BetterRenderDragon-1.4.4.zip
- SHA256 e3e965d428d62a5cc781fec335d9433eff52e4e177b2a1114634d7619432de35
Overview
overview
3Static
static
3LaunchMinecraft.bat
windows10-2004-x64
3LaunchMinecraft.bat
windows11-ltsc_2024-x64
3LaunchMine...ew.bat
windows10-2004-x64
3LaunchMine...ew.bat
windows11-ltsc_2024-x64
3dlls/Bette...on.dll
windows10-2004-x64
1dlls/Bette...on.dll
windows11-ltsc_2024-x64
1launch.ps1
windows10-2004-x64
3launch.ps1
windows11-ltsc_2024-x64
3uwpinject.exe
windows10-2004-x64
1uwpinject.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LaunchMinecraft.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
LaunchMinecraft.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
LaunchMinecraftPreview.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
LaunchMinecraftPreview.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
dlls/BetterRenderDragon.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
dlls/BetterRenderDragon.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
launch.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
launch.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
uwpinject.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
uwpinject.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target BetterRenderDragon-1.4.4.zip
- Size 320KB
- Sample260716-m96trae17s
- SHA256 e3e965d428d62a5cc781fec335d9433eff52e4e177b2a1114634d7619432de35
- MD5 2dd7f2f3e5e21eade282c2b9019a2280
- SHA1 fc0d3a2005d4d7197e56a11ed3eb8b4479506fd7
- SHA512 10f5e76b0423d56b4214b7ec5445e36a13c099eeb1d4276d9456da25d36adbd728f505c15334c579d51ac60bac5a0e4c2e1ef1f20a3909382aeaeaf511d0923d
- SSDEEP 6144:zCHCxpvnxH/JYUyQ3ArKqGwG+EgGGAYNr0CXhCQyaTytiv9prgP+n:zCixFBTZ3UonyAICLPW
- TLSH T1D86423F063297600F005C71238C4DE59243F986A30C7F97B7FBBA533A82A5675E8A957
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/dlls/BetterRenderDragon.dll unpack001/uwpinject.exe
File Explorer
-
BetterRenderDragon-1.4.4.zip.zip 320KB
-
LICENSE34KB
-
LaunchMinecraft.bat132B
-
LaunchMinecraftPreview.bat140B
-
dlls/BetterRenderDragon.dll.dll 501KB
-
launch.ps161B
-
uwpinject.exe.exe 121KB
LICENSE
- SHA256 6f1e622c82a380075843bb084a7ec3b1f1d12a4a02526d75e78b0924a860aa75
- MD5 02d4ea62d9fb26520eee03e3923515ce
- SHA1 231aa27eb8d3ed016f074aa5afd302d2abf27db3
- SHA512 3ce6b90b06934563b990b40cd1a56a08abdefc3e5546e32d20403164610a940d170b85851a05a270f173ca96823a0895bb61a0436645545cff032637d221ee59
- SSDEEP 384:ZMRJzlQ0Lf8KnYz3ZlqXstCTyVqtGJEuzFrb3CNHroNjOK1gxuCfZDbQ9:ZSndSz3ZlqXOWoInuzx3Y8N3W9BD09
- TLSH T126F2845BB74513B2029202516E4BA4CEF31E907A776A40A4785DC15C27B7E3883BFAED
- MD5 SHA1 SHA512 SSDEEP TLSH
LaunchMinecraft.bat
- SHA256 52c98fe3a2115b7b709a20891aeb3668dd480aa0170722e0960c7d03510d0a97
- MD5 e69ca7afa5c2be9310e7fab72b83bcc4
- SHA1 a4a734fbfa9d10739038a32da5dde4b63482e113
- SHA512 87a9780ccd28738362d92ed8fdd2e7a51ca7653ed8392ca9e6150911587f1435ae6ba9c5b896d38fabfeab81276b49fc844214728376b3a989a79e4cee1a5d8c
- TLSH T19CC02B31400DFB8A31C3B90670ECC931301B02C321004EC231304339A02218CD02134F
- MD5 SHA1 SHA512 TLSH
LaunchMinecraftPreview.bat
- SHA256 b0eb1d9859fc737d89001b7dd4b02c95a9d2ffd2a318767bca37e59a4a9271a1
- MD5 b9a3a7a88d18ffb213c5fc33b4bc3978
- SHA1 ce0628d36c35d8028c9f4d96c16f5e55029184fc
- SHA512 b34b12604be58ede997e175ca5c086c9b4a538eaf0db2aeca8faa24f0bea604bc2f6268a91cbe7d6dea3b1689ac18fd3e1a0d0070cdc56b32584749694c18ec9
- TLSH T19FC08C21404AEA8A2292A80670E9CB71301B028321004AC231304339F42268DD02628E
- MD5 SHA1 SHA512 TLSH
dlls/BetterRenderDragon.dll
- IMPHASH 09d4938fcee7f917edc644f5dc5e1f2f
- SHA256 f09e3b8015b68fa4d23f2d159462466711fe4bee2901d9ff07b221158a7bed0a
- MD5 4f2414589c45b0ddd381e7b55e351ed6
- SHA1 0227f005d362ce67aeb9fee0f0c921e0c8e34484
- SHA512 e18c1dd72cd1f4f3dc1854e7db70e9f9e1d083dc368f4d95f700dc4df672252c70a674d94685b1cc9796dbb81b642700402b49d86653b30afce4f5cc79ee4b87
- SSDEEP 6144:ci97XMCjO/T+tmqpoEwiRD3+D8K0/XEBpoaA4JvC5jaGVXA8BcbEbnGXyaZ0VrQR:1R0/45R/XYX8jdVabEbnEvQA
- TLSH T13FB47D96B5A505F8D0B7903856ABA607F679385A0310C7CF33E8A6752FD33E06E7A350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
6
Entry point
366280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\BetterRenderDragon\BetterRenderDragon\Build\BetterRenderDragon.pdb
d3dcompiler_47
D3DCompile
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
WaitForSingleObject
CreateEventW
InitializeCriticalSectionEx
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-heap-l2-1-0
GlobalFree
GlobalAlloc
LocalFree
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
api-ms-win-core-memory-l1-1-0
VirtualProtect
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcess
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-processthreads-l1-1-1
FlushInstructionCache
user32
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetClientRect
kernel32
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetLastError
VirtualQuery
VirtualFree
VirtualAlloc
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
imm32
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
msvcp140_app
??Bid@locale@std@@QEAA_KXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Syserror_map@std@@YAPEBDH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_lock
_Mtx_unlock
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
vcruntime140_1_app
__CxxFrameHandler4
vcruntime140_app
__std_terminate
strstr
__std_exception_destroy
__std_exception_copy
_purecall
__C_specific_handler
__current_exception
__current_exception_context
memset
_CxxThrowException
memmove
__std_type_info_destroy_list
memchr
memcmp
memcpy
api-ms-win-crt-stdio-l1-1-0
ftell
__acrt_iob_func
fflush
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fgetc
fputc
fclose
fseek
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
strcmp
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
strtoul
strtod
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_initialize_onexit_table
_crt_atexit
_configure_narrow_argv
_seh_filter_dll
terminate
_errno
_invalid_parameter_noinfo_noreturn
_execute_onexit_table
_cexit
_initterm
_initterm_e
abort
_initialize_narrow_environment
api-ms-win-crt-math-l1-1-0
floorf
cosf
acosf
_dsign
sinf
ceilf
sqrtf
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
FormatMessageA
api-ms-win-core-file-l1-1-0
FindClose
FindFirstFileW
GetFileAttributesExW
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
Name
.text
Size
365KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=33731,
count=6, id=257, version=30795,
count=4, id=259, version=33731,
count=8, id=260, version=33731,
count=32, id=261, version=33731,
count=3, id=261, productName=VS2019 v16.5.0 build 28610, version=28610,
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=239, id=1, productName=Unmarked objects,
count=15, id=265, version=33813,
count=1, id=258, version=33813,
launch.ps1
- SHA256 d9e965e8344819060a8db57a3f6dcfd883e0d5eb5511716f494c4a4b2997a6d5
- MD5 38be5d9cfe9fb422c6a5bb9cf2ee53e0
- SHA1 9e106fa5ba79911e5109717ae47d21ffb576c278
- SHA512 03bef365481caad1b25837b4e46501e225393931bc72c76418d3cfdd0e47ca9171023f6fca62c466a723aa15a4d4dd49b4d7875bc5a499b524c20dd2f7a53f01
- TLSH T181A0024182D94E5056966C4AE479140EA40E3254201074D0B0134455A35036A6A2B197
- MD5 SHA1 SHA512 TLSH
uwpinject.exe
- IMPHASH 07bc74a780d7b28681197fbb0884985c
- SHA256 dd25b2bb292338230216f211f611076657af4c91972ae86ec8b0ea39ba16f294
- MD5 7c3b798bc6a1433b0db8ca3225e3e3fe
- SHA1 ae14c318103e51fbe19ec680e0c9df5362fdebe4
- SHA512 ba6cb078511f1742d9367b167b7e5ec552c9b812bc74545d4a1dd6d37e66295dbc40d0d2af1a1dbd0f91431b22180991a5824bbeeae966a98f75d137f6e0a864
- SSDEEP 3072:ZeoUc0BSORyPEDdVi18EbNfgnJVcRTbR:Mc6U8Dm18EqQ
- TLSH T147C35B4773A530F8E5778238C9615A16E77278320B709BAF039442A65F637E09E3EF60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9392
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ole32
CoAllowSetForegroundWindow
CoCreateInstance
CoInitializeEx
CoUninitialize
advapi32
ConvertStringSidToSidW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
kernel32
CreateFileW
WriteConsoleW
TlsSetValue
FindFirstFileW
FindNextFileW
CloseHandle
GetLastError
WaitForSingleObject
Sleep
CreateRemoteThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
GetModuleHandleA
GetProcAddress
LocalFree
FormatMessageW
PackageFamilyNameFromFullName
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
HeapReAlloc
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=26715,
count=135, id=261, version=26715,
count=37, id=261, version=30034,
count=16, id=260, version=30034,
count=9, id=259, version=30034,
count=7, id=257, version=26715,
count=104, id=1, productName=Unmarked objects,
count=11, id=260, version=26715,
count=1, id=260, version=30146,
count=1, id=258, version=30146,