Overview
overview
7Static
static
3geometryda....4.zip
windows10-2004-x64
7arm64/package.json
windows10-2004-x64
3arm64/www/data.json
windows10-2004-x64
3arm64/www/...28.png
windows10-2004-x64
1arm64/www/...16.png
windows10-2004-x64
1arm64/www/...56.png
windows10-2004-x64
1arm64/www/...32.png
windows10-2004-x64
1arm64/www/...12.png
windows10-2004-x64
1arm64/www/...64.png
windows10-2004-x64
1arm64/www/...go.png
windows10-2004-x64
1arm64/www/...t0.png
windows10-2004-x64
1arm64/www/...t0.png
windows10-2004-x64
1arm64/www/...t1.png
windows10-2004-x64
1arm64/www/index.html
windows10-2004-x64
7arm64/www/...ain.js
windows10-2004-x64
3arm64/www/...ime.js
windows10-2004-x64
3arm64/www/...ker.js
windows10-2004-x64
3arm64/www/...ker.js
windows10-2004-x64
3arm64/www/...ain.js
windows10-2004-x64
3arm64/www/...eck.js
windows10-2004-x64
3arm64/www/...ble.js
windows10-2004-x64
3arm64/www/...eck.js
windows10-2004-x64
3x64/www/index.html
windows10-2004-x64
7x64/www/sc...ain.js
windows10-2004-x64
3x64/www/sc...ime.js
windows10-2004-x64
3x64/www/sc...ker.js
windows10-2004-x64
3x64/www/sc...ker.js
windows10-2004-x64
3x64/www/sc...ain.js
windows10-2004-x64
3x64/www/sc...eck.js
windows10-2004-x64
3x64/www/sc...ble.js
windows10-2004-x64
3x64/www/sc...eck.js
windows10-2004-x64
3x64/www/workermain.js
windows10-2004-x64
3Analysis
- max time kernel
898s - max time network
436s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/05/2026, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
geometrydash_full_archive_version_3.4.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
arm64/package.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
arm64/www/data.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
arm64/www/icons/icon-128.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
arm64/www/icons/icon-16.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
arm64/www/icons/icon-256.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
arm64/www/icons/icon-32.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
arm64/www/icons/icon-512.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
arm64/www/icons/icon-64.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
arm64/www/icons/loading-logo.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
arm64/www/images/geo-sheet0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
arm64/www/images/shared-0-sheet0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
arm64/www/images/shared-0-sheet1.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
arm64/www/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
arm64/www/scripts/c3main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
arm64/www/scripts/c3runtime.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
arm64/www/scripts/dispatchworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
arm64/www/scripts/jobworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
arm64/www/scripts/main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
arm64/www/scripts/modernjscheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
arm64/www/scripts/objRefTable.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
arm64/www/scripts/supportcheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
x64/www/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
x64/www/scripts/c3main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
x64/www/scripts/c3runtime.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
x64/www/scripts/dispatchworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
x64/www/scripts/jobworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
x64/www/scripts/main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
x64/www/scripts/modernjscheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
x64/www/scripts/objRefTable.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
x64/www/scripts/supportcheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
x64/www/workermain.js
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target arm64/www/icons/loading-logo.png
- Size 63KB
- Sample260531-vm41msft9l
- SHA256 952d8ebe316d4d9b1da2fa060d6b69280ea0bd349bbfe0ed9d7d6b7262d0517f
- MD5 e4d9dfaf0a74f7536235cf2255b48c43
- SHA1 81823e8e97e0d829fad3db891c59e6b4676f97b4
- SHA512 299513e28adf856f3018cbb701f28d8ccf0bf85dcc952daf437a3423c11eb51dcd9f6b5a1588c9d8acb860a682a1b4d348fd9491bfda18bb4091afd844d6abf9
- SSDEEP 1536:WIunu3FTDyrjXies3RpUJTRpaVpFWcB8o82SFe4G/:W61DgjlqdH8rFXG/
- TLSH T1E95312DF120D897E756C1A9FEFF8B17592854000148AB1F2CB20EB6294F7B5409F6EC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1496 mspaint.exe 1496 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1496 mspaint.exe 1496 mspaint.exe 1496 mspaint.exe 1496 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\arm64\www\icons\loading-logo.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1496
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2004