General

  • Target

    instead-3.5.2.zip

  • Size

    7.2MB

  • MD5

    054250652bbf36bf652892aab6f30772

  • SHA1

    9bb632df3fecef8d4f7315ec046facd7b3417f71

  • SHA256

    78997726af8da25919b9afefbc8a86eca7570d8847534e60da29fedbdb7f84e5

  • SHA512

    96a18da95c42ba1deb34e7813fad4454c33859718cc0ae441f6caafd6d8169e125f316f03ff6dc46c95520de43bd1982af9c351fdd99486f81b53e5fe5262581

  • SSDEEP

    196608:g7TM08c3Z0XayH6kDpR+jcT84eepzDNaYV1:eT3f3unH6AKcTweplJP

Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

Files

  • instead-3.5.2.zip
    .zip

    Password: infected

  • instead-3.5.2/COPYING
  • instead-3.5.2/Microsoft.VC80.CRT/Microsoft.VC80.CRT.manifest
  • instead-3.5.2/Microsoft.VC80.CRT/msvcm80.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    2daa984c9cad30e736f52d625c07e4dd


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/Microsoft.VC80.CRT/msvcp80.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    6488997e312be12f8300ea7b1c34d497


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/Microsoft.VC80.CRT/msvcr80.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    7fecbc4a16a5dc85a5394a1df6217680


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/SDL2.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    9c79d30508bb66b3b0a62ac4e5279272


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/SDL2_image.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    6e4da6f2af071424647d58df0d971d9a


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/SDL2_mixer.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    54ffc4ef03ea64ae9183c73c14033ca6


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/SDL2_ttf.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    e8b2f4cbf1b016f1f6feb34ec1103be3


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/doc/examples/stead2/cutscene.lua
    .js
  • instead-3.5.2/doc/examples/stead2/dialog/main.lua
    .js
  • instead-3.5.2/doc/examples/stead2/fonts.lua
    .js
  • instead-3.5.2/doc/examples/stead2/keyboard/keyboard.lua
    .js
  • instead-3.5.2/doc/examples/stead2/keyboard/main.lua
    .js
  • instead-3.5.2/doc/examples/stead2/menu-demo/main.lua
    .js
  • instead-3.5.2/doc/examples/stead2/trigger.lua
    .js
  • instead-3.5.2/doc/examples/stead3/dialog/main3.lua
    .js
  • instead-3.5.2/doc/instead.6
  • instead-3.5.2/doc/modules3-ru.pdf
    .pdf

    Password: infected

    • https://github.com/instead-hub/stead3-modules/tree/master/keyboard

  • instead-3.5.2/doc/stead3-en.pdf
    .pdf
  • instead-3.5.2/doc/stead3-ru.pdf
    .pdf
  • instead-3.5.2/games/tutorial/br.png
    .png
  • instead-3.5.2/games/tutorial/de.png
    .png
  • instead-3.5.2/games/tutorial/es.png
    .png
  • instead-3.5.2/games/tutorial/fr.png
    .png
  • instead-3.5.2/games/tutorial/gb.png
    .png
  • instead-3.5.2/games/tutorial/instead.ogg
  • instead-3.5.2/games/tutorial/instead.png
    .png
  • instead-3.5.2/games/tutorial/it.png
    .png
  • instead-3.5.2/games/tutorial/main-de.lua
  • instead-3.5.2/games/tutorial/main-en.lua
  • instead-3.5.2/games/tutorial/main-es.lua
  • instead-3.5.2/games/tutorial/main-fr.lua
  • instead-3.5.2/games/tutorial/main-it.lua
  • instead-3.5.2/games/tutorial/main-nl.lua
  • instead-3.5.2/games/tutorial/main-pt.lua
  • instead-3.5.2/games/tutorial/main-ru.lua
  • instead-3.5.2/games/tutorial/main-uk.lua
  • instead-3.5.2/games/tutorial/main3.lua
    .js
  • instead-3.5.2/games/tutorial/nl.png
    .png
  • instead-3.5.2/games/tutorial/ru.png
    .png
  • instead-3.5.2/games/tutorial/tutorial.lua
    .js
  • instead-3.5.2/games/tutorial/uk.png
    .png
  • instead-3.5.2/icon/sdl_instead.ico
  • instead-3.5.2/icon/sdl_instead.png
    .png
  • instead-3.5.2/icon/sdl_instead_1.png
    .png
  • instead-3.5.2/lang/cs.ini
  • instead-3.5.2/lang/de.ini
  • instead-3.5.2/lang/en.ini
  • instead-3.5.2/lang/es.ini
  • instead-3.5.2/lang/fr.ini
  • instead-3.5.2/lang/it.ini
  • instead-3.5.2/lang/nl.ini
  • instead-3.5.2/lang/pt.ini
  • instead-3.5.2/lang/ru.ini
  • instead-3.5.2/lang/uk.ini
  • instead-3.5.2/libiconv2.dll
    .dll .ps1 windows:4 windows x86 arch:x86 polyglot

    5e63e66630a8ecd829ce2cfdcfa121ae


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/libmodplug-1.dll
    .dll windows:4 windows x86 arch:x86

    57a679f0658b2c0681df13c61f2ee205


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/libogg-0.dll
    .dll windows:4 windows x86 arch:x86

    8fc70781ffb0eaf38401419f1c251e11


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/lua5.1.dll
    .dll windows:4 windows x86 arch:x86

    0c4746bc523194aab61d984f6afccce2


    Headers

    Imports

    Exports

    Sections

  • instead-3.5.2/sdl-instead.exe
    .exe windows:4 windows x86 arch:x86

    9fc70acdbcb74ca31e6db75282b21395


    Headers

    Imports

    Sections

  • instead-3.5.2/stead/stead2/click.lua
    .js
  • instead-3.5.2/stead/stead2/counters.lua
  • instead-3.5.2/stead/stead2/dash.lua
  • instead-3.5.2/stead/stead2/dbg.lua
    .js
  • instead-3.5.2/stead/stead2/dlg.lua
    .js
  • instead-3.5.2/stead/stead2/events.lua
  • instead-3.5.2/stead/stead2/ext/gui.lua
    .js
  • instead-3.5.2/stead/stead2/ext/paths.lua
  • instead-3.5.2/stead/stead2/ext/sound.lua
    .js
  • instead-3.5.2/stead/stead2/ext/sprites.lua
  • instead-3.5.2/stead/stead2/ext/timer.lua
    .js
  • instead-3.5.2/stead/stead2/finger.lua
    .js
  • instead-3.5.2/stead/stead2/format.lua
    .js
  • instead-3.5.2/stead/stead2/hideinv.lua
    .js
  • instead-3.5.2/stead/stead2/hotkeys.lua
  • instead-3.5.2/stead/stead2/input.lua
    .js
  • instead-3.5.2/stead/stead2/kbd.lua
    .js
  • instead-3.5.2/stead/stead2/nolife.lua
  • instead-3.5.2/stead/stead2/nouse.lua
    .js
  • instead-3.5.2/stead/stead2/object.lua
    .js
  • instead-3.5.2/stead/stead2/para.lua
  • instead-3.5.2/stead/stead2/pixels.lua
    .js
  • instead-3.5.2/stead/stead2/prefs.lua
    .js
  • instead-3.5.2/stead/stead2/proxymenu.lua
    .js
  • instead-3.5.2/stead/stead2/quotes.lua
  • instead-3.5.2/stead/stead2/snapshots.lua
    .js
  • instead-3.5.2/stead/stead2/sound.lua
    .js
  • instead-3.5.2/stead/stead2/sprites.lua
    .js
  • instead-3.5.2/stead/stead2/stead.lua
    .js
  • instead-3.5.2/stead/stead2/theme.lua
    .js
  • instead-3.5.2/stead/stead2/timer.lua
    .js
  • instead-3.5.2/stead/stead2/vars.lua
    .js
  • instead-3.5.2/stead/stead2/walk.lua
    .js
  • instead-3.5.2/stead/stead2/wroom.lua
    .js
  • instead-3.5.2/stead/stead2/xact.lua
    .js
  • instead-3.5.2/stead/stead3/click.lua
    .js
  • instead-3.5.2/stead/stead3/dbg-ru.lua
  • instead-3.5.2/stead/stead3/dbg.lua
    .js
  • instead-3.5.2/stead/stead3/declare.lua
    .js
  • instead-3.5.2/stead/stead3/dlg.lua
    .js
  • instead-3.5.2/stead/stead3/events.lua
  • instead-3.5.2/stead/stead3/ext/gui.lua
    .js
  • instead-3.5.2/stead/stead3/ext/paths.lua
  • instead-3.5.2/stead/stead3/ext/sandbox.lua
    .js
  • instead-3.5.2/stead/stead3/ext/sound.lua
    .js
  • instead-3.5.2/stead/stead3/ext/sprites.lua
    .js
  • instead-3.5.2/stead/stead3/ext/timer.lua
    .js
  • instead-3.5.2/stead/stead3/finger.lua
    .js
  • instead-3.5.2/stead/stead3/fmt.lua
    .js
  • instead-3.5.2/stead/stead3/keys.lua
    .js
  • instead-3.5.2/stead/stead3/noinv.lua
  • instead-3.5.2/stead/stead3/nolife.lua
  • instead-3.5.2/stead/stead3/prefs.lua
    .js
  • instead-3.5.2/stead/stead3/snapshots.lua
    .js
  • instead-3.5.2/stead/stead3/snd.lua
  • instead-3.5.2/stead/stead3/sprite.lua
  • instead-3.5.2/stead/stead3/stdlib.lua
    .js
  • instead-3.5.2/stead/stead3/stead.lua
    .js
  • instead-3.5.2/stead/stead3/theme.lua
  • instead-3.5.2/stead/stead3/timer.lua
  • instead-3.5.2/themes/arctic/adown.png
    .png
  • instead-3.5.2/themes/arctic/aup.png
    .png
  • instead-3.5.2/themes/arctic/bg.png
    .png
  • instead-3.5.2/themes/arctic/cursor-use.png
    .png
  • instead-3.5.2/themes/arctic/cursor.png
    .png
  • instead-3.5.2/themes/arctic/menu.png
    .png
  • instead-3.5.2/themes/arctic/theme.ini
  • instead-3.5.2/themes/bluesteel/bg.png
    .png
  • instead-3.5.2/themes/bluesteel/cursor-use.png
    .png
  • instead-3.5.2/themes/bluesteel/cursor.png
    .png
  • instead-3.5.2/themes/bluesteel/downarrow.png
    .png
  • instead-3.5.2/themes/bluesteel/menu.png
    .png
  • instead-3.5.2/themes/bluesteel/theme.ini
  • instead-3.5.2/themes/bluesteel/uparrow.png
    .png
  • instead-3.5.2/themes/book/book.png
    .png
  • instead-3.5.2/themes/book/theme.ini
  • instead-3.5.2/themes/clearlooks/adown.png
    .png
  • instead-3.5.2/themes/clearlooks/aup.png
    .png
  • instead-3.5.2/themes/clearlooks/bg.jpg
    .jpg
  • instead-3.5.2/themes/clearlooks/cursor-use.png
    .png
  • instead-3.5.2/themes/clearlooks/cursor.png
    .png
  • instead-3.5.2/themes/clearlooks/menu.png
    .png
  • instead-3.5.2/themes/clearlooks/theme.ini
  • instead-3.5.2/themes/default/adown.png
    .png
  • instead-3.5.2/themes/default/aup.png
    .png
  • instead-3.5.2/themes/default/bg.png
    .png
  • instead-3.5.2/themes/default/click.ogg
  • instead-3.5.2/themes/default/click.wav
  • instead-3.5.2/themes/default/cursor-use.png
    .png
  • instead-3.5.2/themes/default/cursor.png
    .png
  • instead-3.5.2/themes/default/menu.png
    .png
  • instead-3.5.2/themes/default/sans-b.ttf
  • instead-3.5.2/themes/default/sans-bi.ttf
  • instead-3.5.2/themes/default/sans-i.ttf
  • instead-3.5.2/themes/default/sans.ttf
  • instead-3.5.2/themes/default/theme.ini
  • instead-3.5.2/themes/default/use.png
    .png
  • instead-3.5.2/themes/fantasy/bg.png
    .png
  • instead-3.5.2/themes/fantasy/down.png
    .png
  • instead-3.5.2/themes/fantasy/menu.png
    .png
  • instead-3.5.2/themes/fantasy/theme.ini
  • instead-3.5.2/themes/fantasy/up.png
    .png
  • instead-3.5.2/themes/mobile/bg.png
    .png
  • instead-3.5.2/themes/mobile/theme.ini
  • instead-3.5.2/themes/wide/bg.png
    .png
  • instead-3.5.2/themes/wide/theme.ini