FrameHUDOverlay_0.1.zip
- SHA256 df914b28940b6091ab1a7052b388e8788cbf27d8b13a59d7ec7ecbe720a215ef
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ForgeMods/FrameHUDOverlay.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ForgeMods/FrameHUDOverlay.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
dinput8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
dinput8.dll
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target FrameHUDOverlay_0.1.zip
- Size 1.2MB
- Sample260703-prnlkahs81
- SHA256 df914b28940b6091ab1a7052b388e8788cbf27d8b13a59d7ec7ecbe720a215ef
- MD5 e4339bb89a992394147c3211eb96baf5
- SHA1 8539a30faca858ef662e1c7f9a0760f682345ff6
- SHA512 aaf68f33842a1acd10525bd5618aa1458bce488ef3cc0d881513f32265d5fec0f4168f75fed4628267351b968a99900c1dc5f65dad7aed5ebb690ae1aa3d01b6
- SSDEEP 24576:bj2z+wXFcfkmbyfLcCRLYqRybT3/WbArYjdrC+wCpInkPPWFiLHkN:bqvc8m2fLTsLebmMJC+wCVPVHkN
- TLSH T1E3453348BF490E92C03B1614E08514CB84AD3D55CBB86E92F8DBB2F506DC6264FFB997
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ForgeMods/FrameHUDOverlay.dll unpack001/dinput8.dll
File Explorer
-
FrameHUDOverlay_0.1.zip.zip 1.2MB
-
ForgeMods/FrameHUDOverlay.dll.dll 4.0MB
-
dinput8.dll.dll 49KB
ForgeMods/FrameHUDOverlay.dll
- IMPHASH fc3f69b2905d0d571cde8afbc7110370
- SHA256 f6096f2b4433958d44508f77bd0c50b64dbe4739def473a954344f44daf8e6f9
- MD5 c44b455ecf454b3f35666379c7735960
- SHA1 efd899dbb40953bd8c55b6b34d1dcc4be8c84fd1
- SHA512 1bf6c99c3eae36e776f73823da765e2f7f449345ca316309ae0986baf2ada2e8d894c4f4a2c5693f07bad1836119f432dcd2c2fb8b262290dce17d5237001dae
- SSDEEP 49152:rG4gQCAulzbxKa9NiQhhK5mGLb4fzXgfsNkpYetYCjMxU0QTgXPap1je2mz1:bCfbvXimNzXgV/Yap1je2mz1
- TLSH T1EB163B43B5DB0DA9CEE6677461C76336BB34FD358A291F3B9608C2312D636C0A95EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d3d12
D3D12CreateDevice
d3dcompiler_47
D3DCompile
dwmapi
DwmEnableBlurBehindWindow
DwmGetColorizationColor
DwmIsCompositionEnabled
dxgi
CreateDXGIFactory1
gdi32
CreateRectRgn
DeleteObject
GetDeviceCaps
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
FlushInstructionCache
FormatMessageA
FreeLibrary
FreeLibraryAndExitThread
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetLocaleInfoA
GetModuleHandleA
GetModuleHandleW
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetProcessAffinityMask
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
GetTickCount64
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
IsBadReadPtr
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OpenThread
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TerminateProcess
Thread32First
Thread32Next
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VerSetConditionMask
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WritePrivateProfileStringA
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
__setusermatherr
_amsg_exit
_assert
_beginthreadex
_endthreadex
_errno
_fileno
_initterm
_lock
_read
_setjmp
_setmode
_strdup
_strtoi64
_strtoui64
_unlock
_vscprintf
_vsnprintf
_wfopen
_write
abort
atof
calloc
fclose
fflush
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getc
getenv
isdigit
isleadbyte
isspace
iswctype
isxdigit
ldexp
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
realloc
setlocale
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strncpy
strstr
strtol
strtoul
strxfrm
tan
tolower
toupper
towlower
towupper
ungetc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm
shell32
ShellExecuteW
user32
CallWindowProcA
ClientToScreen
CloseClipboard
CreateWindowExW
DefWindowProcW
DestroyWindow
EmptyClipboard
GetAsyncKeyState
GetCapture
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetKeyboardLayout
GetMessageExtraInfo
IsWindowUnicode
LoadCursorA
MonitorFromWindow
OpenClipboard
RegisterClassExW
ReleaseCapture
ReleaseDC
ScreenToClient
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetProcessDPIAware
SetWindowLongPtrA
TrackMouseEvent
UnregisterClassW
InitializeASI
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
199KB
Virtual Size
199KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
84B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/97
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
dinput8.dll
- IMPHASH e4caa66d26bf89420eb4c7f36a2143ac
- SHA256 bb75fcf6f911e7ea706e1cbe7b4d6abf1fdf29f5255579c624e4cd4f2a5b4ebd
- MD5 9a0e491c24fd89a1c305bf8d586751c8
- SHA1 8cd0fff7ce1c9f599892a7a64dc63239f7653790
- SHA512 35e26bf4f869b13d0ea9e72cbbe2acd6648dcb61b51dd9699e25a73d483a6df0a2bceb518b398fa68e5383fb0bef3c7e53e871c010f3a4c5e6744accc5e6a42f
- SSDEEP 768:I4v0yRxQMpLQuxcfmIgFwEaUv2RMefSKASkz6VaLJWZe+IzcMyQW5xv:ZvpieIgKpMe4zLLwe+ucMtW5l
- TLSH T185336C0F7A9805F9E4AA817DCAA35E46D2B3B04607228BCF0360526E1F677E2597F741
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
31756
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetSystemDirectoryA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetFileInformationByHandleEx
GetLastError
AreFileApisANSI
InitializeSListHead
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
GetLocaleInfoEx
LocalFree
FormatMessageA
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
vcruntime140
__std_exception_destroy
_CxxThrowException
__C_specific_handler
__std_exception_copy
__std_terminate
memcpy
memmove
__std_type_info_destroy_list
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
terminate
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
DirectInput8Create
Name
.text
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=32420,
count=3, id=259, version=32420,
count=23, id=261, version=32420,
count=6, id=257, version=32420,
count=3, id=257, version=26715,
count=124, id=1, productName=Unmarked objects,
count=4, id=264, version=32537,
count=1, id=259, productName=VS2019 v16.6.2 build 28806, version=28806,
count=1, id=261, version=32537,
count=1, id=256, version=32537,
count=1, id=255, version=32537,
count=1, id=258, version=32537,