MacroGamer_v275_Source.zip
- SHA256 9e3031df74a81bddff8fd973d137a2505c87cee07b0a112cb84709d44f098968
Overview
overview
8Static
static
3MacroGamer...ce.zip
windows10-2004-x64
1MacroGamer...ce.zip
windows11-ltsc_2024-x64
8MacroGamer.ps1
windows10-2004-x64
3MacroGamer.ps1
windows11-ltsc_2024-x64
3MacrosDisabled.wav
windows10-2004-x64
6MacrosDisabled.wav
windows11-ltsc_2024-x64
1MacrosEnabled.wav
windows10-2004-x64
6MacrosEnabled.wav
windows11-ltsc_2024-x64
1RecordingStarted.wav
windows10-2004-x64
6RecordingStarted.wav
windows11-ltsc_2024-x64
1RecordingStopped.wav
windows10-2004-x64
6RecordingStopped.wav
windows11-ltsc_2024-x64
8gmerico.ico
windows10-2004-x64
3gmerico.ico
windows11-ltsc_2024-x64
3help.chm
windows10-2004-x64
1help.chm
windows11-ltsc_2024-x64
8kh.dll
windows10-2004-x64
3kh.dll
windows11-ltsc_2024-x64
3mgconfig.dat
windows10-2004-x64
3mgconfig.dat
windows11-ltsc_2024-x64
3profile.mgp
windows10-2004-x64
3profile.mgp
windows11-ltsc_2024-x64
3scancodes.dat
windows10-2004-x64
3scancodes.dat
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MacroGamer_v275_Source.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
MacroGamer_v275_Source.zip
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
MacroGamer.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
MacroGamer.ps1
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
MacrosDisabled.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral6
Sample
MacrosDisabled.wav
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
MacrosEnabled.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral8
Sample
MacrosEnabled.wav
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral9
Sample
RecordingStarted.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral10
Sample
RecordingStarted.wav
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
RecordingStopped.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral12
Sample
RecordingStopped.wav
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral13
Sample
gmerico.ico
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
gmerico.ico
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
help.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
help.chm
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral17
Sample
kh.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
kh.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
mgconfig.dat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
mgconfig.dat
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
profile.mgp
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
profile.mgp
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
scancodes.dat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
scancodes.dat
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target MacroGamer_v275_Source.zip
- Size 142KB
- Sample260622-ysbstsgt5x
- SHA256 9e3031df74a81bddff8fd973d137a2505c87cee07b0a112cb84709d44f098968
- MD5 da89d18de41449fab464d6399aa60d7f
- SHA1 8056ad22af11affdc1e9911394900c04d8378a1f
- SHA512 3fa8202cb495fce447e96c19b0a076e656b3ad65cdd8e110fb1af370f76be982858e35149b9ede8e462ef6d588631167a7890dad5802034e03f405e14e3ccee9
- SSDEEP 3072:ltW65EkLxMhk8mfCVi6hV6g1+nC+fkVqoRgmcU79zMi61PBUvn59/N+K8HBf:ltOcxI5VnV6g1L+fkbRH3WiTx98Kg
- TLSH T1B9E312B4967E1C40E19B55B2AF1043712FEA17E102A6D4CD903046F9BBCB3E479BB85E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/kh.dll
File Explorer
-
MacroGamer_v275_Source.zip.zip 142KB
-
MacroGamer.au3.ps1 108KB
-
MacrosDisabled.wav297KB
-
MacrosEnabled.wav273KB
-
RecordingStarted.wav269KB
-
RecordingStopped.wav290KB
-
gmerico.ico2KB
-
help.chm.chm 21KB
-
kh.dll.dll 4KB
-
mgconfig.dat98B
-
profile.mgp149B
-
scancodes.dat2KB
MacroGamer.au3
- SHA256 81d14495e5ab13d3aec1c25832843cbd880b75291e9b3020f617c72469eaeca0
- MD5 04eede6b9daef8a704fe67ab529bced1
- SHA1 69d8a805ebda6a72067b3474ba921b8969f234a4
- SHA512 213c4b27f6ef4579d1e94d51b8cfe75f77039c5831cb62d4606a62f1649d00e55ce4bbb328cb0361f942b2cef17a47844fe767ae619f6cb0eaecfe124ce01a5a
- SSDEEP 1536:qNnfPs/CyZHF1mgtjXAbX9FE3gQKOlsiS0NEN3NCOtTrq:+7yZHF1mcLAbsQclgDti
- TLSH T156B3C521B22D4C56F6831903547B890EFF0F8D16F9317287B4394DAC22797B4629AEDB
- MD5 SHA1 SHA512 SSDEEP TLSH
MacrosDisabled.wav
- SHA256 155f4a862140a5438c7f32be38551e7a20c761adc5d350ecd503a809b1ef851a
- MD5 79c03707bd6c4348c8ba135f55854a15
- SHA1 f3e84d947ab067477c3d139c4245f4ab5ea1d2ac
- SHA512 f228cb66ef166591c82edf3b813c1efb3469cdb9eab3d09d460482873ba594c7cd2c8133203db244e4e81ba4b790d23c3d8df043251a50d33703087afe1bc286
- SSDEEP 3072:DM2tTD8888lSEn8888E8888kbrn8888/8s8888sK8888U88888sa8888LgF8888H:D1tf8888lSE/brclta8888LTlnVs
- TLSH T1DC548373F9CF8012C1438430AEB4AE3514765A58D9770530F9BEB689D2CBBD129CFA98
- MD5 SHA1 SHA512 SSDEEP TLSH
MacrosEnabled.wav
- SHA256 3365cd94173df80024154ae4c3f6602758b0bf7436cd236df0aba5a9f44bc948
- MD5 491c8fc76fccb9fd5f5217b8d4a7a976
- SHA1 c67bf9ffef8ee539c0d2b2853901b375bb55dd0e
- SHA512 135d76cd298179832187d5bb2258683997d31a8cdd2012ae3f3dc5c7629e1cd557c0d6527cf03fc03a4bc624481296b3d9a333ad10f41bacf1fb922ab2fe2d09
- SSDEEP 3072:RM2tTD8888lSE0fsv8888X8888kMk6g8888c1t8888X888838888c1NE8888k88H:R1tf8888lSEck8888li1N8ndSl
- TLSH T19E546173F5CF8112C1438430AEB46E3960B55958D9770534BABEB789D3CBB9028CFA98
- MD5 SHA1 SHA512 SSDEEP TLSH
RecordingStarted.wav
- SHA256 9653a694a897aaafef12d3cc5a47389ba2a2966eb119b3009d6cfb64163910bb
- MD5 d741e763eda5cba9eba261e3098b0420
- SHA1 ace7d5fecf8058c48a5eeca46b9c9d5c22eb482f
- SHA512 d48bf5c80efcba6afa5888b29efeb6c731b2390f5dd08ec1f87bfe3b73178b8145c7944edf4cc9a998c7240b41de4291e3986738cd106610d890355862299fd9
- SSDEEP 6144:mnfv8888X888838888k8888i8888fVl8888prG8888i888838888F2:mnH8888X888838888X8888f/8888Ft8d
- TLSH T1B444B4A3F8DF4112C2878431EEF87E34647A1558D5770130B9BDB699D2CBB9029CFA89
- MD5 SHA1 SHA512 SSDEEP TLSH
RecordingStopped.wav
- SHA256 dd624a405a3bd4bd08c5480b9766d4415cc8d745a64aa4e8a4b9283003429a17
- MD5 c5eee3f8239dbd49a849702566eaee99
- SHA1 79cabe82f9724732752ae9f7416f3eeb2e048f89
- SHA512 425cf8528501f79d601242cb8eb593c70e1d33cb30a8a0c9e06d41efee1388f2123d4fa159b4a3873b246a18e43a1c5184f9f2f90313b5f12b99772b3728df7f
- SSDEEP 3072:xa888838888E88889enfnv8888E18888ggHnaLv8888X88888vl8888C58888D7E:inf8ar8888cvgtxH3O
- TLSH T15D549293E7DEA066F14654307F74BEBF107D1C54D8360C21AEED7E84B38BA501C9A9A8
- MD5 SHA1 SHA512 SSDEEP TLSH
gmerico.ico
- SHA256 3a42398beeb367206df79cdc96ed052c3c6f1d62ac905b7e33f71bdbe413527f
- MD5 5dcafcf4e8260357f57cefcc01f0c0f2
- SHA1 cf013d7ccdfd062e4c2be384b0d3abe6054c65f7
- SHA512 c661c5ff9e31afe4d0b59e46cc765479d50a0f139489311817507db41a3f6e867fd57167e2599f142a8652f1e213ba67d0eaf0e3c6f4ee26be41b527c6995b04
- TLSH T14851DFB3354E8CEAD14726345C51CAD87221BDAB8C283C3AB4E737AE54346D08D8E6E0
- MD5 SHA1 SHA512 TLSH
help.chm
- SHA256 7e72d0c29d113581a58561d2e1db812c92d239b8e32cecf9d5f3a36662bab0d6
- MD5 b3259fa1e1d5f433bbc5348bd17fea8b
- SHA1 f4c2fdc6295c9c103ce4a417ac80a04a72c9da57
- SHA512 c04666982203ce477514c04a46825ba6651c2e2f5f3ca1241b3589073b318954ac88753498d223582f411069b16ea666285f8c333dcb743a5c124eb957305527
- SSDEEP 384:DU/OgY26Q97UYnmC+7qm2niz932mlsSYBPcz1YoaWc9Ze7uBw6:DUmvuUjdyizs3BPi3s9lBw6
- TLSH T142A2BFA9B2509108C40B5DB36EB9E956A7321E203DF62549F27C626D05FBBCC0F6149B
- MD5 SHA1 SHA512 SSDEEP TLSH
kh.dll
- IMPHASH cd4a32f84689085e668b4967ba4e8399
- SHA256 ab05f3533dbcd3d829e984e33110c7c568cbd64bd1cf9dfa3408b6315d1f668f
- MD5 3908212a9e2bf9839e765655a31a8001
- SHA1 fb0ba65176aa3bbe1558530c68e8fa096b9c0a7a
- SHA512 80e51096f684367a7274da5a418550aec5b9e5506604a0b424b90efa432bb40cd5e7cdd49bc474bd9caf4e572b00704717f36516d8cd3e80d27087792effe73a
- SSDEEP 48:6mh9GMCc917rXV2fMrXUEaMrDFSGsh1MluhewNgZ+6:F17zV2fMXrZSGshOuhlNgI6
- TLSH T10B91415FA3424557C0CC17FAA95B3A7B122B4DB43AE601179CF7950B382B3935E35B05
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5232
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
GetVersionExA
user32
CallNextHookEx
PostMessageA
GetKeyState
CBTProc
KeyProc
MouseProc
SetValuesCBT
SetValuesKey
SetValuesMouse
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.shared
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
mgconfig.dat
- SHA256 06fc4aeba8af535656c8d3d4d6804e02f73348edf61d91f325a7fa4ec58ce449
- MD5 604e297e623edc17ac727f89796c2e2a
- SHA1 22aaec3d159df072817b698b1661d97a77645aa5
- SHA512 36365db77086d3e42602666fe0b6b1df7252c8480b5e29314b541485dc8ec89e94651e7857c150b978f56dd1112e134bc91d4360ed631e913883e7868265f419
- TLSH T15EB0024F710DD51B42310720A90567507415170D912DD554F3A7D3959C984D16404176
- MD5 SHA1 SHA512 TLSH
profile.mgp
- SHA256 d9a7f89b0a5e9c5cff8bf2073e9af520347930d8de7db73fd9619bae7cf68e49
- MD5 c37c104cb195d1667874c32e2c1ed9ea
- SHA1 29ed44d86255f792ec3ae37446ca1c81d0212bff
- SHA512 59c1c24e4a9a599257ca24c968c2420b4dff8223e287941c5bc6345e91dd017086da0ff9f1e57cf3b90d013be783ddba44c7f9744ddfb0245dd40f62fca9753c
- TLSH T13EC0483EC437EAB530AD00D800A8CF04AF03808300A720702C027FDB3C13510EC6F2A6
- MD5 SHA1 SHA512 TLSH
scancodes.dat
- SHA256 4c2f8d3dec39671648aa256bfcd220e9f1efccb644309f17e5535151ad7c5dfa
- MD5 f34e92039e140abfee02b4429d0c8390
- SHA1 7851f43a016404d14cadfa1b452d2ec57a23fd4d
- SHA512 2b6bc206699534167be34105f2af271cf53dd15ec3080889e9fc016dadae70c525155a4de66366c0edf0fb65a8eba05b0fd06bdc0237bf517045a016ad21325b
- TLSH T125415551E99D16C1EA737292BFB24F110C6AA30A104E3AA337A57F566D80636EA0703C
- MD5 SHA1 SHA512 TLSH