ParzPainter_[unknowncheats.me]_.zip
- SHA256 a3da21c77c6319aa3ebcd41a4e034e6d77b212d4892fe1aa4a4508279ae5ffcc
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ParzPainter.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ParzPainter.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ParzPainter.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
ParzPainter.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target ParzPainter_[unknowncheats.me]_.zip
- Size 1.4MB
- Sample260803-de7m5abc47
- SHA256 a3da21c77c6319aa3ebcd41a4e034e6d77b212d4892fe1aa4a4508279ae5ffcc
- MD5 60f122ba7dd9d71c605897f4978a4115
- SHA1 245e8c8038b11df030a2f26c7c43e9aaec80e3c1
- SHA512 b008799ea793b73688f084dd945fdfb0ba8f1f197a171aebcc5618113bf878966339786565009da1fde59f8855b98fcf35fe1237b924cd17fc74684b0e2c7e38
- SSDEEP 24576:CIf076r5zLtT3vgQ8eq0qAtXtcZ7STCVJUtOh6BaSZE5F8IHAFdzD:CIc7mpLgEq0qAtXtch5VEMgFdzD
- TLSH T13B6533AA44DD55F23EC2464510A98C22450D0744533778F8EB6DED5AB333CCDEAE8AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ParzPainter.dll unpack001/ParzPainter.exe
File Explorer
-
ParzPainter_[unknowncheats.me]_.zip.zip 1.4MB
-
ParzPainter.dll.dll 2.3MB
-
ParzPainter.exe.exe 152KB
-
README.txt552B
-
images\onepunch.jpg.jpg 11KB
-
images\pikachu.png.png 66KB
ParzPainter.dll
- IMPHASH 0336ac935d12f21121c65ef0e8bd923f
- SHA256 d68f9651a0375cb9c98e4624f2b047e709c6a720d228a845e31848e448698fe8
- MD5 8e9aec4d11b684c954aed3fd6b21756a
- SHA1 d140ede823290bc89c0c7aed22bec75d7490bb1d
- SHA512 0a0fd2864fd3cd5f5c088949c4a8cef3742bb380fe7080cc5c269c1ff0594c60f33c3f48447f9e2ba7d4d1bc46412dc96641a6e595951ceea1cb5b211c4c12ea
- SSDEEP 49152:1FNUZWsczwUqeydRNvqkKZon5zIEyBtfet7mJ9wWOn+uUIIv:dq3UqeVon9yBtG9
- TLSH T1CDB5CF5A72A801A4E067A23DC6879B47EBB138590321D7CB17E8469E2F573F01B7F352
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
743800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\User\Downloads\chameleonEsp-main\chameleonEsp\x64\Release\chameleonEsp.pdb
kernel32
WaitForSingleObject
GetModuleHandleA
CreateEventW
LoadLibraryA
CloseHandle
GetProcAddress
QueryPerformanceFrequency
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
GetCurrentProcess
FreeLibraryAndExitThread
GetCurrentThreadId
Sleep
DisableThreadLibraryCalls
FreeConsole
CreateThread
GetCurrentProcessId
AllocConsole
VirtualFree
VirtualAlloc
GetSystemInfo
HeapCreate
VirtualProtect
HeapFree
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetLastError
HeapReAlloc
HeapAlloc
HeapDestroy
GetThreadContext
GetModuleHandleW
FlushInstructionCache
GlobalUnlock
OpenThread
OutputDebugStringW
WriteConsoleW
SetEndOfFile
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
SetConsoleCtrlHandler
CreateDirectoryW
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
GetFileSizeEx
GetConsoleOutputCP
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
VirtualQuery
GetTickCount64
FindClose
FindFirstFileA
FindNextFileA
SetThreadContext
WriteFile
GetFileType
GetStdHandle
ReadConsoleW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
GetLocaleInfoEx
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SetFilePointerEx
GetCurrentThread
GetConsoleMode
RtlUnwind
user32
SetClipboardData
GetClipboardData
EmptyClipboard
GetWindowThreadProcessId
CallWindowProcW
GetWindowRect
SetWindowLongPtrW
GetWindowLongPtrW
GetAsyncKeyState
DestroyWindow
DefWindowProcA
CreateWindowExA
UnregisterClassA
RegisterClassExA
GetKeyState
GetDC
MonitorFromWindow
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
SetProcessDPIAware
IsWindowUnicode
ReleaseCapture
SetCursorPos
ReleaseDC
GetCursorPos
OpenClipboard
CloseClipboard
gdi32
CreateRectRgn
GetDeviceCaps
DeleteObject
imm32
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmGetColorizationColor
DwmIsCompositionEnabled
DwmEnableBlurBehindWindow
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=259, version=30795,
count=181, id=261, version=30795,
count=22, id=260, version=30795,
count=10, id=259, version=33808,
count=15, id=260, version=33808,
count=77, id=261, version=33808,
count=13, id=257, version=30795,
count=184, id=1, productName=Unmarked objects,
count=24, id=265, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,
ParzPainter.exe
- IMPHASH 882522e003efd29f96ed22d409919e27
- SHA256 36f1a49ef15923b57db7eaa3a3190c9833352f2627bfcf3ca9d61504ecf119bb
- MD5 dd6ae81861c6d1dcdb7556657d45f0a7
- SHA1 efd4d053014889f9f9abc5f4b55d19c7072c5209
- SHA512 89c4fbd065859333cb16ba2dc4b325cc13c97c09cc7be4808c14c91c8f713815f5e318ff2c609f8e8fb09768e74e0b28a1b84b9753e428b997cacac73359d63e
- SSDEEP 3072:rkSZxwxEAhN6O2hRVybb0hH1e/XfzYJ+GtjUva:vZxwxEyNQFyb0hVZA
- TLSH T1FBE36C47B3E531F9E1B7827888611602E772B8760770AB9F07A447766F236D09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8092
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFileAttributesW
CloseHandle
GetLastError
WaitForSingleObject
CreateRemoteThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
HeapSize
HeapReAlloc
CreateFileW
RtlUnwind
Name
.text
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=140, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=257, version=30795,
count=98, id=1, productName=Unmarked objects,
count=9, id=259, version=33808,
count=16, id=260, version=33808,
count=44, id=261, version=33808,
count=1, id=261, version=34120,
count=1, id=258, version=34120,
README.txt
- SHA256 26fc84276ee8e1f5b581113b3938b210debc65e35309ede5ca397b6782d041fd
- MD5 4160c962c29300fd69ee80d62e293f51
- SHA1 3563e23f383e70d583ae639d8668b505e3b1913b
- SHA512 ce24156621a16e97a22328ef3f211b2ffadda39a1f8dac93c00cff6476d5c0e6953ab11ec844762b69b346de2ffa59c55446a80e00f6f3a846691e5b70891926
- TLSH T12EF08BAEBDCA4DA3C062D01B750FB6B082179043EADA531805DD9039A69161180BDEE1
- MD5 SHA1 SHA512 TLSH
images\onepunch.jpg
- SHA256 db4af1b975b752f6dfe83cec04f6474c00c499d9447ce0d2e59b0ed6b3b5c020
- MD5 e2ca349fa5226ca09fbf52841c6ae751
- SHA1 6e146daa2296ad58ed9d8366ea6dd8d5ea65dd90
- SHA512 dac69a674e81dbadfa80598d8728663efdb91d83383afc3d65edd3a681f776f49f46d743867033a88b71dacddc8105ee75887a4da08d20db40c023733228676f
- SSDEEP 192:smp9JBTa1LAvEJ8YrV7ajE/mHlzLfo+JYVqjqTDecTxL71m4J4TvunZ:smzJBTa6vElrVegOHBE+NcDp71m4JiWZ
- TLSH T14B329D7F8FB0A691D4AEFFB631C96A20CBC5412372D81B075628107B6C33BC87E69245
- MD5 SHA1 SHA512 SSDEEP TLSH
images\pikachu.png
- SHA256 a79b5d881d4d43d4d42cd9cf011de18e55f7fbf2a4a9831701341bba2be1cefb
- MD5 7a55b796472e390ee88ee08aec697566
- SHA1 dfc1491eefc326b3777e57d378fe3eb4213a1270
- SHA512 9f03c0d8535cadd66652802cf2c7ff89d6eec7d33c484326a12337acaf503f3d0db50781a21faef237d1a105f49ba5f5989c0a3a88747c4c108452108762f7aa
- SSDEEP 1536:JZi2WQFCrfMHv5CgacszERvLUJDWGUJYR4mGtjsk5fwvwq:yeFwM51n4X5RRXGtjsk1wvwq
- TLSH T1D86302D2BECE96524CDBC34B4DD005B4C2BACA15F854153819FB93A64ED39CC37A54E8
- MD5 SHA1 SHA512 SSDEEP TLSH