General

  • Target

    Alumina_2.zip

  • Size

    13.3MB

  • MD5

    912954d81f387a34ccd68ee0925da2cc

  • SHA1

    3ccaf074c3a1c9aaf6358d0429b39d21c5064d23

  • SHA256

    2a6954b5799a682adf8e85719963dc2e5c7426c5a16ff1460599e8981d25dbed

  • SHA512

    dd42a6d5d73ea7a971094d97f1897549bd3ce02a0379ed1ea5b7c24d9b7807d0ffa2f28e240e5988319c08e1b13da4bdb8515c873f7f5cd58a91e611ffea7b4b

  • SSDEEP

    393216:tdCkolf6v+GawmM4qM+ImWLLCaQrNe/ulF/FurkPu2a5FZ:7w4Gf9pexsGvdugGT

Score
7/10

Malware Config

Signatures

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

Files

  • Alumina_2.zip
    .zip
  • Alumina.deps.json
  • Alumina.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Alumina.exe
    .exe windows:6 windows x64 arch:x64

    5c16479801aac25e19e4d3e71f54842d


    Headers

    Imports

    Sections

  • Alumina.pdb
  • Alumina.runtimeconfig.json
  • CrystalAPI.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • ICSharpCode.AvalonEdit.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • IronPython.Modules.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • IronPython.SQLite.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • IronPython.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • IronPython.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Microsoft.Dynamic.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Microsoft.Scripting.Metadata.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Microsoft.Scripting.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Mono.Unix.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • WebView2Loader.dll
    .dll windows:5 windows x64 arch:x64

    3fd78a8f50b85b627af2d0fc485b5e97


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Wpf.Ui.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • api-ms-win-crt-convert-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-crt-filesystem-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-crt-heap-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-crt-locale-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-crt-math-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-crt-runtime-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-crt-stdio-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-crt-string-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • bin/Terraria.py
  • bin/__pycache__/Terraria.cpython-312.pyc
  • bin/lua.xshd
    .xml
  • bin/path.txt
  • cd57e4c171d6e8f5ea8b8f824a6a7316.dll
    .dll windows:6 windows x64 arch:x64


    Headers

    Exports

    Sections

  • cpr.dll
    .dll windows:6 windows x64 arch:x64

    7bc8b32667f209b178f1f0635b6ee0d5


    Headers

    Imports

    Exports

    Sections

  • libcurl.dll
    .dll windows:6 windows x64 arch:x64

    9a4ddbe07217dde8376bb7c577388155


    Headers

    Imports

    Exports

    Sections

  • msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    01c801a34c4715440ef1f25ad689b315


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtimes/android-arm/native/libMono.Unix.so
    .elf linux arm
  • runtimes/android-arm64/native/libMono.Unix.so
    .elf linux aarch64
  • runtimes/android-x64/native/libMono.Unix.so
    .elf linux x64
  • runtimes/android-x86/native/libMono.Unix.so
    .elf linux x86
  • runtimes/ios-arm/native/libMono.Unix.a
  • runtimes/ios-arm64/native/libMono.Unix.a
  • runtimes/ios-armv7s/native/libMono.Unix.a
  • runtimes/iossimulator-arm64/native/libMono.Unix.a
  • runtimes/iossimulator-x64/native/libMono.Unix.a
  • runtimes/linux-arm/native/libMono.Unix.so
    .elf linux arm
  • runtimes/linux-arm64/native/libMono.Unix.so
    .elf linux aarch64
  • runtimes/linux-x64/native/libMono.Unix.so
    .elf linux x64
  • runtimes/maccatalyst-arm64/native/libMono.Unix.a
  • runtimes/maccatalyst-x64/native/libMono.Unix.a
  • runtimes/osx-arm64/native/libMono.Unix.dylib
    .dylib macos arch:arm64
  • runtimes/osx-x64/native/libMono.Unix.dylib
    .dylib macos arch:x64
  • runtimes/tvos-arm64/native/libMono.Unix.a
  • runtimes/tvossimulator-x64/native/libMono.Unix.a
  • scripts/test.txt
  • vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ws2_32.dll
    .dll windows:10 windows x64 arch:x64

    6eee61ef7874aa59d1a3452c72e61d5c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zlib1.dll
    .dll windows:4 windows x64 arch:x64

    9434905d51e7bf5f119cc9e5ee85d0da


    Headers

    Imports

    Exports

    Sections