Hell Fivem Cheat_dump[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Hell Fivem Cheat_dump.exe
Size 2.6MB
Sample261107-1s6djs118j
SHA256 01306efafcb53c34e4cf8114af8e3e90f25b48f5481aa5235f5bf96b392992ed
MD5 35ba26c74ff28dd311e6effb1d3bc2fd
SHA1 86a3fec722da55402d47c7c69986f159589ee2d5
SHA512 5a79dff2b51691878f1406df8a57259e41666080fda2a58c905787245a3b67ef86576f587e68820a4d81d4e138c1945e192e677627aededb9ee76188b1f3c8d7
SSDEEP 49152:Unf1PpfuQRcB2VML6FWvssKBT8+HEm2cLYwccMnNlaplVknV:U9P4Q+BrsicLYwccppl
TLSH
T120D5BE47A3A146E9C467D038C6479313F2727808272097EB6BE44EA61F63AE16F3F751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Hell Fivem Cheat_dump.exe

File Explorer

Hell Fivem Cheat_dump.exe

.exe 2.6MB

Hell Fivem Cheat_dump.exe

IMPHASH fd6573933a4faf864c4575f1e11fb4f4
SHA256 01306efafcb53c34e4cf8114af8e3e90f25b48f5481aa5235f5bf96b392992ed
MD5 35ba26c74ff28dd311e6effb1d3bc2fd
SHA1 86a3fec722da55402d47c7c69986f159589ee2d5
SHA512 5a79dff2b51691878f1406df8a57259e41666080fda2a58c905787245a3b67ef86576f587e68820a4d81d4e138c1945e192e677627aededb9ee76188b1f3c8d7
SSDEEP 49152:Unf1PpfuQRcB2VML6FWvssKBT8+HEm2cLYwccMnNlaplVknV:U9P4Q+BrsicLYwccppl
TLSH
T120D5BE47A3A146E9C467D038C6479313F2727808272097EB6BE44EA61F63AE16F3F751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1503764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nilsv\Desktop\ALL\Sources\FIVEM INJECTOR LOADER SOURCE + CHEAT SOURCE\FiveM External Cheat Source\hellsservice\femulis\FemulisExternalSrcsKEVINKURWA\x64\Release\HELLSERVICES.pdb

d3dx9_43

D3DXVec3Transform D3DXMatrixTranspose D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SetLastError FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetStartupInfoA AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockExclusive VerSetConditionMask AcquireSRWLockExclusive EnterCriticalSection SleepConditionVariableSRW QueryPerformanceFrequency GetModuleHandleW GetLocaleInfoA CreateFileMappingA GetProcAddress LoadLibraryA K32GetProcessMemoryInfo GetFileAttributesA GetCommandLineA GetModuleHandleA ExitProcess LocalFree GetLastError GetTickCount64 GetCurrentProcess ReadProcessMemory VirtualProtectEx GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead CloseHandle Process32Next K32GetModuleFileNameExA CreateToolhelp32Snapshot OpenProcess Module32First Module32Next Process32First GlobalUnlock VirtualFreeEx WideCharToMultiByte MultiByteToWideChar LeaveCriticalSection UnmapViewOfFile QueryPerformanceCounter FreeLibrary CreateDirectoryA CreateRemoteThread VirtualAllocEx GlobalLock GlobalFree GlobalAlloc Sleep MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA

user32

CreateWindowExW SetWindowPos DestroyWindow GetWindowRect IsWindow DispatchMessageA SetWindowLongA SetCursorPos ReleaseCapture IsWindowUnicode MoveWindow UnhookWindowsHookEx DefWindowProcA SetLayeredWindowAttributes ShowWindow SetCursor TranslateMessage SetCapture SetWindowDisplayAffinity EmptyClipboard CloseClipboard SetWindowsHookExW GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient OpenClipboard LoadCursorA GetMessageExtraInfo GetKeyState GetWindowThreadProcessId PeekMessageA CallNextHookEx SetClipboardData UnregisterClassW GetClientRect GetWindowLongPtrA PostQuitMessage FindWindowA UpdateWindow GetCursorPos GetClipboardData mouse_event GetAsyncKeyState GetForegroundWindow RegisterClassExW

advapi32

CryptHashData OpenProcessToken AdjustTokenPrivileges ConvertSidToStringSidA DuplicateTokenEx SetThreadToken LookupPrivilegeValueA SetTokenInformation PrivilegeCheck RegGetValueA CreateProcessAsUserA RevertToSelf CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash GetTokenInformation CryptCreateHash CryptGenRandom

shell32

SHOpenFolderAndSelectItems SHGetFolderPathA SHParseDisplayName

ole32

CoInitializeEx

ws2_32

WSAIoctl accept WSASetLastError listen getaddrinfo recv ntohs getsockname getpeername bind __WSAFDIsSet closesocket select inet_pton WSAStartup send setsockopt socket WSAGetLastError ioctlsocket connect htons getsockopt htonl freeaddrinfo recvfrom sendto gethostname ntohl WSACleanup

msvcp140

?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock _Cnd_broadcast ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Winerror_map@std@@YAHH@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z

normaliz

IdnToAscii

crypt32

CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertCreateCertificateChainEngine CertOpenStore

wldap32

ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord143 ord79 ord30 ord200 ord301

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp _CxxThrowException memcpy memmove __current_exception_context __std_exception_destroy __current_exception memcmp __C_specific_handler __std_exception_copy memchr __std_terminate strstr memset strchr strrchr longjmp

api-ms-win-crt-runtime-l1-1-0

exit strerror _beginthreadex _errno _getpid terminate __sys_nerr abort _invoke_watson _register_thread_local_exe_atexit_callback _c_exit _configure_narrow_argv _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _read fgetc _write _close fwrite _open _lseeki64 _set_fmode fgets __stdio_common_vsprintf fclose feof fgetpos fputs fopen setvbuf ungetc fsetpos fread _wfopen _fseeki64 fputc __stdio_common_vfprintf fseek __acrt_iob_func ftell __stdio_common_vsscanf __stdio_common_vsprintf_s _get_stream_buffer_pointers fflush

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc calloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

atan2f sqrtf ceilf _dsign log logf acosf pow _hypotf powf fmodf __setusermatherr sinf sqrt _dclass cosf

api-ms-win-crt-convert-l1-1-0

atoi atof strtoll strtoull strtod strtol strtoul

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_access _stat64 _unlink _fstat64 _unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-string-l1-1-0

strncpy _stricmp toupper strncmp strcpy_s strcmp _strdup strpbrk isupper strcspn strspn tolower

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64