SOTDQ 0.5.3.5 (WINDOWS).zip
- SHA256 ac9c737450a2dcda4ca50771d4eabe9f8a7c7397f961cd337c80097975596f3c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SOTDQ 0.5.3.5 (WINDOWS).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral2
Sample
SOTDQ 0.5.3.5 (WINDOWS).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
General
- Target SOTDQ 0.5.3.5 (WINDOWS).zip
- Size 390.6MB
- Sample260827-b4actaydrc
- SHA256 ac9c737450a2dcda4ca50771d4eabe9f8a7c7397f961cd337c80097975596f3c
- MD5 ca9f3026a961413e72292652ecebd4bb
- SHA1 86c3c2b77e884cdf2a9e43f43f2d36f7eb296454
- SHA512 77e302abd1234329da29316cd605289304557e9819ecf21e1078481359656b6307dfbeacc56e00cfcf6beb53863e8c8c467cdc8bc24eae9f7942a0f9af7f9be8
- SSDEEP 6291456:dvDYm1CCQVcbdIU4dA1MMcEU9fGXKGUq7f+LzheVTOvX2isLkIG8cynC8T7SWeuU:d3kVcCfAK4fYzheBqsiSC8TmWjU
- TLSH T1B31933E1097B01514A93B853BBDEE780255080A6915DFF76F3A397B833A3AC0F23E595
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/SOTDQ 0.5.3.5 (WINDOWS).exe
File Explorer
-
SOTDQ 0.5.3.5 (WINDOWS).zip.zip 390.6MB
-
SOTDQ 0.5.3.5 (WINDOWS).exe.exe 58.6MB
-
SOTDQ 0.5.3.5 (WINDOWS).pck400.9MB
SOTDQ 0.5.3.5 (WINDOWS).exe
- IMPHASH abdfe9c0642a3afad7fcc0b89d35b8a8
- SHA256 26b24b820ed46191b09e9af54a4f19fe0fff91a3c3efee1bab0daffdff04818b
- MD5 97c7287dd3fc34de8d97953ead5c43d5
- SHA1 25a973b86991652c52c295815f8d7ff5dd04908e
- SHA512 3a7dadf1d28c142f9a0943f5c527838cb2023b015a62c6b2d37e29e7b10015057410a59e0d8561570408a7abaa0339a7549a74dbf795d8ae96c30275899910d3
- SSDEEP 393216:2+AOfBE0EXYCLXd7AubZV8OXm3I+cQthY0UlbFWBOIKt5/yNTeyvydDMORu3Qd9E:21OnCbdCFtvROryPT
- TLSH T120D78DABA1E451E9D5A7D175970FB01BE372780A53306AEF257082183FB36F45D3EA80
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ac:11:e6:c4:29:04:d2:3f:b7:22:a5:99:0b:d3:18:94:c1:3e:9f:bd:a1:6e:82:88:5a:8c:c4:92:dc:c6:3f:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Seduction Of The Demon Queen
Chains
Aug 7, 2026
CN=Seduction Of The Demon Queen
Subject
CN=Seduction Of The Demon Queen
Serial Number
7f:cf:25:d7:67:23:98:b0:45:03:62:22:6a:26:ca:d9
Issuer
CN=Seduction Of The Demon Queen
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 9, 2025 - Mar 9, 2030
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
45463504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winmm
timeBeginPeriod
timeEndPeriod
midiInGetNumDevs
midiInGetDevCapsA
midiInGetErrorTextA
midiInOpen
midiInClose
midiInStart
midiInStop
kernel32
LCIDToLocaleName
GetLocaleInfoEx
LoadLibraryA
GetLocaleInfoW
WriteFile
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
IsValidCodePage
GetCurrentThreadId
GetCurrentThread
SetLastError
OutputDebugStringA
K32GetPerformanceInfo
SetConsoleOutputCP
HeapQueryInformation
HeapSize
HeapReAlloc
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetCommandLineA
SetEndOfFile
MoveFileExW
RemoveDirectoryW
FreeLibraryAndExitThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
GetModuleHandleExW
ExitProcess
GetFileType
InitializeCriticalSectionAndSpinCount
RtlUnwind
RtlUnwindEx
InterlockedPushEntrySList
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCPInfo
GetStringTypeW
GetModuleHandleW
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
InitOnceComplete
InitOnceBeginInitialize
AcquireSRWLockShared
ReleaseSRWLockShared
GetNativeSystemInfo
lstrlenW
WaitForSingleObjectEx
RaiseException
RtlPcToFileHeader
SleepConditionVariableSRW
WakeConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetACP
CreateNamedPipeW
ConnectNamedPipe
SetFileAttributesW
CreateSymbolicLinkW
ReplaceFileW
GetVolumeInformationW
GetTempFileNameW
GetLogicalDrives
GetFinalPathNameByHandleW
GetDiskFreeSpaceExA
FindFirstFileExW
DeleteFileW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetTickCount64
GetProcessHeap
HeapFree
HeapAlloc
CreateMutexA
SetConsoleCP
SetConsoleCtrlHandler
SetConsoleMode
AttachConsole
GetUserDefaultUILanguage
MultiByteToWideChar
GetTimeZoneInformation
SystemTimeToFileTime
FormatMessageW
LoadLibraryExW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
FreeLibrary
GetLocalTime
GetSystemTimeAsFileTime
GetSystemTime
OpenProcess
CreateProcessW
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
PowerClearRequest
ReleaseMutex
CreateEventA
ResetEvent
SetEvent
SleepConditionVariableCS
WakeAllConditionVariable
InitializeConditionVariable
SetThreadAffinityMask
SetThreadIdealProcessor
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcess
Sleep
WaitForSingleObject
QueryPerformanceFrequency
CreateThread
QueryPerformanceCounter
CreatePipe
GetLastError
SetHandleInformation
CloseHandle
ReadFile
PowerSetRequest
PowerCreateRequest
GlobalLock
GlobalUnlock
GlobalSize
LoadLibraryW
SetPriorityClass
FindFirstFileW
CompareStringOrdinal
FindClose
CompareFileTime
SetEnvironmentVariableW
GetEnvironmentVariableW
SetStdHandle
GetStdHandle
WideCharToMultiByte
LocalFree
GlobalAlloc
GetExitCodeThread
SetThreadPriority
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SwitchToThread
GetSystemInfo
GetLargePageMinimum
VirtualFree
VirtualAlloc
DeleteCriticalSection
FindNextFileW
GetFileAttributesW
GetFullPathNameW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetOEMCP
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
PropVariantClear
CoTaskMemFree
CoTaskMemAlloc
oleaut32
SysFreeString
VariantInit
SysAllocString
user32
MessageBoxW
ActivateKeyboardLayout
ToUnicodeEx
GetKeyboardLayoutList
UnregisterClassW
RegisterClassW
GetMenuItemRect
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
SetMenuInfo
TrackPopupMenuEx
RemoveMenu
GetMenuItemCount
DestroyMenu
CreatePopupMenu
PostMessageA
GetRawInputDeviceList
GetRawInputDeviceInfoA
RegisterRawInputDevices
GetRawInputData
IsProcessDPIAware
EnumDisplayMonitors
GetMonitorInfoW
GetMonitorInfoA
MonitorFromWindow
SystemParametersInfoA
DisplayConfigGetDeviceInfo
QueryDisplayConfig
GetDisplayConfigBufferSizes
EnumDisplaySettingsW
CreateIconIndirect
CreateIconFromResource
DestroyIcon
LoadIconA
LoadCursorA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowLongPtrW
SetWindowLongPtrA
GetWindowLongPtrW
GetWindowLongPtrA
OffsetRect
FillRect
ClipCursor
WindowFromPoint
ScreenToClient
ClientToScreen
SetCaretPos
DestroyCaret
CreateCaret
GetCursorPos
SetCursor
SetCursorPos
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SetWindowRgn
GetUpdateRect
ReleaseDC
GetWindowDC
GetDCEx
GetDC
AllowSetForegroundWindow
SetForegroundWindow
GetForegroundWindow
DrawTextW
GetSystemMetrics
KillTimer
SetTimer
ReleaseCapture
SetCapture
MapVirtualKeyExA
MapVirtualKeyA
RegisterTouchWindow
CloseTouchInputHandle
GetTouchInputInfo
GetKeyboardState
GetAsyncKeyState
GetKeyState
SetFocus
IsClipboardFormatAvailable
EmptyClipboard
RegisterClipboardFormatA
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
GetDlgItem
EndDialog
DialogBoxIndirectParamW
IsZoomed
IsIconic
IsWindowVisible
SetWindowPos
MoveWindow
FlashWindowEx
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
GetDoubleClickTime
CallWindowProcW
DefWindowProcW
SendMessageW
SendMessageA
GetMessageExtraInfo
GetMessageTime
PeekMessageW
DispatchMessageW
TranslateMessage
TrackMouseEvent
GetKeyboardLayout
gdi32
SelectObject
Rectangle
GetTextExtentPoint32W
SetDIBitsToDevice
GetPixel
GetDIBits
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
BitBlt
CreateDIBSection
CreatePolygonRgn
SetPixelFormat
SwapBuffers
GetStockObject
ChoosePixelFormat
shlwapi
ord219
shell32
CommandLineToArgvW
ShellExecuteW
SHFileOperationW
SHGetKnownFolderPath
SetCurrentProcessExplicitAppUserModelID
SHCreateItemFromParsingName
Shell_NotifyIconGetRect
Shell_NotifyIconW
SHGetPropertyStoreForWindow
DragAcceptFiles
DragQueryFileW
advapi32
RegEnumKeyExW
AdjustTokenPrivileges
RegEnumValueW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
LookupPrivilegeValueW
GetCurrentHwProfileA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
OpenProcessToken
RegSetValueExW
RegGetValueW
dinput8
DirectInput8Create
imm32
ImmGetContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
bcrypt
BCryptGenRandom
crypt32
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CryptBinaryToStringA
CertOpenSystemStoreA
avrt
AvSetMmThreadPriority
AvSetMmThreadCharacteristicsW
dwmapi
DwmGetWindowAttribute
DwmIsCompositionEnabled
DwmSetWindowAttribute
DwmEnableBlurBehindWindow
dwrite
DWriteCreateFactory
iphlpapi
GetBestInterfaceEx
GetAdaptersAddresses
wsock32
htonl
htons
ntohl
ntohs
closesocket
getsockname
send
bind
ioctlsocket
sendto
setsockopt
socket
WSAGetLastError
connect
recv
select
__WSAFDIsSet
accept
inet_ntoa
listen
recvfrom
WSAStartup
WSACleanup
ws2_32
WSAConnect
getnameinfo
freeaddrinfo
getaddrinfo
inet_pton
ntdll
NtQueryInformationFile
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
Name
.text
Size
43.7MB
Virtual Size
43.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11.9MB
Virtual Size
11.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1011KB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
pck
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
118KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
328KB
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=259, version=33140,
count=2, id=253, version=35207,
count=19, id=260, version=35207,
count=14, id=259, version=35207,
count=101, id=261, version=35207,
count=329, id=260, version=35213,
count=210, id=261, version=33140,
count=107, id=260, version=33140,
count=3, id=262, version=33140,
count=41, id=257, version=33140,
count=460, id=1, productName=Unmarked objects,
count=1327, id=261, version=35213,
count=1, id=256, version=35213,
count=1, id=255, version=35213,
count=1, id=258, version=35213,
SOTDQ 0.5.3.5 (WINDOWS).pck
- SHA256 0e3465b2cf338a883b82a54e297baae4848b4fe7738b8f52e17c8530674f1c22
- MD5 69539e47a7d9bb542c121bdb2dec0ff4
- SHA1 31bfd2e9dd5818a688f03ac90c468da6fa83c40a
- SHA512 5d5bde879764e4c7364aefaf1927ad33abd6eeab0c1fe47e257974734ec055ca94a590a23272a7d36b3a71e73f85e420a01557c21874de2dde0e2e9ec41d44c9
- SSDEEP 6291456:z84aGgn0t2r79u4FtpMtXcdI1Kt5TZz1DUA1RRmiEv6nJsc/:A0Nt6ugpMtXcgKt5TZSuRQiEmJsu
- TLSH T151191242B301D8A2F4062B368DA2D7E1D732BD56AF1297F7B054BB2E3DB32C16B11585
- MD5 SHA1 SHA512 SSDEEP TLSH