MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Malicious

22 engines flag this signed installer as OfferCore bundler with credential-theft and process-injection behaviour.

offercoreVerified · Plooto Inc
Trust score12Critical
CheatEngine77.exe
6.6 MB
5cc02964795e405e5b…919ba434d8
Antivirus engines
22 of 73 flagged
Code signing
Signed by Plooto Inc
Age
First seen 2 days ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

88%Confidence
Very high
Reasoning

Strong tier-1 consensus on the bundler family combined with multiple high-severity synthetic heuristics for credential theft and injection outweigh the verified signature. The file contacts 15 IPs directly without DNS and matches prior OfferCore imphashes that received malicious verdicts. YARAify community rules also fired on injection and TLS anomalies. While no malicious dropped children were found, the offensive MITRE techniques and rapid new-file prevalence indicate active distribution of a PUA bundler.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.tier1FamilyConsensus.strong=true (bundler, 3 engines)

  2. behaviour.offensiveTechniques includes T1055, T1555, T1003

  3. similarHashes[0].verdict=malicious (ai:malware_family_offercore)

  4. yaraify.ruleCount=7 with CP_Script_Inject_Detector

  5. triggeredHeuristics: MalwareTips.Synth.BrowserCredentialTheft (high)

Points in its favour
  • File is Authenticode signed
  • No malicious dropped children detected
  • No known-malicious hosts contacted
Points against
  • Tier-1 family consensus on OfferCore bundler
  • Process injection and credential-theft MITRE techniques observed
  • Direct-IP C2 with zero DNS usage
  • 7 YARAify rules matched including injection detectors
  • 3 prior imphash matches classified malicious for OfferCore
What to do

Block the hash and treat any installation as unwanted software; remove the file and monitor affected systems for credential theft indicators.

Threat family attribution

offercore corroborated by 3 sources

  • 7 YARA rules
    Borland, CP_Script_Inject_Detector, HUNTING_SUSP_TLS_SECTION
  • VT (73 engines)
    offercore
  • MT AI Engine
    offercore
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
19

Adversary techniques mapped to the MITRE ATT&CK framework.

T1003T1005T1027T1027.002T1033T1055T1070T1071T1082T1129T1552T1552.001T1555T1555.003T1562T1562.001T1564T1564.004T1574
Spawned processes
14
$(unnamed)
C:\Windows\system32\wbem\unsecapp.exe -Embedding
$(unnamed)
C:\Users\<USER>\AppData\Local\Programs\Opera\133.0.5932.24\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-ha…
$(unnamed)
"C:\Users\<USER>\Desktop\CheatEngine77.exe"
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\is-D33HA1U7HA.tmp\CheatEngine77.tmp" /SL5="$16006C,5592098,893952,C:\Users\<USER>\Desktop\CheatEngine77.exe"
$(unnamed)
C:\Windows\system32\services.exe
$(unnamed)
C:\Windows\System32\svchost.exe -k NetworkService -p
$(unnamed)
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
$(unnamed)
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
+6 more processes captured.
Network activity
33
IP addresses15
  • 13.33.19.213
  • 3.170.83.164
  • 3.170.73.34
  • 32.185.145.248
  • 23.218.145.42
  • 107.167.125.189
  • 107.167.96.44
  • 104.18.24.17
  • 23.223.131.50
  • 32.186.225.164
+5 more
URLs18
  • http://statusd.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRNolijWxrE%2B4oss3hMFE8Heagz1AQU9VYiH9m%2Fa1kkUrDhas3A4Vdn6egCEAaV2Cvjf8%2BY2vZ6CGdVSuk%3D
  • https://d1dj9aohuk02ls.cloudfront.net/o
  • https://d3mq5i5bxc3hns.cloudfront.net/zbd
  • https://d1dj9aohuk02ls.cloudfront.net/f/WebAdvisor/images/NEW/EN.png
  • https://d1dj9aohuk02ls.cloudfront.net/f/RAV_Triple_NCB/images/DOTPS-855/EN.png
  • https://d1dj9aohuk02ls.cloudfront.net/f/Opera_new/images/DPS-1954/EN.png
+12 more
Filesystem & mutexes
8
Files written8
  • C:\Users\<USER>\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\metadata
  • C:\Users\<USER>\AppData\Local\Temp\is-D33HA1U7HA.tmp\CheatEngine77.tmp
  • C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION
  • C:\Users\<USER>\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
  • C:\Users\<USER>\AppData\Local\Temp\is-LSVX8MQDDN.tmp\CheatEngine77.tmp
+3 more
Dropped payload

Files this sample writes at runtime

This file drops 2 children at runtime. None are currently flagged malicious in our cache.

2 unseen
  • 07eea42af4d565d09ce6…d3da42Never scanned
    never seen before
  • 0cced5aee76602d3fd7d…4e3b27Never scanned
    never seen before
Network chain-of-malice

Who this file talks to on the internet

This sample contacts 1 host we've verdicted suspicious in our own URL scanner.

1 suspicious11 checked
Cross-referenced with our URL scanner cache. Click any host to see its report.
External threat intelligence

1 corroborating signal from researcher-curated sources

YARAify HIT·7 community rules matchedView on YARAify
  • Borlandby malware-lu
  • CP_Script_Inject_Detectorby DiegoAnalytics
    Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
  • HUNTING_SUSP_TLS_SECTIONby chaosphere
    Detect PE files with .tls section that can be used for anti-debugging
  • pe_detect_tls_callbacks
  • PE_Digital_Certificateby albertzsigovits
Cross-referenced against MalwareBazaar (abuse.ch), YARAify, and the CIRCL hashlookup reference DB.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

5 YARAify4 synthesis
MITRE ATT&CK profile
Defense evasion× 1Cred access× 2C2× 1
YARAify (community)
Researcher-authored rules via abuse.ch
  • Borland
  • CP_Script_Inject_Detector
  • HUNTING_SUSP_TLS_SECTION
  • pe_detect_tls_callbacks
  • PE_Digital_Certificate
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • ProcessInjection
    T1055
    high

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    C:\Windows\System32\svchost.exe -k NetworkService -p
  • CredentialDumper
    T1003T1003.001
    medium

    Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.

    Evidence
    C:\Windows\system32\lsass.exe
  • BrowserCredentialTheft
    T1555.003T1552.001
    high

    Sample accessed browser login databases (Chrome / Firefox / Edge / Opera) or a cryptocurrency wallet file. This is textbook infostealer behaviour — targeting saved passwords, cookies, or wallet keys.

    Evidence
    C:\Users\<USER>\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\metadata
  • DirectIpC2
    T1071
    medium

    Sample contacted 15 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    13.33.19.213 · 3.170.83.164 · 3.170.73.34
Antivirus engine breakdown

22 detections across 73 engines

22 malicious0 suspicious51 clean
Tier-117 engines
7flag
Top commercial AVs (low FP rate)
Tier-240 engines
12flag
Mainstream engines with mixed FP rates
Low-trust16 engines
3flag
Heuristic / generic-AI engines (high FP rate)
AhnLab-V3
malicious
PUP/Win.OfferCore.R779875
ALYac
malicious
Gen:Variant.Application.Bundler.OfferCore.4
Arcabit
malicious
Trojan.Application.Bundler.OfferCore.4
BitDefender
malicious
Gen:Variant.Application.Bundler.OfferCore.4
CTX
malicious
exe.trojan.offercore
DrWeb
malicious
Trojan.InstallCore.4116
Emsisoft
malicious
Gen:Variant.Application.Bundler.OfferCore.4 (B)
ESET-NOD32
malicious
Win32/OfferCore.B potentially unwanted application
GData
malicious
Gen:Variant.Application.Bundler.OfferCore.4
Gridinsoft
malicious
Adware.Win32.BundleInstaller.dd!c
K7AntiVirus
malicious
Unwanted-Program ( 005ce5691 )
K7GW
malicious
Unwanted-Program ( 005ce5691 )
Lionic
malicious
Trojan.Win32.OfRat.tt66
Malwarebytes
malicious
PUP.Optional.BundleInstaller
Microsoft
malicious
PUADlManager:Win32/OfferCore
MicroWorld-eScan
malicious
Gen:Variant.Application.Bundler.OfferCore.4
Paloalto
malicious
generic.ml
Rising
malicious
PUA.OfferCore!8.12692 (CLOUD)
Skyhigh
malicious
BehavesLike.Win32.ObfuscatedPoly.vc
Sophos
malicious
Generic Reputation PUA (PUA)
TrellixENS
malicious
Artemis!0DE678B499F8
VIPRE
malicious
Gen:Variant.Application.Bundler.OfferCore.4
Hash 5cc02964795e… cross-referenced against 73 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy10 sections
.text
6.38
.itext
6.04
.data
5.18
.bss
0.00
.idata
4.82
.didata
2.76
.edata
1.34
.tls
0.00
.rdata
1.38
.reloc
6.70
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.

Common & new
Unique uploaders
146
Hundreds of people have uploaded this — common.
Total submissions
157
Includes repeat uploads by the same source.
First seen by VT
1d ago
Jul 8, 2026
Prevalence quadrant
Rare · New
Targeted malware lives here
here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
7/8/2026, 8:52:04 AM
First seen (MalwareBazaar)
—
Last analysis (VT)
7/8/2026, 11:34:07 AM
Scanned here
7/9/2026, 10:36:49 PM
File name
CheatEngine77.exe
Size
6.56 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
5cc02964795e405e5b5d762548541b46e19d880af4315b9abf8a42919ba434d8
MD5
0de678b499f8fc64f1e8ed8682c5c754
SHA-1
b5612f82d10ced60dccc2e47e45fbe29e6ee298b
PE imphash
88016fcdef7f227c62171d0afad9aae4
First seen (VT)
7/8/2026, 8:52:04 AM
Last analysis (VT)
7/8/2026, 11:34:07 AM
First scan (MalwareTips)
7/9/2026, 10:36:49 PM
Last scan (MalwareTips)
7/9/2026, 10:36:49 PM
Code signer
Plooto Incverified
Community reputation
-1flagged
Behavior tags
overlaysignedpeexe
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.