General

  • Target
    FeridoGame.exe
  • Size 96.3MB
  • Sample260621-vre73set2r
  • SHA256 d994a393c6ccbd7650ea9d6f08a22000350a2de18d418be5a2cb6a62e5e23699
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 3 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • FeridoGame.exe
    .exe 96.3MB
  • $PLUGINSDIR/StdUtils.dll
    .dll 100KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/app-64.7z
    .7z 95.9MB
  • FeridoGame.exe
    .exe 191.9MB
  • LICENSE.electron.txt
    1KB
  • LICENSES.chromium.html
    11.7MB
  • chrome_100_percent.pak
    144KB
  • chrome_200_percent.pak
    215KB
  • d3dcompiler_47.dll
    .dll 4.7MB
  • ffmpeg.dll
    .dll 2.9MB
  • icudtl.dat
    10.0MB
  • libEGL.dll
    .dll 481KB
  • libGLESv2.dll
    .dll 7.6MB
  • locales/af.pak
    536KB
  • locales/am.pak
    868KB
  • locales/ar.pak
    954KB
  • locales/bg.pak
    991KB
  • locales/bn.pak
    1.2MB
  • locales/ca.pak
    602KB
  • locales/cs.pak
    622KB
  • locales/da.pak
    562KB
  • locales/de.pak
    601KB
  • locales/el.pak
    1.1MB
  • locales/en-GB.pak
    487KB
  • locales/en-US.pak
    492KB
  • locales/es-419.pak
    593KB
  • locales/es.pak
    592KB
  • locales/et.pak
    539KB
  • locales/fa.pak
    885KB
  • locales/fi.pak
    550KB
  • locales/fil.pak
    623KB
  • locales/fr.pak
    642KB
  • locales/gu.pak
    1.2MB
  • locales/he.pak
    777KB
  • locales/hi.pak
    1.3MB
  • locales/hr.pak
    599KB
  • locales/hu.pak
    645KB
  • locales/id.pak
    532KB
  • locales/it.pak
    585KB
  • locales/ja.pak
    712KB
  • locales/kn.pak
    1.4MB
  • locales/ko.pak
    602KB
  • locales/lt.pak
    650KB
  • locales/lv.pak
    648KB
  • locales/ml.pak
    1.5MB
  • locales/mr.pak
    .ps1 1.2MB
  • locales/ms.pak
    558KB
  • locales/nb.pak
    539KB
  • locales/nl.pak
    560KB
  • locales/pl.pak
    622KB
  • locales/pt-BR.pak
    584KB
  • locales/pt-PT.pak
    589KB
  • locales/ro.pak
    610KB
  • locales/ru.pak
    1006KB
  • locales/sk.pak
    633KB
  • locales/sl.pak
    606KB
  • locales/sr.pak
    935KB
  • locales/sv.pak
    543KB
  • locales/sw.pak
    574KB
  • locales/ta.pak
    1.5MB
  • locales/te.pak
    1.3MB
  • locales/th.pak
    1.1MB
  • locales/tr.pak
    584KB
  • locales/uk.pak
    1009KB
  • locales/ur.pak
    879KB
  • locales/vi.pak
    693KB
  • locales/zh-CN.pak
    498KB
  • locales/zh-TW.pak
    492KB
  • resources.pak
    5.7MB
  • resources/app.asar
    62.8MB
  • resources/app.asar.unpacked/node_modules/@primno/dpapi/LICENSE
    1KB
  • resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
    .js 412B
  • resources/app.asar.unpacked/node_modules/@primno/dpapi/package.json
    934B
  • resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
    .dll 137KB
  • resources/app.asar.unpacked/node_modules/@primno/dpapi/src/dpapi_addon.h
    206B
  • resources/app.asar.unpacked/node_modules/@primno/dpapi/src/dpapi_not_supported.cpp
    327B
  • resources/app.asar.unpacked/node_modules/@primno/dpapi/src/dpapi_win.cpp
    2KB
  • resources/app.asar.unpacked/node_modules/@primno/dpapi/src/main.cpp
    698B
  • resources/app.asar.unpacked/node_modules/datavault-win/dist/index.js
    .js 412B
  • resources/app.asar.unpacked/node_modules/datavault-win/package.json
    670B
  • resources/app.asar.unpacked/node_modules/datavault-win/prebuilds/win32-x64/node.napi.node
    .dll 137KB
  • resources/app.asar.unpacked/node_modules/datavault-win/src/dpapi_addon.h
    99B
  • resources/app.asar.unpacked/node_modules/datavault-win/src/dpapi_not_supported.cpp
    218B
  • resources/app.asar.unpacked/node_modules/datavault-win/src/dpapi_win.cpp
    2KB
  • resources/app.asar.unpacked/node_modules/datavault-win/src/main.cpp
    589B
  • resources/app.asar.unpacked/node_modules/sqlite3/LICENSE
    1KB
  • resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
    .dll 1.8MB
  • resources/app.asar.unpacked/node_modules/sqlite3/deps/common-sqlite.gypi
    1KB
  • resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
    224B
  • resources/app.asar.unpacked/node_modules/sqlite3/deps/sqlite-autoconf-3440200.tar.gz
    .gz 3.1MB
  • sqlite-autoconf-3440200.tar
    .tar 12.0MB
  • sqlite-autoconf-3440200/INSTALL
    15KB
  • sqlite-autoconf-3440200/Makefile.am
    744B
  • sqlite-autoconf-3440200/Makefile.fallback
    .sh 547B
  • sqlite-autoconf-3440200/Makefile.in
    .bat 37KB
  • sqlite-autoconf-3440200/Makefile.msc
    28KB
  • sqlite-autoconf-3440200/README.txt
    3KB
  • sqlite-autoconf-3440200/Replace.cs
    .js 7KB
  • sqlite-autoconf-3440200/aclocal.m4
    .ps1 364KB
  • sqlite-autoconf-3440200/compile
    7KB
  • sqlite-autoconf-3440200/config.guess
    48KB
  • sqlite-autoconf-3440200/config.sub
    34KB
  • sqlite-autoconf-3440200/configure
    .bat 485KB
  • sqlite-autoconf-3440200/configure.ac
    8KB
  • sqlite-autoconf-3440200/depcomp
    23KB
  • sqlite-autoconf-3440200/install-sh
    .sh .vbs 14KB
  • sqlite-autoconf-3440200/ltmain.sh
    .sh .bat 319KB
  • sqlite-autoconf-3440200/missing
    6KB
  • sqlite-autoconf-3440200/shell.c
    885KB
  • sqlite-autoconf-3440200/sqlite3.1
    4KB
  • sqlite-autoconf-3440200/sqlite3.c
    8.5MB
  • sqlite-autoconf-3440200/sqlite3.h
    622KB
  • sqlite-autoconf-3440200/sqlite3.pc.in
    267B
  • sqlite-autoconf-3440200/sqlite3.rc
    1KB
  • sqlite-autoconf-3440200/sqlite3ext.h
    37KB
  • sqlite-autoconf-3440200/sqlite3rc.h
    78B
  • sqlite-autoconf-3440200/tea/Makefile.in
    .bat 16KB
  • sqlite-autoconf-3440200/tea/README
    1KB
  • sqlite-autoconf-3440200/tea/aclocal.m4
    147B
  • sqlite-autoconf-3440200/tea/configure
    .bat 275KB
  • sqlite-autoconf-3440200/tea/configure.ac
    .sh 8KB
  • sqlite-autoconf-3440200/tea/doc/sqlite3.n
    494B
  • sqlite-autoconf-3440200/tea/generic/tclsqlite3.c
    125KB
  • sqlite-autoconf-3440200/tea/license.terms
    257B
  • sqlite-autoconf-3440200/tea/pkgIndex.tcl.in
    334B
  • sqlite-autoconf-3440200/tea/tclconfig/install-sh
    .sh .vbs 13KB
  • sqlite-autoconf-3440200/tea/tclconfig/tcl.m4
    129KB
  • sqlite-autoconf-3440200/tea/win/makefile.vc
    .vbs 14KB
  • sqlite-autoconf-3440200/tea/win/nmakehlp.c
    20KB
  • sqlite-autoconf-3440200/tea/win/rules.vc
    18KB
  • resources/app.asar.unpacked/node_modules/sqlite3/deps/sqlite3.gyp
    2KB
  • resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
    59B
  • resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
    .js 6KB
  • resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
    .js 1KB
  • resources/app.asar.unpacked/node_modules/sqlite3/package.json
    1KB
  • resources/app.asar.unpacked/node_modules/sqlite3/src/async.h
    1KB
  • resources/app.asar.unpacked/node_modules/sqlite3/src/backup.h
    .js 6KB
  • resources/app.asar.unpacked/node_modules/sqlite3/src/database.h
    5KB
  • resources/app.asar.unpacked/node_modules/sqlite3/src/gcc-preinclude.h
    861B
  • resources/app.asar.unpacked/node_modules/sqlite3/src/macros.h
    10KB
  • resources/app.asar.unpacked/node_modules/sqlite3/src/statement.h
    6KB
  • resources/app.asar.unpacked/node_modules/sqlite3/src/threading.h
    388B
  • resources/elevate.exe
    .exe 119KB
  • snapshot_blob.bin
    324KB
  • v8_context_snapshot.bin
    685KB
  • vk_swiftshader.dll
    .dll 5.3MB
  • vk_swiftshader_icd.json
    106B
  • vulkan-1.dll
    .dll 882KB
  • $PLUGINSDIR/nsis7z.dll
    .dll 424KB

FeridoGame.exe

  • IMPHASH b34f154ec913d2d2c435cbd644e91687
  • SHA256 d994a393c6ccbd7650ea9d6f08a22000350a2de18d418be5a2cb6a62e5e23699
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest
ad:ee:8a:86:2c:d4:c8:7b:ee:c5:7a:db:5d:14:59:8f:19:0f:f6:7b:cf:cb:12:ec:5c:ef:36:ea:77:c2:c3:f1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Rapid Inc. Development

PE Signature issue

Digest
13:3b:3c:31:74:c6:76:ec:d4:39:ad:24:0c:6a:15:4e:00:3d:a6:c1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Rapid Inc. Development
Minor OS version
0
Major OS version
4
Entry point
13199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths