BodysmithTales_0.2.2b (1).zip
- SHA256 019c62fee5550a5177fb458f7b7b4c09731355af073ddc50b583fcd731fa56d1
Static task
static1
1 signatures
General
- Target BodysmithTales_0.2.2b (1).zip
- Size 16.2MB
- Sample260818-sdvdqscq5x
- SHA256 019c62fee5550a5177fb458f7b7b4c09731355af073ddc50b583fcd731fa56d1
- MD5 331f28900ab74041b8f338c140e81a92
- SHA1 b920aba6c2c5b8d9271c6b6043230f959d4353ef
- SHA512 2468e44504d4b67c5a5a393925a4cea06c10d91e68a228a1f0e0a0bf55e19ca5b3d00d18a207bc210753d3a271f455b67ec1ecc1dc4582971c4799026c6b27cd
- SSDEEP 393216:7B1lx35oPBUUj7n2My809S3QBNVwSm8nd5sShdTQOeJt/5NJMthWpvy9:7H35oTWMy809xBTGsLsCeJ95NJMXOY
- TLSH T1B807334020C0A743FDCB28BF3A94E1DBC0257A61D9467876C5D73DA1CABA6DE848F257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/BodysmithTales_0.2.2b/BodysmithTales.exe unpack001/BodysmithTales_0.2.2b/execute_shell_simple_ext_x64.dll
File Explorer
-
BodysmithTales_0.2.2b (1).zip.zip 16.2MB
-
BodysmithTales_0.2.2b/BodysmithTales.exe.exe 19.5MB
-
BodysmithTales_0.2.2b/data.win15.0MB
-
BodysmithTales_0.2.2b/execute_shell_simple_ext_x64.dll.dll 3KB
BodysmithTales_0.2.2b/BodysmithTales.exe
- IMPHASH e04fec3a7dd86b923d15c0ee80b226cb
- SHA256 d65a95d6e8b048eb611c05c3de9c75d0f86715e94132c6264a7d75ad99fcbb96
- MD5 79d1d0894d400b062f52d273346e8539
- SHA1 66516f61c976ae12611aa859252cc7e0ccd67e6e
- SHA512 ac6149ac6f74694077cd09356d842195c7b4dbf46b6612e5abfdfdd0d444e365933f73563af30a21eba73e430edba077c9cc6d5358dbea7c530f4c27dfd767a0
- SSDEEP 196608:TsJGOkZBHK+lbh+FgilyzVMP/Sp54z49vAR/kVGr19f:TsEOkZFK+lbh+FsQRcE
- TLSH T1EF274B243979C6C9C0B6E47CC566C3ABE9203D94C72887FB4570765B2FFA2E09936127
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12833940
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\GM\AssetCache\GMS2CACHE\BodysmithT_55EA1CF5\Release\Scripts\llvm-win\Sln\x64\Release\BodysmithTales.pdb
wininet
InternetReadFile
InternetSetOptionA
InternetCloseHandle
HttpSendRequestA
InternetOpenA
HttpQueryInfoA
InternetConnectA
InternetCanonicalizeUrlA
HttpOpenRequestA
InternetCrackUrlA
InternetGetConnectedState
d3d11
D3D11CreateDevice
dbghelp
MiniDumpWriteDump
winmm
timeGetDevCaps
timeBeginPeriod
joyGetPosEx
joyGetPos
timeGetTime
timeEndPeriod
ws2_32
WSAGetLastError
getaddrinfo
WSAStartup
socket
setsockopt
sendto
send
recvfrom
recv
ntohs
listen
getsockopt
ioctlsocket
connect
closesocket
bind
accept
inet_ntop
getnameinfo
select
getpeername
__WSAFDIsSet
htons
WSAAddressToStringA
freeaddrinfo
inet_pton
gdiplus
GdiplusStartup
GdiplusShutdown
comctl32
InitCommonControlsEx
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
rpcrt4
UuidToStringW
UuidCreate
iphlpapi
NotifyIpInterfaceChange
GetAdaptersAddresses
avrt
AvSetMmThreadPriority
AvSetMmThreadCharacteristicsA
propsys
PropVariantToInt64
PropVariantToUInt32
api-ms-win-core-path-l1-1-0
PathCchCombine
kernel32
FreeLibraryAndExitThread
ExitThread
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
MoveFileExW
SetFileAttributesW
GetFileAttributesExW
HeapWalk
HeapValidate
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
GetStdHandle
RtlUnwind
RtlPcToFileHeader
RtlUnwindEx
GetStringTypeW
GetCPInfo
LCMapStringEx
FlushFileBuffers
GetConsoleOutputCP
DecodePointer
EncodePointer
FlsFree
WriteFile
TlsAlloc
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
FlsSetValue
FlsGetValue
FlsAlloc
OutputDebugStringA
GetCurrentProcess
K32GetProcessMemoryInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CloseHandle
GetLastError
SetWaitableTimer
CreateWaitableTimerW
GetConsoleWindow
GetCommandLineW
ExpandEnvironmentStringsW
CreateDirectoryW
CreateFileW
GetFinalPathNameByHandleW
GetFullPathNameW
SetUnhandledExceptionFilter
SetErrorMode
Sleep
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
SetPriorityClass
SetProcessInformation
GetTimeFormatW
GetModuleHandleW
MoveFileA
HeapReAlloc
WideCharToMultiByte
GetFileAttributesW
GetFileSize
ReadFile
SetFilePointer
FreeLibrary
GetProcAddress
LoadLibraryExW
LocalFree
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
GetTickCount64
InitializeCriticalSection
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
CreateThread
LoadLibraryW
FormatMessageW
GetCurrentDirectoryW
DeleteFileW
SetLastError
GetExitCodeThread
GetSystemInfo
GetVersionExW
GetLocaleInfoW
CreateDirectoryA
FindClose
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetTempPathA
ResumeThread
CreateProcessW
GlobalAlloc
GlobalUnlock
GlobalLock
SetCurrentDirectoryA
GetCurrentDirectoryA
VerSetConditionMask
VerifyVersionInfoW
GetEnvironmentVariableA
SetEnvironmentVariableA
CreateFileMappingW
MapViewOfFile
ExitProcess
lstrlenA
GlobalFree
GetVersion
LoadLibraryA
DebugBreak
WaitForSingleObjectEx
CreateEventExA
SleepConditionVariableSRW
WakeAllConditionVariable
TryEnterCriticalSection
InitializeCriticalSectionEx
GetNativeSystemInfo
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
LoadLibraryExA
VirtualQuery
VirtualProtect
RaiseException
GetDateFormatW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
GetModuleFileNameW
ReadConsoleW
GetTimeZoneInformation
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
EnumSystemLocalesW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetEndOfFile
HeapSize
MultiByteToWideChar
WriteConsoleW
user32
IsClipboardFormatAvailable
GetForegroundWindow
CreateDialogParamW
DialogBoxParamW
EndDialog
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
DrawTextW
GetAsyncKeyState
keybd_event
SetDlgItemTextA
ReleaseDC
GetDC
GetMonitorInfoW
EmptyClipboard
MonitorFromPoint
SetWindowLongPtrW
GetCursorPos
SetCursorPos
MessageBoxW
SetProcessDPIAware
EnumDisplaySettingsA
IsDialogMessageW
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
TranslateMessage
wsprintfW
EnumDisplayDevicesW
EnumDisplaySettingsW
GetClipboardData
SetClipboardData
MonitorFromWindow
LoadImageW
LoadCursorW
OpenClipboard
UnhookWindowsHookEx
SetWindowsHookExW
FindWindowExA
FindWindowA
SetParent
ScreenToClient
SetCursor
AdjustWindowRectEx
GetClientRect
InvalidateRect
SetForegroundWindow
UpdateWindow
GetSystemMetrics
ReleaseCapture
SetCapture
GetKeyState
SetFocus
BringWindowToTop
IsIconic
SetWindowPlacement
SetWindowPos
SetLayeredWindowAttributes
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostThreadMessageW
PostMessageW
SendMessageW
SendMessageA
EnumWindows
GetWindowLongPtrW
IntersectRect
GetWindowRect
GetActiveWindow
IsWindowVisible
GetLayeredWindowAttributes
MessageBoxA
GetWindowLongW
GetWindowPlacement
MapWindowPoints
ClientToScreen
CloseClipboard
SetWindowTextW
CallNextHookEx
MoveWindow
gdi32
SelectObject
GetStockObject
GetRgnBox
DeleteObject
CreateRectRgnIndirect
GetDeviceCaps
CombineRgn
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegQueryValueExW
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegOpenKeyExW
shell32
SHGetFolderPathW
ShellExecuteW
ole32
PropVariantClear
CoInitialize
CoTaskMemFree
CoCreateInstance
CoCreateFreeThreadedMarshaler
dwmapi
DwmSetWindowAttribute
DwmGetWindowAttribute
DwmGetCompositionTimingInfo
imm32
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmAssociateContext
Name
.text
Size
13.6MB
Virtual Size
13.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.0MB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
906KB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
502KB
Virtual Size
502KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
403KB
Virtual Size
403KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=259, version=33145,
count=1, productName=Unmarked objects (old),
count=6, id=253, version=28518,
count=20, id=260, version=30034,
count=12, id=259, version=30034,
count=93, id=261, version=30034,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=221, id=261, version=33145,
count=75, id=260, version=33145,
count=43, id=257, version=33145,
count=397, id=1, productName=Unmarked objects,
count=135, id=260, version=30159,
count=358, id=261, version=30159,
count=1123, id=265, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,
BodysmithTales_0.2.2b/data.win
- SHA256 64a55aba8dc4bb9eb7e56c92ee546f41c9e6f65a4b98024aa22cda6e48a5f3cf
- MD5 9335e3a9354ba1698c949739a4762ee2
- SHA1 f4d6c01455f8ac97eb6d4c73e6eaa832e73ebe91
- SHA512 53d6dab78e73dad1a8797d2febe25f21dba110dffe45fffed7847b75d9f660e92eebb625c1a1b225e0778ca270d7df868c9cc9880fb63acf47b5ac6deaebc3c3
- SSDEEP 393216:GedXQwYkfepf6ZSsPHgMsT4NjU7GxSDqhNP:35xfAiZnsT4NjUqSOhNP
- TLSH T1EBF64AD2F504E982CC555E394E67D9A847323D36FE55861332C0BB4F3AB3292EA31786
- MD5 SHA1 SHA512 SSDEEP TLSH
BodysmithTales_0.2.2b/execute_shell_simple_ext_x64.dll
- IMPHASH 5c605c49a6ec9d9ef6883b5ed2652972
- SHA256 8b793592b52cd7838a2c0ae1ac68acdfa6fedd131a289084f94c5241735197ab
- MD5 2f24b511a02c35b30ed9d7cb4b8a1a10
- SHA1 a485c87f10c6001c76e22d1c5ea2e16dd0084878
- SHA512 40c582dd3c92ba2cb205fed40f8191f84a59db8f3a53a793b430873d2c7995af83b6a0a9b3c377a34b254c310f38a82fddc48e33114fdaa1b06fc16e03091e18
- TLSH T12751E273B770ACB6E95C033D8417C8EF332EB54002175B6F569A910616E2FC9343A6D1
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GetCurrentDirectoryW
shell32
ShellExecuteW
execute_shell_simple_raw_1
execute_shell_simple_raw_2
Name
.text
Size
512B
Virtual Size
363B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=33140,
count=3, id=1, productName=Unmarked objects,
count=3, id=261, version=30156,
count=1, id=256, version=30156,
count=1, id=258, version=30156,