ModMenu.rar
- SHA256 a55cfb0689b9cddbb8e3f9f08a8716ddb0912b3101287ba587b97e5469f5f024
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dinput8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
dinput8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
sneakyevil_menu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
sneakyevil_menu.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target ModMenu.rar
- Size 637KB
- Sample260808-afyvtsaf56
- SHA256 a55cfb0689b9cddbb8e3f9f08a8716ddb0912b3101287ba587b97e5469f5f024
- MD5 f9ba617ab1975cf45f57fbc4ef9bb4ae
- SHA1 e6093a399f7056e9e95a9e9d87f5ff5f3d26a27e
- SHA512 bedac026498a794ef78c53e8e092c3908317e94cbbc8c8c344fe068126da187890f2af6bd8d3831114f0e02ceca9485ab87256828369a8f8490b8df21e8467f7
- SSDEEP 12288:JfH4UGMx/a62erPo8hOZaBQo0nOUyucpeejZVv5Uu3q8b+J:NH4UiqrPZhsY34OU9c3jFq8bk
- TLSH T19AD433B0F0FD9186DD2D60B64AC59A483879D319F16BA4C4FEE689F9287EE4006CD734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/dinput8.dll unpack001/sneakyevil_menu.asi
File Explorer
-
ModMenu.rar.rar 637KB
-
dinput8.dll.dll 6KB
-
sneakyevil_menu.asi.dll 1.4MB
dinput8.dll
- IMPHASH f35579fb4593a28e91657ae2293134ba
- SHA256 f37f564e99853cee2b2bc2ddf901f4cec5ea9ac3585e36f98df404564206dcf6
- MD5 1010c957c5ebb629790860fb807f2ef1
- SHA1 f6dfd0653a2c78e49936aa4914962737af9c5415
- SHA512 7d8a35286eff5b7b7011fe094269fc2af43823c8ced1df16ffc022ba6a646e89a2f545a7dfe4c000e0cf88a0e2c1bb1291ccfcfe538c1b4e5c3b1383bfea6eb0
- SSDEEP 96:BTF/SE3/5+4hyfdNzr8n913f15A3dXyjRwZr:373/53hMdNY913N5A5ytwN
- TLSH T162C1C81E693110E6C89BC1359CA31F05A7DDF0501B4BAADF898945CF2FC43D9E77864A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5807
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
FindClose
FindFirstFileA
FindNextFileA
FormatMessageA
GetCurrentDirectoryA
GetLastError
GetProcAddress
GetSystemDirectoryA
LoadLibraryA
LocalFree
user32
MessageBoxA
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetdfDIJoystick
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
sneakyevil_menu.asi
- IMPHASH 0ae66f10de5257ae55ac1a1f4704fb95
- SHA256 0a6535b5a4d8b8d12584b17658a3f92cf5c1307639164f72f9d12016db107c72
- MD5 10f21a10808744f3ad9fbcc18d54976e
- SHA1 af8d4551df3d1807331c8af62341e0d0d3c067d5
- SHA512 ec982d8ef40ac84e4de39a69774cbc1c4d122242a7e593702d1023c7be10af10161027bcc32bc7705c0ad13aa7d7939fe91799f4d7998fec0d0ae3aa44afb00a
- SSDEEP 24576:MYGcvQnovJvwathIE2nd+M7pcVsPe0921sZNxd+IczYPBVQML:MoFvJv3l2nj7pb921sZR+IczY
- TLSH T176659D46B6A006F5D97FD034C973690BE93438450330A6FB1ED80A996F22BF91B7E725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
667564
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Sources\SDmodding\.Mods\Mod Menu\x64\Release\Mod Menu.pdb
kernel32
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadPriority
InitializeCriticalSection
WaitForSingleObject
ResumeThread
Sleep
CloseHandle
CreateThread
DeleteCriticalSection
CreateEventA
GetModuleHandleA
VirtualProtect
RemoveVectoredExceptionHandler
RtlCaptureStackBackTrace
K32GetModuleBaseNameA
AddVectoredExceptionHandler
VirtualQuery
IsDebuggerPresent
GetModuleFileNameA
FindFirstFileA
FindNextFileA
FindClose
DisableThreadLibraryCalls
WriteConsoleW
HeapSize
SetStdHandle
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetFileSizeEx
GetConsoleOutputCP
WriteFile
DeleteFileW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
ReadConsoleW
GetConsoleMode
GetFileType
GetStdHandle
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
FormatMessageA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
LocalFree
CreateDirectoryW
CreateFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetLastError
GetFileInformationByHandleEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
HeapCreate
HeapFree
HeapAlloc
HeapReAlloc
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
SuspendThread
GetThreadContext
SetThreadContext
GetCurrentProcess
FlushInstructionCache
VirtualFree
GetSystemInfo
VirtualAlloc
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
TerminateProcess
ExitProcess
GetModuleHandleExW
ReadFile
RtlUnwind
user32
LoadCursorA
ScreenToClient
GetKeyboardLayout
SetCursor
GetClientRect
IsWindowUnicode
SetClipboardData
GetClipboardData
EmptyClipboard
GetKeyState
CloseClipboard
MessageBoxA
OpenClipboard
ole32
CoUninitialize
CoCreateInstance
CoTaskMemFree
PropVariantClear
CoInitialize
mfplat
MFShutdown
MFCreateMemoryBuffer
MFCreateMediaType
MFCreateSample
MFStartup
wininet
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile
HttpOpenRequestA
Name
.text
Size
832KB
Virtual Size
831KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
181KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=259, version=27412,
count=4, productName=Unmarked objects (old),
count=1, id=262, version=27412,
count=184, id=261, version=27412,
count=76, id=261, version=30034,
count=15, id=260, version=30034,
count=10, id=259, version=30034,
count=30, id=260, version=27412,
count=11, id=257, version=27412,
count=215, id=1, productName=Unmarked objects,
count=26, id=265, version=30148,
count=1, id=255, version=30148,
count=1, id=258, version=30148,