Overview

overview

9

Static

static

9

Epic.Battl....4.zip

windows10-2004-x64

1

Epic.Battl...R/hash

windows10-2004-x64

1

Epic.Battl...es.xml

windows10-2004-x64

1

Epic.Battl...er.swf

windows10-2004-x64

3

Epic.Battl...es.exe

windows10-2004-x64

1

Epic.Battl...ME.txt

windows10-2004-x64

1

Epic.Battl...og.txt

windows10-2004-x64

1

Epic.Battl...metype

windows10-2004-x64

1

Epic.Battl...s.meow

windows10-2004-x64

3

Epic.Battl...pi.dll

windows10-2004-x64

1

Epic.Battl...id.txt

windows10-2004-x64

1

Epic.Battl...me.txt

windows10-2004-x64

1

Epic.Battl...ge.txt

windows10-2004-x64

1

Epic.Battl...er.jpg

windows10-2004-x64

3

Epic.Battl... 1.jpg

windows10-2004-x64

3

Epic.Battl... 2.jpg

windows10-2004-x64

3

Epic.Battl... 3.jpg

windows10-2004-x64

3

Epic.Battl... 4.jpg

windows10-2004-x64

3

Epic.Battl... 5.jpg

windows10-2004-x64

3

Epic.Battl... 6.jpg

windows10-2004-x64

3

Epic.Battl...r.html

windows10-2004-x64

1

Epic.Battl...er.swf

windows10-2004-x64

3

Epic.Battl...!!.txt

windows10-2004-x64

1

Epic.Battl...PC.url

windows10-2004-x64

1

Epic.Battl...up.exe

windows10-2004-x64

7

Epic.Battl...up.exe

windows10-2004-x64

7

Epic.Battl...st.exe

windows10-2004-x64

6

Epic.Battl...64.exe

windows10-2004-x64

7

Epic.Battl...86.exe

windows10-2004-x64

7

Epic.Battl...64.exe

windows10-2004-x64

7

Epic.Battl...86.exe

windows10-2004-x64

7

Epic.Battl...st.msi

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Epic.Battle.Fantasy.5.v2.1.4.zip

  • Size

    393.7MB

  • Sample

    240408-r5njtsfb3y

  • MD5

    da3bd08182ff372da9fefcdccf32a328

  • SHA1

    dc6af9041c822eec199493c1e588775c6b62980b

  • SHA256

    dffdacf51e351220803d30bd9262bf0181f0b9193005797156034f9a896c8fa5

  • SHA512

    52a894dc50b7ffedf565c870eb04528d85aaa3e14c673acca3d6bdf5a3d550c1301adc791aa932f34f693fbd2c3b20a4635ab37336001f3ed9048cc6777d6488

  • SSDEEP

    12582912:xOO9TAgCyZyFVkY5AWxx8Zr1gNl1S1fXaL+3pl/G/YkrXCiekox:xl6y8FZ1vgZCW1fXaS3K/YkrXCiCx

Score
9/10
cryptonediscoverypackerpdfpersistence

Malware Config

Targets

    • Target

      Epic.Battle.Fantasy.5.v2.1.4.zip

    • Size

      393.7MB

    • MD5

      da3bd08182ff372da9fefcdccf32a328

    • SHA1

      dc6af9041c822eec199493c1e588775c6b62980b

    • SHA256

      dffdacf51e351220803d30bd9262bf0181f0b9193005797156034f9a896c8fa5

    • SHA512

      52a894dc50b7ffedf565c870eb04528d85aaa3e14c673acca3d6bdf5a3d550c1301adc791aa932f34f693fbd2c3b20a4635ab37336001f3ed9048cc6777d6488

    • SSDEEP

      12582912:xOO9TAgCyZyFVkY5AWxx8Zr1gNl1S1fXaL+3pl/G/YkrXCiekox:xl6y8FZ1vgZCW1fXaS3K/YkrXCiCx

    Score
    1/10
    behavioral1

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/META-INF/AIR/hash

    • Size

      32B

    • MD5

      0a754c6ef9d12f51f28e42b706f30a34

    • SHA1

      a05897cdbac2579e07c331be3e3d83794b8ab02b

    • SHA256

      d59dca2b65b8afadb3f0d6a3a2d639df4e21026c9f9b873e2eb1d15c2960f7e3

    • SHA512

      39579801e09f0e03e32bc773f6e28bb15f7dffa9dcb5dd58279f5f6a8b0ae7d64476f0881dc8b07d88b7f78c26757dc49721809cab9e12491dce9347aebdce92

    Score
    1/10
    behavioral2

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/META-INF/signatures.xml

    • Size

      6KB

    • MD5

      2f8b81afe57b642bf5b294f2a06207d6

    • SHA1

      bb5e7a100e3802fd2c634eec5e9126148964aaeb

    • SHA256

      ff1a7ce1a479fd0c5c3e9b10f5297a6173c093990e4248ccc1b4f971b123d3c1

    • SHA512

      82d7276d38173d03cddb3c0d713ea63dbaad813f5402d2b11f3b6a275c4ced2d568e706c6744e4b91e948885144a78e5016558751016241907dbb69dee43adb1

    • SSDEEP

      192:ZPqG7lxBda0MbR5RURtRVRpRrR5RsRaRLGRQR1RMXMRbhRmRjRpRB:ZPlhxraBbjKL/bJLugdGurCcdh0tfX

    Score
    1/10
    behavioral3

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/NPC maker.swf

    • Size

      1.3MB

    • MD5

      eb473515f0841eeae486d9d4ca8cbef1

    • SHA1

      07c42b45842dd183dd7d5147e383583d47d8cdbc

    • SHA256

      6dfdd6b6a56682152df6349f3ad9b84f5626606918f65a88f6067ba54a237c98

    • SHA512

      e6cc1b5e9b3e921b0aed217d48f1363975ff30cea794547d01e07403c4a9ea1f940172b7a2f72ded10d8505c8a315567fcabe1b5d8b58109e40012856bcd5eb3

    • SSDEEP

      24576:K3MWPFfI/JvimuiDrKOTuJdmxanjhptezfeNDP40xthe9d81p3Bb4+7:K3DfUvZbDuJWaZaKxtU9d8B4+7

    Score
    3/10
    behavioral4

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/QRes.exe

    • Size

      4KB

    • MD5

      ca493006d55ebda9f97c7848cee144a7

    • SHA1

      82671680c2fd7037e3982da62227bfa9611f91ee

    • SHA256

      66252b80e1f62e284d60ddfc340fa7d6b651929d85360cee0f78cc04a8c5e343

    • SHA512

      35f0eada98d97edfea875f1301eeb84fb81d9e1f59a63098bb73b963bf6d463fb5c780840a3aacbcf6d2e7fb8fbda139bb1c61625b6f334cf4fe6d5677fcc035

    • SSDEEP

      96:XsK1jHA1J4NV/HMjiNOi7XV8jr1enQYzjaADfNP4oyn:dj/Hco8jrgQoja2fNP4oyn

    Score
    1/10
    behavioral5

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/READ ME.txt

    • Size

      1KB

    • MD5

      770a53d3ce510086b42aec29ec1778b0

    • SHA1

      1fca51b5b7bfe7f53233b657555371118668d18b

    • SHA256

      94a8be661f3fa136ab3de3d1c53f10490035c3037e3b8f348400876c5602eb69

    • SHA512

      e8038f24a021a6861775f9cf4147bf2ff0603bfa1eb168fd2ad986c25c3bcf6005596d0de532743bf428dc3de55fa5e6200fe6049007b0ec06408c3482aa1f73

    Score
    1/10
    behavioral6

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/errorLog.txt

    • Size

      163B

    • MD5

      cf042a8fb5708dacd23ee37de12aff00

    • SHA1

      90dead571de3f18e85819837ce56c6439734e6c0

    • SHA256

      a91774805487204cb115018ed9b378238093750e442301649be526027c761f95

    • SHA512

      d5751aa9ae4699c0d3d7bd926d7cc86b7ed8a6d7de9864a002e9bf447cee424814c32cdd703bcdb988ee00c72177405ad41ea30307aa1a78a06066236ddefd8a

    Score
    1/10
    behavioral7

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/mimetype

    • Size

      59B

    • MD5

      60649e4365437442732ee45233b18f0c

    • SHA1

      ee3d2fdb51bf4c48956542988d2b3ba1c20f09e6

    • SHA256

      d3fa026fce131ca31a82d2340f2d0aa2012ef764de81d7aca91aff7255dcb757

    • SHA512

      584bfa5823d82e1a4ce387387baa5f9a296bcc0a08939b2e7a757ba78c98306bb2b3be594c5aa6e83ab13c944f16c090e712cbc03d6dfadae639d1c170835525

    Score
    1/10
    behavioral8

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/options.meow

    • Size

      178B

    • MD5

      9f10fd26679d83bd1eea4b87da865d0c

    • SHA1

      5f95ad26f8861da48446f5906cc8730d1b8660fa

    • SHA256

      f08d83388018b597bb692668afd8c86778eec5d66456be3829aa65f8483c0bd0

    • SHA512

      76c374824a57c0bc24f4c0301403a285aefd2746a9a2b550eb2d40bd15b79d29adbb92e9a037972892311ba72f861d9a2a1cd409b54f60e1fa75acd841328e74

    Score
    3/10
    behavioral9

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/steam_api.dll

    • Size

      1.4MB

    • MD5

      74ca6c536af79a6797dc7001d16101ed

    • SHA1

      452863057af71f900b7589ac7cec6224492f5d9e

    • SHA256

      4f0260e49c9ee87a2e6a683d561aad5b9df5bfa79cab9490cea543c7e62e6ded

    • SHA512

      4d3d0b10ce41d8f0a36427ebc6b1f6c3f731dd51ae245c96fee6ea923b8dcba3fd60943af2aebefae066239ffdc724afe5c72ec7b1bf52a5d193f0cdd43e8d9c

    • SSDEEP

      24576:JPIzR6Ax46V+wE77YCWBkOeeKglwLeIt4PKBP3tvzcoKemE9Crqd+veU/yOfCQIB:WvcwE7kCWBkOemlW44FvziemEMrqdSev

    Score
    1/10
    behavioral10

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/steam_appid.txt

    • Size

      7B

    • MD5

      0d7399c1022be8fb0694bc0c1e601277

    • SHA1

      cceb63c7a2cb57248cd718c01da59f92c7ea79c6

    • SHA256

      b1f36031dcf72d03cbbe63cbc61a71587b0d733d1f389a6c3dc63b862b7a2ef7

    • SHA512

      2fc2a2cf359a1f13f411da03b5214895a6a111d909076d2db4a8d88179a70d3a787bf3d159495276bc5a7aa6dfed9e28f1d80398fedee772e71774b998723065

    Score
    1/10
    behavioral11

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/steam_settings/force_account_name.txt

    • Size

      11B

    • MD5

      2a5d4a8e4e22cd2950238e1ac30e5ae1

    • SHA1

      5629a93470da2d2b8f6ae47c90a6f6e9f3c789d7

    • SHA256

      5745efccad30eda68b8da83d1403dd13285d2f5743028df89b238a84bbc03872

    • SHA512

      6d9a1ae169ce9dc18aee0f39bb0a3712b42e4b51e7e513f02601a2dd0eddf8dc12f7836ef99ef14870b03cd02ce9276a6945406ad70d6d040b4a2c9e38ff7741

    Score
    1/10
    behavioral12

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/steam_settings/force_language.txt

    • Size

      7B

    • MD5

      ba0a6ddd94c73698a3658f92ac222f8a

    • SHA1

      1b669334dae8ebafa433f0175b5fd418a7bc0975

    • SHA256

      b6234d2ea0d6022be63db80d7b80e221097fe4a469dc44febcd2a9241effdeba

    • SHA512

      0882b702e0f4c1db1701789796ab1d12d72627811b67299bf36b9b25c29465cc24e72483d171c435368dc9f777837d2bd45ccff293de2207d32ba58a6ac01023

    Score
    1/10
    behavioral13

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/wallpapers/main wallpaper.jpg

    • Size

      846KB

    • MD5

      93978877b03a32fd8dd6f83c6c3cbc95

    • SHA1

      7a2e87e10b4acb66c082136d36fd98ddf9d16588

    • SHA256

      66d40ed57db88fb0bdb30272b8a199f8f4b2cf20cec0cbd98c34b54384c8d715

    • SHA512

      6414241fb7e28079e383caf56cab9ef3b8f890896d441e1a1884bf0cb2e03cd5c4cac273a58639ab83754a08af1fb9b0f7373495a0b411f8e906bd1ea5b20c52

    • SSDEEP

      24576:3BYLVf49gXpQig8J8/sTXHXtlht4YbdPplo0m:3BYRxpQnmTXtlht4YbdBla

    Score
    3/10
    behavioral14

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/wallpapers/wallpaper 1.jpg

    • Size

      1021KB

    • MD5

      c442972a65c97a4438858e6eed90c635

    • SHA1

      9f3fd96503d21471eb62d88e758783b47c81a5f3

    • SHA256

      fecb410c3f53745c7e14f373b3504d00a1ccee763685772445c348a45b314225

    • SHA512

      f380409ee6473d0ce92ea847c4415d0bcec021c8a4ac8d098def392792321c38a582b55303b90401651daaa973a3063182775dbad45a23e59af12918d661d2c3

    • SSDEEP

      24576:6eO62HpKkAM/uUyc0aynjZJt1ecZLl1af1rUjhgxu4ZNn:6e14pKkrWI0fnVJt1b1af1rUoNn

    Score
    3/10
    behavioral15

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/wallpapers/wallpaper 2.jpg

    • Size

      982KB

    • MD5

      5195cae9327053aacf5a2d85f4544ca5

    • SHA1

      0f6dfb4b144548fa52583956df449600b43c2140

    • SHA256

      14b77d1a2ad5aad3d7badce589b6b88fee9ce6c3ddc9cd1ab49a66dbc0f0411f

    • SHA512

      245c404f302c469df14143bbf4245ae6adca528eb2878b4a166b56fe664d8220a6c9e36f952f5553d6a7e3c85f98b349ee0564d470124e84e330983c80ecabe2

    • SSDEEP

      24576:gienMy2ukHZ7P7UXklPEzhWJ9JLVH6Gyb+Bav9uE83w:gmyvkHZ7P5dyWQUBaZ83w

    Score
    3/10
    behavioral16

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/wallpapers/wallpaper 3.jpg

    • Size

      853KB

    • MD5

      1127867a0092303e2b27a8001bd12577

    • SHA1

      aab795137ebb792a62619ebb9949bd16c709046d

    • SHA256

      b3eea06136fb0e14f02135847a8fa9c1cd4b640fc918fd7960c4459342d6a495

    • SHA512

      b4dcfa492c306ef9ebb81f101ad5f2e2119cd623994a03ab0d31dcf1c924b306375f1a7f03f9e02615ac10e5becc817ce6fb74b1862e2b373d1e5b540a5a7c93

    • SSDEEP

      24576:PowhlBS1cH/Y3odAl56Ms+49++yEaUTUyR5v:PowhrSGHhdAl56u49jV53RN

    Score
    3/10
    behavioral17

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/wallpapers/wallpaper 4.jpg

    • Size

      1.1MB

    • MD5

      b0dfa5c3223ccccc93ebef930f28215f

    • SHA1

      e5fb196707b575be42e84521daddae25c1527785

    • SHA256

      21e5e91fe8d713cea711b8a7593ab848aecd4ba8758560ad5cd4f802d561cad6

    • SHA512

      d942630069ba4125a31d3e02193e361263e4476bf8a872233de411338af1ff544d0752d4fab8b339888b12099c23d96bc57884278e83500300f4a79a752a4cab

    • SSDEEP

      24576:yHzdT0rwZ89oITi08FgbXdwiKWTARXbfJ/ix7AVs5G7z2z/:jrwLCqFed0BRLfRixUV77a

    Score
    3/10
    behavioral18

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/wallpapers/wallpaper 5.jpg

    • Size

      976KB

    • MD5

      10fe434c8399b1d757bc0ae7c5a96001

    • SHA1

      f78778f4188d0efe6f80a6e620af76de53f80609

    • SHA256

      684d5a1962bb7d60bb1147f3cfd6d64573a3e8ca930a1042d64a62728926b118

    • SHA512

      ac944a39105f6d223d7217a11d6070e84afe56827cedda4c974bbe73f205d1747793bca223e6f2a76f4b7f4243113f826d64fd868cee443bd0a57b547d76dc5f

    • SSDEEP

      24576:R29fOWZBwG2tCYLtf5ewRUUtddky0rDCsrsT3LTaT+u:89fTBwUYtGrg7TaT+u

    Score
    3/10
    behavioral19

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/wallpapers/wallpaper 6.jpg

    • Size

      936KB

    • MD5

      ac4eb709310fc64036d757c3953ee3f1

    • SHA1

      13794756e77e171303b2ce620e58b7f60ca081e6

    • SHA256

      831fc3c9d07e01471f78874bf628a114b54c5e3d83606dfc08db17213f6781b4

    • SHA512

      31017778426b216718fae58aa93945ca5d4a9a991dcffe363e9b38e2663b405fea54e149759095a11852f629d15fcf2d8f12a8c6661b7b0372a43fb3aa38ae99

    • SSDEEP

      24576:5MsQb2CBSZqBbvQMLOeLkMLAirbhHbOXzIQyE+S:5rQb29ox3OQAcbIXuEX

    Score
    3/10
    behavioral20

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/wrapper.html

    • Size

      1KB

    • MD5

      7e7b2344f30d96d9e3e560315dcea0e9

    • SHA1

      e534f6811c703ced569e082b89709420b1ffa7db

    • SHA256

      a3f3e6d60ef0a6e930f8a82121949c2a41a3707015172499254bcf3c95dc2f45

    • SHA512

      653ed17459a27393ac132c385d112b8162f78c1b322506758ca5ee5bae9218ddc1ad3bb6444870000533ea1bf3dfa1637274c3a54d02a2f47eeb668d091c9436

    Score
    1/10
    behavioral21

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/Epic.Battle.Fantasy.5.v2.1.4/wrapper.swf

    • Size

      6KB

    • MD5

      7b7108aaf857f9e4c2903e8cd548c0f3

    • SHA1

      f80f0155357f953ea483d14c3e32b3c7712800c0

    • SHA256

      49a8369e9706211870d16babcab66db6803a747c48bcd84fb61eb4cafdcca139

    • SHA512

      a5a1d2b5093546d4b1b7b8a8470457bed0164dea94a389345c944d39f62d9ed2b65df9a993a0073942abbf4b69410052597e46e93a9cb722b0ef41cff3365a8c

    • SSDEEP

      96:xL4Dt1ov7TWeXzR9hgOCoKKfngJKmyQ8iEP9+84qYRdVmS+OU7NGjg5DvDei:k7ovH19h1CoAyS8KZ4x5D7ei

    Score
    3/10
    behavioral22

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/HOW TO RUN GAME!!.txt

    • Size

      268B

    • MD5

      ab104c411c19cc3b94c6259ab56e941a

    • SHA1

      e94e95cbf6d8d1d5f3dbfbb4c18adb05c5a4f172

    • SHA256

      29ef0b1c3d56de4f5c968fbe762bd9fc96f971dc8ba410e9b2dc089218c4ab50

    • SHA512

      046d6131cc74cc627c675d518e4e48af29a4fb6430ee6b078953574c77f8ea197a7b141a5331c558371f5747867090d8e844581f4218bb01ca3036b1b3820cde

    Score
    1/10
    behavioral23

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/STEAMUNLOCKED ยป Free Steam Games Pre-installed for PC.url

    • Size

      52B

    • MD5

      92672216743fd0ad8799d25ec99e5096

    • SHA1

      68103be0fa83db8a4a2efac6bb6169ce959a0290

    • SHA256

      677d2e85447eea64fa541b8e8a9e92b41e20456360bef8642f898e7eb1b2f0db

    • SHA512

      1ca286141902e64c4cac05fabc1ce0ef4d910582e720c8b38f3cf2799cadaab7cbc9d8fc925eff17e0d3280d5d074ebd856dc75d6cadbd95872cae14eddb7719

    Score
    1/10
    behavioral24

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/_Redist/dotNetFx40_Full_setup.exe

    • Size

      868KB

    • MD5

      53406e9988306cbd4537677c5336aba4

    • SHA1

      06becadb92a5fcca2529c0b93687c2a0c6d0d610

    • SHA256

      fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425

    • SHA512

      4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99

    • SSDEEP

      24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral25

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/_Redist/dxwebsetup.exe

    • Size

      281KB

    • MD5

      fd6057b33e15a553ddc5d9873723ce8f

    • SHA1

      f90efb623b5abea70af63c470daa8674444fb1df

    • SHA256

      111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288

    • SHA512

      d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d

    • SSDEEP

      6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc

    Score
    7/10
    persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral26

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/_Redist/oalinst.exe

    • Size

      790KB

    • MD5

      694f54bd227916b89fc3eb1db53f0685

    • SHA1

      21fdc367291bbef14dac27925cae698d3928eead

    • SHA256

      b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd

    • SHA512

      55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5

    • SSDEEP

      12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV

    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral27

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/_Redist/vcredist_2015-2019_x64.exe

    • Size

      14.3MB

    • MD5

      f0248d477e74687c5619ae16498b13d4

    • SHA1

      9ed4b091148c9b53f66b3f2c69be7e60e74c486a

    • SHA256

      b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52

    • SHA512

      0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591

    • SSDEEP

      393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral28

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/_Redist/vcredist_2015-2019_x86.exe

    • Size

      13.7MB

    • MD5

      de34b1c517e0463602624bbc8294c08d

    • SHA1

      5ce7923ffea712468c05e7ac376dd9c29ea9f6be

    • SHA256

      ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6

    • SHA512

      114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac

    • SSDEEP

      393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral29

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/_Redist/vcredist_x64.exe

    • Size

      5.5MB

    • MD5

      630d75210b325a280c3352f879297ed5

    • SHA1

      b330b760a8f16d5a31c2dc815627f5eb40861008

    • SHA256

      b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023

    • SHA512

      b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f

    • SSDEEP

      98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral30

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/_Redist/vcredist_x86.exe

    • Size

      4.8MB

    • MD5

      b88228d5fef4b6dc019d69d4471f23ec

    • SHA1

      372d9c1670343d3fb252209ba210d4dc4d67d358

    • SHA256

      8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8

    • SHA512

      cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8

    • SSDEEP

      98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral31

    • Target

      Epic.Battle.Fantasy.5.v2.1.4/_Redist/xnafx40_redist.msi

    • Size

      6.7MB

    • MD5

      97c2eebb30c5a88c68c8f24f37183f1d

    • SHA1

      49efdc29f65fc8263c196338552c7009fc96c5de

    • SHA256

      e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7

    • SHA512

      c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da

    • SSDEEP

      98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq

    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

15
T1082

Query Registry

9
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

pdfcryptonepacker
Score
9/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
3/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
3/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
1/10

behavioral22

Score
3/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
7/10

behavioral26

persistence
Score
7/10

behavioral27

discovery
Score
6/10

behavioral28

discovery
Score
7/10

behavioral29

discovery
Score
7/10

behavioral30

Score
7/10

behavioral31

Score
7/10

behavioral32

Score
6/10