General

Malware Config

Signatures

Files

• SkyBlade.zip

  .zip

  Password: test

• SkyBlade/ModTools/Resources/Fog/0001.swatchbin
• SkyBlade/ModTools/Resources/Fog/0002.swatchbin
• SkyBlade/ModTools/Resources/FrameData.xml
• SkyBlade/ModTools/Resources/GroundLighting/base.swatchbin
• SkyBlade/ModTools/Resources/Lighting/0001.swatchbin
• SkyBlade/ModTools/Resources/Lighting/0002.swatchbin
• SkyBlade/ModTools/Resources/Lighting/0003.swatchbin
• SkyBlade/ModTools/Resources/Lighting/0004.swatchbin
• SkyBlade/ModTools/Resources/Motion/0001.swatchbin
• SkyBlade/ModTools/Resources/Motion/0002.swatchbin
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/css/bootstrap-responsive.css
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/css/bootstrap-responsive.min.css
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/css/bootstrap-select.min.css
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/css/bootstrap.css
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/css/bootstrap.min.css
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/img/glyphicons-halflings-white.png

  .png
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/img/glyphicons-halflings.png

  .png
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/js/bootstrap-select.min.js

  .js
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/js/bootstrap.js

  .js
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/js/bootstrap.min.js

  .js
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/favicon.ico
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/haxe-nav.css
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/highlighter.css
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/highlighter.js

  .js
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/index.html

  .html
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/index.js

  .js
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/jquery-1.9.1.min.js

  .js
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/nav.js

  .js
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/styles.css
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/ExitNode.html

  .html
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/LevelInfo.html

  .html
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/LevelMob.html

  .html
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/LevelProps.html

  .html
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/Meta.html

  .html
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/RoomNode.html

  .html
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/SeededRandom.html

  .html
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/Struct.html

  .html
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/triangle-closed.png

  .png
• SkyBlade/ModTools/Scripts/TechnicalDocumentation/triangle-opened.png

  .png
• SkyBlade/Resources/cardIcons.png

  .png
• SkyBlade/Resources/cols.png

  .png
• SkyBlade/Resources/links.png

  .png
• SkyBlade/StartGame.exe

  .exe windows x86

  Password: test

  5a498eee87e4d89512a84502f500181f

  
  

  Code Sign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:1c:b2:8a:00:00:00:00:00:26

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-04-2011 19:41

  Not After

  15-04-2021 19:51

  Subject

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3d

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  03-12-2019 00:00

  Not After

  07-12-2022 12:00

  Subject

  CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3b

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  13-08-2018 00:00

  Not After

  11-09-2021 23:59

  Subject

  CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  61:19:93:e4:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  22-02-2011 19:25

  Not After

  22-02-2021 19:35

  Subject

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  43:65:40:17:78:65:bb:62:3f:61:89:d8:dd:27:0e:9c:9f:45:48:18:fc:46:67:ac:88:29:02:27:09:94:75:7d

  Signer

  Actual PE Digest

  43:65:40:17:78:65:bb:62:3f:61:89:d8:dd:27:0e:9c:9f:45:48:18:fc:46:67:ac:88:29:02:27:09:94:75:7d

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

  30-04-2021 12:30

  Valid: false

  d1:4d:e6:e6:40:dc:ce:0d:f7:7d:3d:2b:13:28:a7:62:33:e4:23:c7

  Signer

  Actual PE Digest

  d1:4d:e6:e6:40:dc:ce:0d:f7:7d:3d:2b:13:28:a7:62:33:e4:23:c7

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

  30-04-2021 12:30

  Valid: true

  Chain 1

  CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetProcAddress

  GetModuleHandleA

  LoadLibraryA

  Sections

  XTSB

  Size: 146KB - Virtual size: 145KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  evm2

  Size: 1.0MB - Virtual size: 1.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  yQ2T

  Size: 125KB - Virtual size: 124KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  xpcg

  Size: 4KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  r7nd

  Size: 551KB - Virtual size: 550KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  4Ufn

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  9n8ewe

  Size: 14KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE