tl2.wasd.and.more.release.gog.v1.0.02z1.zip
- SHA256 59b2bbd759c85e3cff93057754011a61fa1dacd65226a8e04a9081fe067b3710
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tl2.wasd.and.more.release.gog.v1.0.02z1.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
tl2.wasd.and.more.release.gog.v1.0.02z1.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
General
- Target tl2.wasd.and.more.release.gog.v1.0.02z1.zip
- Size 394KB
- Sample260814-tvpegsem9w
- SHA256 59b2bbd759c85e3cff93057754011a61fa1dacd65226a8e04a9081fe067b3710
- MD5 76b8c98380735af1d6b962571117f94d
- SHA1 d8be6fa8fe6912e65c7c8c73d280dea50ffc7423
- SHA512 aa29eb3f7d64b12f8e41ffb5f3d88bb092d9eadd0572acc98d67eb1fb183adbf3234cadd30c764a471725e11a4884a5fe40e0790a43ee5beaf72762a0fe31b75
- SSDEEP 6144:faZTJ3HqXeNsGmvhrPCDzcJ2n9okZimtyZdeHEBTf2RYFEMR44nu:f2nsGor6DjokZ/yQ+fqS44nu
- TLSH T110848D12F691A031C8FE00746256E792863E793017D4ECDFB3940A9E2E751D1AB37B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/release gog v1.0.02z1/MSWSOCK.dll unpack001/release gog v1.0.02z1/TL2TrueKeyboardMove.dll
File Explorer
-
tl2.wasd.and.more.release.gog.v1.0.02z1.zip.zip 394KB
-
release gog v1.0.02z1/MSWSOCK.dll.dll 93KB
-
release gog v1.0.02z1/TL2TrueKeyboardMove.dll.dll 290KB
-
release gog v1.0.02z1/TL2TrueKeyboardMove.ini11KB
release gog v1.0.02z1/MSWSOCK.dll
- IMPHASH 66a87f219b8d87e4741f9c0959111031
- SHA256 22c240c4698aeeb1a2b86f5308d1a6928c91036c335d87d0fe5ec9af28c1cd18
- MD5 e2bbe8fa37869ce591ad299e31d0ead1
- SHA1 c7a3e7c028ab602ddd9010f9667e9ea5fdb94713
- SHA512 a3c2cf2e15b834bcf4c3791b6ffceec585e01ebcd302b5553e503f5d6cf2635ea0ef9b89ec6dec09be6c186c87770b822f949e92f59b37b8f9c4480dfbb2e320
- SSDEEP 1536:zn7k/2prtXVxvnpCMjrx8w3vzyeNlXQfPSbHbdX+gLzisWm7cdw0hx0zbPt3L4G:+2ZxvpCMJ3vfFQfPSMCmwbPNL4G
- TLSH T19E937C10B4D1D079D5BE08395864EAB15B3D7820DFA59DEB37A507AE0F742C0DE32E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\CODEX SPACE\Torchlight 2\TL2_WASD_and_more_versions\v1.0.02z1 GOG port source\source\dist\mswsockproxy\MSWSOCK.pdb
kernel32
VirtualProtect
GetCurrentProcess
WriteFile
GetPrivateProfileIntW
GetModuleFileNameW
lstrlenA
CreateFileW
GetSystemDirectoryW
Sleep
DisableThreadLibraryCalls
CloseHandle
LoadLibraryW
CreateThread
GetProcAddress
GetModuleHandleW
FlushInstructionCache
WriteConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
DecodePointer
user32
wsprintfA
AcceptEx
EnumProtocolsA
EnumProtocolsW
GetAcceptExSockaddrs
GetAddressByNameA
GetAddressByNameW
GetNameByTypeA
GetNameByTypeW
GetServiceA
GetServiceW
GetSocketErrorMessageW
GetTypeByNameA
GetTypeByNameW
MigrateWinsockConfiguration
MigrateWinsockConfigurationEx
NPLoadNameSpaces
NSPStartup
SetServiceA
SetServiceW
StartWsdpService
StopWsdpService
Tcpip4_WSHAddressToString
Tcpip4_WSHEnumProtocols
Tcpip4_WSHGetBroadcastSockaddr
Tcpip4_WSHGetProviderGuid
Tcpip4_WSHGetSockaddrType
Tcpip4_WSHGetSocketInformation
Tcpip4_WSHGetWSAProtocolInfo
Tcpip4_WSHGetWildcardSockaddr
Tcpip4_WSHGetWinsockMapping
Tcpip4_WSHIoctl
Tcpip4_WSHJoinLeaf
Tcpip4_WSHNotify
Tcpip4_WSHOpenSocket
Tcpip4_WSHOpenSocket2
Tcpip4_WSHSetSocketInformation
Tcpip4_WSHStringToAddress
Tcpip6_WSHAddressToString
Tcpip6_WSHEnumProtocols
Tcpip6_WSHGetProviderGuid
Tcpip6_WSHGetSockaddrType
Tcpip6_WSHGetSocketInformation
Tcpip6_WSHGetWSAProtocolInfo
Tcpip6_WSHGetWildcardSockaddr
Tcpip6_WSHGetWinsockMapping
Tcpip6_WSHIoctl
Tcpip6_WSHJoinLeaf
Tcpip6_WSHNotify
Tcpip6_WSHOpenSocket
Tcpip6_WSHOpenSocket2
Tcpip6_WSHSetSocketInformation
Tcpip6_WSHStringToAddress
TransmitFile
WSARecvEx
WSPStartup
dn_expand
getnetbyname
inet_network
rcmd
rexec
rresvport
s_perror
sethostname
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33145,
count=137, id=261, version=33145,
count=19, id=260, version=33145,
count=20, id=259, version=35207,
count=15, id=260, version=35207,
count=30, id=261, version=35207,
count=5, id=257, version=33145,
count=97, id=1, productName=Unmarked objects,
count=1, id=265, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
release gog v1.0.02z1/TL2TrueKeyboardMove.dll
- IMPHASH 9110869e984fd6d678a622787db5d4cf
- SHA256 0e3c8b78f45a0aab693d5989987d260e2bf063f2f8338db90c622742d3902845
- MD5 ed660e88742e7d6c7116a962f0f6ab99
- SHA1 ee91587809f70f1199f0b318c30073109275d300
- SHA512 a948520c1c63a7bbaecb05fa544a3ff58bf368443297ca529e03426b8bb1625403d41456048cc1bc2ffcdd30ac980f9577c977d02279f85cb6f09234401177bc
- SSDEEP 6144:ivhrPCDzcJ2n9okZimtyZdeHEBTf2RYFEMR44n:cr6DjokZ/yQ+fqS44n
- TLSH T1F0545B22F652A031D8AE00747256E393857E797017C4ECDBE3E0099E3A751D1A73BB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
120841
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\CODEX SPACE\Torchlight 2\TL2_WASD_and_more_versions\v1.0.02z1 GOG port source\source\dist\TL2TrueKeyboardMove.pdb
user32
BeginPaint
GetWindowLongW
GetWindowThreadProcessId
DefWindowProcW
SetPropA
CallWindowProcW
PostMessageW
GetWindow
DispatchMessageA
GetWindowRect
GetDC
IsWindowVisible
SetWindowPos
MonitorFromWindow
FillRect
GetSystemMetrics
wsprintfA
ShowWindow
IsWindow
GetAsyncKeyState
MapVirtualKeyExW
DrawTextA
GetMonitorInfoW
ClientToScreen
GetKeyboardLayout
GetForegroundWindow
GetPropA
EnumWindows
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
LoadCursorW
wsprintfW
SetWindowLongW
GetClientRect
PeekMessageA
CharUpperBuffW
RegisterClassExA
InvalidateRect
GetAncestor
IsIconic
ReleaseDC
EndPaint
kernel32
GetProcessHeap
LCMapStringW
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStdHandle
HeapAlloc
HeapFree
ReadFile
CompareFileTime
WritePrivateProfileStringW
VirtualProtect
SetLastError
VirtualFree
GetCurrentProcess
GetStringTypeW
WriteFile
lstrcpynW
GetPrivateProfileIntW
VirtualAlloc
GetModuleFileNameW
SetFilePointer
GetEnvironmentVariableW
lstrlenA
GetLocaleInfoW
CreateFileW
GetCurrentThreadId
lstrcmpA
MultiByteToWideChar
GetPrivateProfileStringW
Sleep
GetLastError
GetFileAttributesExW
ReleaseSRWLockExclusive
DisableThreadLibraryCalls
AcquireSRWLockExclusive
CloseHandle
ReleaseSRWLockShared
LoadLibraryW
CreateThread
GetProcAddress
AcquireSRWLockShared
GetFileSize
lstrcpynA
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
WideCharToMultiByte
lstrcmpiW
GetTickCount
WriteConsoleW
GetProcessHandleCount
MulDiv
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
lstrlenW
lstrcmpW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
gdi32
BitBlt
CreateCompatibleBitmap
CreateFontA
SelectObject
CreateDIBSection
CreateCompatibleDC
GdiFlush
DeleteDC
SetTextColor
SetBkMode
DeleteObject
CreateSolidBrush
Name
.text
Size
199KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=259, version=33145,
count=138, id=261, version=33145,
count=19, id=260, version=33145,
count=21, id=259, version=35207,
count=15, id=260, version=35207,
count=30, id=261, version=35207,
count=7, id=257, version=33145,
count=174, id=1, productName=Unmarked objects,
count=1, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
release gog v1.0.02z1/TL2TrueKeyboardMove.ini
- SHA256 416d35738e3843ef38857a99452caf80556e1e2006fae759ca40ad177e546165
- MD5 64d72cec270e3586d5e419c486a82a6c
- SHA1 a22989e80b3912294933d5521b40c2276d574554
- SHA512 3a61adc32eabc8be585d95c5957b0f47e844c7bb30a3b6440d0c5cd310891ae7b6c33a7c7d946a196c71fd14a1265af314a0c503c1560719b7a74a5739d4d69a
- SSDEEP 192:0c+0jjm3WrMgJzCEf57JlcYS6kXof5nuBrDvWwEuT4n50nxmp+ScA16gl4aqa:0b0jjeWrnCEf5FlcTX45utD+wEuTMax2
- TLSH T1EB322AE6B39927B64BE38027959F62D54B2A9180563450ADF84D894D30DF0A9C3BBEF0
- MD5 SHA1 SHA512 SSDEEP TLSH