MSI-APP-Player.zip
- SHA256 36efcaf26c37637a898eba5eda8283b8b29d166428d59e638f9ce901412ca696
Static task
static1
Behavioral task
behavioral1
Sample
BlueStacksMicroInstaller_5.22.75.6322_native.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
300 seconds
General
- Target MSI-APP-Player.zip
- Size 991KB
- Sample260721-vaevzser2s
- SHA256 36efcaf26c37637a898eba5eda8283b8b29d166428d59e638f9ce901412ca696
- MD5 cf4eebab0e8fbee9e85d54fce070c784
- SHA1 6c3356cdb57523bcf3f1c2f253a11ff29bd2f630
- SHA512 d05dfe8ae549aa2e98d0e5751244aec15ee51fa733290ca10f4cb1f8614a4f3b1b3756e1e12bebed6271f2cade7ed1136b9756f0d8a92a27bae2f9d6a8350656
- SSDEEP 24576:j+861EjILSVaW6RP2AkqOdoGhCjr0c/vUr2u5Q+9S9q5H8Y:v61EYHvReAzOd1hC7vUqgQ+uqOY
- TLSH T1F52533645BC56FC728E0FB10A9B2E51E3A78D6635880CAE533ECF9F97E5D12F0620146
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
MSI-APP-Player.zip.zip 991KB
-
BlueStacksMicroInstaller_5.22.75.6322_native.exe.exe 1.1MB
BlueStacksMicroInstaller_5.22.75.6322_native.exe
- IMPHASH 07afe1e0c9da7fec9e5f700881a1f162
- SHA256 06cb3f619a7554dc955214e33358fb7ce6f4e734bf3020846ce5d4b7040fdf7e
- MD5 bbeb9e9aa01a83708a0e4b966b0ca877
- SHA1 32f55edb8c00dc3d746a414d1067430b8aaf6f67
- SHA512 f40e2ec422a475c212b31118ff672d9ec6c09f84bec3c428ccd4a897d57a922d3e6e69bfe6cbf21440d49c11776cb5df1258e5a0739c9be8bc04a7d170cad7ca
- SSDEEP 24576:wivtCX8jD0MhSq73WMGYPmjDhUGhPmQYuXh6a5S0crqHGFA:1tCX8P0Mhb7DGYahhPXYGh5cDm
- TLSH T12245F1440B4AC4F4C09622F15FD28230AB7D96768FFFC142AAF16F1CC7366ED59616A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ef:a1:e6:ec:1e:c2:18:41:f2:fd:8c:85:a1:d1:28:b2:74:1b:bd:25:54:42:19:56:2d:d0:98:f2:44:1f:9f:74
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 12, 2025
SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0d:f2:24:41:e7:a2:4c:bc:b5:fe:9e:70:58:24:2e:b9
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 18, 2025 - Mar 17, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
5
Entry point
107954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryExW
GetModuleFileNameW
LocalFree
FormatMessageW
GetSystemDirectoryW
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
RemoveDirectoryW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetProcessAffinityMask
GetCurrentProcess
GetSystemInfo
GlobalMemoryStatus
GetFileInformationByHandle
GetStdHandle
WaitForMultipleObjects
Sleep
VirtualAlloc
VirtualFree
GetVersionExW
lstrcatW
lstrlenW
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
GetExitCodeProcess
CreateProcessW
GetCommandLineW
HeapSize
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ExitProcess
HeapCreate
RtlUnwind
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
ExitThread
CreateThread
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
TerminateProcess
IsDebuggerPresent
user32
DestroyWindow
LoadIconW
EndDialog
KillTimer
SetTimer
SetWindowTextW
PostMessageW
SendMessageW
MessageBoxW
DialogBoxParamW
GetWindowLongW
SetWindowLongW
ShowWindow
LoadStringW
CharUpperW
GetDlgItem
shell32
ShellExecuteExW
oleaut32
VariantClear
SysAllocStringLen
SysStringLen
Name
.text
Size
130KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
129KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=21, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=157, id=1, productName=Unmarked objects,
count=93, id=131, productName=VS2008 build 21022, version=21022,
count=103, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,