good.zip
- SHA256 052115944406380ae5c58b85714bedd39b93b6521728de5c727f97be93682305
Password
zest
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
good/blue.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
good/main.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target good.zip
- Size 458KB
- Sample260813-sq76csshmb
- SHA256 052115944406380ae5c58b85714bedd39b93b6521728de5c727f97be93682305
- MD5 9496ea3b00bb06ddc23dca1fc1620df5
- SHA1 45d5eb0554f58d9a293ff47a738946244b438053
- SHA512 65042fcb46ec040194a59b069f0ac0b49575d2172c2840fd803c0e87b913f1673256636415fe79acd62ecb05a881140ad9c4dc3029de05369ff2930ad042c580
- SSDEEP 6144:I3uNjspT2f6Y3N03ZXEsuCmcW3KaYbtH3Bdq0CWACXpdUbdTM8X7dmGxak5wjoz+:HbepDXmxKaU/sWybFNr5akBd+9
- TLSH T1E4A4230BDA5AEDA6F5CF30AB13251CED417CA38C5A017413B306588FE762367495F762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/good/blue.dll unpack001/good/main.exe
File Explorer
-
good.zip.zip 458KB
-
good/blue.dll.dll 95KB
-
good/dbdata.token13KB
-
good/main.exe.exe 1.2MB
good/blue.dll
- IMPHASH 6d0a9abaab6feebcfb1563f0e77db2db
- SHA256 4961046d6dc19b94bf7c69c9f73dc31d67c771e91fb7c4877f592647224ae952
- MD5 cc444ac6266d209133b5ea9ed1e1e5c4
- SHA1 bd5f1e0c562e350d2a8742db3eeb96d44ac71ae1
- SHA512 d8df244243c49172fd4e6f92fe5875376a16a54be669554fd6d0936257db873b6217e8d87dadeae33db64398c40e46cba298b11356c289bd0b2673d94244ed5d
- SSDEEP 1536:j1VcSD2n5/ArVI2WnMTgDS5cJP5L5CgJ1WOqKVEGPosb8rHQY3EYyH:j/cSD2n5/ABWnWAS5cJP5L5VRQsMwJ
- TLSH T13A930BF27BE28D89DA56637867C6D961373CFEE08662470B062816312F03FE17DD9246
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
zest
Minor OS version
0
Major OS version
4
Entry point
4754
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredExceptionHandler
AllocConsole
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
OutputDebugStringA
Sleep
TlsGetValue
VirtualAlloc
VirtualProtect
VirtualQuery
api-ms-win-crt-convert-l1-1-0
mbrtowc
wcrtomb
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
fputc
freopen_s
fwrite
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
wcslen
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
_Z10VehHandlerP19_EXCEPTION_POINTERS
_Z13CpuidEmulatorP8_CONTEXT
_Z15PatchCpuidToUd2v
_Z15PatchKuserReadsv
_Z18CreateDebugConsolev
_Z3LogPKcz
_Z6printfPKcz
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
304B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
275B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
175B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/80
Size
512B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/91
Size
512B
Virtual Size
378B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
good/dbdata.token
- SHA256 41f182fb27166e9ac1bd60a089fa960b54f8b70dc59b00eda5ea42014f538821
- MD5 27b50e01175c5308d1359b05ae246055
- SHA1 2376f86dc9f42e5ad481ec03c03c458d09490160
- SHA512 cfe4fef861dbc7bd4af98e29f8614f097d5ee81aa453919a63bdb33fd801547323a429d3d906274e6bc215e07b5f2cb9dbb8f641d6566ea2a7ce370fcf91d1b7
- SSDEEP 384:zf0lOaTp0MoFJz2B6QoWiumHeeL1kITmkAYGSSQ:ehoX3QT2e61kyHEQ
- TLSH T19A527CCCD2AA48D18D456FC5A87662CB4F25177B4DE8054720B8BB281E734EE8079EED
- MD5 SHA1 SHA512 SSDEEP TLSH
good/main.exe
- IMPHASH 3d1f154825c3db974c7377f41bdba303
- SHA256 026e701fd8f9388984bb26d0174cfa6a2cb041ffc2172b23ee21b9e1ba35b001
- MD5 d74493540ad31d84051de4c84dfdb064
- SHA1 e1e8f0b9cb2af4e60ccfe35bc9c8f4bf28530fa0
- SHA512 7ca227bea3a3c81cb43ba0f7a73f5e42609b86bc79f93d5d2261132912fc52b592c266ad03cbf363fa2aa7b0303ab311527a8c6a1b1193acfaab045f2532f26d
- SSDEEP 24576:3U3qT42th4FgBOKHqSv5qmKDqSha4mnYIVgVA6LO0vOO4GgnsJu:3U3qT42v4FgBOKHqGqkSha4MrVgFLO04
- TLSH T146453AA5BF22C354D8422C7814384B09DB387F8EC22DD657D7AA3542371DB9EB1AE385
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
zest
Minor OS version
0
Major OS version
4
Entry point
1327104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptDestroyKey
BCryptFinishHash
BCryptGetProperty
BCryptHashData
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptVerifySignature
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
DeleteDC
DeleteObject
GetStockObject
SelectObject
SetBkMode
kernel32
CloseHandle
CreateFileA
ExitProcess
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStdHandle
GetTickCount
ReadFile
VirtualAlloc
WriteFile
LoadLibraryA
user32
AdjustWindowRect
BeginPaint
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
DrawTextA
EndPaint
FillRect
FrameRect
GetClientRect
GetMessageA
InvalidateRect
IsDialogMessageA
KillTimer
LoadCursorA
LoadIconA
MessageBoxA
PostQuitMessage
RegisterClassA
SendMessageA
SetTimer
ShowWindow
TranslateMessage
UpdateWindow
arm_game_timer
cell_blocked
change_direction
compute_window_size
current_timer_ms
draw_board
draw_cell
draw_center_box
draw_scene_to_dc
eat_bonus
ensure_backbuffer
fill_rect_color
finish_game
generate_obstacles
handle_key
init_game_memory
mainCRTStartup
main_window_proc
make_score_text
maybe_spawn_bonus
paint_double_buffered
place_apple
point_hits_obstacle
point_hits_snake
release_backbuffer
run_game_application
snake_eat_apple
start_new_game
stop_game_timer
u32_to_dec
update_game_step
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.blue
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE