I did a static analysis of this file in Ghidra because I was concerned about the VirusTotal detections.
Here is what I found:
The program uses InternetOpenUrlA to download files from GitHub (raw.githubusercontent).
It downloads files like offsets.hpp, client_dll.hpp, and FAQ.md.
It uses WriteFile, but through standard C++ runtime functions (likely for config/offset saving).
It calls CreateProcessAsUserA, but the command line passed is simply the result of GetCommandLineA().
This means it relaunches itself with the same command line (likely for privilege/token adjustment).
There are no signs of injection APIs, such as:
There are no suspicious command executions like:
No obvious credential-stealing or browser-access APIs.
No secondary executable being dropped and executed.
The presence of OpenProcess alone does not indicate malware. It can be used simply to check if the game process is running.
Based on the analysis, the behavior matches a typical external cheat loader with an online offset updater.
VirusTotal detections are mostly generic / ML-based (GameHack / PUA classifications), which is expected for cheat software.
From a technical standpoint, I did not find evidence of this being a trojan, dropper, RAT, or stealer.
If there is any malicious behavior or hidden payload that I failed to detect during my analysis, I do not accept responsibility. Any decision to run this file is entirely at your own risk.
Here is what I found:
The program uses InternetOpenUrlA to download files from GitHub (raw.githubusercontent).
It downloads files like offsets.hpp, client_dll.hpp, and FAQ.md.
It uses WriteFile, but through standard C++ runtime functions (likely for config/offset saving).
It calls CreateProcessAsUserA, but the command line passed is simply the result of GetCommandLineA().
This means it relaunches itself with the same command line (likely for privilege/token adjustment).
There are no signs of injection APIs, such as:
- VirtualAllocEx
- WriteProcessMemory
- CreateRemoteThread
- NtCreateThreadEx
There are no suspicious command executions like:
- cmd.exe
- powershell
- rundll32
No obvious credential-stealing or browser-access APIs.
No secondary executable being dropped and executed.
The presence of OpenProcess alone does not indicate malware. It can be used simply to check if the game process is running.
Based on the analysis, the behavior matches a typical external cheat loader with an online offset updater.
VirusTotal detections are mostly generic / ML-based (GameHack / PUA classifications), which is expected for cheat software.
From a technical standpoint, I did not find evidence of this being a trojan, dropper, RAT, or stealer.
Risk Assessment (Based on My Analysis)
- 85% → Cheat / GameHack
- 10% → Poorly written loader
- 5% → Hidden trojan (no evidence found)
Disclaimer
If there is any malicious behavior or hidden payload that I failed to detect during my analysis, I do not accept responsibility. Any decision to run this file is entirely at your own risk.
