13e8992c4ebc6dce006e28d37fa0f23b13fa5041.zip
- SHA256 57323025e30fa9cc85fca7f1e26678f5667a7301f148cc383d0b623feb8fa11d
Static task
static1
1 signatures
General
- Target 13e8992c4ebc6dce006e28d37fa0f23b13fa5041.zip
- Size 6.0MB
- Sample260722-yllpfsbg35
- SHA256 57323025e30fa9cc85fca7f1e26678f5667a7301f148cc383d0b623feb8fa11d
- MD5 cb607a2fd03d4fba1dffc44acd30193b
- SHA1 97dbdb4c2d34e9c8a7c16ea41cb6cfcbe8ebe5da
- SHA512 b662cd92428eff757200be6b0d667c7cd9bbc0329f82692298c1a1e132f82bd1f683f75a3b39dd2c617ddd0ed67da5651749d31c529b10b7db6d8493929ae250
- SSDEEP 98304:IzvpEyIbi6qqPz1gEVJH3Fne7eqvAaZiJ/OLErYDnSh/qonPMKK3s/nJTuuHVbZf:MvnIbZRgeH3Fne7FBLE8DaSonXNnJT5f
- TLSH T1C15633007DEB3AC642B34521101056CAD79DB9A2815589C1ED3D8F236D9F2ECE4AE9FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/bin/win64/xldr.dll
File Explorer
-
13e8992c4ebc6dce006e28d37fa0f23b13fa5041.zip.zip 6.0MB
-
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/.gitattributes66B
-
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/bin/win64/xldr.dll.dll 6.0MB
-
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/cs2/iccache.bin594KB
-
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/cs2/localizations/english.bin10KB
-
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/cs2/localizations/russian.bin14KB
-
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/cs2/localizations/schinese.bin10KB
-
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/cs2/vpks/game.vpk.js 220KB
-
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/fonts/esp-icons.ttf75KB
-
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/fonts/gui-icons.ttf19KB
-
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/fonts/pixel7.ttf25KB
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/.gitattributes
- SHA256 1a1dbe176bc233b499d35a57db7513f2941c99ab9759f177830c9149be99005b
- MD5 05bdb783ee6514c8c072e47680af8ff7
- SHA1 ba3dfe345280bdcc5e817bb02cf49b8b8d8e1c4c
- SHA512 9e820d6126d62c0b89e380c69685f6668b2f131283f57e524f59492fa6df22844dda1b90d244d4a1f8aea78a84e65d47b1a878168c4e41001459a947ef275ffe
- TLSH T1EFA022028C0233CCA0C8B3022088E0800338838E2000800A00880C0822C3022C0A2F30
- MD5 SHA1 SHA512 TLSH
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/bin/win64/xldr.dll
- IMPHASH 190978a42c6d6646d7aa5be6b9437c98
- SHA256 ee05ff49bd3c2561dc3c435acbee0091780361fa168ea1db08430b82ed760da3
- MD5 30622c4ad20e9a42d4c14f3f92533e29
- SHA1 541c62a855377ed3819b27c11c870ac0a27ed0ea
- SHA512 c6cbbfc722e89135a00b83aebb8af3475f30b77b61ed4a67219b2fc40bae587517092682b43927e3e2b064eb1aab8c8d1a5238e4a68019bdf59a1128d110191c
- SSDEEP 196608:CgvU/RTqETLhtW1FxVAQ/yqCBtd+hTKIf9b:W/lfVtKENkp
- TLSH T16C5623C63BC561B8C68B8E30C0486ADDFD8974C57D764816BFD605083B719D2CFA6A3A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12251967
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntdll
KiUserExceptionDispatcher
bcrypt
BCryptGenRandom
comctl32
InitCommonControlsEx
ucrtbase
_purecall
user32
ChangeWindowMessageFilterEx
kernel32
CreateProcessW
Name
knwldwqy
Size
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
hgaanarx
Size
Virtual Size
418KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
uibddciy
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
umnhksnz
Size
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
kpmvsdhn
Size
Virtual Size
145B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
qksnzpvv
Size
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
tempwqvq
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
nrqwtlxj
Size
6.0MB
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
sdurcnvm
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/cs2/iccache.bin
- SHA256 119e2a7c50ec720a9cb5da7ee0998b6f941a57071689a0dfb1650620f8937f59
- MD5 35f5d05ba451c5965118341c4829f07a
- SHA1 385878b93f1bb3173c386c9df8a87d0d84205038
- SHA512 effdd5956681ba9411df09c0bec431d1ef0a11f2ec45373552a6eb6261ddcd9a0ac55224a07cfc74fd35c3b8a390664351f1560ff640d90d26a65e4030a4257f
- SSDEEP 12288:f0s+o5GDmUP0DnEqt7I19NmL05c1zYVW1aPf3cw3lG5HOK87S301FDdiwRo:5GWDEyynqGfUotFDdiwi
- TLSH T1A8D44B63F9DA6F8AB7C6E10883F162FC9245817031B9531AABD42748F5D94123EE72CD
- MD5 SHA1 SHA512 SSDEEP TLSH
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/cs2/localizations/english.bin
- SHA256 2a34547a6abf651dbf6c2fc17bac234e72928fd61ddd0f6e37a5e8372c36f323
- MD5 e824d38da4144983fe4485de376656de
- SHA1 cfeec73162c3c1641a1cdae4635a05899b3ef114
- SHA512 2b01482ebe99282622a4f1c33dbd0337c12041ff6dd148bd18cc729b418f3389588ff8e54dc0e39cd61b2a4de83ee454569a5b2beb491aefa9ee55ae7851fee8
- SSDEEP 192:rcc/JDwr4yY1MRcDUtDJX5JX20MhyYGWalrrcC9pcAM6Yw0jeyLHif:wc8Y1XItDDh8hyYJerrcC9ptYRjeyLHS
- TLSH T166224BBF21AD60FAF4A2F1AC56693492BB626176C3DEC1A8F32CD810C1F54140BDAB51
- MD5 SHA1 SHA512 SSDEEP TLSH
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/cs2/localizations/russian.bin
- SHA256 b5769d6f7e81aac25b31384b8aeb46a24b2d4af5fc5b6deefc24fc769c68c29f
- MD5 58c4667d42adc0fbf6a077dc03baed85
- SHA1 d1011a3e6a7b75bfe58c72e59ec7265b37215550
- SHA512 2593ad3f26862073490c553a77be414d81d0276c4ceee6189687a2d84e07c51422cb6fa73433c00efcb995cbb959ba8b525197710ff4da521c9955913b06c63b
- SSDEEP 384:1EQjLIkv58lfbogMPzJgwn0erDW6H7NZoGY:1jjLIO5/5Swu6H7NSZ
- TLSH T13A627135508960DE5641F10BCD996E097EBB5EBE2FAB636616346C3F75F20108B3C70A
- MD5 SHA1 SHA512 SSDEEP TLSH
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/cs2/localizations/schinese.bin
- SHA256 30c3ac70c1ae5ffa756359cc2bdc03c3c0d15b1534c95e050f28e3c2777abe50
- MD5 b6440cd4616f24f99e0ff7ee795689be
- SHA1 042043cda3ed277af57db589be84cee1748c445e
- SHA512 81e3cb6543d870d0f90338492fe09b74e09db523a1addffa07292c2f572b593d092b9d5ad0333ccc8c9003ac120ddfbafa8c7e2894ee9996ca85007a21870204
- SSDEEP 192:9HTNI/J759wr6jx7HkC9L+fnD2PumyQOH1JNaUSb6XvYpCQ0GqQEnveB/Wqf:9hItL1L+fnaPumyVVJNu6Xws6EveQq
- TLSH T103328D9731A861F62897B58C8AA9809A675DE3325FD3F01BBB76DF10412C63007A2F53
- MD5 SHA1 SHA512 SSDEEP TLSH
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/cs2/vpks/game.vpk
- SHA256 d76cdff55c74709a1668aad633d53cf589783d1d0e95ddc40c263a277406e8d9
- MD5 1b36b259d5fa64369ae4dd61f4f8d224
- SHA1 dc80c4dc5baaad1a2e83eca88a95b5cae1c7a4ad
- SHA512 476a11765a6eb641651a9e9921f2d436be5bee1abb0630fba6e8bcbc3c82208689cd27b64a70cd5cc538692bc9092219bc45965d4976706e293ee5c3681b903c
- SSDEEP 3072:P/aV8NoWHq6bUl84LZoUyBCjpuPZ9aYBonQ2WMLieCt:XaVUof6bfUyBCjAPZjD2W8u
- TLSH T1E324091425AB1092F56B75BDB7CB4112772080036905EE38FD8DF629AF8A6FD13F1B86
- MD5 SHA1 SHA512 SSDEEP TLSH
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/fonts/esp-icons.ttf
- SHA256 6aae8b79f861cc57ce4ed3909fabe698aa4d7500e5f5cc4f2856c7706395b3f9
- MD5 9ffc243d6605ea211d86ab35f64b5863
- SHA1 d5e778e796ddfabf8c35cd5ed3552bb37203c364
- SHA512 0e7f4e4d25668c6939dba8502e18132eee73460fb72c37e8db3dfa953ad9ad73a4e82fde65ef859d1d49dbd3e4d78f5f3a66ad6c4d0c6d087ddce5092a0e15f9
- SSDEEP 1536:9eMXjx0WMfgVd8Y4h2sw7IVdd3P5OfpgJ7iz9DsLLsHMa:9eMXjx0XIIdhhCIZm07ep
- TLSH T10673E88623FCDF8AE07169E2449205578AD5E208DF264B32FECE5EDCC1216E44D257AF
- MD5 SHA1 SHA512 SSDEEP TLSH
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/fonts/gui-icons.ttf
- SHA256 b7d26e39b4109dd3d4bfeaf93cccd10651c02da847381454df2272a3f860fe7f
- MD5 5ee79ba590b45d0bc7fdbb910264213f
- SHA1 5780354d30583c3bef4e94dae3e35176adde5e35
- SHA512 4107803f53efb3bc100ec78bff1125d63c654fe82cc726fce7f03184cb22f9d4d8c18654baaa0139ee5715519255015b32aa43b88fecf41407f0d0dbb9bdac7a
- SSDEEP 384:ZFkl9HDjnGCAZ0EgXAa/UbF/5aoBsbUm8uInKyQGUvXW9aBT:ZFklp/GCAZ0EgXuPWgm8RnKylv9aV
- TLSH T1B6922B5997D2CF8ECD2687FD5CA346A10BF0CE21D27AD56F68869C42D0389DC4EB0A49
- MD5 SHA1 SHA512 SSDEEP TLSH
client-resources-13e8992c4ebc6dce006e28d37fa0f23b13fa5041/fonts/pixel7.ttf
- SHA256 0e71338a9ae45df2ede080567cfab831627bac9a83be601521ddbace4cbed11e
- MD5 cd2242816d23dad4250f5ea159c7675c
- SHA1 de74028b5cdb4f3ddc5d5efb0a9b16111b5270fc
- SHA512 5636ff40d846a824c555b076b8ea95a24a62fce9e1abb04048d529a98d62c9961ffa9f12bbd38caa3281f33dc10900aef3095362f34309b6404ad82fd0900458
- SSDEEP 384:VfvBLFj/8zVzglSHg/CxhAzxhAefWVfW0Ur2tPRGVRZ:7LFj8zVzglIAbqlPRGJ
- TLSH T115B2AE084FD72B6DF23296752A61271CB371BE5F0386178BE69D287A1CB31CA4C256D3
- MD5 SHA1 SHA512 SSDEEP TLSH