SPOILER_Velocity Tweaks.zip
- SHA256 9010b0d05540bc2ec7fb20aa11507bf3fe8f4c7b12397d34f9a43d6d38ebe49e
Static task
static1
3 signatures
General
- Target SPOILER_Velocity Tweaks.zip
- Size 1.4MB
- Sample260713-2qq2hsas5k
- SHA256 9010b0d05540bc2ec7fb20aa11507bf3fe8f4c7b12397d34f9a43d6d38ebe49e
- MD5 19c431729307080c8ac6a886cfb304e5
- SHA1 8ca356e948c5feeb93b63eaaa3473d8b6cebe214
- SHA512 ffb11722c467ad67b84d30e6fa2e4b165c65a80a4328d273aebc328ae357815667c6c1e594db46a0d3a7cf3485c64acf74431d747ed5430f82a743d09a23b73a
- SSDEEP 24576:uGTeMpqORiNhGCKRVYAcl0oKtGTo8CyZ/ZsVFK68TgCpMoDPLLaIXxADIhN3Y:De5OcNh/KRkSoKwbCSmW6SDKobzXxADf
- TLSH T1DC653380FDAEEE1CF9B3E714BBD8B5928FF658A4260DB90B924740FC199154BE1F5210
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/Siticone.Desktop.UI.dll ConfuserEx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Velocity Zero Delay.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Siticone.Desktop.UI.dll
File Explorer
-
SPOILER_Velocity Tweaks.zip.zip 1.4MB
-
Before (Apply Then Restart).reg146B
-
READ FIRST.txt239B
-
Siticone.Desktop.UI.dll.dll 4.0MB
-
Velocity Zero Delay.exe.exe 786KB
Before (Apply Then Restart).reg
- SHA256 feceb01514a47354a47e33c0c6002defecfa39e81672260ca9a984a85307fac2
- MD5 b3558387ea7b27707c5a3d0b27b31cf6
- SHA1 dcc1089064ad38a280c67b72e9f048caa28864cc
- SHA512 96c173e98dd91b87292c728f64edeae9982c8779eac487c9164c83a9aed283bb36bb367c2b7065d1665b9e8af3d1554a407800e25e2d37b25698b0392f7ac818
- TLSH T140C08CA009208693E2E0A000480AB1C237B5762A38CB8A1000E090C076D29C782280AF
- MD5 SHA1 SHA512 TLSH
READ FIRST.txt
- SHA256 53e7e91f3a070050dcd3d48144c23e1cd2a9a662d95d20ec23d7ea0421cd254a
- MD5 664e27b715cb9e5c857ec78b3a5c3272
- SHA1 3efb621e9201410c353512742ace836e6d3e54c7
- SHA512 2f29b94ade7e35b9963defa1f5723525108519788e5dd5fc615e14ae4bddea0a1aa56fce166f999e36ab2e926d34d82f8b546d31b8b2cf87000a9d2d965828fb
- TLSH T1B7D0A744EF06537243D4401BA88D7A42F7D95968C30C050C783BD66D434968CCBBECD8
- MD5 SHA1 SHA512 TLSH
Siticone.Desktop.UI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 21eecaf504b7fe787a45f4aa8f8f36dacfc3ab1d75624dfb41827cdef2a9a589
- MD5 1582aa45d981e0e569c6e05698642b30
- SHA1 763506f312a186c55a04ef6a16ad7e867c394097
- SHA512 278a7a4e2b9d82528200b9f92244db3f228187d15c36fd169deb927e343bc4d0bb29c9dba496f86558aea4f4deb44d1e47a41d5598c0b375d99ad9fbe99cec34
- SSDEEP 24576:UCCxPAT4L7h3M7O2MLBSlvTh/aOBteUePU/DU/GHQYazK/DkWoql3zjbndHQ/jzb:WuO2MIThZNwewYDoyG
- TLSH T12E166D013BD08917D16EBF76B463141C97F6F804E6A7E74E7995F2AC2B9B3684802363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
b1:71:29:25:46:e9:2d:e2:55:d6:f1:cb:f7:85:05:22:d0:ea:41:50
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Siticone Technology
Chains
Oct 25, 2022
CN=Siticone Technology
Subject
CN=Siticone Technology
Serial Number
3a:93:0b:19:8f:29:72:9a:49:b0:8b:f3:6d:f8:17:ae
Issuer
CN=Siticone Root CA
Timespan
Feb 5, 2020 - Oct 22, 2030
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
4196702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Siticone.Desktop.UI.pdb
mscoree
_CorDllMain
Name
.text
Size
4.0MB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Velocity Zero Delay.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8ff59c4ddd1f29036ff3e9d6c5ce2ff4fbb2ad736b554139262edf7a8e600a6a
- MD5 ff901cbfc7c5aa7b88ec0ac6cae3acc0
- SHA1 d88d08b46f2f56eea00c86f6b54c01979da4ee3c
- SHA512 1e87ef01e5380fb24578cda266b5bf47ff24ddada18e45ca7f0bc59f59a0811a2b09b129dee2bc7e6ef9f6a37e19db92c93c612eb0210e179b73b8f4f2e39384
- SSDEEP 12288:rKTe2T/rUderXD/ULR0OtRHtjLwg278mCbckHZVWm9Rui+hisrH56:N5FfWmz5KigZ6
- TLSH T16D055D15DF21C68AD62D3BB790F4947423B510A3D0B8AD778EA860F468F37945A93C3E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
400750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
383KB
Virtual Size
383KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
402KB
Virtual Size
401KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ