f9f94e42f8hm9t89l53k8uyk.zip
- SHA256 75d11e18a86106ee4d045e2838138eb1686ef35e353b98bcce76eaeba851d9bd
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
er1ikhanmod_obfuscated.jar
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f9f94e42f8hm9t89l53k8uyk.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
fabric-rendering-indigo-v2.jar
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target f9f94e42f8hm9t89l53k8uyk.zip
- Size 4.1MB
- Sample260718-pdvsqaes7s
- SHA256 75d11e18a86106ee4d045e2838138eb1686ef35e353b98bcce76eaeba851d9bd
- MD5 c1c7bad0b9f16610736526cad5f451a5
- SHA1 6dde1a914a3b41e4ff33df35d54f1f85f00f8555
- SHA512 003dbeec807f3c6a62996151b95d13a8c5a102c40dba93258f749d2c70fa15611aac381c1d6a92948648ad3d8bc39f255a81711be406a28977abf6c6c36ba2f2
- SSDEEP 98304:yE/5F7fgWkvlp3TC+BuFyj+hDK0+2hLEA1shaLCNREYsVFFJl5H1dYn3Z:yE/5lJ2pDlBu1K0rLE4shaLTFzl5QnJ
- TLSH T1F21633BA3382F58FB0416767548AF4D4B7CA9F6B927997043763A3086C0E6B36673434
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned JAR 1 IoCs
Checks for missing JAR codesign signature.
resource unpack001/fabric-rendering-indigo-v2.jar
File Explorer
-
f9f94e42f8hm9t89l53k8uyk.zip.zip 4.1MB
-
er1ikhanmod_obfuscated.jar.jar 3.0MB
-
f9f94e42f8hm9t89l53k8uyk.exe.exe 2.0MB
-
fabric-rendering-indigo-v2.jar.jar 24KB
er1ikhanmod_obfuscated.jar
- SHA256 5a392f44e71908f36d3457e4b5ec9737c430e6fde2ce5b15c14b39fda0b774ad
- MD5 e8a80b55ddc3dc4686b1790b10dc9945
- SHA1 279437d1e8025d2be3a29fe90685ea37c19a3f2a
- SHA512 045f03bcb1f71afa35409ab6c21cfc644ab695d240786302567630bf9fb22b95ca93d6e4f07be8ebbd9ee068a0553bedc83dc4979f2ecc2e0d164d066c64321f
- SSDEEP 49152:0DncROlIUipVzMjmhL7+JUFgrvMhbqpBuB/i1aBCV0ciglipp1nklfJA/+3SZ+VV:gcgripmjm57MUAUhbqiBq1aBCVXigspo
- TLSH T186E5337B3346E16AF0016BBB5C86E4D5E3DE9B3BD235670433917349992A6720363CB8
- MD5 SHA1 SHA512 SSDEEP TLSH
f9f94e42f8hm9t89l53k8uyk.exe
- IMPHASH d2e03ef9659e3636110fe106ac852703
- SHA256 bd272277f32f720a225fdf81872ebf378cc756fff76d52ec64913c1368d03f23
- MD5 db9fc1ecd2c9b3d7f3c8d5945313e849
- SHA1 8110ac8ed467c06d513b95be78e8673bbc01d206
- SHA512 78ef2d10fd743338941dd06f8010c3126d3d90ca62856d1b691ed22ef2c52b759303ba7ca5327cb71dd213ad88cd4005413ee004654d54cd39e4876556789b63
- SSDEEP 49152:mCYR9ZmCjjeZ/UFjCqaky2JctCnwE2XDZPS:mDpjO/HkV2tRJXVPS
- TLSH T1ECA5BE46B3E501E8D467C138C5529B2AE77278160F20DBDF17E45B6A6F73AE01E7A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d8:29:71:62:a6:fe:49:a7:9a:74:10:e5:96:b3:5f:89:d2:79:54:bf:57:39:a8:e6:94:08:4e:b0:c7:83:ca:ea
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=GRM Tymon Nowak,O=GRM Tymon Nowak,L=Warszawa,ST=mazowieckie,C=PL
Chains
Mar 27, 2026
CN=GRM Tymon Nowak,O=GRM Tymon Nowak,L=Warszawa,ST=mazowieckie,C=PL
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=GRM Tymon Nowak,O=GRM Tymon Nowak,L=Warszawa,ST=mazowieckie,C=PL
Serial Number
58:ec:be:43:a6:d8:e1:b0:5b:ca:a7:03:94:22:9c:f4
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 7, 2025 - Jul 7, 2026
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
863448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\jakub\Documents\Grim-Project\Grim-Loader\src\example_win32_directx11\Release\grim-loader.pdb
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
WriteProcessMemory
OpenProcess
CloseHandle
VirtualProtectEx
GetCurrentProcessId
GetCurrentThread
WaitForSingleObject
CreateProcessA
SetLastError
GetSystemInfo
VirtualFree
GetCurrentProcess
VirtualAlloc
Sleep
GetModuleFileNameA
SizeofResource
FindResourceA
GetModuleHandleExA
GetLastError
LockResource
DeleteFileA
LoadResource
SetFileAttributesA
CreateDirectoryA
SetEndOfFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetModuleHandleA
GetOEMCP
GetACP
IsValidCodePage
HeapSize
OutputDebugStringW
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ReadConsoleW
GetConsoleMode
SetFilePointerEx
WriteFile
FreeLibraryAndExitThread
ExitThread
CreateThread
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetFileType
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GetStdHandle
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GlobalAlloc
MultiByteToWideChar
GetCommandLineA
HeapFree
RtlUnwind
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
SleepConditionVariableSRW
WakeAllConditionVariable
LCMapStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateFileA
GetFileSizeEx
ReadFile
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetTempPathW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
GetCurrentThreadId
InitializeCriticalSectionEx
user32
GetCapture
ScreenToClient
LoadCursorA
GetMessageExtraInfo
GetKeyState
FindWindowA
UpdateWindow
PostQuitMessage
PeekMessageA
LoadIconA
TranslateMessage
SetLayeredWindowAttributes
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
UnregisterClassW
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
MoveWindow
DefWindowProcW
DispatchMessageA
GetWindowRect
DestroyWindow
CreateWindowExW
GetSystemMetrics
GetWindowLongA
RegisterClassExW
ShowWindow
SetWindowLongA
ClientToScreen
ole32
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
VariantClear
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
winhttp
WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
402KB
Virtual Size
402KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
450KB
Virtual Size
462KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=30795,
count=189, id=261, version=30795,
count=23, id=260, version=30795,
count=1, id=253, version=33731,
count=12, id=259, version=33731,
count=19, id=260, version=33731,
count=106, id=261, version=33731,
count=26, id=260, version=31107,
count=20, id=257, version=30795,
count=34, id=261, version=33814,
count=1, id=259, version=33814,
count=7, id=156, version=21202,
count=268, id=1, productName=Unmarked objects,
count=20, id=265, version=33814,
count=1, id=255, version=33814,
count=1, id=151,
count=1, id=258, version=33814,
fabric-rendering-indigo-v2.jar
- SHA256 f0282d87baf7efff6c86055d89351afe586fcf22c3eed9ce9d1d4d53dfbdadd9
- MD5 0bfd27af8836e3bba98452b25e68bf37
- SHA1 be226597fecf5d6d9534f7b7b10a37858b65546a
- SHA512 bcf2fb7daf92cdaa3a129ec494bbf5e4ca11e15fa67516a3b9b04edef43db61b6a5fa6fdfab9ca4c1d56830881d0584cfb80b60d148d19fce304472cd6b27b0d
- SSDEEP 768:ThnJnk/O12RMC0pyxhjq0qHp7aGYyJa9y8eDHHb:ThnJk/P0ihjrGYFs8eDb
- TLSH T1A2B2E16D3BFE621BE76B337C1420B429B0D9A14BDD9E9AF6B8C21561CBD40001D4739D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned JAR
Checks for missing JAR codesign signature.