gd elenemigos.zip
- SHA256 e6c6cfab4cd2c9589b3a83df2e86cca931011a3d460b341ceda1cdb3a193edd7
Static task
static1
Behavioral task
behavioral1
Sample
gd elenemigos/GeometryDash.exe
Resource
win10v2004-20260513-es
Behavioral task
behavioral2
Sample
gd elenemigos/fmod.dll
Resource
win10v2004-20260513-es
Behavioral task
behavioral3
Sample
gd elenemigos/libExtensions.dll
Resource
win10v2004-20260513-es
Behavioral task
behavioral4
Sample
gd elenemigos/libcrypto-3-x64.dll
Resource
win10v2004-20260513-es
Behavioral task
behavioral5
Sample
gd elenemigos/libcurl.dll
Resource
win10v2004-20260513-es
Behavioral task
behavioral6
Sample
gd elenemigos/steam_api64.dll
Resource
win10v2004-20260513-es
Embeds OpenSSL, may be used to circumvent TLS interception.
| resource | yara_rule |
|---|---|
| static1/unpack001/gd elenemigos/libcrypto-3-x64.dll | embeds_openssl |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/gd elenemigos/GeometryDash.exe |
| unpack001/gd elenemigos/fmod.dll |
| unpack001/gd elenemigos/glew32.dll |
| unpack001/gd elenemigos/jpeg62.dll |
| unpack001/gd elenemigos/legacy.dll |
| unpack001/gd elenemigos/libExtensions.dll |
| unpack001/gd elenemigos/libcocos2d.dll |
| unpack001/gd elenemigos/libcrypto-3-x64.dll |
| unpack001/gd elenemigos/libcurl.dll |
| unpack001/gd elenemigos/liblzma.dll |
| unpack001/gd elenemigos/libpng16.dll |
| unpack001/gd elenemigos/libssl-3-x64.dll |
| unpack001/gd elenemigos/pthreadVC3.dll |
| unpack001/gd elenemigos/pthreadVCE3.dll |
| unpack001/gd elenemigos/pthreadVSE3.dll |
| unpack001/gd elenemigos/sqlite3.dll |
| unpack001/gd elenemigos/tiff.dll |
| unpack001/gd elenemigos/turbojpeg.dll |
| unpack001/gd elenemigos/uv.dll |
| unpack001/gd elenemigos/websockets.dll |
| unpack001/gd elenemigos/zlib1.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/gd elenemigos/steam_api64.dll |
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=33030,
count=4, id=259, version=33030,
count=34, id=261, version=33030,
count=6, id=257, version=33030,
count=2, id=257, version=30159,
count=2, id=257, version=32545,
count=2, id=257, version=30143,
count=10, id=257, version=30795,
count=5, id=257, version=33135,
count=1245, id=1, productName=Unmarked objects,
count=240, id=265, version=33135,
count=1, id=255, version=33135,
count=1, id=151,
count=1, id=258, version=33135,
Unsigned PE
Checks for missing Authenticode signature.
count=24, id=259, version=27412,
count=155, id=261, version=27412,
count=33, id=261, version=30034,
count=15, id=260, version=30034,
count=25, id=259, version=30034,
count=1, id=263, version=27412,
count=25, id=260, version=27412,
count=11, id=257, version=27412,
count=150, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2019 v16.9.4 build 29914, version=29914,
count=198, id=261, version=30159,
count=51, id=260, version=30159,
count=1, id=256, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=10, id=261, version=30034,
count=7, id=260, version=30034,
count=2, id=259, version=30034,
count=5, id=257, version=30795,
count=36, id=1, productName=Unmarked objects,
count=1, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=151,
count=1, id=258, version=30143,
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33030,
count=14, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=259, version=33030,
count=2, id=257, version=30795,
count=47, id=1, productName=Unmarked objects,
count=27, productName=Unmarked objects (old),
count=101, id=260, version=33134,
count=1, id=256, version=33134,
count=1, id=255, version=33134,
count=1, id=151,
count=1, id=258, version=33134,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=2, id=257, version=30795,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=3, id=257, version=30143,
count=134, id=1, productName=Unmarked objects,
count=4, productName=Unmarked objects (old),
count=37, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=258, version=30143,
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=26, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=259, version=33030,
count=6, id=257, version=33030,
count=2, id=257, version=33134,
count=2, id=257, version=33135,
count=8, id=257, version=30143,
count=7, id=257, version=30795,
count=563, id=1, productName=Unmarked objects,
count=24, id=265, version=33135,
count=1, id=256, version=33135,
count=1, id=255, version=33135,
count=1, id=258, version=33135,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=253, version=33030,
count=8, id=260, version=33030,
count=4, id=259, version=33030,
count=30, id=261, version=33030,
count=6, id=257, version=33030,
count=15, id=260, version=33134,
count=4, id=257, version=33134,
count=8, id=257, version=30143,
count=15, id=257, version=30795,
count=571, id=1, productName=Unmarked objects,
count=14, id=260, version=33135,
count=126, id=261, version=33135,
count=1, id=256, version=33135,
count=1, id=255, version=33135,
count=1, id=258, version=33135,
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=211, id=1, productName=Unmarked objects,
count=11, id=257, version=30795,
count=36, productName=Unmarked objects (old),
count=917, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=258, version=30143,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=8, id=253, version=28518,
count=12, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=2, id=257, version=30143,
count=197, id=1, productName=Unmarked objects,
count=11, id=257, version=30795,
count=164, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=151,
count=1, id=258, version=30143,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33030,
count=12, id=261, version=33030,
count=8, id=260, version=33030,
count=3, id=259, version=33030,
count=3, id=257, version=30795,
count=57, id=1, productName=Unmarked objects,
count=80, id=260, version=33134,
count=1, id=256, version=33134,
count=1, id=255, version=33134,
count=1, id=151,
count=1, id=258, version=33134,
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=1, id=253, version=28518,
count=12, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=2, id=257, version=30795,
count=3, id=257, version=30143,
count=70, id=1, productName=Unmarked objects,
count=15, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=258, version=30143,
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=12, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=4, id=257, version=30795,
count=3, id=257, version=30143,
count=589, id=1, productName=Unmarked objects,
count=89, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=258, version=30143,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=3, id=257, version=30795,
count=77, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=10, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=1, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=258, version=30143,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=30034,
count=3, id=257, version=30795,
count=78, id=1, productName=Unmarked objects,
count=13, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=1, id=261, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=258, version=30143,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=3, id=257, version=30795,
count=75, id=1, productName=Unmarked objects,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=1, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=258, version=30143,
Jun 18, 2024
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33030,
count=13, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=259, version=33030,
count=3, id=257, version=30795,
count=112, id=1, productName=Unmarked objects,
count=1, id=260, version=33134,
count=1, id=256, version=33134,
count=1, id=255, version=33134,
count=1, id=258, version=33134,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jul 27, 2026
CN=GSE,OU=GSE,O=GSE,C=UK
Jun 17, 2024
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33030,
count=1, id=253, version=33030,
count=13, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=259, version=33030,
count=2, id=257, version=30795,
count=4, id=257, version=33134,
count=3, id=257, version=30143,
count=110, id=1, productName=Unmarked objects,
count=43, id=260, version=33134,
count=1, id=256, version=33134,
count=1, id=255, version=33134,
count=1, id=151,
count=1, id=258, version=33134,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33030,
count=2, id=253, version=33030,
count=14, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=259, version=33030,
count=2, id=257, version=30795,
count=62, id=1, productName=Unmarked objects,
count=27, productName=Unmarked objects (old),
count=113, id=260, version=33134,
count=1, id=256, version=33134,
count=1, id=255, version=33134,
count=1, id=151,
count=1, id=258, version=33134,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=4, id=253, version=28518,
count=12, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=1, id=260, version=30795,
count=19, id=257, version=30795,
count=280, id=1, productName=Unmarked objects,
count=37, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=258, version=30143,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=9, id=253, version=28518,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=8, id=257, version=30795,
count=9, id=257, version=30143,
count=410, id=1, productName=Unmarked objects,
count=90, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=151,
count=1, id=258, version=30143,
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=30034,
count=4, id=253, version=28518,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=2, id=257, version=26213,
count=49, id=1, productName=Unmarked objects,
count=15, id=260, version=30143,
count=1, id=256, version=30143,
count=1, id=255, version=30143,
count=1, id=151,
count=1, id=258, version=30143,