71aff12bfa79175f0a0b9260803776cad0b06cd0fe32a1ca5a3e0fa25811c825
- SHA256 71aff12bfa79175f0a0b9260803776cad0b06cd0fe32a1ca5a3e0fa25811c825
Behavioral task
behavioral1
Sample
GameCheat修改器/GameCheat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 71aff12bfa79175f0a0b9260803776cad0b06cd0fe32a1ca5a3e0fa25811c825
- Size 1.3MB
- Sample261030-d2216avycx
- SHA256 71aff12bfa79175f0a0b9260803776cad0b06cd0fe32a1ca5a3e0fa25811c825
- MD5 c61f97df1507ac67b7f13b6f5292dab1
- SHA1 63851a9f9a40ee029dabd8bf3ceaa3dc328565d0
- SHA512 d04a1eb4264bee81ed1fbeb1fd8e079f06cc023acf9f9b98765315965a34ecb12e1b7d91ee715439fcd783fa5b55732f140057bbe072f5b698d7b53833fd341e
- SSDEEP 24576:HTrpMLZB5wD3RWE6QA8c/Wb9wIQTKHCeCqnlH8thoxPI0ZS2KIXcv:2dBKD3RX6Qw+bQWjCOlmYQ0Y2KGW
- TLSH T17555333D244A7508DA3CB5F812966E77B3E964299CCFA72608E105FE855333F1267B83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/GameCheat修改器/GameCheat.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/GameCheat修改器/GameCheat.exe unpack002/out.upx
File Explorer
-
71aff12bfa79175f0a0b9260803776cad0b06cd0fe32a1ca5a3e0fa25811c825.zip 1.3MB
-
GameCheat修改器/GameCheat.exe.exe 1.4MB
-
out.upx.exe 5.5MB
GameCheat修改器/GameCheat.exe
- SHA256 aac8e3e6ba549e23fd6ba00a97dfca9d0c394fb8a04d0e0abc4902d95934ac5c
- MD5 20d93a47725cc77865d95f22ec9dad7e
- SHA1 fede1be4ab23d1eef98c9690c3403f718cef5888
- SHA512 45cd608018a13e436f0ef8757c92d4164a3010d1b7b00e1da022096341a283938faeb9ba7b09012d99ac525ad348789a9e924ae9033576cce6831595b69847f6
- SSDEEP 24576:NfSRpvbINGh7Ry0ZToZPIWrUwUH6R93dMeKIBK+GWqg1bUGXLG/1o/F6l:1SnTI0ZRPTohIWrDU2drbCC1bUO6/Kc
- TLSH T1D665330186A885F3E11D61B17841DAE880BFBEE451CADD939BF9EA1F5D2E3C355132B0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5927632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
58KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 f850a053d243473c04b1a16ebc65fe99f3dd9ce7cadce247a2176e9297c75af8
- MD5 3499bb719d7820e4db0db5e5a80ac5c0
- SHA1 90870dd0ef57c18d6b4b21b982dbf9aeabf5ceb5
- SHA512 84eee90ddb13094ad6b6b41ccb0e9fc97427fc4f4475d2bd5aba3b5e0b906f8f6c1ffe615fe6b612e5729bf29e2ccc6d53ca4d1a5fd933c1deaf8ac9d2dd5694
- SSDEEP 49152:fwgj4nKWRQ5SpkFniC54SVm/gSQFqusgevRHCh2KZa50FzrX:1j8nPC5RaRPKQS
- TLSH T1B846C56A37A58118C15E803981964F61BA3374B90FFADEFB0D804AA45F33AD05E3FD65
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4576208
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
385KB
Virtual Size
384KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
53KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
114B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
632B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
109B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
195KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
229KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
209KB
Virtual Size
209KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ