Behavioral task
behavioral1
Sample
Elf Bowling 7 full version + patch/Elf Bowling 7 Full version Patch/Reflexive Patcher.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Elf Bowling 7 full version + patch/Elf Bowling 7 Full version Patch/Reflexive Patcher.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Elf Bowling 7 full version + patch/Elf Bowling 7 Installer/ElfBowlingTheLastInsultSetup.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
Elf Bowling 7 full version + patch/Elf Bowling 7 Installer/ElfBowlingTheLastInsultSetup.exe
Resource
win10v2004-20230703-en
General
-
Target
Elf Bowling 7 full version + patch (1).rar
-
Size
22.2MB
-
MD5
97c17767fb31eac8b9080214bf30ff46
-
SHA1
ae0ec730c40814de50d9d4fa5827f57b5d337cf9
-
SHA256
d104c96536279a919f58b15103b6960f88de7f769d256a4f64f252289c81c62a
-
SHA512
fcad172261a69a0393466cb941d6171c19eccd6b6d2bef8a22c35c8c747fd8aff050500db9bdd02a95f6d84a12c823cef65193350f8e60ad3e81bee51437b3f2
-
SSDEEP
393216:NxLBa06jG0kT+/loqHb6GS0qxYGdVF9rB/Wm2ufiOVCfhI4B57XbaUGSusJ0x9gg:tGjG0j/G4bJS0qLFWulV+Iq5ASusJ0DX
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Elf Bowling 7 full version + patch/Elf Bowling 7 Full version Patch/Reflexive Patcher.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Elf Bowling 7 full version + patch/Elf Bowling 7 Full version Patch/Reflexive Patcher.exe unpack001/Elf Bowling 7 full version + patch/Elf Bowling 7 Installer/ElfBowlingTheLastInsultSetup.exe
Files
-
Elf Bowling 7 full version + patch (1).rar.rar
Password:
-
Elf Bowling 7 full version + patch/Elf Bowling 7 Full version Patch/Reflexive Patcher.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX3 Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Elf Bowling 7 full version + patch/Elf Bowling 7 Installer/ElfBowlingTheLastInsultSetup.exe.exe windows x86
Password:
655ef525c97730d767eaabf5fa8b32f1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
GlobalFree
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
SetUnhandledExceptionFilter
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalReAlloc
Sleep
GetTempPathA
SetStdHandle
LocalAlloc
LocalFree
GlobalAlloc
GlobalLock
LCMapStringA
GlobalUnlock
SetFilePointer
ReadFile
GetTickCount
GetModuleFileNameA
CreateProcessA
GetExitCodeProcess
IsBadReadPtr
IsBadWritePtr
CloseHandle
FileTimeToDosDateTime
GetSystemTimeAsFileTime
FindClose
FindFirstFileA
GetFileAttributesA
CreateDirectoryA
CreateFileA
GetVersion
SetFileAttributesA
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetLastError
DeleteFileA
SetEndOfFile
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcAddress
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
FlushFileBuffers
user32
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
SetWindowPos
SendMessageA
InvalidateRect
PeekMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
BeginPaint
EndPaint
PostQuitMessage
ShowWindow
GetDesktopWindow
SetForegroundWindow
SetCursor
GetActiveWindow
MessageBoxA
GetDC
ReleaseDC
gdi32
CreateDIBitmap
CreateDIBSection
GetStockObject
GetObjectA
GetDeviceCaps
SelectObject
CreateCompatibleDC
GetMapMode
SetMapMode
DPtoLP
BitBlt
DeleteDC
CreateSolidBrush
PatBlt
DeleteObject
SelectPalette
RealizePalette
CreatePalette
advapi32
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
Sections
.text Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Elf Bowling 7 full version + patch/How to install.txt