Overview
overview
7Static
static
3geometryda....4.zip
windows10-2004-x64
7arm64/package.json
windows10-2004-x64
3arm64/www/data.json
windows10-2004-x64
3arm64/www/...28.png
windows10-2004-x64
1arm64/www/...16.png
windows10-2004-x64
1arm64/www/...56.png
windows10-2004-x64
1arm64/www/...32.png
windows10-2004-x64
1arm64/www/...12.png
windows10-2004-x64
1arm64/www/...64.png
windows10-2004-x64
1arm64/www/...go.png
windows10-2004-x64
1arm64/www/...t0.png
windows10-2004-x64
1arm64/www/...t0.png
windows10-2004-x64
1arm64/www/...t1.png
windows10-2004-x64
1arm64/www/index.html
windows10-2004-x64
7arm64/www/...ain.js
windows10-2004-x64
3arm64/www/...ime.js
windows10-2004-x64
3arm64/www/...ker.js
windows10-2004-x64
3arm64/www/...ker.js
windows10-2004-x64
3arm64/www/...ain.js
windows10-2004-x64
3arm64/www/...eck.js
windows10-2004-x64
3arm64/www/...ble.js
windows10-2004-x64
3arm64/www/...eck.js
windows10-2004-x64
3x64/www/index.html
windows10-2004-x64
7x64/www/sc...ain.js
windows10-2004-x64
3x64/www/sc...ime.js
windows10-2004-x64
3x64/www/sc...ker.js
windows10-2004-x64
3x64/www/sc...ker.js
windows10-2004-x64
3x64/www/sc...ain.js
windows10-2004-x64
3x64/www/sc...eck.js
windows10-2004-x64
3x64/www/sc...ble.js
windows10-2004-x64
3x64/www/sc...eck.js
windows10-2004-x64
3x64/www/workermain.js
windows10-2004-x64
3Analysis
- max time kernel
898s - max time network
439s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/05/2026, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
geometrydash_full_archive_version_3.4.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
arm64/package.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
arm64/www/data.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
arm64/www/icons/icon-128.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
arm64/www/icons/icon-16.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
arm64/www/icons/icon-256.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
arm64/www/icons/icon-32.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
arm64/www/icons/icon-512.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
arm64/www/icons/icon-64.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
arm64/www/icons/loading-logo.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
arm64/www/images/geo-sheet0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
arm64/www/images/shared-0-sheet0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
arm64/www/images/shared-0-sheet1.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
arm64/www/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
arm64/www/scripts/c3main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
arm64/www/scripts/c3runtime.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
arm64/www/scripts/dispatchworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
arm64/www/scripts/jobworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
arm64/www/scripts/main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
arm64/www/scripts/modernjscheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
arm64/www/scripts/objRefTable.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
arm64/www/scripts/supportcheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
x64/www/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
x64/www/scripts/c3main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
x64/www/scripts/c3runtime.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
x64/www/scripts/dispatchworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
x64/www/scripts/jobworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
x64/www/scripts/main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
x64/www/scripts/modernjscheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
x64/www/scripts/objRefTable.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
x64/www/scripts/supportcheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
x64/www/workermain.js
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target arm64/www/icons/icon-128.png
- Size 16KB
- Sample260531-vm41msft9l
- SHA256 56d66d35bdece8f0dfec0cefe56eec1e86fc9cc25d85eba0a935ec4b473fa7e6
- MD5 91dd28db79dc9e75c289d0f6a2306e8b
- SHA1 e4216c5997eeadb83f95c35a5878703a3fc11250
- SHA512 c7bddc35686d9aceee257163157af94089520c08f95273d5abb747cbb8f55ceb32617a18bf40719c88c62249a7fe09a5f87c6690119a0be410d2ab7a1f924d21
- SSDEEP 384:Weby0s3drzbvHMNCMYNncMXNe9TU9d7eRhtk4AA:JWztzHtzcSetIeRbGA
- TLSH T15072D05703ADBA713EF90ACDE0D38D9405261AB1A04944642A0D7DB835F67E6FF91F42
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4012 mspaint.exe 4012 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4012 mspaint.exe 4012 mspaint.exe 4012 mspaint.exe 4012 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\arm64\www\icons\icon-128.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4012
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3348