RimWorld.iso
- SHA256 1d13ad041aa5487528aa4a845f5084a35d4e8d38c643bb6c7e79d3cd6b10fbf0
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target RimWorld.iso
- Size 656.4MB
- Sample260712-teekcaew9v
- SHA256 1d13ad041aa5487528aa4a845f5084a35d4e8d38c643bb6c7e79d3cd6b10fbf0
- MD5 7f53adb93fecd53467351bdfe8973012
- SHA1 de7b63f81f3a4293f83ae9c1a0c8671193411cef
- SHA512 554db3dbb06d54f36e5db1f4d9a0506025e56de92bc8d8090467436fe27b71bb434957104a4b047a3817279854bb81232423910f320a956ae16be1ac25b93553
- SSDEEP 12582912:tPYLQXnzoyd5rsTmiBZ0u9sbqphQVwewJM0g4odtRZDB+r5l:tgLQjX3sTmiXf9UQewJpg4odtRJBK5
- TLSH T14369337376106AACC264CEFF291952DE5E0C5CB594FC491A3E21BE9F77B909D0836382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/setup.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack002/setup.exe innosetup
File Explorer
-
RimWorld.iso.iso 656.4MB
-
out.iso.iso 656.4MB
-
RimWorldWin64_0.ico136KB
-
autorun.inf67B
-
elamigos-1.bin653.3MB
-
setup.exe.exe 3.0MB
out.iso
- SHA256 1d13ad041aa5487528aa4a845f5084a35d4e8d38c643bb6c7e79d3cd6b10fbf0
- MD5 7f53adb93fecd53467351bdfe8973012
- SHA1 de7b63f81f3a4293f83ae9c1a0c8671193411cef
- SHA512 554db3dbb06d54f36e5db1f4d9a0506025e56de92bc8d8090467436fe27b71bb434957104a4b047a3817279854bb81232423910f320a956ae16be1ac25b93553
- SSDEEP 12582912:tPYLQXnzoyd5rsTmiBZ0u9sbqphQVwewJM0g4odtRZDB+r5l:tgLQjX3sTmiXf9UQewJpg4odtRJBK5
- TLSH T14369337376106AACC264CEFF291952DE5E0C5CB594FC491A3E21BE9F77B909D0836382
- MD5 SHA1 SHA512 SSDEEP TLSH
RimWorldWin64_0.ico
- SHA256 08b704366589b849e1da0ec896e9dd9a15c4ad4a9c846e631628d09cb51f5316
- MD5 8e6df66ce2fd4931831dd658e196cefa
- SHA1 367b1b2a0d432097c28c9d0f6f16f045a36e70f0
- SHA512 709010f512244e81b445f104454a53f3816986408212dcb570818d1065bbd57be4824a2d697a8dacb36fd0c7b3163467b98368fc10b8963d9a04b51952523988
- SSDEEP 1536:pwsSoov1i0tdNAtIlVQIeP2bL9fy2HpHMHHjHHOe:moGgsnywQIe6LA2HpHMHHjHHOe
- TLSH T159D330777D3C5084C6188CBD54B250D6186C1D9AA0BCBC7E3681BE5B3FFA2C65D098AB
- MD5 SHA1 SHA512 SSDEEP TLSH
autorun.inf
- SHA256 9cd67b74fec05d30e71a560d3c0f96bb9750ce9fe8a133036d4db2b52818cb89
- MD5 1dfb5ca1c7000cd6173dcfa7e96fb0d1
- SHA1 5b96e4f10c410812bdca73c8f36827b8ea117fdf
- SHA512 30558c19d9307ec3a9d390eda2f92a0f016f33a9e6af336cc5b9d0ea6046365a956deec4e36098b4e53dd6adbde04ac546baf9ea14c4d75510cdd10058dbae09
- TLSH T1BDA00202D9A944CFEB0923D1052B44F3D7BE62BE2A546EF9A3FDE49564211184F57850
- MD5 SHA1 SHA512 TLSH
elamigos-1.bin
- SHA256 d178be510d5da68dafcf35e3cbb32bf3753c2e1421aaed515fc63a01f40644fa
- MD5 8028499b3f10a56bfb9185e38b76b330
- SHA1 16710339548eaecd6f8ccb36e4af5960e89440de
- SHA512 19fc4739d8823876ea30c0edce92bdd3873a293eee158c164c90196c5da15579a6402f6138233f4e3707359d4fc4631af6f5e6ec4343d11a72e99d24f7c4202d
- SSDEEP 12582912:qPYLQXnzoyd5rsTmiBZ0u9sbqphQVwewJM0g4odtRZDB+r5l8:qgLQjX3sTmiXf9UQewJpg4odtRJBK52
- TLSH T11869336273406FDC17A8CBEB3E1D63DEAB089CB9A8E84A0677115F9FB35905D0176381
- MD5 SHA1 SHA512 SSDEEP TLSH
setup.exe
- IMPHASH 48aa5c8931746a9655524f67b25a47ef
- SHA256 1f2a3f26eadb7b4e7e1ef4efc18e59c7278f4fe4dbbd52c2a90c4b0f45ccbb4f
- MD5 3e4e89ba0bac39bc9e1ff3178c04f130
- SHA1 85d2099aa22c129fa4fc629895f2ae82ab639b33
- SHA512 8aa1cc908b76de473df4783f3b4374d83d2f391980f61908e2eb28730524a31ad5df7763aabcce67a7f9a34a0fc109998825a3eaaa80ea5e972d02378335efc2
- SSDEEP 49152:6cGoYHpHMHHjHHOwQBN6HLLFCQKayDDAwcrJxS7aST8n1/BJYr3bv9PPKfjAHrsi:5GjieVsbS5T8n15JYHZCjAHrQtS
- TLSH T1EBE522336A7A1076D5048CBC90B150955C1E2DAA24FC7C2E3DB1FD5F6BBA2C28C36667
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Minor OS version
0
Major OS version
5
Entry point
70588
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
user32
GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CloseHandle
Sleep
comctl32
InitCommonControls
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
177KB
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ