CPSE_v0.6.1-alpha.1.zip
- SHA256 5868d955d4fa53009d8adee2402afa44bf81f9034a7061188d35743bc829de31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
save_editor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
save_editor.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target CPSE_v0.6.1-alpha.1.zip
- Size 2.3MB
- Sample260906-w2dbxacf72
- SHA256 5868d955d4fa53009d8adee2402afa44bf81f9034a7061188d35743bc829de31
- MD5 08dda65f2a7a9db4bb5e07b1781d4abc
- SHA1 5eb5104412a1af561951cf751fa91c704c7a414b
- SHA512 a30ff7193bba2708bfbde0c480cdb26b6225551dc0e829c32991af54eb4bc8a5255b2d2927aaf2cf868bed698468a6a36efb32e329fb025903670b6dd565bc1f
- SSDEEP 49152:IXGXiufJ27aXJfFZEyUC9vx2lMXwdpWYBrPX:I2jfI7ax2Cr2qEpBBL
- TLSH T187B533A359123BCCB88B072B9BF548D25360AE388667038D86F8DCD59C5E24B53F964D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/save_editor.exe
File Explorer
-
CPSE_v0.6.1-alpha.1.zip.zip 2.3MB
-
db/CEnums.json340KB
-
db/CFacts.json588KB
-
db/CObjectBPs.json5.9MB
-
db/TweakDBIDs.json3.1MB
-
db/internal_names.txt783KB
-
save_editor.exe.exe 2.0MB
db/CEnums.json
- SHA256 6dac3bd179dabc31a3446b7f50dcdc8f555f52cb2577488009cfbd9a269aafb2
- MD5 8e20110a5b977c05a7f349d38890a862
- SHA1 cd688333823efb2a17241a3d0bbfdab5ebb78abd
- SHA512 f6209d71ec1bfe1a7f77a18851ae19216e9e89592208143cb61b5f7ec9307d39742b304a119321614303866a12ee3e1522fda791fc74eff459cbff12640dd6d6
- SSDEEP 6144:oxIU0lxPdf8jQ0we30TgpjH6S+StWE5umq5JglKcxwjMwZ:nvetWEk9bglwM4
- TLSH T1D2746073FB10CE3915BA47286CA98D02F62017FF96910D9F3476825C1F3B9261AA772D
- MD5 SHA1 SHA512 SSDEEP TLSH
db/CFacts.json
- SHA256 5e13642ee05855bd426b7d042dc6d37f3821ceace3d111b8e1481de3b26a9dd0
- MD5 258e63551d3204fd20d1e64016887a60
- SHA1 729693d40f36430f7ab93e246b88b7edba9a750f
- SHA512 668fd5e3a5fad01bf5249531be59ee4ebadd16c74f72a67c1f7ef04906c45ce345073da73d0929cf5188fcc58c497768fa58af325a006baa7e6c4549f68f5d66
- SSDEEP 6144:SojMSVJGjsIXa5ED26/MJezpx2743hGrgsxbD7DiVpM6RvSYZ9lH1uexCJKHgY5H:SJYUjEbD7DiVpM6RvSYZ9Tuc6DJM
- TLSH T147D4403B5564C42948B5A29B92EAF6427518DFFFD7F00E8FF273964C1210A90362B7C9
- MD5 SHA1 SHA512 SSDEEP TLSH
db/CObjectBPs.json
- SHA256 10043a818a89f45c451f3d0bf7173df9f514962c32cb4f668f8477cca6ecffde
- MD5 7f5c63105816454ace02293373e5c3a6
- SHA1 720785f45822a8c3e3be34638b1b89ab58afe401
- SHA512 06e32dd98d77d40d815adbc24bf79d3a6b6dadf304183112002286be7c4ef12b0444e0be8384891241dfe93b154de3e17d6ed873d50d906c337305d84cf9fcd9
- SSDEEP 49152:DdAQdddMaojUHqNZfTOj8zT/gpnv4nStyjRP5fFEp3y5Fn5BGoc54bR:M
- TLSH T1EE567F76E9A44C1B0B7E23A5AE694722F511036B42865E0F3AFD9C7C2FF6C967501F08
- MD5 SHA1 SHA512 SSDEEP TLSH
db/TweakDBIDs.json
- SHA256 20541fb7a5b4d10ebc8f7b87fdac1b659d7ba99cccad9a11f82dec0059b4ef94
- MD5 3a95182a5f53a58cea15f1b1c968a669
- SHA1 fd7b568b607ad9fb8bbfcc3d4a48b54fa5fe012f
- SHA512 73dc6b0c56264a2a8c803bb353625b72aac6db81342f189b38bb7e21ea2e546986a7e9b674a88872d4f73ee3c34c27e04eabe29c20bd401fdd76b0ec833e906d
- SSDEEP 49152:psm85RTL7uPeeWtyxmA74YhTpGY4Aj203ZzD5oZjiGY4Aj203jJ53K3RAMa6iZon:pPeeWtuhTB07tmo
- TLSH T10DE5E63F4591D532C4F35569A4E78682BC280F9FCA772D27BA3B144CB35A02A25E3F19
- MD5 SHA1 SHA512 SSDEEP TLSH
db/internal_names.txt
- SHA256 305ac8fcc8b66b24a1b499a3490db7fdd7cd5be51c82c33b2fd2be9b02c5859e
- MD5 45526596104d1f9d94ff8067c4b33c55
- SHA1 0cc6204ce5256343d53ac17ab175526a2981607b
- SHA512 e7ce8371333a34c784312fa107440153eb364bf8e468165d619ce56e2e7465614948fcdf5225a3e2961996c85462495e715559205742a2be9bb3b339277ecb6d
- SSDEEP 12288:p+yXjKv5vzqI1315zVaM2pPrURD0O7SrK+7LnJrZQd3TW9QC9Dk+L:p+f5bqA315zVaM2pPruYQ3TW9QC9Dk+L
- TLSH T19D050739B755D557ADFB6147D0E16592F4BAC2832C1F14146AC64C8C328BABC2B2BF0B
- MD5 SHA1 SHA512 SSDEEP TLSH
save_editor.exe
- IMPHASH df77a7513ae28b8f8a1e03d60b03094d
- SHA256 b7c255b0317d33449f4981b6140a9fb905cf013f12bd773d8952301d7a1384a5
- MD5 15bbb4bea5e37553c2ff134b5936249d
- SHA1 653257a4093cc122e1005dfc47a6b05b2b0b9184
- SHA512 19fe8344d4fa1ad1a38238f733169d24ee82af9253057714066c548c63ca736b6ab6a133a4f240d5fca9440105d5513b90574891193704fc6b715f83eb00f776
- SSDEEP 49152:TL3dwrKz3G3KuLP8n2CoO/DmAH0modZnDi9ECeX:k/CtDtG
- TLSH T17BA58D1AB2A801F8D0B7D17C895BAA4BEB71341903219BDF13E046591FB76F19EBE311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1406700
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Desktop\cpsavedit\CyberpunkSaveEditor\bin\Release\save_editor.pdb
kernel32
GetCurrentThreadId
Sleep
GetConsoleMode
GetDynamicTimeZoneInformation
GetCurrentProcessId
GetDriveTypeA
WriteFile
SetEndOfFile
WriteConsoleW
HeapSize
WriteConsoleA
GetStdHandle
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetLastError
GetLogicalDrives
FormatMessageW
GetModuleHandleW
QueryPerformanceFrequency
GetProcAddress
QueryPerformanceCounter
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
CloseHandle
DeviceIoControl
CopyFileW
MoveFileExW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
LocalFree
FormatMessageA
GetLocaleInfoEx
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
InitializeSRWLock
WaitForSingleObjectEx
GetExitCodeThread
RtlPcToFileHeader
RaiseException
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
ReadFile
ExitProcess
GetModuleFileNameW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleOutputCP
ReadConsoleW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
user32
TranslateMessage
PeekMessageW
DispatchMessageW
ShowWindow
RegisterClassExW
UnregisterClassW
CreateWindowExW
MessageBoxW
DestroyWindow
DefWindowProcW
GetCursorPos
SetCursorPos
ReleaseCapture
PostQuitMessage
GetClientRect
SetCursor
UpdateWindow
LoadCursorW
GetForegroundWindow
IsChild
ClientToScreen
GetCapture
ScreenToClient
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
MessageBoxA
SetCapture
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
shell32
DragAcceptFiles
DragQueryFileW
SHGetKnownFolderPath
ole32
CoTaskMemFree
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
356KB
Virtual Size
355KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
59KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=259, version=30795,
count=185, id=261, version=30795,
count=27, id=260, version=30795,
count=17, id=260, version=32420,
count=107, id=261, version=32420,
count=12, id=259, version=32420,
count=1, id=262, version=30795,
count=17, id=257, version=30795,
count=223, id=1, productName=Unmarked objects,
count=23, id=265, version=32545,
count=1, id=255, version=32545,
count=1, id=258, version=32545,