Kiddions_v2.zip
- SHA256 461179d961f3a981487eb1bccc517121c3afc1707d80add00e75dc27f45010a3
Password
2026
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Kiddions_v2/Kiddions Mod.exe
Resource
ubuntu2404-amd64-20250619-en
ubuntu-24.04-amd64
0 signatures
150 seconds
General
- Target Kiddions_v2.zip
- Size 2.3MB
- Sample260702-rpy1macz8j
- SHA256 461179d961f3a981487eb1bccc517121c3afc1707d80add00e75dc27f45010a3
- MD5 de1ffb11e66fe7481d4cd52f204a3534
- SHA1 cb25345b532433b4b18c8989d5d467d3bca52450
- SHA512 8715a49fae1c3cdb1828d92b3bbf5ab8b5d20ee88cad12bbab7afbc458691dd228ad5346fcfee748eb0ef962f2ea9309d41e20ae6db9762d6f89dd965ee88c8d
- SSDEEP 49152:/Ge51LEj8wjzRxLCXiv+e8HTU8RnJZhVTuxX9VmVsAK:ucLEj8wjzvCXiv+nTU8RJVOgtK
- TLSH T1B7B53393F2A4A116ECDED9D8C5053C1A212BF0B32C9536D4A154D87C6BEEC6142B6EDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/Kiddions_v2/msedge_elf.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Kiddions_v2/msedge_elf.dll
File Explorer
-
Kiddions_v2.zip.zip 2.3MB
-
Kiddions_v2/Kiddions Mod.exe.exe 1.5MB
-
Kiddions_v2/ai.cfg44B
-
Kiddions_v2/cacert.pem2KB
-
Kiddions_v2/config.vdf14KB
-
Kiddions_v2/msedge_elf.dll.dll 4.5MB
Kiddions_v2/Kiddions Mod.exe
- IMPHASH 55c92788dc86824dcf85360071e9fcac
- SHA256 232fa5792839dc677b0211b3694954e9660b174aa0f9bedcab772ac1e86d3843
- MD5 e31770026101eaccb1b5de7cffd52033
- SHA1 235beed3a3c2ecb6415eff789d2f4deb2cd28c3b
- SHA512 c65068629659f5e11e0580e57f10f14e685b4e7fe26e30e2447bc5c74fddaf8c233d095bb96df4b982b2695048a5e4f7c7d5bc138613fbc69db86a05dde6e9cc
- SSDEEP 24576:WdpUGxARynhYYI6dwnHL3b5qbDCLTTG/Zl1kngqi6Qj92dgysZI:Z/RynhYYlEbb5Q4TT05hxY
- TLSH T1B9758C13F29902E8D06ED2B9CB568132EA61BC060B35B6DF069073552F77BE46B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
2026
Digest
c7:8c:9e:ed:89:0b:de:d8:6a:f6:8a:3a:c7:7f:d1:a2:a8:8f:fb:c8:43:0d:93:e4:08:bf:6b:f7:0f:62:09:d8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:06:d7:bc:51:38:98:23:ec:2c:00:01:00:00:02:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
593600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
identity_helper.exe.pdb
msedge_elf
GetInstallDetailsPayload
SignalInitializeCrashReporting
advapi32
BuildTrusteeWithSidW
CheckTokenMembership
ConvertStringSidToSidW
GetLengthSid
GetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetTokenInformation
IsValidAcl
IsValidSecurityDescriptor
IsValidSid
OpenProcessToken
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
SetEntriesInAclW
SetNamedSecurityInfoW
SetSecurityInfo
dbghelp
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
shell32
CommandLineToArgvW
SHGetFolderPathW
SHGetKnownFolderPath
user32
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
GetMessageW
PostQuitMessage
RegisterClassExW
ShowWindow
TranslateMessage
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
kernel32
AcquireSRWLockExclusive
CloseHandle
CompareStringW
CreateEventW
CreateFileMappingW
CreateFileW
CreateThread
DeleteCriticalSection
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalProcessorInformation
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProductInfo
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemTimePreciseAsFileTime
GetTempPathW
GetThreadId
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatusEx
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetModuleInformation
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
PrefetchVirtualMemory
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetProcessShutdownParameters
SetStdHandle
SetThreadInformation
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
ole32
CoCreateInstance
CoInitializeEx
CoRegisterInitializeSpy
CoRevokeInitializeSpy
CoTaskMemFree
CoUninitialize
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
GetHandleVerifier
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
205KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
58KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
57KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
537B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Kiddions_v2/ai.cfg
- SHA256 db9ec7ae21d140904d44d6e6550c0c964e32ef11c055696b355835905c9c3a53
- MD5 73ed0e22c8cc70ed93dfd0c1b8f81e19
- SHA1 f16c87ca3eb393ee34f57fb59781cd37f5963db0
- SHA512 3dbe1fd660c7446c4a70c99cf6bf7909c76cd02ca24930bdeee851da094850b2fd6f6742025d215ce7dbf3348225c0b64d28e3f1ba133bdd9c7beece84d7e54f
- MD5 SHA1 SHA512
Kiddions_v2/cacert.pem
- SHA256 5513aa54afe134569e08b27aa61e60e888ab31d9e112f8c5881adbaecc817678
- MD5 39f89143815797c4a41c62f30f137094
- SHA1 39a602c37ee958e5a5779c167ea095a56f0218e4
- SHA512 02cfee4a3fdc728e63e5a63797c58c5a6fbd805f6f6e5c0ab4e5dbf1d1701636a6aefc94095096b627b7475e731327d620c519ddc1a65b3ee49dd41b4d219d6d
- TLSH T19F512B068F4A4CD80C87F054A97F8108D86F42F6D88F74580D263A56CB0AB3A82BE689
- MD5 SHA1 SHA512 TLSH
Kiddions_v2/config.vdf
- SHA256 9fce8b4ac41455418615f2785199f72d7fe6ce39d8cd9182027a752c4f26d04a
- MD5 bb23e26ed15c9951460513efdb0b7ac7
- SHA1 41e15b1f30840160ea095f0f415ac3afd6d06968
- SHA512 f3f3e7ef4765520554fcb523b43f448b28b29fbbf150657728084b720fca4568a23a3846f37f3c57b6710fdeb3761fecc190f468944ba1a687aad0e8f7af1093
- SSDEEP 96:o9lCt/5KFdRBQ20LPr7U8Op3y47Zu/ZqaJOTFogkU:o9MtBKFdRBQ20LPr7U8OBlsRq8gkU
- TLSH T1435295536D2C89AF330F4ABD11E2A0DE189C87F7A948D3E779D21B159109B9E50BD338
- MD5 SHA1 SHA512 SSDEEP TLSH
Kiddions_v2/msedge_elf.dll
- IMPHASH d8b31f8c03e0c76ff245ed05a15ffe6c
- SHA256 c6581c3aa98c9371ecdcaeb598a26ec8a1a5cf6056d00e5b89885391dce36e78
- MD5 88c4380fb107619c09d07c71c6c775e1
- SHA1 6918099bfb56b444d865211e6b519ad03f462f6c
- SHA512 54d4cde06354d6936ad44a2708b5a7baa9af44dab3f7f9e7345c7214a8cb131018da0f4924f35f0464f4252cc5814519be6c958d9257446d0e84ac57168b4bfa
- SSDEEP 49152:TBDVMlDxyfAcYobhZiIoEemJSR92GRIVEHFtgA5WeSDG:TfMM6rD8Ez/WeSq
- TLSH T1A8265A13ED944665C0ABE13D9CB6A141BA307C480B7423D32E527A793EB7BC4527BB39
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
2026
PE Signature issue
Digest
95:44:7c:0a:9e:44:81:82:0e:a1:f1:b9:c5:dc:87:e1:8d:dd:68:2e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=glitch.com
Chains
Jul 2, 2026
CN=glitch.com
Subject
CN=glitch.com
Serial Number
78:d3:57:64:f5:55:7b:83:aa:46:35:87:4f:93:6f:05:33:1b
Issuer
CN=Certainly Intermediate R1
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth
Timespan
Jan 15, 2026 - Feb 14, 2026
Minor OS version
1
Major OS version
6
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredContinueHandler
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
RaiseFailFastException
ResumeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
calloc
fputc
free
fwrite
localeconv
malloc
memcpy
memset
realloc
strerror
strlen
strncmp
vfprintf
wcslen
GetInstallDetailsPayload
SignalInitializeCrashReporting
_cgo_dummy_export
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
295KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ