Overview
overview
7Static
static
3geometryda....4.zip
windows10-2004-x64
7arm64/package.json
windows10-2004-x64
3arm64/www/data.json
windows10-2004-x64
3arm64/www/...28.png
windows10-2004-x64
1arm64/www/...16.png
windows10-2004-x64
1arm64/www/...56.png
windows10-2004-x64
1arm64/www/...32.png
windows10-2004-x64
1arm64/www/...12.png
windows10-2004-x64
1arm64/www/...64.png
windows10-2004-x64
1arm64/www/...go.png
windows10-2004-x64
1arm64/www/...t0.png
windows10-2004-x64
1arm64/www/...t0.png
windows10-2004-x64
1arm64/www/...t1.png
windows10-2004-x64
1arm64/www/index.html
windows10-2004-x64
7arm64/www/...ain.js
windows10-2004-x64
3arm64/www/...ime.js
windows10-2004-x64
3arm64/www/...ker.js
windows10-2004-x64
3arm64/www/...ker.js
windows10-2004-x64
3arm64/www/...ain.js
windows10-2004-x64
3arm64/www/...eck.js
windows10-2004-x64
3arm64/www/...ble.js
windows10-2004-x64
3arm64/www/...eck.js
windows10-2004-x64
3x64/www/index.html
windows10-2004-x64
7x64/www/sc...ain.js
windows10-2004-x64
3x64/www/sc...ime.js
windows10-2004-x64
3x64/www/sc...ker.js
windows10-2004-x64
3x64/www/sc...ker.js
windows10-2004-x64
3x64/www/sc...ain.js
windows10-2004-x64
3x64/www/sc...eck.js
windows10-2004-x64
3x64/www/sc...ble.js
windows10-2004-x64
3x64/www/sc...eck.js
windows10-2004-x64
3x64/www/workermain.js
windows10-2004-x64
3Analysis
- max time kernel
898s - max time network
491s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/05/2026, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
geometrydash_full_archive_version_3.4.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
arm64/package.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
arm64/www/data.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
arm64/www/icons/icon-128.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
arm64/www/icons/icon-16.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
arm64/www/icons/icon-256.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
arm64/www/icons/icon-32.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
arm64/www/icons/icon-512.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
arm64/www/icons/icon-64.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
arm64/www/icons/loading-logo.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
arm64/www/images/geo-sheet0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
arm64/www/images/shared-0-sheet0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
arm64/www/images/shared-0-sheet1.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
arm64/www/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
arm64/www/scripts/c3main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
arm64/www/scripts/c3runtime.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
arm64/www/scripts/dispatchworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
arm64/www/scripts/jobworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
arm64/www/scripts/main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
arm64/www/scripts/modernjscheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
arm64/www/scripts/objRefTable.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
arm64/www/scripts/supportcheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
x64/www/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
x64/www/scripts/c3main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
x64/www/scripts/c3runtime.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
x64/www/scripts/dispatchworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
x64/www/scripts/jobworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
x64/www/scripts/main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
x64/www/scripts/modernjscheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
x64/www/scripts/objRefTable.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
x64/www/scripts/supportcheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
x64/www/workermain.js
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target arm64/www/icons/icon-512.png
- Size 19KB
- Sample260531-vm41msft9l
- SHA256 adc611bf676cc4740aeb25f28fba8ffdc89f0d664b1676deb7d2a22aa55bfecf
- MD5 39e7b81fb02c1e0a124f1f441a54a81e
- SHA1 5c4cbbb6df17ae05e90e4ca300777feaf2e9a2da
- SHA512 18d39b467f530c46c5429c9e90618b09a3577b002a2900322363afcc5577768d5d2958dc02a0db5acf24f4d796cf2473f9fdeaedf085669b2bcada72de5e36b4
- SSDEEP 384:5uLamybCL2KvftvNQ9S+Y2t9k5PgjXZDyFKIk57k/:5GMCCgfHQ9HVOKl5q
- TLSH T1D892BEF67CF8DA8ADD3765B23BE58F172DE69C7C59DA215AD040142DC928E643AC01C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4300 mspaint.exe 4300 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4300 mspaint.exe 4300 mspaint.exe 4300 mspaint.exe 4300 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\arm64\www\icons\icon-512.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4196