c:\dev\tibialoader\tibialoader\obj\Release\tibialoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Tibia Loader/ICSharpCode.SharpZipLib.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Tibia Loader/ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Tibia Loader/tibialoader.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Tibia Loader/tibialoader.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Tibia Loader/updater.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Tibia Loader/updater.exe
Resource
win10v2004-20240226-en
General
-
Target
tl.rar
-
Size
404KB
-
MD5
2e1120568b1fcb31966756bb800607a5
-
SHA1
5de3000986be0d6fe1b2c3547a14e51a161c45fc
-
SHA256
75fc059a2232524daaf15ca5b43cfed3656ae2f512cc0c3da13e2f5ec8909826
-
SHA512
53890ff0b3f1ac472a60235a561c40e334deb84ab0aa37798f66d7309d7f4a77b69c3d29acd68bc0aacefae7e476c28ab2a0199a9cac0b71668128471d2de135
-
SSDEEP
12288:encPMc8yaixg0P3A0querWuo0RERLVe4C76sbHPRvB:XPHDH5queCXKOLa6sbP/
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Tibia Loader/ICSharpCode.SharpZipLib.dll unpack001/Tibia Loader/tibialoader.exe unpack001/Tibia Loader/updater.exe
Files
-
tl.rar.rar
-
Tibia Loader/ICSharpCode.SharpZipLib.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 172KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Tibia Loader/Thumbs.db
-
Tibia Loader/apps.xml
-
Tibia Loader/clients.xml
-
Tibia Loader/config.xml
-
Tibia Loader/favourites.xml
-
Tibia Loader/readme.txt
-
Tibia Loader/tibialoader.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Tibia Loader/updater.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\dev\tibialoader\updater03\obj\Release\updater.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ