Kaentake-HD-addon.zip
- SHA256 b53f32e1a2a7fd1f13f0e28bfc24dcfbe45f419d60a4128a47b8321b28784984
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kaentake.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Kaentake.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Kaentake.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Kaentake.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
MapleStory.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
MapleStory.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Kaentake-HD-addon.zip
- Size 4.3MB
- Sample260728-w4emrasene
- SHA256 b53f32e1a2a7fd1f13f0e28bfc24dcfbe45f419d60a4128a47b8321b28784984
- MD5 2faf77706158e90e52f69187a754c7d3
- SHA1 76774708cdfad9b909c43de2cdb35f670df7d158
- SHA512 5f0d6454ea53cc640df183fa3c9d13cef7d607a7ce08bbe8757107e37b354345dd66d2fca675838f476e9d2af7f2ab0824ef4a2c24676f1728e604048e87ce56
- SSDEEP 98304:ZoCNXEF9L2ZT4+8/StonpAKfnCn1csAreUx+bwpuHkFS8LML:vlUIAat+ppPCqsAyUYbwsEFXL6
- TLSH T12B26336972CD1B54513A249BB5A3B532B1AF7FEC20986311739B2C4E7DAF1DE043702A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Kaentake.dll unpack001/Kaentake.exe unpack001/MapleStory.exe
File Explorer
-
Kaentake-HD-addon.zip.zip 4.3MB
-
Custom.wz44KB
-
Kaentake.dll.dll 111KB
-
Kaentake.exe.exe 31KB
-
MapleStory.exe.exe 9.5MB
-
README-Kaentake-HD.txt1KB
-
config.ini38B
Custom.wz
- SHA256 791809613e8ec270723d43418e67aa26ed072f72313d6a3ffcd7879b77469000
- MD5 0ace1ca40d7d9cbff23787c9d04bcb7d
- SHA1 cb6a1cf9f3a6e7502e92eae693f78d8b6e4ec035
- SHA512 8844b70bf41d458dffe93369cb85c3795e9f9adbe7b7fa53332891d8303d631f516a069f04e990f0582cbfa0587203a8a920e604c1b3fee86ae6dc9c92739cb0
- SSDEEP 768:GJ52tlzYCrMRtUEpdpFZmu74197xCP4dv15wPzGUoPKDfRX48Kq9ZWU:W52XYCrMrb3tkHCPaKWRAWU
- TLSH T14F23D0C23BF56F1AD7BA57B9702941B407B0A9847D51931B554CC81C7E612CD3EB132A
- MD5 SHA1 SHA512 SSDEEP TLSH
Kaentake.dll
- IMPHASH 4fb337f829e0ca63519d0965cbc21fa4
- SHA256 b05a9e1264971b11579d66eaee9e9ffdcf40f41300974d08e5a3b4c5b5af80be
- MD5 dda5ae539851ae3104991b31f7230f60
- SHA1 c7377d9c18bc79ef75e764b6ff071c63057c08ec
- SHA512 0ffe18616f997b1385ab2287720b8ab712bfdd541769ea0f85c5a8995d6f0b2e1c39f2ae20089ca744ee53c277fbc261a4d8ed0cbce79db682662048247f6ed3
- SSDEEP 3072:dG1S7zu+RhELBQBsbj7KGTLQnaHLqJh9KDnMSsqahGCl8N/4:d+S7ztTELBQBsbjmGTwaHLO9CMSsqah9
- TLSH T178B32A20B52B86BAD6CC50BDA97C4B5A076F5260EF6355D7B35A5BAE0D300D32F34603
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
77471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCommandLineA
HeapAlloc
HeapFree
GetProcessHeap
Sleep
GetSystemInfo
DisableThreadLibraryCalls
GetModuleHandleA
GetProcAddress
GetPrivateProfileStringA
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
GetVersionExA
GetModuleFileNameA
MultiByteToWideChar
GetLastError
GetCurrentThread
VirtualProtect
LoadLibraryA
K32GetModuleInformation
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualQuery
SetLastError
LocalFree
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
user32
IntersectRect
MessageBoxA
SetWindowLongA
ScreenToClient
ClientToScreen
SetCursorPos
MsgWaitForMultipleObjects
SetRect
PeekMessageA
DispatchMessageA
GetCursorPos
TranslateMessage
SetCursor
ShowCursor
GetWindowRect
ReleaseCapture
SetCapture
GetAsyncKeyState
PostQuitMessage
SetWindowPos
ShowWindow
CallWindowProcA
LoadCursorA
oleaut32
GetErrorInfo
VariantChangeType
VariantCopy
VariantClear
VariantInit
msvcp140
?_Xlength_error@std@@YAXPBD@Z
ws2_32
inet_pton
WSAGetLastError
closesocket
inet_ntop
htons
WSAAsyncSelect
connect
socket
winmm
timeGetTime
vcruntime140
memcpy
memset
wcsstr
__std_exception_copy
__std_exception_destroy
__current_exception
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
__CxxFrameHandler3
__std_terminate
_CxxThrowException
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
__stdio_common_vswprintf_s
__stdio_common_vsscanf
__stdio_common_vsprintf
api-ms-win-crt-convert-l1-1-0
atoi
wcstol
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo
_invoke_watson
_seh_filter_dll
_initialize_narrow_environment
_errno
terminate
_configure_narrow_argv
api-ms-win-crt-heap-l1-1-0
free
malloc
DummyExport
Name
.text
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=4, id=257, version=35207,
count=19, id=261, version=35207,
count=11, id=257, version=33145,
count=128, id=1, productName=Unmarked objects,
count=19, id=261, version=35227,
count=1, id=256, version=35227,
count=1, id=255, version=35227,
count=1, id=258, version=35227,
Kaentake.exe
- IMPHASH b899d1c08700c87edd13e59650857525
- SHA256 792e1023e5405454b978c83a0cb9b866add8df759596ed42309be6df93f50848
- MD5 602b74006131b70b99930887216a4d42
- SHA1 0762ba8b889a4fefcf82ffa2c23ee5eee28a0efa
- SHA512 e67fe2296c22d99f630a5845e039d387da88bd74325e5c3f210f09a10075f6c9638f964e5e6d7c60b2ab8f86accbaf8e71964166d2ced0a8c468b2c1385f26eb
- SSDEEP 768:gb2miy6rPEPDHlXk7R1EPRdyWLW9gTI8uk:g6+64b5k7RKRQWqGU8uk
- TLSH T1F1E2800FBF423661F62C42742735E65842EBEE3016A17A9B57603DF90D795C3EF2218A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12892
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetLastError
WaitForSingleObject
GetExitCodeProcess
ResumeThread
LocalFree
FormatMessageA
OutputDebugStringA
GetEnvironmentVariableA
CloseHandle
SetLastError
GetCurrentProcess
TerminateProcess
CreateProcessA
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
GetProcAddress
LoadLibraryW
GetModuleHandleW
GetCurrentThreadId
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
user32
MessageBoxA
vcruntime140
_CxxThrowException
__std_exception_destroy
__current_exception_context
memset
memcpy
_except_handler4_common
__current_exception
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
_set_fmode
__p__commode
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_exit
_get_narrow_winmain_command_line
exit
_initialize_onexit_table
_cexit
_crt_atexit
_controlfp_s
terminate
_initterm_e
_set_app_type
_register_thread_local_exe_atexit_callback
_register_onexit_function
_c_exit
_initialize_narrow_environment
_configure_narrow_argv
_initterm
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=1, id=259, version=35207,
count=12, id=260, version=35207,
count=26, id=261, version=35207,
count=5, id=257, version=33145,
count=88, id=1, productName=Unmarked objects,
count=6, id=261, version=35227,
count=1, id=255, version=35227,
count=1, id=258, version=35227,
MapleStory.exe
- SHA256 6bdac0b18ba2a27b904ece8bb3753a16ce7c7e6dfc06534df957b75c2372d9d1
- MD5 7abddaa5760c821ce81f935531395f14
- SHA1 a2092e73852498bf7fe883277c8dc8041c04e8ff
- SHA512 80275a126c2d60ea2bed43ba213d12a37a519bcc38f691881642dc59bdf5e9c198f63db0bc7961d8507509bf963610e525994d4d3c9a321a405fd92ff42daa4f
- SSDEEP 98304:vMeDRBamHwHrDtBLSdOstjwa2gePz/R6yLgNDmkRNSoQBrkqWews7MFGO:+mQHr8ea2HV6eEBR3QB4qWen7TO
- TLSH T176A6D65C2590964FEF2ED333D38B394091E6B2E5993097628BF9E6C869FECC41285C1D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6701043
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
8.0MB
Virtual Size
8.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
125KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
1.3MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mackt
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=93, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=29, version=9178,
count=5, id=12, version=7291,
count=45, id=14, version=7299,
count=161, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=11, version=8798,
count=1, id=11, version=8047,
count=1, id=10, version=8966,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=11, id=11, version=8966,
count=6, id=28, version=9178,
count=2, id=37, version=8755,
count=27, id=25, version=9210,
count=234, id=1, productName=Unmarked objects,
count=280, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=7, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
README-Kaentake-HD.txt
- SHA256 67e0ad6fe7810f054a363e00b5b99667b2550fcb5be52891f5f8db1770b0a31b
- MD5 c84b503937c3502588152cffe9c65921
- SHA1 a2e1a19ff7e6cd7bdb79cfeed7d4bcce60b1f1bf
- SHA512 45774b98e4f6c826c7e27d2235eb5835182e805c7c5b65226328c8d492a0a8cb271b1885c92d05258b9d2da5b1998df73f41b00bd38341d0fa759bdea3ce81a2
- TLSH T1563198975D8743735262E450C12E2994E72290EFD036602822BD816CBED23DDB36FCD9
- MD5 SHA1 SHA512 TLSH
config.ini
- SHA256 eaee5424d8fe165b95712be2c3fb23b9649f127ec2456563a862b04916f1c7f3
- MD5 733186692df180e27630de30a7a78248
- SHA1 cbe61574461359231262ec1c585d90b72f26bdd8
- SHA512 70a7b9ce2af3e06870b5c002287ae5a08865de5f689f1ef0142cab2eed8dd381c2bb2e1b04510586ebc7e62fd9d6da92db556432dfa0ec4313b251050ce30bf7
- MD5 SHA1 SHA512