Essentialsv1.8_[unknowncheats.me]_.zip
- SHA256 d750a8e660b2c5a13e1255b3a11bc213ccc8435cbdf0bd82394be171690fbb62
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Essentialsv1.8.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
33 signatures
150 seconds
General
- Target Essentialsv1.8_[unknowncheats.me]_.zip
- Size 2.9MB
- Sample261030-v8pg3szzbw
- SHA256 d750a8e660b2c5a13e1255b3a11bc213ccc8435cbdf0bd82394be171690fbb62
- MD5 f7750a8bf7948b226203f398d9f870f7
- SHA1 202ebbd7a745f77de514870c08cf78a4e3cf5ebb
- SHA512 fa1b5b1889fd5fcb8453f883f77d7d2c2a620574145e44717c371bc03c135b41aae5a634fcbddd77f6717fac4e3d655bb06c557283dcf46c10bb1b531be63713
- SSDEEP 49152:PTYBLuTZvV3fsALwmckR36Qk2GEVFY+yWoU/TaALE/xD539x:PcQTT76kR3Ho+XGV3L
- TLSH T102D533E6C780BC9E6C1B0F684F53CE471584683D169BDCEEDE3827B050E72AB525225E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Essentialsv1.8.exe
File Explorer
-
Essentialsv1.8_[unknowncheats.me]_.zip.zip 2.9MB
-
Essentialsv1.8.exe.exe 5.2MB
-
client_dll.json206KB
-
grenades.json108KB
-
offsets.json1KB
Essentialsv1.8.exe
- IMPHASH 4b3acda85a66e48477f7cb37897c26a3
- SHA256 a519aa4057c5bad962a0e371f158246f3f59ce6d6ba293a99ef058ef2991c4d8
- MD5 26e437d1b4077f41435be88a273fdb13
- SHA1 8f335f9839d1db84a55d8db974c483dee79caaed
- SHA512 36a5cc89862b58a49c63b424d211a28e8152a5b585e024be90ba0e60b575e3a555736ee620692c67994bd3fc19be239ec5a9a9ab6f5000ff1f5432e850ac2800
- SSDEEP 49152:i22Q+z7Dv2m9Coxwhq7zNTsR1T9DcNvWcg4+4C0Bfaw45OH8e6pf3FgmLsmLA:ivSovzoT9A+fQHkx3F1hA
- TLSH T18046CE03F39689D9D157A63885739307E33278186B2143CB6BA87A75EF6B3D01E76780
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1575576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\nikor\source\repos\cheetah\x64\Release\cheetah.pdb
kernel32
Module32FirstW
Module32NextW
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
SetConsoleCtrlHandler
SetConsoleTitleA
GetModuleFileNameA
GetCurrentThreadId
Sleep
GetTickCount
CreateFileA
GetFileSizeEx
ReadFile
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
Process32FirstW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
SetFilePointerEx
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Process32NextW
MultiByteToWideChar
CreateToolhelp32Snapshot
FindClose
FindNextFileA
GetDriveTypeA
FindFirstFileA
GetCurrentProcessId
AcquireSRWLockShared
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
WakeAllConditionVariable
ReleaseSRWLockShared
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OutputDebugStringA
IsValidLocale
GetCurrentProcess
FormatMessageA
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
WaitForSingleObjectEx
GetExitCodeThread
LocalFree
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
SetEndOfFile
user32
SetClipboardData
GetClipboardData
EmptyClipboard
GetAsyncKeyState
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
MapVirtualKeyW
CloseClipboard
IsWindowUnicode
DestroyWindow
SetWindowPos
GetSystemMetrics
ShowWindow
GetKeyNameTextA
SetWindowDisplayAffinity
AttachThreadInput
MapVirtualKeyA
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
SetFocus
GetWindowLongPtrA
UnregisterClassA
PostQuitMessage
SetWindowLongPtrA
RegisterClassExA
UpdateWindow
SetForegroundWindow
GetWindowThreadProcessId
FindWindowExW
IsWindowVisible
GetWindowTextW
DispatchMessageA
MessageBoxA
TranslateMessage
PeekMessageA
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
advapi32
GetTokenInformation
RegCloseKey
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
shell32
ShellExecuteW
winmm
timeBeginPeriod
timeEndPeriod
d3dcompiler_47
D3DCompile
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
d3d11
D3D11CreateDeviceAndSwapChain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
422KB
Virtual Size
422KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3.0MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=259, version=27412,
count=180, id=261, version=27412,
count=1, id=253, version=35207,
count=12, id=259, version=35207,
count=18, id=260, version=35207,
count=98, id=261, version=35207,
count=32, id=260, version=27412,
count=23, id=257, version=27412,
count=255, id=1, productName=Unmarked objects,
count=27, id=260, version=35216,
count=37, id=265, version=35229,
count=1, id=255, version=35229,
count=1, id=258, version=35229,
client_dll.json
- SHA256 a6463a4f77c8d4984baeadce50837eecc7e47cd3f507599ec3813cf633f09499
- MD5 f2e3a5db2a6a5d6e8f10f9e4e3081ebc
- SHA1 12597b335d8928461a9da89f42183beaa7e53d55
- SHA512 90fb03b12ea41678fb4b55fd42c72245295954445e315e9bc7dcfba961287225204a88579e83c8c99fdcb79db0e6bfb98aaf7d705955bc29f0340c633a11d709
- SSDEEP 1536:R1sjmmbYLigGH6oNo1vU+4kiU+JjUHAP6uoVS0bJ8ff2RUV:omvMmy+4ki6XbxUV
- TLSH T11924D158E4748CA376CA3A7618FDA742B374A2978C597C247B8C580C4F4C92E317AF5B
- MD5 SHA1 SHA512 SSDEEP TLSH
grenades.json
- SHA256 6c654e1902f5d63423ccc41143cc0636d832e3906d7b6082dd32f27ed167cd12
- MD5 e2db534180989d31deec598086185f9c
- SHA1 2665ca1061150e8aa8645ed56e604ff08ed09553
- SHA512 eb3b54ff4408845370467ef8e22a3030e7932d424a16abca3d25c84a5352cfb4e02663ee761b6eff208ae263a319083ed31feaa7d317a624bd3c85dabc431d24
- SSDEEP 384:/7EtParpyMCytQ6kypiMCnMOhJq50PxRMg/lwDNWnCETXlEsklax4zL60Rg8u8tO:jEaphQ6kPM4jVPxqdN3EJkIbTH
- TLSH T1C8B3533BC118CC075AB923B559E9520AF62503EF91C0281FBBFC096D4FBB9019D5EE5A
- MD5 SHA1 SHA512 SSDEEP TLSH
offsets.json
- SHA256 033bb81a3eac8407b0cfcff4438a6781d9c77d5801d12d30ff074aabcb031aaa
- MD5 2cdece4648ed01bfba9d12bfe7a5a186
- SHA1 000f8c86d7801c2de437640f6d30093bf39bd140
- SHA512 50e6a138047ae50968d2a53954ccd6bb813e4629f81734d0524230d811c7abd8ca25370962b7edd4718eea3752e454dd8d365ab074d25856f38b2e0ca74077a4
- TLSH T11A217665E63C3C9C318011AD5E616A57A92172930C6B3CBFB0C010CECF4D11EC7BE80A
- MD5 SHA1 SHA512 TLSH