FFXIII-2 - Leviathan's Tears (v1.3).zip
- SHA256 2b4b23ef97ee7bc6318e73bd539d6e843414c0b89287341d98fa045ac4a13d11
Overview
overview
8Static
static
3FFXIII-2 -...3).zip
windows10-2004-x64
3FFXIII-2 -...3).zip
windows11-ltsc_2024-x64
1FFXIII2Lev...rs.exe
windows10-2004-x64
3FFXIII2Lev...rs.exe
windows11-ltsc_2024-x64
3IMGBlibrary.dll
windows10-2004-x64
1IMGBlibrary.dll
windows11-ltsc_2024-x64
8LocateFile.dll
windows10-2004-x64
1LocateFile.dll
windows11-ltsc_2024-x64
1PatchData.zip
windows10-2004-x64
1PatchData.zip
windows11-ltsc_2024-x64
1vfx/field/...ex.dds
windows10-2004-x64
3vfx/field/...ex.dds
windows11-ltsc_2024-x64
3vfx/field/...ex.dds
windows10-2004-x64
3vfx/field/...ex.dds
windows11-ltsc_2024-x64
3WPDtool.dll
windows10-2004-x64
1WPDtool.dll
windows11-ltsc_2024-x64
8WhiteBinTools.dll
windows10-2004-x64
1WhiteBinTools.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FFXIII-2 - Leviathan's Tears (v1.3).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
FFXIII-2 - Leviathan's Tears (v1.3).zip
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
FFXIII2LeviathansTears.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
FFXIII2LeviathansTears.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
IMGBlibrary.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
IMGBlibrary.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral7
Sample
LocateFile.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
LocateFile.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
PatchData.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
PatchData.zip
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
vfx/field/weather/weather07/_veffs.jp.win32.imgb/v8cc6bbc2d6112f.vtex.dds
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
vfx/field/weather/weather07/_veffs.jp.win32.imgb/v8cc6bbc2d6112f.vtex.dds
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
vfx/field/weather/weather08/_veffs.jp.win32.imgb/ve961e1acb4d64e.vtex.dds
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
vfx/field/weather/weather08/_veffs.jp.win32.imgb/ve961e1acb4d64e.vtex.dds
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
WPDtool.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
WPDtool.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral17
Sample
WhiteBinTools.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
WhiteBinTools.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target FFXIII-2 - Leviathan's Tears (v1.3).zip
- Size 67KB
- Sample260620-2sca5saz8x
- SHA256 2b4b23ef97ee7bc6318e73bd539d6e843414c0b89287341d98fa045ac4a13d11
- MD5 5693f08898182de11b48301136ec7b7b
- SHA1 c30bba9a0b90911e298ff7f97fc70ec6c42dd775
- SHA512 d43c3015c421e5582568323b2b115036265f2b673947e301b34e692064d441a30a80832edeb39b8ee6851080dc15766fdcb1c2b576313c33ce66eee84cbf6464
- SSDEEP 1536:kpJn4KLSdG8Gx0HoQWKLvJWYbL88C5y/pQMtX:mJFuI9x055VnMny/V
- TLSH T1C263023CB8083525D0368F3AED6AD163F25499D24C79DF9738CC74E345A6ED52E0E24A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/FFXIII2LeviathansTears.exe unpack001/IMGBlibrary.dll unpack001/LocateFile.dll unpack001/WPDtool.dll unpack001/WhiteBinTools.dll
File Explorer
-
FFXIII-2 - Leviathan's Tears (v1.3).zip.zip 67KB
-
FFXIII2LeviathansTears.exe.exe 16KB
-
IMGBlibrary.dll.dll 23KB
-
LocateFile.dll.dll 4KB
-
PatchData.bin.zip 7KB
-
vfx/field/weather/weather07/_veffs.jp.win32.imgb/v8cc6bbc2d6112f.vtex.dds3KB
-
vfx/field/weather/weather08/_veffs.jp.win32.imgb/ve961e1acb4d64e.vtex.dds3KB
-
WPDtool.dll.dll 10KB
-
WhiteBinTools.dll.dll 114KB
FFXIII2LeviathansTears.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1a156a8b43825092671ff08edb49243673152adfafeb0c078ff8f1b416096ff5
- MD5 f107469bc091d2695e50e1dd624571ed
- SHA1 25e669a9d429e941b75f43c907477b491cbc6015
- SHA512 90a529b5a9992351acf16b3c09a447bf0b53699cea834858a26667c8740e7b14934a991e2160ea1b079cdcd0418d1a997777a5b6e43cbec53d2241494977f840
- SSDEEP 192:U+k1MX1O/BbS+0wSQmkC6RLpK74YEEoDZGzQVH+OsvxHL4rlO/lvkqDDHtaKiEnh:qGO/eF16y74YDQYaKiE/yck9y4Vr
- TLSH T19072121577F8022AE6FFAB30D9712201C739B947E875EF4E148A114B1A6FA508DA1F71
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21498
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IMGBlibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7201f9319a94a3d8cb618e1a8379af1324e0b9433f6a286cb590718e376ef55e
- MD5 963ca87fc8372f5ecabc3b9c19a96c1c
- SHA1 100c45a57dca5097a222c50011747f4657d58d99
- SHA512 5727647227a096bd4326df214b2bc75f79313671aaa150904e2a0995c8f5b2995ce66aa298f88600dd188c9abafc5f6def10b57933c41d3fc257fb3512d63e3b
- SSDEEP 384:3eX5DvUVU5KMJTkBFrMDzW/0e72/ipi3vYN1rjGnd:sDvUVUUkTkfoWiqg3vYN1Wd
- TLSH T1CCB2EA492BD9633BDAFE573419F0025016F9F42BB772E70B9D83105B2D13B998610BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LocateFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 38ad378686d7772ad85e6ca2da7bb6a97ea1c66c2f932de0a769248bfbff5ce9
- MD5 3f37ea40c706a6927a1b8a0ec2f15318
- SHA1 a71d5a440908bf1a95a7d4f826903032a1caa890
- SHA512 bf3428c1b186871b7d19f6ba0d2770919fdb42b3d91d23a3dd652968b94e0211eb61051ad498542e312007e3d7b7eca246291f64be2bd989b91657f81cfccf44
- TLSH T147818425A7E48777DEB74B31ED63134906B4FB609A13DB2D09C0A21B7C166244E32BA0
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PatchData.bin
- SHA256 52849a9409d2b021e5fb95b16897bcaa3c141fc219752cc20d0a7a2f9f2de48a
- MD5 dc506b5c95a2319dcfad23b7b8b769ca
- SHA1 c0a7782d3f716022b9b2a4e232baec15c484bdf8
- SHA512 3a451144dd38222053c286649479a9689714517f893d27876ca020165208bb2cbda16560e29216241fd4df08941d566e7a371f1e36c9cc818d8bcd4a86fa82bb
- SSDEEP 96:MPHIkrOjAVUb8bbBPtdQME85k31l5hamjAZbI1WtPnwVgzgkeC84UHz75d31:DMVc8bbBPv35yz50pI2Pnmgzg1ie5Z1
- TLSH T1C6F1ABFBC40482D9C9084EF97071463DB33EB633E98A7ECE572A042949A75604F3799B
- MD5 SHA1 SHA512 SSDEEP TLSH
vfx/field/weather/weather07/_veffs.jp.win32.imgb/v8cc6bbc2d6112f.vtex.dds
- SHA256 5fc020ebf29212ef067f2f7b4236fc2806ebd648493b0ff5befc6345db922fdc
- MD5 3d3fde65ca02944c19b2a9f21c24c951
- SHA1 ae635fd4a4dfd51ac15e340160b8d4d05f8e4452
- SHA512 374a1e5d5cf7ee3a3b3a2c74f2db0a3859a455a56bdfe4f12eed09cc1cbadd01fb01101d8387b853df7650aba49e1439e454b62d9096f839d783fc29518cf139
- TLSH T1CE6113F7840095E6CE084DF4B552063EB26EBA37F489BECF273A095189275554F378A3
- MD5 SHA1 SHA512 TLSH
vfx/field/weather/weather08/_veffs.jp.win32.imgb/ve961e1acb4d64e.vtex.dds
- SHA256 e06cb5657d0ef65920eca7914bccfc9eb351b271c14bd1d1a9d64c67d1f4d314
- MD5 30d8e659b9967722f174cf9e86cf7c5d
- SHA1 fed393d79a3f5b23691edf7b0f18da692ef6bee9
- SHA512 b543674d1aaa20f6d097d0ffd2b1bda01b374e4b8ca252d9dad63a5797a6314a447ce4ef38e9738f3792e37a146c144c1c40a6f5d3f72f5d41a7e3deebd12c96
- TLSH T1226150FBC41492D5C6084DF9B172463DB33EBA32E88BBECC171A097899A74144F374A8
- MD5 SHA1 SHA512 TLSH
WPDtool.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 846db0fbbf2e3af124cbf5126185706e2d19b22b890c7c4b9e5af600ca7ad6cc
- MD5 982d844f8533565b84074ba77615e031
- SHA1 3dc3f7ae5b9b2681e5b2abe4ad76c82b7472102a
- SHA512 c5d2cd8ac03ee103c05b96d9ad71ebb8216fb60e29396fca04a58250602ca321f907a6d36c964f31e9fc03a5923368d54242ac6fdbd23f483697d84bb3cdb0f7
- SSDEEP 192:BzURztQwN9n8dbw0XMNuehC+ExTDdujCdiTNSDpRjE4cVk/x:BzgZQw6QuxHdujCpsVkp
- TLSH T12622C5047BE98616E4FF5F767CF103100231F617EA72CB0F6882555F6E32B9588A0BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
WhiteBinTools.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b3ead2ea9df39b03e11a1b73fd39210abf2ed6ce89c268b8f28e77e9703ff1a4
- MD5 8710cc5c4eb7d147a0299c69c353fb5c
- SHA1 ee7564c9103eb26857d383ea6d7c681645865314
- SHA512 5f4ce8902266a13af3e54de8ca764429394209beff2401e69be592aa57526b8be0209006e518f0669785f634f39ede41c427cc556118c71b7482d6ad8cc5999b
- SSDEEP 3072:hIONhLQToLxcQACtWiKXVkkA28mVN5VgweI/KQ73WmVNc:hIONhLNLxFtWiKXas8mVN5VdN
- TLSH T154B35C346F9D9B6FD4BE82FDA4B0127503F0B136B61BE79B694024F919037818A11BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
112750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ