YandereSimLauncher.zip
- SHA256 dcde6eb57d20919fc6d15615898d46047a01e6af5b7456bd238046a8d6cd08fa
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
YandereSimulatorLauncher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
YandereSimulatorLauncher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target YandereSimLauncher.zip
- Size 4.1MB
- Sample260805-beyn4sgr31
- SHA256 dcde6eb57d20919fc6d15615898d46047a01e6af5b7456bd238046a8d6cd08fa
- MD5 d3a6c859c6be93f9e41db88ba522c7aa
- SHA1 63f61b15ca3464d185f6633b65e12c57436e2c35
- SHA512 8caf054937547008f159549809833e234f25758281a6934078ba076de2ca1d993066036dedbb490d03c6d58ba573c70d1c15e0843ae0bfd8e2deb240a8839d2f
- SSDEEP 98304:FxXQwwzxgcnLj0fQeLy+kuDBY8biVJIARW+xSkBM9Iiia:lw9f0fTLLkuDBYRYkO9IS
- TLSH T14816338F1BDBCFAEE9368B3D925854902471760383D23D68D0C26E338FAC526479AD4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/YandereSimulatorLauncher.exe unpack002/costura.dll unpack002/megaapiclient.dll
File Explorer
-
YandereSimLauncher.zip.zip 4.1MB
-
README.txt14KB
-
YandereSimulatorLauncher.exe.exe 4.7MB
-
costura.dll.dll 4KB
-
megaapiclient.dll.dll 105KB
-
newtonsoft.json.dll.dll 683KB
README.txt
- SHA256 f28292f331d463caf3b0dbd3c8a380b321c5c8a30253556c3ac85378e98a7ca6
- MD5 31febbf320e003e2a9d4430dc111db9e
- SHA1 59ba9d9a619bc992196e40c6322682d401ebf9a4
- SHA512 01bc5769aa13493e77ff234c5a37aa48ba179c182f84145418071d1d44d978da248fbb61c87488db8e7af9ff7fd7e3c9ee76ab25840ba442dd553aec2844498d
- SSDEEP 384:E+XZjFNgkS7zlE3j/qVJlPMvzQ3zzxsXkApkQY/:E+XZjFNgf7ZED2DPMvzQ3fiXX+/
- TLSH T18E62E71F3741037609D65341A61EF8EAF21E912DBB6F2684346ED25C233A72C57FB298
- MD5 SHA1 SHA512 SSDEEP TLSH
YandereSimulatorLauncher.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 33a3fcb7494e831dc252e1133dd33360e1f452ab7e5b63ec1905ec6fe12dbe02
- MD5 7006edb42f32157804a769264a2f5019
- SHA1 50877fe87ff458cc9c6103bb96734c2ab8e0d608
- SHA512 68a72fdbe9586161adf55eab6a637d550b7400737f01d622a1dce2b66e6fa88e2886cd16f7e628d36e2b8918a0e8cce5534be1d859e01eeb73937b62b21fd400
- SSDEEP 98304:JRXG+U5FP7zOnKWScghx10+HvYOumBfEzsTb6S6yhv1M9lc:pUzfOKWW3gOumBf/lbv69
- TLSH T1293623A55EE74E2AC1350BF88CD40F349EB31F42CA50DA5CD4497425BEF3B92A60866F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4719054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
202KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
costura.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e0d68e4a15788ca1464ee024b3422cfdf8a68bc9058ad0d9c6bc91614935eed
- MD5 d075a47a551e53e27889f83670a581e1
- SHA1 5954e332ec7732ba34c27e2d88d154d1919c1b07
- SHA512 d2f2ca4358102cb0d3cb90c1cebe9aa2cb2c6fb21facdf3471c50ab72d6ac907e789bb918508539c34c10fc948792c68f67363eb755b80a2343bd72dc9e93c0e
- TLSH T1CA81632193B8067AE9770FB29D7B03516375F921ED32C73F595561096C273248E72B32
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\costura\Costura\obj\Release\net40\Costura.pdb
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
megaapiclient.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e2d9a3e2e188cf233a87ee198ec08319475cde8b4b59a031c9e622adcd2355de
- MD5 c7b3edc91c5ec8f2b039a81f2ecf65ac
- SHA1 fb86acb435b693b0d083330c8bb5a1f0fef6c7c4
- SHA512 081389ea27b40ab4a473b539d6aaae4cefe7b6beffde45ac5cead569efc22d22c05831b6af8f90b25c18c7ed724eac210acb193095aa7631049504c8ab33b05c
- SSDEEP 1536:yda0cZGb5ZMZ05lZAEuTED+YOvqJz01L14upsc3guItwL/I:Aa0O25ZMZ0FJu46qJzWZpzetw0
- TLSH T121B35B65EBAC832BC79E5738B4A982500778D25E7413FBA79D44FCE9241B3E40901BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
108022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\megaapiclient\MegaApiClient\obj\Release\net45\MegaApiClient.pdb
mscoree
_CorDllMain
Name
.text
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
newtonsoft.json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- TLSH T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Nov 9, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
696798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
673KB
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ