Overview
overview
7Static
static
7Sacred Gol...es.pdf
windows7-x64
1Sacred Gol...es.pdf
windows10-2004-x64
1Sacred Gol...es.pdf
windows7-x64
1Sacred Gol...es.pdf
windows10-2004-x64
1Sacred Gol...ns.pdf
windows7-x64
1Sacred Gol...ns.pdf
windows10-2004-x64
1Sacred Gol...es.pdf
windows7-x64
1Sacred Gol...es.pdf
windows10-2004-x64
1Sacred Gol...ns.pdf
windows7-x64
1Sacred Gol...ns.pdf
windows10-2004-x64
1Sacred Gol...de.pdf
windows7-x64
1Sacred Gol...de.pdf
windows10-2004-x64
1Sacred Gol...UI.exe
windows7-x64
1Sacred Gol...UI.exe
windows10-2004-x64
1Sacred Gol...ta.exe
windows7-x64
7Sacred Gol...ta.exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
Sacred Gold & Storm Silver V1.05/Documents/Action Replay Codes.pdf
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
Sacred Gold & Storm Silver V1.05/Documents/Action Replay Codes.pdf
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
Sacred Gold & Storm Silver V1.05/Documents/Evolution Changes.pdf
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
Sacred Gold & Storm Silver V1.05/Documents/Evolution Changes.pdf
Resource
win10v2004-20231025-en
Behavioral task
behavioral5
Sample
Sacred Gold & Storm Silver V1.05/Documents/Important Item Locations.pdf
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
Sacred Gold & Storm Silver V1.05/Documents/Important Item Locations.pdf
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
Sacred Gold & Storm Silver V1.05/Documents/Pokemon Changes.pdf
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
Sacred Gold & Storm Silver V1.05/Documents/Pokemon Changes.pdf
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
Sacred Gold & Storm Silver V1.05/Documents/Pokemon Locations.pdf
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
Sacred Gold & Storm Silver V1.05/Documents/Pokemon Locations.pdf
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
Sacred Gold & Storm Silver V1.05/Documents/Special Event Guide.pdf
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
Sacred Gold & Storm Silver V1.05/Documents/Special Event Guide.pdf
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
Sacred Gold & Storm Silver V1.05/Patches/xDelta GUI.exe
Resource
win7-20231023-en
Behavioral task
behavioral14
Sample
Sacred Gold & Storm Silver V1.05/Patches/xDelta GUI.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
Sacred Gold & Storm Silver V1.05/Patches/xdelta.exe
Resource
win7-20231020-en
Behavioral task
behavioral16
Sample
Sacred Gold & Storm Silver V1.05/Patches/xdelta.exe
Resource
win10v2004-20231025-en
General
-
Target
bdea0e4f6a08f389dfb333a069cccaa97d39a36c1ce09838ffaf90a449fca6be.zip.zip
-
Size
12.5MB
-
MD5
0557fec273afe979a8bd724623ddeb52
-
SHA1
d17b64c0add749c251b93714d4658c4b3aec851a
-
SHA256
d48b549eadc837e4e87fa8e65520324a01415702598283dd840d842c5185106f
-
SHA512
b5c1d2ca2261eb1c3f7a9bd630901ea9917a040e49b7e52bec75af1cd937d1f2b03b9bbbc7630c75da332260f35bf553f9f0a4a4d13888939282d576aace334d
-
SSDEEP
393216:RY2rM00GzL69MjDixMkJR5f1psy3FaMuvbu:ROGzL6k2xM45N6y3MMuDu
Malware Config
Signatures
-
resource yara_rule static1/unpack002/Sacred Gold & Storm Silver V1.05/Patches/xdelta.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Sacred Gold & Storm Silver V1.05/Patches/xDelta GUI.exe unpack002/Sacred Gold & Storm Silver V1.05/Patches/xdelta.exe
Files
-
bdea0e4f6a08f389dfb333a069cccaa97d39a36c1ce09838ffaf90a449fca6be.zip.zip.zip
Password: infected
-
bdea0e4f6a08f389dfb333a069cccaa97d39a36c1ce09838ffaf90a449fca6be.zip.zip
-
Sacred Gold & Storm Silver V1.05/Documents/Action Replay Codes.pdf.pdf
-
Sacred Gold & Storm Silver V1.05/Documents/Evolution Changes.pdf.pdf
-
Sacred Gold & Storm Silver V1.05/Documents/Important Item Locations.pdf.pdf
-
Sacred Gold & Storm Silver V1.05/Documents/Pokemon Changes.pdf.pdf
-
Sacred Gold & Storm Silver V1.05/Documents/Pokemon Locations.pdf.pdf
-
Sacred Gold & Storm Silver V1.05/Documents/Special Event Guide.pdf.pdf
-
Sacred Gold & Storm Silver V1.05/Patches/Classic Version - NO POKEMON CHANGES/SacredGoldClassic.patch
-
Sacred Gold & Storm Silver V1.05/Patches/Classic Version - NO POKEMON CHANGES/StormSilverClassic.patch
-
Sacred Gold & Storm Silver V1.05/Patches/Complete Version - EVERYTHING/SacredGoldComplete.patch
-
Sacred Gold & Storm Silver V1.05/Patches/Complete Version - EVERYTHING/StormSilverComplete.patch
-
Sacred Gold & Storm Silver V1.05/Patches/Instructions.txt
-
Sacred Gold & Storm Silver V1.05/Patches/xDelta GUI.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Sacred Gold & Storm Silver V1.05/Patches/xdelta.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 320KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 671KB - Virtual size: 672KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE