TranslateMessage SetLayeredWindowAttributes DefWindowProcA GetWindowLongA SetWindowLongA ShowWindow RegisterClassExW UnregisterClassW GetSystemMetrics IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetClientRect LoadIconA

gdi32

CreateRoundRectRgn

shell32

ShellExecuteA SHGetFolderPathA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileW

winmm

PlaySoundA

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

iphlpapi

GetAdaptersInfo

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memcmp memchr strstr __std_terminate __std_exception_copy __std_exception_destroy memmove

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf fgetpos fsetpos _get_stream_buffer_pointers fgetc __stdio_common_vsprintf_s ftell __p__commode __acrt_iob_func fputc _set_fmode fflush fclose _fseeki64 __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fseek __stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_get_narrow_winmain_command_line _initterm _initterm_e exit _exit _invoke_watson _c_exit _register_thread_local_exe_atexit_callback _cexit _beginthreadex terminate _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe abort _set_app_type _crt_atexit _wassert

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

_stricmp _strdup tolower _wcsicmp strcmp

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

sqrtf cosf ceilf fmodf powf sinf acosf __setusermatherr