Overview
overview
7Static
static
3geometryda....4.zip
windows10-2004-x64
7arm64/package.json
windows10-2004-x64
3arm64/www/data.json
windows10-2004-x64
3arm64/www/...28.png
windows10-2004-x64
1arm64/www/...16.png
windows10-2004-x64
1arm64/www/...56.png
windows10-2004-x64
1arm64/www/...32.png
windows10-2004-x64
1arm64/www/...12.png
windows10-2004-x64
1arm64/www/...64.png
windows10-2004-x64
1arm64/www/...go.png
windows10-2004-x64
1arm64/www/...t0.png
windows10-2004-x64
1arm64/www/...t0.png
windows10-2004-x64
1arm64/www/...t1.png
windows10-2004-x64
1arm64/www/index.html
windows10-2004-x64
7arm64/www/...ain.js
windows10-2004-x64
3arm64/www/...ime.js
windows10-2004-x64
3arm64/www/...ker.js
windows10-2004-x64
3arm64/www/...ker.js
windows10-2004-x64
3arm64/www/...ain.js
windows10-2004-x64
3arm64/www/...eck.js
windows10-2004-x64
3arm64/www/...ble.js
windows10-2004-x64
3arm64/www/...eck.js
windows10-2004-x64
3x64/www/index.html
windows10-2004-x64
7x64/www/sc...ain.js
windows10-2004-x64
3x64/www/sc...ime.js
windows10-2004-x64
3x64/www/sc...ker.js
windows10-2004-x64
3x64/www/sc...ker.js
windows10-2004-x64
3x64/www/sc...ain.js
windows10-2004-x64
3x64/www/sc...eck.js
windows10-2004-x64
3x64/www/sc...ble.js
windows10-2004-x64
3x64/www/sc...eck.js
windows10-2004-x64
3x64/www/workermain.js
windows10-2004-x64
3Analysis
- max time kernel
898s - max time network
430s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/05/2026, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
geometrydash_full_archive_version_3.4.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
arm64/package.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
arm64/www/data.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
arm64/www/icons/icon-128.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
arm64/www/icons/icon-16.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
arm64/www/icons/icon-256.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
arm64/www/icons/icon-32.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
arm64/www/icons/icon-512.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
arm64/www/icons/icon-64.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
arm64/www/icons/loading-logo.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
arm64/www/images/geo-sheet0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
arm64/www/images/shared-0-sheet0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
arm64/www/images/shared-0-sheet1.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
arm64/www/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
arm64/www/scripts/c3main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
arm64/www/scripts/c3runtime.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
arm64/www/scripts/dispatchworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
arm64/www/scripts/jobworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
arm64/www/scripts/main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
arm64/www/scripts/modernjscheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
arm64/www/scripts/objRefTable.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
arm64/www/scripts/supportcheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
x64/www/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
x64/www/scripts/c3main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
x64/www/scripts/c3runtime.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
x64/www/scripts/dispatchworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
x64/www/scripts/jobworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
x64/www/scripts/main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
x64/www/scripts/modernjscheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
x64/www/scripts/objRefTable.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
x64/www/scripts/supportcheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
x64/www/workermain.js
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target arm64/www/images/geo-sheet0.png
- Size 282KB
- Sample260531-vm41msft9l
- SHA256 bec5727a28d32788dbe7a3b257972b623a17c39f96fbcd798214cc0930fab29f
- MD5 7538ddff9da10db27ed557f7111dd0a4
- SHA1 03f25393411417a653ac0fec20a3cfb131fddbeb
- SHA512 80e3782067c18ab2f8016561bb2f3bfce935d2fafd3907677ac1600294c48995a0ada98d429c24d5fa6db0ca71f5061b3cc3f011e7ef8c4e9b6a6b7cd338068f
- SSDEEP 6144:eqPj8+jB3Tlw6aRb2GiSoMweDq7Ai2v+uY0nUXEx:1PB3T1EG7Ai22uY0UUx
- TLSH T1C25422303E4AD24A3D0D98FF477299B9D74CE4B6D4922DEE304283492CD9FA24475EE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4704 mspaint.exe 4704 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4704 mspaint.exe 4704 mspaint.exe 4704 mspaint.exe 4704 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\arm64\www\images\geo-sheet0.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2944