General
-
Target
kid.zip
-
Size
17.1MB
-
MD5
e6fa03c9934b495a4bf6c964e870fe83
-
SHA1
6c663b5ea5c96e35aa84fb8eae58f63f12e50350
-
SHA256
29acf6e586055295b5228db327ff3ab74f29f493971dd4f9ee32602143b85dd1
-
SHA512
48e1be18d0efeacc727e17e337edb125d0c179cb2a7338e2395d5380b5d4fe7dc99ca68e9b8ce911707ea7bf04a2084bf8cbbf5bb3ff18a6d2b6c4555496851d
-
SSDEEP
393216:LCgs1848MPygIlJAGtH2TI/E/12tQNrpcrndG:LPsy3CygIzAAHc/dhlcrY
Malware Config
Signatures
-
resource yara_rule static1/unpack001/kid/modest-menu.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/kid/modest-menu.exe
Files
-
kid.zip.zip
-
kid/config.json
-
kid/modest-menu.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 989KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 75KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 23KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 24.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 15.8MB - Virtual size: 15.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
kid/scripts/Readme.api
-
kid/scripts/Silent.Night.v1.68.lua
-
kid/scripts/Ultimate_Menu_V19_1.68.lua.js
-
kid/scripts/demo.lua
-
kid/scripts/kiddionsscript to max stats.lua
-
kid/scripts/sirius.lua.example
-
kid/scripts/uhTransactions.lua.js
-
kid/scripts/vehicle.lua
-
kid/scripts/weapon.lua
-
kid/teleports.json
-
kid/themes.json
-
kid/vehicles.json