2ab4b26e82ce07bccbf8fddc854d7967d3bd67cc8392028ad70b8658e9917bf2
- SHA256 2ab4b26e82ce07bccbf8fddc854d7967d3bd67cc8392028ad70b8658e9917bf2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DragonSword Awakening v1.0-v1.0.x Plus 53 Trainer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
DragonSword Awakening v1.0-v1.0.x Plus 53 Trainer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2ab4b26e82ce07bccbf8fddc854d7967d3bd67cc8392028ad70b8658e9917bf2
- Size 974KB
- Sample260727-csfwwsvsbx
- SHA256 2ab4b26e82ce07bccbf8fddc854d7967d3bd67cc8392028ad70b8658e9917bf2
- MD5 9a69eb847827a96b7b711cfc2570138c
- SHA1 0386c57f469e13a89a11526257b96436db19f443
- SHA512 cb4b9ac9f7df630e583ce163177d8a19d479f32bda0b8ab3150d4120e560c7860f4900e926890fca8cabf89d31da1db879e3606791de1f12e359266d6155aed8
- SSDEEP 24576:YLePoSmT6G3Y+djF4nfgW5o35XmT5kWC3Of5HnqOH4sb:ieyTDo+dmnfx5o35Xu5kWflYY
- TLSH T12D25339175CBC7B2427EF8158D6802B808A4BDF8B55817449FD0F13BE3B5C8AD2DA1B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DragonSword Awakening v1.0-v1.0.x Plus 53 Trainer.exe
File Explorer
-
2ab4b26e82ce07bccbf8fddc854d7967d3bd67cc8392028ad70b8658e9917bf2.zip 974KB
-
DragonSword Awakening v1.0-v1.0.x Plus 53 Trainer.exe.exe 1.7MB
DragonSword Awakening v1.0-v1.0.x Plus 53 Trainer.exe
- IMPHASH 65ffadf271018806ad95944d4f92c51a
- SHA256 d459f87d86a80331a81587e8b3989975106499aaf3e251a9452a2b130e05ebd1
- MD5 71d68fdf183454c7558391a1fa5e37f5
- SHA1 33f1479ac418e9a913622a4309bf14a1de0b1939
- SHA512 633301eadd5d299035ec4269539f582630feb3c44aaf77612f8bf63adac915243ca3dbd54673bdf1aa996c0a86a12abc3a204a410ed3f59ca6205c67e665ed95
- SSDEEP 24576:UtMW/piCT5RVr66XcewDAEKYx9wyrX6aDpYk1RPkl7EQs:gtN6AcewDAJXsQRs
- TLSH T1FA85AE26A6A801ACD1B7D1F889268947E772B84A0731AFDF03D056771F277D44E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
684816
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WritePrivateProfileStringW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
Sleep
GetCurrentProcessId
LoadLibraryW
GetProcAddress
GetModuleHandleA
LoadLibraryA
InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleHandleW
DecodePointer
GetModuleFileNameW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetTempPathW
WaitNamedPipeW
ReadFile
CreateFileW
GetCurrentProcess
FindResourceW
LoadResource
SizeofResource
LockResource
LoadLibraryExW
GetFileAttributesW
FreeLibrary
GetProcessTimes
GetSystemTimeAsFileTime
IsWow64Process
SetLastError
QueryFullProcessImageNameW
GetFileSizeEx
ResumeThread
WaitForSingleObject
LocalFree
CreateDirectoryW
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetLastError
CloseHandle
MultiByteToWideChar
GetPrivateProfileStringW
WideCharToMultiByte
GetCommandLineA
FindNextFileW
FindFirstFileExW
FindClose
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
VirtualProtect
ReadConsoleW
GetConsoleMode
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
EncodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
IsDebuggerPresent
OutputDebugStringW
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
TerminateProcess
IsProcessorFeaturePresent
GetStdHandle
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetFileType
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
RtlUnwind
user32
SetProcessDPIAware
MessageBoxA
MessageBoxW
advapi32
SetEntriesInAclW
ConvertStringSidToSidW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
shell32
SHGetFolderPathW
SHCreateDirectoryExW
ole32
CoUninitialize
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
VariantInit
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
mscoree
CLRCreateInstance
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
PlaySoundW
Name
.text
Size
861KB
Virtual Size
860KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
279KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
561KB
Virtual Size
560KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=179, id=261, version=33145,
count=18, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=99, id=261, version=35721,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=17, id=257, version=33145,
count=162, id=1, productName=Unmarked objects,
count=30, id=261, version=35723,
count=18, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=151,
count=1, id=258, version=36252,