Gekke.org Raider 1.7.zip
- SHA256 53e5831b8bd13aeacf00258f617fbf8702dbfefeef8e62bd012d43fe6d09d4d5
Password
123
Static task
static1
1 signatures
General
- Target Gekke.org Raider 1.7.zip
- Size 134.5MB
- Sample260808-ccqfdsxhnf
- SHA256 53e5831b8bd13aeacf00258f617fbf8702dbfefeef8e62bd012d43fe6d09d4d5
- MD5 bce768914bebfd33e3e8724a5a8604b0
- SHA1 af156c62ca928c9f0fc1c044e793b9a6d4a1c3db
- SHA512 4ab0c638dfc9a5b7df8c3e92d29d8fe82a9e968713f4f5b0d38ae2026b723c0bcfdd595aee774118b85f7d74275c1fb28cf07a631820dffe36a4efef8c352073
- SSDEEP 3145728:2SbBXyoF1t9HuqAC9UBNvukB063MHaEadFd7o/v6k5YWMcdb1:9bBXyct9HuuyjvtBgMdb785j
- TLSH T1DB68333C98CBCDEEE5D6C56542626B000319A0E2477A6FF36B121B232A171D342D6BDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Gekke.org Raider 1.7.1.exe
File Explorer
-
Gekke.org Raider 1.7.zip.zip 134.5MB
-
Gekke.org Raider 1.7.1.exe.exe 124.9MB
-
input/Data/Audio/audio.mp35.2MB
-
input/Data/AudioCache/audio.mp3.json3.1MB
-
input/Data/bloxlink.json2B
-
input/Data/images/Kenny smoking.png.png 82KB
-
input/Data/images/boykisser.png.png 362KB
-
input/Data/images/business.png565KB
-
input/Data/images/idkk.png.jpg 34KB
-
input/Data/images/kitty.png.png 893KB
-
input/Data/images/logo.png.png 1.4MB
-
input/Data/rover.json2B
-
input/config.json810B
Gekke.org Raider 1.7.1.exe
- IMPHASH 20bd67bca6c560d47ee260a75029b116
- SHA256 3c48a4a9b3684a46a0430f6f44c10f811736eadf714493b39038d866c9685e47
- MD5 646c0c0e516328ed53b08a0d7ba4e32f
- SHA1 6d65094f8a91ced6859d18d41fb27e8e0795e917
- SHA512 dffeeba7a19c52fafdbb395d65e611eea94c90477802bfe778e8e22c971a5a85133c87d534c72d11db10101721b7322693cecafd38e928c8d4748a4976e27d26
- SSDEEP 3145728:KqzOho9JGp84DZbyGlXNInt3w8qeHW+T0d6bz8z6wvQum:KqzOh6Gp84tNpNStkUTU6Mj
- TLSH T1EF58333DF99BC5CEF8E6C8B501926B5152157CF107B65AF36A2138232B33681025AFDE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddDllDirectory
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateProcessW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FindResourceA
FormatMessageA
FreeLibrary
GenerateConsoleCtrlEvent
GetCommandLineW
GetCurrentProcessId
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetProcAddress
GetProcessId
GetShortPathNameW
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathW
InitializeCriticalSection
IsDBCSLeadByteEx
K32GetModuleFileNameExW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadResource
LockResource
MapViewOfFile
MultiByteToWideChar
OpenProcess
ReadFile
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__set_app_type
__setusermatherr
__wargv
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_unlock
_wcsdup
_wcsicmp
_wrename
abort
calloc
exit
fwprintf
fprintf
fputc
fputwc
free
fwrite
iswctype
localeconv
malloc
mbstowcs
memcpy
memmove
memset
puts
signal
strerror
strlen
strncmp
vfprintf
wcschr
wcscmp
wcslen
wcsncmp
wcstoul
shell32
CommandLineToArgvW
SHFileOperationW
SHGetFolderPathW
Name
.text
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
124.7MB
Virtual Size
124.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
input/Data/Audio/audio.mp3
- SHA256 5d7deb7a89b8bbefd7149b8fada46c752d0086f53d7800c6fb124e6b05dfc843
- MD5 e4fe2142c7109b8f5b6bf10fa094f304
- SHA1 5db32a44f284bfb9a8480e19b59ad1b9a459d0fa
- SHA512 fc0daa8e311ad545ac7798709c4a62e7e76a6f488b334062ce362ea04e27cfb635ddc624d96895dae73741d303227b356a67f255d8c9bca8c3e4ee9e3fa102d6
- SSDEEP 98304:OyB+XQCzsjBl2+nkbD8Nnke06SJBqZoC2rgvuhmce7MF51nI4Y:OyBgQXkbABkiS76+Z5c
- TLSH T10F462309C348306CF26349761DBB2495F9355E807415BAE9ED8AFFB8617BF20772B026
- MD5 SHA1 SHA512 SSDEEP TLSH
input/Data/AudioCache/audio.mp3.json
- SHA256 3b0d487abeb0c50fb1b7830e1a53b231a49e18be44eca79ec558957f2e0cd95e
- MD5 a1885fa96eab32c1ca9b6376093aa99a
- SHA1 7c1e07c868c68ca3b0bd4fe9b535e847abc105b2
- SHA512 85a41e6fd73b32392ba173769101adb4ce3c5812c5b3eeb065203f30e9cf9e972bb1c574cf0b76973b5f1892a354bae863dfbff2780b76ad66704d24a4e727ca
- SSDEEP 24576:qRllWHe0O9zIoPVbwpA6nHa0gnBKlmh8IbFFcizXla3zf7L9sSgQwQ8IUyFOBy5R:v
- TLSH T144E5AFB875042CF7F66F566BDA96BDDC13A636229ACBB4CC806477C30567363EE02805
- MD5 SHA1 SHA512 SSDEEP TLSH
input/Data/bloxlink.json
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
input/Data/images/Kenny smoking.png
- SHA256 e56c4096322eb09a0908a9c5846fc53e28d8b5ebd4039b68c2227db845f8031b
- MD5 0fbd0501cbec3e2ac2e36d1cfa4c969d
- SHA1 1e65c887599c7ee3aa88f963816d96145c7ce077
- SHA512 fcaf282ddfcb2d6a59484785fa90c03aa72852e11f08a0ad72affa9051b1c94cbe9d1cfa795ce59cd6eb055940cfe58bdb3770e277f1b5333bf46794e4d1e15d
- SSDEEP 1536:jRcKmGCETO8AJ/ENCHocKCMfbf9ssiUOldJPAW5Lq3fK4WCjSrEY:jRcyT2J/UCHn6fbfiEOlTIhnjSr3
- TLSH T15483126E69B21BD4C5377EECF29014424BA0710E653C43A1BC6A0992FDE9F9B447C74B
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
input/Data/images/boykisser.png
- SHA256 5898f045652268956abcade81acad7768cf686c6bca49f7f2b91f195ec7bf0ac
- MD5 b192fa0520de2c6a8c7847d541455061
- SHA1 73e4ee9a578384a242b44824b4e754b1814d86d5
- SHA512 3bf99b5e44f727cd93a8740a0b56c96384458adea406912ab79c52071ac2e08aa65971bdaf0446cb0fd3962c69415848a20d961745f379f6c8e30d391777c53e
- SSDEEP 6144:FLBC2/v7Oz/F0kL6Iq+hKPsXzJwmD+R5A5KfkNikJjvIB+ppM59vU091q/T7/LMi:F9F30ZYuXNM7ACkhblSZUd/T7/LMQQvM
- TLSH T1E98423C4A4FFD81E8E954A2A36AF6B519C826012D3205FC47B0FC6DE19AF848915CF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
input/Data/images/business.png
- SHA256 920c6ba77ba718843f0a441bb1eddca7819f1c336851d62f273edfd7b4a8b66c
- MD5 55179a689d61d55f523bc5809b5d7124
- SHA1 3f67ca2e2f16738256b45b8ab50913800504fde5
- SHA512 2893234b8ec28e1b80a221ef13a2aabb2cd2b8d45da905fd3037c06c4707da835e0f8aa4a146d3049bc61134355bfa6850af90fc41dcb09358ba480eae3a437a
- SSDEEP 12288:yh6vXrs4AK4xTVSnJOgMf9NPJTXMLdF9lgG859zMcIuSteA:3v72KbV4TXqdFHgXInpQA
- TLSH T1E9C423A7B5B77C09CAB0526C50A291D36994899D02358BBCD25FFCF3DA254E480DF3E2
- MD5 SHA1 SHA512 SSDEEP TLSH
input/Data/images/idkk.png
- SHA256 4ecc0667b6f1cc8437bd9f9e7c4f47ac0ac13d30e8afa28643752e26f1e02df5
- MD5 bbc631835f900e2ca337de2e281b274d
- SHA1 ecb468d634ab1b2c32660219ce3b0aea0c2c8cd5
- SHA512 aa4531cfa9780297a076ee426af8f3b8e3182f7b797463079ea1988af22a9a0179879dec1083b584b393c20b7f2957acd4fae0cfb1898256f41aa9311236088b
- SSDEEP 768:s3eiagdau/J+ylp7xR8Bwx2ov0LYsKTGLhIiEfY:sOiagdakpd5v0GSLkY
- TLSH T162F2E142796E4441ED03DF7B5C64A4AC29840CF1EA47EE3FB2DB90D0E8BE77605416D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
input/Data/images/kitty.png
- SHA256 5e390b89b03ab83d1f0038799206c2f9cc85a041570bd24da7f348b8e0d98c0b
- MD5 620162de709e2a667390c9fc3fd99d98
- SHA1 243ce003ab6577642bc3a279db08ba54919d9767
- SHA512 8da21fd578b4bbe680647d79ae9c08eadf89849bb1aa902a4b4f56e67bfef4a5888da271a9c2ca0c11946b20992afdcd596cc9b1ff6c15c1b0f2cd7737805bee
- SSDEEP 24576:3h8+x46GVn0VbjJ+G0qtOwOndVcoiTG4e0jsF:3NKdVnTstOLe/64eF
- TLSH T12815331C9DABBDF3DA47C888F62E64B1436168258BF3251A903E825C5417FF59F2231B
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
input/Data/images/logo.png
- SHA256 a8150e03838da540a7d7ad29529d20b62a4e21e1e19b50f737e4d24cfb07bbf3
- MD5 075b1edd850d66f3c1bbcb532f5e7800
- SHA1 20eb1eb89c2223c04826832eed4270db8e4f53ad
- SHA512 2624c9b40fdc3f1a63bfbbbc5af63d3adaadca0522a4f5b21ca58f4562de4954b7c4aa7a1485f83dfc20ab516adfcfb07179713f6e9aab0f267ad1f0117991de
- SSDEEP 24576:wSuuWYUHokEAUYaRv0TszFLaAZ7rqvNZCOlb6w0inQSBc1gray:wSu9YUHoDMaN0ILaAwV3dKaray
- TLSH T11E6533ED42D14DB6C7B3893208BFA0999A1674B6E6831092D3CBD514F72C6E96033EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
input/Data/rover.json
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
input/config.json
- SHA256 86ad52b6c5599ae52e7688be55c88d2bc33f28f45f4bfa63332a4fe459a9286d
- MD5 8ef5225531c501415f44f011a2ddb74c
- SHA1 2b1239dde099095fba9851337c72f7f7ba65081b
- SHA512 838d212e09c40ffbd2908f9e6951017df9804abc0e2a0a1012a22ada062615eb55f51abe41494de993f636d0108c8c777694bec914205b1b2ec689da4488ed9e
- TLSH T1EC01AF29CD449EF556BA412E8B650383DF1CC7075318187F7A7C5E8C0F729564097712
- MD5 SHA1 SHA512 TLSH