A Weekend with Your Step-Sister Kiara Lord friends.zip
- SHA256 7a7ec8b926cc4fdf38679d38ae99d097be347d6f41144524172f2cdfdb3478d5
Behavioral task
behavioral1
Sample
Play.swf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Play.swf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
flashplayer_25_sa.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
flashplayer_25_sa.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
game.xml
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
game.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target A Weekend with Your Step-Sister Kiara Lord friends.zip
- Size 6.3MB
- Sample260906-g1bpcseq7s
- SHA256 7a7ec8b926cc4fdf38679d38ae99d097be347d6f41144524172f2cdfdb3478d5
- MD5 3eec8ed8a8dca199309880f50c32a8a8
- SHA1 d4065d0fad3b08a0552e1cbbebd8fa57dfeb63da
- SHA512 0e3a2904c520b8d7fe387673c743be682d4aa0ada03d050dc7d6b5846d77eb85bccf52c271301957f03f3f8956248574ae433e69b8a7811573e851f9d79ec0c9
- SSDEEP 196608:zRWPGwTqNBSZr8xEVrLxRvK5JYza1xHvFvlEJGrlAu:zRweWIxG/xE5B/4sKu
- TLSH T15E6633D8CAE994EF280F5B7BF5204B284F80A61E24365797E799590CD27E11387F381B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
File Explorer
-
A Weekend with Your Step-Sister Kiara Lord friends.zip.zip 6.3MB
-
Play.swf40KB
-
flashplayer_25_sa.exe.exe 15.2MB
-
game.xml21KB
Play.swf
- SHA256 beaff3ccc359338fa7daa55b091eb8883071d26ad3b6aa079ab1dd7f3c37309a
- MD5 62c6532371d07dccc3f72ee74eb0e057
- SHA1 542e3b075334676138d2f16027c1b0bf3e97dc90
- SHA512 e033256fa064b73b023ced697173dcfaa8e5a107c49c00be7fdf9520fbefdda46ed45b7b18f9c8e13a819b114821f1b0cc8dddfdc21df1f51b797e6059a29503
- SSDEEP 768:lSb6EVmaPCMWefdIhVvpfKaUhPJvrApoBkThKGU01HBmjqd:lSbOeCtelIDpffUhPJjApoBkhKQQjU
- TLSH T11513F1414098D3998E3C9B1AED9E793141A2CE2832A085329BF117C77F16AC7BBD7951
- MD5 SHA1 SHA512 SSDEEP TLSH
flashplayer_25_sa.exe
- IMPHASH fb7edbaed2049fb3a26bdfb89c534f53
- SHA256 cc81b6555f5bd749d160b8f107d4d24378a9d5b195af47b8575ddc4592214f2e
- MD5 a26468aa4a6f9d1e9fd5aefeabbdd85a
- SHA1 516fd176c0e1f0c16be73e4af576ae0fb41d505a
- SHA512 ad733e50263b5973ca70cf8a106fc14dc13f5bd28b9a2ab783a9ea3ddbc1a5b9d168b6cc01c8b2634d60167df9a7d42ad16f8536a9d6d1f2bea78aa44fc0e1ff
- SSDEEP 393216:jlaq9K51KDC7vq2RwuLOUYmWWXdMhiyYv4N16rra:jlaq9KjwuLOUYmWm4N12O
- TLSH T118F68D23A2424472D45330BEC93ADA9E6168BE25076454CB62D47C2B7673FC3AA3D74F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
67:07:d1:51:a9:15:90:9c:be:a8:60:2d:57:11:22:fd:d4:c2:06:98
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Feb 28, 2017
SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 4, 2014 - Mar 3, 2024
Subject
SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
4e:a1:e8:9e:15:ea:4f:fa:93:79:84:d8:8f:54:5f:ba
Issuer
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 14, 2015 - May 7, 2017
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Apr 11, 2027
Minor OS version
0
Major OS version
5
Entry point
9086018
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
FlashPlayer.pdb
kernel32
ReadFile
SetFilePointer
GetFileSize
CreateFileW
GetModuleFileNameA
GetCommandLineW
SetEndOfFile
WriteFile
CreateFileA
GetFileAttributesA
GetStartupInfoW
GetCommandLineA
ExitProcess
RemoveDirectoryW
CopyFileW
GetModuleFileNameW
GetCPInfo
GetACP
IsDBCSLeadByte
HeapSize
DeviceIoControl
CreateProcessA
GetTempPathA
FindNextFileW
GetSystemWow64DirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GetLongPathNameW
CreateProcessW
GetTempFileNameA
CreateDirectoryA
DeleteFileA
GetFileAttributesW
CreateMutexA
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
MoveFileExW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameW
ExpandEnvironmentStringsW
OutputDebugStringA
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
GetVersionExW
GetCurrentProcess
VirtualQuery
ExitThread
GetUserDefaultLangID
GetUserDefaultUILanguage
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
GlobalAlloc
GlobalUnlock
GlobalLock
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalSize
QueueUserAPC
OpenThread
SleepEx
SetUnhandledExceptionFilter
GetCurrentProcessId
GetProcessTimes
RaiseException
FlushInstructionCache
SetLastError
TerminateThread
CreateEventW
SetEvent
ResetEvent
WaitForMultipleObjects
CreateWaitableTimerW
GetTickCount
SetThreadPriority
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
DebugBreak
GetModuleHandleW
LCMapStringW
GetExitCodeThread
DuplicateHandle
GetCurrentThread
MapViewOfFile
UnmapViewOfFile
CompareFileTime
ReleaseMutex
CreateFileMappingA
ReleaseSemaphore
CreateSemaphoreW
SetThreadAffinityMask
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
GetVersionExA
GetVersion
VirtualAlloc
VirtualFree
FlushFileBuffers
GlobalMemoryStatusEx
IsDebuggerPresent
SetSystemTime
FileTimeToSystemTime
TlsAlloc
TlsFree
ResumeThread
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateSemaphoreA
HeapAlloc
HeapFree
HeapUnlock
HeapWalk
HeapLock
HeapCreate
HeapDestroy
VirtualProtect
GetNumberFormatW
GetCurrencyFormatW
CompareStringW
GetDateFormatW
GetTimeFormatW
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
GetProcessAffinityMask
IsProcessorFeaturePresent
GetStartupInfoA
RtlUnwind
UnhandledExceptionFilter
GetSystemTimeAsFileTime
HeapReAlloc
GetStdHandle
TerminateProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetOEMCP
IsValidCodePage
LCMapStringA
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
LocalAlloc
GlobalMemoryStatus
FlushConsoleInputBuffer
GetProcAddress
WaitForSingleObject
GetExitCodeProcess
CloseHandle
FindFirstFileW
FindClose
GetSystemDirectoryW
LoadLibraryW
GetModuleHandleA
GetTempPathW
GetTempFileNameW
GetLastError
DeleteFileW
CreateDirectoryW
GetSystemInfo
SwitchToThread
TlsGetValue
TlsSetValue
GetCurrentThreadId
LeaveCriticalSection
ReadConsoleInputA
SetConsoleMode
FindFirstFileA
EnterCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InterlockedCompareExchange
GetLocaleInfoW
Sleep
FileTimeToLocalFileTime
GetDriveTypeA
GetFullPathNameA
PeekNamedPipe
GetCurrentDirectoryA
advapi32
CryptEncrypt
CryptDestroyKey
CryptImportKey
CryptSetKeyParam
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptAcquireContextA
CryptCreateHash
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExW
CryptDecrypt
IAEModule_AEModule_PutKernel
IAEModule_IAEKernel_LoadModule
IAEModule_IAEKernel_UnloadModule
_WinMainSandboxed@20
Name
.text
Size
10.0MB
Virtual Size
10.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rodata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
863KB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
489KB
Virtual Size
489KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=150, version=20413,
count=61, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=30, productName=Unmarked objects (old),
count=18, id=137, version=30729,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=460, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=663, id=1, productName=Unmarked objects,
count=12, id=109, productName=VS2005 build 50727, version=50727,
count=433, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=132, productName=VS2008 build 21022, version=21022,
count=1254, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=2, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
game.xml
- SHA256 7dad7399a63524c96fa0e6c3a1c2e892c464ec5c315a41e10cfa28b8fc8d08b1
- MD5 e1ea06e046587007b85cbe21c5db3655
- SHA1 702ab941a7c6a36e97781861bd425b0ad05ead70
- SHA512 8545df470298b6608cac064e906409d83ab00ac2b934e08f1ed5fbf45b5e5cb63b6d7ac742258fdde6f7a8ca279c6d2bbac9570d44bb97c058d2c944089de7aa
- SSDEEP 384:Rw3MYMPMmMf3qhq6qkqd3OxO6OcOts/OGgi6pVcqdB80ACTkknAEHB3/h1hV7:RvQd3
- TLSH T1B5A2E13CF5D54D0B5926805BBE04CFD1228EEB45620AD09CBD8E84EB94DFCD51BEAC68
- MD5 SHA1 SHA512 SSDEEP TLSH