C:\Users\Xz0v\Documents\GGKILLER\ConsoleApp1\obj\x64\Release\net6.0-windows\GGKiller.pdb
Overview
overview
9Static
static
7GGKILLER.7z
windows7-x64
9GGKILLER.7z
windows10-2004-x64
7GGKILLER/GGKiller.exe
windows7-x64
9GGKILLER/GGKiller.exe
windows10-2004-x64
9GGKILLER/GGKiller.exe
windows7-x64
9GGKILLER/GGKiller.exe
windows10-2004-x64
9GGKILLER/G...g.json
windows7-x64
3GGKILLER/G...g.json
windows10-2004-x64
3GGKILLER/H...2.7.js
windows7-x64
3GGKILLER/H...2.7.js
windows10-2004-x64
3Behavioral task
behavioral1
Sample
GGKILLER.7z
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
GGKILLER.7z
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
GGKILLER/GGKiller.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
GGKILLER/GGKiller.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
GGKILLER/GGKiller.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
GGKILLER/GGKiller.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
GGKILLER/GGKiller.runtimeconfig.json
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
GGKILLER/GGKiller.runtimeconfig.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
GGKILLER/Helldivers2_1.2.7.js
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
GGKILLER/Helldivers2_1.2.7.js
Resource
win10v2004-20240508-en
General
-
Target
GGKILLER.7z
-
Size
3.5MB
-
MD5
155608e4df8013f2e348eeb83512f4ae
-
SHA1
2452d259f8bbb61cae3ec2993ec44c5e8a44fef2
-
SHA256
cdfccd9051fde177ede6ae732d3e339625df4633909fe184c4148db5e52c27af
-
SHA512
a6bbf115f3fcc495bffaf15366ce5d4c531d6c035e29c8f52c4e398a07d999c30872c651d6dfaa461d881e21feb682faeb194fe3dbed7443025d898ec36fd3bf
-
SSDEEP
98304:e2WZIOmHCh4IXwpmcJUMyTzVyXn0NqHXpIorqwaFh:e2QWChRAppyTcXn0cHbrq93
Malware Config
Signatures
-
resource yara_rule static1/unpack001/GGKILLER/GGKiller.exe themida -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/GGKILLER/GGKiller.dll unpack001/GGKILLER/GGKiller.exe
Files
-
GGKILLER.7z.7z
-
GGKILLER/GGKiller.dll.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
GGKILLER/GGKiller.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 53KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 14KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
GGKILLER/GGKiller.runtimeconfig.json
-
GGKILLER/Helldivers2_1.2.7.ct.js .xml polyglot