ContentWarning.rar
- SHA256 5a37abc48934ae4a4041dde2551ad36894997cdc912cbae28394d225df5b147e
Overview
overview
7Static
static
3ContentWarning.rar
windows10-2004-x64
3games/Cont...ng.exe
windows10-2004-x64
7xlbstealer.pyc
windows10-2004-x64
3games/Mono.Cecil.dll
windows10-2004-x64
1games/Mono...re.dll
windows10-2004-x64
1games/SkiaSharp.dll
windows10-2004-x64
1games/contentmod.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
ContentWarning.rar
Resource
win10v2004-20240611-fr
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
games/ContentWarning.exe
Resource
win10v2004-20240508-fr
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral3
Sample
xlbstealer.pyc
Resource
win10v2004-20240508-fr
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
games/Mono.Cecil.dll
Resource
win10v2004-20240611-fr
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
games/MonoMod.Core.dll
Resource
win10v2004-20240611-fr
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
games/SkiaSharp.dll
Resource
win10v2004-20240508-fr
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
games/contentmod.dll
Resource
win10v2004-20240611-fr
windows10-2004-x64
0 signatures
300 seconds
General
- Target ContentWarning.rar
- Size 20.3MB
- Sample240615-tk35wszglm
- SHA256 5a37abc48934ae4a4041dde2551ad36894997cdc912cbae28394d225df5b147e
- MD5 75a5581550b14c5019e56c9df71a1e63
- SHA1 72486bdffb654304a02c1e665738ca3a8fb4fe5e
- SHA512 d29f7a7b3680ede13a44fc2e5670fb32b85484b47aab5b741a40ce3bda98cd7060d8b6cd4df9f89f75f9e5e375059ea53c8a70850f7d096b8c88b4cbfb439f34
- SSDEEP 393216:GedMHlzaO5R5PtWajUVwV9lJHn/45uDTBDIuO2C8Rfy85TAfEj9inwYRg:HdMH55RRt/jUopBDE58Rfy89AMj9Lsg
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/games/ContentWarning.exe pyinstaller - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/games/ContentWarning.exe unpack001/games/Mono.Cecil.dll unpack001/games/MonoMod.Core.dll unpack001/games/contentmod.dll
File Explorer
-
ContentWarning.rar.rar 20.3MB
-
games/ContentWarning.exe.exe 20.3MB
-
xlbstealer.pyc40KB
-
games/Mono.Cecil.dll.dll 348KB
-
games/MonoMod.Core.dll.dll 213KB
-
games/SkiaSharp.dll.dll 422KB
-
games/contentmod.dll.dll 63KB
games/ContentWarning.exe
- IMPHASH 2ac23c52e7647c5bbea38e98bb68c652
- SHA256 4356dc595e7a949591e9d06f0f066437db9aaa4f8c2b4864f639547ec3eed2da
- MD5 5ed01ba06cd792b29b36a99af68ff31b
- SHA1 07c79cf62e13658ee512212efde629b5af2cc097
- SHA512 ae98d00260c4d65529c699883b80c0b67b25675eac39cc6d9f07a32a016b0f8461cf9c374ae048b83451b0e34fa72644173efe8eb366996f1ea19f3fef6df04a
- SSDEEP 393216:Au7L//LQfoSBfFZNRwSo68dQusl8l99oWOv+9fgxQS8rJGEvuz:ACLLQfZBfFXR668dQuxDorvSYxn2f
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
48672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
GetLastError
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
GetEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
ExpandEnvironmentStringsW
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=180, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=33731,
count=9, id=259, version=33731,
count=17, id=260, version=33731,
count=40, id=261, version=33731,
count=11, id=257, version=30795,
count=143, id=1, productName=Unmarked objects,
count=25, id=260, version=33811,
count=1, id=258, version=33811,
xlbstealer.pyc
- SHA256 0ce3e0f5313f2e2cb9515d3c0a4307bde664e462420847bc53c7a9e5fc0aef45
- MD5 3b4c432fa2dfc65b09981803809fc084
- SHA1 e21d75052d34499a55b49dfd235a65cbbc8cb74f
- SHA512 0dfb8f9bd85547d27f472c36ee9bb3aa9e1f523266da898bf714c6f0972917976b8952942aa6b795a0fa7fa21434a84772f3f212f202f2557a465fb5884f192d
- SSDEEP 768:z8q+ewxN8RM4PjYHA1LgKoX3T5vqsmySr5VUIHrMeH53A2UcVAQnb0RwC:rKuRMIt20smywVlflUcOQQR9
- MD5 SHA1 SHA512 SSDEEP
games/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 769a59793d4b8885bbbfbc5aee8f57a0d4e34d275c56c60c03994309b87f67e9
- MD5 7c40214d60b54749a1a7f79ea6f62bac
- SHA1 a240d705b52fb1a78cceedab268db42cbeb47512
- SHA512 66a489988d15f1c651061656703b6fb03c4c6ebe82bcb0d48246c760e3764e4a7f2ad8d1653c90401fba6aa9974586d36256ad3a47e1112c1f38488a8818ab92
- SSDEEP 6144:NimznQ2nMpRAX2diEIn5o4gcuomZSFrIb:XnB2EELcu0Fr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
360770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\obj\Release\netstandard2.0\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
346KB
Virtual Size
346KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
games/MonoMod.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7fafdd61712040dfdc6c6160f32a165084e24fb3a1f3466ab42a463f9b1324af
- MD5 3c7acfce818b5ef795f795d436d978d3
- SHA1 d7994e2082a7069a634638deffe64f1077b3343f
- SHA512 6ae623e710ae43f8b902a8580141ab93e85968852de0729671648e8edcaff69919793bbfa04cafe506d8ae359d709f5232b0d7fda3f048264600623a73c5063c
- SSDEEP 3072:meTaIQQ/OZRN0sUI5N9OPPv1tZ+S/cjrBlieAMqRz6lYEU:meUhdno/8SqfWMq6YE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
223162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Z:\Users\aaron\Source\Repos\MonoModReorg\MonoMod\artifacts\obj\MonoMod.Core\Release\net7.0\MonoMod.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
211KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
games/SkiaSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 460d0da07e2d1e5b70220c6f12f74c8c485d641a8bd6e4856d99f66dff4cc105
- MD5 ed17ceb7b96274d0aeee54e9b65a3ca4
- SHA1 22fa6143a806442f500b79a4193d7778445d12da
- SHA512 3c9fe78cdd0361fac097aee789afd7ff82112cf616613aa79b8034f326307d210a241d007a97674adde739ed02703facc27b3c7f2b3a3033dac36479a42a0f94
- SSDEEP 6144:icjafCcoFzL/6zZbkvVBeDwMKRuTAFicmKda/Mh+SbgbWrUfo0sSrF4mmh4mmSzZ:o06zZiAACrI50HzznoT
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ac:87:ca:ca:eb:8a:76:d2:de:d9:fd:c3:f1:5a:b9:aa:da:4c:4e:c6:3c:1f:e1:56:4c:5b:e9:a2:13:c1:76:b7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 12, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
427774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\binding\SkiaSharp\obj\Release\net6.0\SkiaSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
410KB
Virtual Size
409KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
games/contentmod.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 09ecc2b85dc12b062df8b7dcd5ef2c3b3e50d04cbbfd8c7df92a6f799f34ecc8
- MD5 d145b9e038d5008d2495adec5686640d
- SHA1 0d0d3743190f7a6c7e0db8e0607a6f64de41fef1
- SHA512 b993fd3132dedaed8f16965ccf0c6efbd55fe811bbfe4ae55a8ad3a54a143a56c092313ffe9b8ae18bea00bf6be7ec343b509dbb3a674afb8f0061b1dd3c245d
- SSDEEP 768:tlylCrLKVElBjTCcYdSxCfY2Xw7jdhV9JHHxRM3iARkVMkgHS/BZrdA3jx5iaYTY:tQRACfY2avV9JHI3TRkVfv/nr4PRf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ