WorldInstaller.zip
- SHA256 ec78d2084b97bc6d53772718fbfc4d2dab5ac5f1b605cc00626ec26f9daae317
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
win-x64/World Client Installer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
win-x64/World Client Installer.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
win-x64/World Client Installer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
win-x64/World Client Installer.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target WorldInstaller.zip
- Size 295KB
- Sample260620-qsmlbsgw4v
- SHA256 ec78d2084b97bc6d53772718fbfc4d2dab5ac5f1b605cc00626ec26f9daae317
- MD5 493b26deab50e3c1523841f2dce7414b
- SHA1 e9e3ee356dd509566d44058f222fa2bbc3f1b511
- SHA512 293a623a19019b2d01b74a68916bbd208be38788cad0c8ad00d25249a65d07bcbf650d27f06b26de044c43e39e9d3304b964b3867fbe4e523bc3291ed6c80442
- SSDEEP 6144:nzAFQ9HbAU0A5JHbNZm7mDHb0SnAiWasNftBUf9Hb4QYtXQn:n0FabAU0A/bN5btAiGfMpbktXO
- TLSH T178541261973F5440CB778A397DEB8A5CBB1BA888C140BA4D71C44EB1756ED9F826C80B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/win-x64/World Client Installer.dll unpack001/win-x64/World Client Installer.exe
File Explorer
-
WorldInstaller.zip.zip 295KB
-
win-x64/World Client Installer.deps.json514B
-
win-x64/World Client Installer.dll.exe 198KB
-
win-x64/World Client Installer.exe.exe 206KB
-
win-x64/World Client Installer.pdb21KB
-
win-x64/World Client Installer.runtimeconfig.json519B
-
win-x64/wi-version.txt5B
win-x64/World Client Installer.deps.json
- SHA256 da0c84e1b57e4dd6a2730ad5e18c3acfbbab33c81d5a0530235b1e0373c59729
- MD5 2a4961feb7f86f2b555637cea95acdb9
- SHA1 1c67bdd5658fcc707a05f987d5542a941c11c1d1
- SHA512 4faefa794cc6997ef06ea033bf0dbf5e52d49461d44c0e891b5fd168c060d361046b7a74235501b99748c142cc1897a5d4d866273cdad365112c5a20b184829a
- TLSH T1A6F0E20CE3881D6B01F127A6A53686A2F672A3336406340974FF851C1F72C274009E62
- MD5 SHA1 SHA512 TLSH
win-x64/World Client Installer.dll
- SHA256 c93c6a81b2a7e411f799a71174f16feb4982c6871f746cef0804ebd891d59a8e
- MD5 5237f7d1944aad79b1b0d39eb7b97254
- SHA1 e42d4226990859d09d5db77a7513049809350287
- SHA512 256e86b91b50e0b25192f60b98a8ac4e4482c8789a972dcaab410d4ca4e360a496f1b7e90bd8014a8567aa0d5f8aae7c139e2a282bb967bb6d25ba18edf11d5c
- SSDEEP 3072:syWiYx1ciubGb0p4+G1t1YvGbsRtQX1t1YvGbsRtQa1t1YvGbsRtQX:nbm0VGlHbyQXlHbyQalHbyQ
- TLSH T1FC14CF003BB94491FB7BCB3C2DB259051A36B94EB691E70C3C88269858F5B06B727F57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Eamon\source\repos\World Client Installer\World Client Installer\obj\Release\net10.0-windows\win-x64\World Client Installer.pdb
Name
.text
Size
148KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
win-x64/World Client Installer.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 f64bd7760e255d1091cb188c82bc75f8597ee485062f61ba6782e3faaf8f95fa
- MD5 7d28ebee127042a4bf9af03d6b2b8717
- SHA1 2a380ce29294fad8052095cb43d3a75ecb0efad9
- SHA512 2f737d06703d259f13e2fa8fc4ce2b5dcbe5e2069a436019987d48d0ea625d490520482d1a6b1cf28bb78fcede5d6336e75653c03e776e49776493a21adb970b
- SSDEEP 3072:+lDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT52C1t1YvGbsRtQ8:yAIwxrI14Q3kYBTMJClHbyQ
- TLSH T10F246D13A76950BEE1B3D678C9A24941FB7278598B71A6CF03504EB60F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
win-x64/World Client Installer.pdb
- SHA256 c0c2c15ade6eb0e1e2ec85a9b701f82d7ef364de9320fef44478cb1ea5a4fed7
- MD5 a3115e47a5b0e936be425fefcc04e2dc
- SHA1 43c7d5779781c82f9f1f75acce36bf67990e7227
- SHA512 d75aee78a5b066d461d1dddd6fd93bf7e4b1c08f396cb4834669934a5bcf88b3d03e97c196a4f2a4363c92f3a3d9b4b88e7554076a947338fd820f50f1a5d974
- SSDEEP 384:oURJyp3Q6Ea4+uo2rzBMOw2/sfaIvz1d+byShopz47nrUQoqGWNcKrpQHRfax7Ed:jRJyuja4+uoeBHYuoGqd36d+690
- TLSH T1C6A2E677939CCB62C5025639A8A1C44D3631D3606B02EE36F1C87A39EDBFB5903B6175
- MD5 SHA1 SHA512 SSDEEP TLSH
win-x64/World Client Installer.runtimeconfig.json
- SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
- MD5 7e4444b5a3e3cea574693f055f944011
- SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
- SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
- TLSH T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
- MD5 SHA1 SHA512 TLSH
win-x64/wi-version.txt
- SHA256 b389fd695d0f1725d524f22834c6aabefebc74cb314e9532f7e8a25c29ee47d2
- MD5 812b7598bbe881cd8e5efaa29fc2d684
- SHA1 1d081306e5641dc8f7dae6c01bd4b9c0b99a8996
- SHA512 8019b99f5c911fab6b261fb777aa416f1ebae435291bc7ad3320a173f2be9d6f05e91214860eedbf276af63cd2854bcb83c4a9474c507e34b66cee42237b1d76
- MD5 SHA1 SHA512