New Compressed (zipped) Folder.zip
- SHA256 dfeeb22d767e6b45d6517fce933e2fd5368227a38024282633946ef6ab0e3dd7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
New Compressed (zipped) Folder.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
New Compressed (zipped) Folder.zip
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Gorilla Tag.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Gorilla Tag.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
MonkeModManager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
MonkeModManager.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target New Compressed (zipped) Folder.zip
- Size 114KB
- Sample260605-cdbcvsav2y
- SHA256 dfeeb22d767e6b45d6517fce933e2fd5368227a38024282633946ef6ab0e3dd7
- MD5 e5dfd32f09f32921a5c78be4967a0aa1
- SHA1 fe7305c0704389cb3b307078880dc84242b96d2f
- SHA512 3cfa5f14be81ba102d67743e31f77ccaa9418e709af82dfb0f7d7aa607b0c51465f03eee3741c337f80045171f7f8f37602ef75b7d40bf916f23f17c2f65f48b
- SSDEEP 3072:1tciqvJ8iwrPmAykBaA529bgqjIjiTdnTJitnRg:cbGOSVMjIiTdTJ6nS
- TLSH T1BFB312B6E66BA03FCCBBA778F07557BDC305025CAB0ADC96846D7F78105548AA0D3271
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Gorilla Tag.exe unpack001/MonkeModManager.exe
File Explorer
-
New Compressed (zipped) Folder.zip.zip 114KB
-
Gorilla Tag.exe.exe 652KB
-
MonkeModManager.exe.exe 92KB
Gorilla Tag.exe
- IMPHASH a136217cdd3247ff6a8766561064ca0b
- SHA256 e40b4d8552ee26816f18360dfec0be5d258e622aba1f2485e4166caadaabfa8c
- MD5 430e43ab21d03582bea7c6e9cbb633a9
- SHA1 695f0baa20f1dcd32e1e8cdbc8b6541ded1bfb3f
- SHA512 754b67915eac9081442063c45cff76cbf90cf22c6d0721d47b4267c03c1c48dc21017adaa27d5dcd6b5984d5ae3940aca05dd4f072978c3399eea22d53eaab62
- SSDEEP 1536:An6FL0B23UTvCDPPpOSOPvuMXuUUhCKZPRcGkiRmzVHsWMdo9dl1HcUIc/bn2lds:BwazAjvuMeUwZPR5YzK4jHcUIcLBSnQ
- TLSH T170E440462016F48DD57405F9AFC5C2FC62207FA8395AA3F617E82E3B360634DC95BA93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4708
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\build\output\unity\unity\artifacts\WindowsPlayer\Win_x64_VS2022_VB_nondev_m_r\WindowsPlayer_player_Master_mono_x64.pdb
unityplayer
UnityMain2
kernel32
HeapAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CloseHandle
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
AmdPowerXpressRequestHighPerformance
D3D12SDKPath
D3D12SDKVersion
NvOptimusEnablement
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
552KB
Virtual Size
552KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=28900,
count=138, id=261, version=28900,
count=10, id=260, version=28900,
count=2, id=257, version=28900,
count=9, id=259, version=34321,
count=16, id=260, version=34321,
count=40, id=261, version=34321,
count=3, id=257, version=34433,
count=89, id=1, productName=Unmarked objects,
count=2, id=261, version=34433,
count=1, id=256, version=34433,
count=1, id=255, version=34433,
count=1, id=258, version=34433,
MonkeModManager.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6ace08b97457333f9aea5ca8d4fb4e72170c1fa4aa4c92df82cea73d1f438377
- MD5 21982966b8fedf70fa647b1eb0643eae
- SHA1 a05100bcd4540337bc5525fccccc0d902e95b696
- SHA512 664549735317e0f719f7880e70d4cf2504d5756aaf77d7b281af49592661e5d5d8049c159ca05008b51dc46bfcaedafb6184a1c91e407d3583477d2abc26dce4
- SSDEEP 1536:UwLpukG6RVSumlSuUeReDxCQhvXTMxb+VLzwRG953jSiMFkq1V96uIKPoR:3LpuL6RVhmQuzRArpSWLzwR05eBPwuXk
- TLSH T13A935B1033F84B27E6FE9BFDA47505110B72FA0B6522EBDC5E8960CD19E37406612BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
93846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\ngbat\RiderProjects\MonkeModManager\MonkeModManager\obj\Release\MonkeModManager.pdb
mscoree
_CorExeMain
Name
.text
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ