General

  • Target

    Winterz_Updated.zip

  • Size

    56.5MB

  • MD5

    0bb822a8834be191e7d35524a14a4f07

  • SHA1

    9e931b0697f13765d119b3681e868ef2c28d697d

  • SHA256

    03166b16a6f03c9a60a17c374ac0e43601b7321dcbfceb7d56da785185fa2c9e

  • SHA512

    4ac892827e879b4a63a7f4dd5e33519773ec04e66770802fb483fd73a57f6e9316173020b8b949c7d7100f1ef576b500127e93cca5805367f44f4f8ea8e0580b

  • SSDEEP

    1572864:x58z9XkgrofMrhJrIZ/qZUY4pRLXvf4DV/qZu:x+zFkgrofMrLiqjMVf4Dpqg

Score
3/10

Malware Config

Signatures

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Winterz_Updated.zip
    .zip

    Password: infected

  • Accord.dll.config
  • AimmyLauncher.exe
    .exe windows:6 windows x64 arch:x64

    Password: infected

    90d2464c05751e0163b327ef7e8a4518


    Headers

    Imports

    Sections

  • AimmyWPF.deps.json
  • AimmyWPF.dll
    .exe windows:4 windows x64 arch:x64

    Password: infected


    Headers

    Sections

  • AimmyWPF.dll.config
  • AimmyWPF.exe
    .exe windows:6 windows x64 arch:x64

    Password: infected

    90d2464c05751e0163b327ef7e8a4518


    Headers

    Imports

    Sections

  • AimmyWPF.runtimeconfig.json
  • DirectML.Debug.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    6af4a8d442d21ca96033085fddf29a99


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • DirectML.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    de90869f37e914fc01b99c913f65b5b5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/Overlay.cfg
  • bin/configs/Default.cfg
  • bin/models/PhantomForces_Hamsta_v1.onnx
  • bin/models/Universal_Hamsta_v4.onnx
  • onnxruntime.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    39e1a29a795654c064e5e6ee1d09c320


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtimes/win-arm/native/onnxruntime.dll
    .dll windows:6 windows

    Password: infected

    c0b3d77fdce8a6e210b73b8ab89af645


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtimes/win-arm/native/onnxruntime.lib
  • runtimes/win-arm64/native/onnxruntime.dll
  • runtimes/win-arm64/native/onnxruntime.lib
  • runtimes/win-x64/native/onnxruntime.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    39e1a29a795654c064e5e6ee1d09c320


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtimes/win-x64/native/onnxruntime.lib
  • runtimes/win-x86/native/onnxruntime.dll
    .dll windows:6 windows x86 arch:x86

    9b9eefe3aa2efecf5bfc3511ac8762b1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtimes/win-x86/native/onnxruntime.lib