Noelle game.zip
- SHA256 f47715edadb7cb981fc2b63c9625c9e683fa637f4764fa3d2607c07572b4d14a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Noelle game.zip
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
data.win
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
holiday.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
mus_girl_next_door.ogg
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
mus_noelle_happy.ogg
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
mus_noelle_house.ogg
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
options.ini
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target Noelle game.zip
- Size 4.2MB
- Sample260910-d15ewsfa73
- SHA256 f47715edadb7cb981fc2b63c9625c9e683fa637f4764fa3d2607c07572b4d14a
- MD5 cf459d75b03ec24390718b8730732dd9
- SHA1 ae5c52027a180b3cdedb05686d2e6ca1d55d2bf6
- SHA512 0373a564f382fbac7e619f8ff086f2059cd4e7a9546cb85c00958c16b31aab461eaba14bbb97e3f522e9d2ff0ab22d459112db5be10ed30b9163179aa6068249
- SSDEEP 98304:cCfnltG8qLWmtk1Z8WGnn80oQJRmXjtvc7v6XF6dWc4+v:1ttEKeW/moviCVcWc4W
- TLSH T1131633412A8B8C05B6DC879CF4C32C12776558D4CEB6CDADDFA32310B296AE752B79C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/holiday.exe
File Explorer
-
Noelle game.zip.zip 4.2MB
-
data.win668KB
-
holiday.exe.exe 7.6MB
-
mus_girl_next_door.ogg172KB
-
mus_noelle_happy.ogg183KB
-
mus_noelle_house.ogg309KB
-
options.ini26B
data.win
- SHA256 0442943e2e8d339494e582f57642133eaea8b5db51678eb298b12dcfce9cb16a
- MD5 118b85fb3bb911f1e4e05ba9c33748b4
- SHA1 7cc3ffa45cf83718a4b41edcaf6c2f63f973dc5b
- SHA512 d0f2a1e16e1798c553bba21ab1cac68ee858b6644a980b40fc86c59c5ac9bffd764ee65035c8fd642059da799ddfd0cb60b335b98867eca7a9454d9550c7100b
- SSDEEP 12288:WYn6ruhpgyIGGzP5Bg84RbOMHiWbfBa7JA/pryogKYbaXj9Dq:WIyGK31CfU7JA8ogK/U
- TLSH T1C9E4BE4336D1CABAC029B235CC9B4B6A7331BE95BE46476779D07B1C5DB93608D0228F
- MD5 SHA1 SHA512 SSDEEP TLSH
holiday.exe
- IMPHASH 83d57b956a5bade45030cf18da8dd06b
- SHA256 056555487d72b14c165854aa677b8e7f99adc58cc7313d1f08c4d90105e162e9
- MD5 a382259b59af72a6633833d6aa664a40
- SHA1 5e6047448b0633b3f1ceaa30b4826f5fd14239fa
- SHA512 928176449fdeb492811eaf123ba996ee0335ff3c0877c2a8b587bc872af6546772440ed893f015536bc7ff8e6db7550370067ee1d87fe2096944a8d6f52d21e3
- SSDEEP 98304:5NxLl4ACJKmjtXdpHHC0kWFOXMbYtovv9:5NxLCA0hfHHC0kWcXWYtSv9
- TLSH T167866B8672A0C1DDD1678039C19666F7E2723C44CF5087DB6AA07F2D3F73AD449BAA12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4927936
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\GameMaker\GameMaker\GameMaker\Runner\GMS2-Runner-Main\VC_Runner\x64\Release-Zeus\Runner.pdb
rpcrt4
UuidCreate
UuidToStringW
wininet
InternetCrackUrlA
InternetSetOptionA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile
InternetCanonicalizeUrlA
HttpOpenRequestA
HttpQueryInfoA
InternetOpenA
InternetGetConnectedState
d3d11
D3D11CreateDevice
dbghelp
MiniDumpWriteDump
winmm
joyGetPosEx
joyGetPos
timeGetTime
timeGetDevCaps
timeEndPeriod
timeBeginPeriod
ws2_32
listen
bind
getaddrinfo
WSAStartup
WSAAddressToStringA
send
socket
ntohs
connect
recvfrom
recv
getsockopt
freeaddrinfo
sendto
ioctlsocket
setsockopt
WSAGetLastError
__WSAFDIsSet
select
getpeername
inet_ntop
getnameinfo
htons
closesocket
accept
inet_pton
gdiplus
GdiplusStartup
GdiplusShutdown
comctl32
InitCommonControlsEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
avrt
AvSetMmThreadCharacteristicsA
AvSetMmThreadPriority
propsys
PropVariantToUInt32
PropVariantToInt64
iphlpapi
GetAdaptersAddresses
NotifyIpInterfaceChange
api-ms-win-core-path-l1-1-0
PathCchCombine
kernel32
GetStdHandle
FreeLibraryAndExitThread
ExitThread
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
MoveFileExW
SetFileAttributesW
GetFileAttributesExW
GetModuleHandleExW
HeapWalk
HeapValidate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
WriteFile
RtlPcToFileHeader
RtlUnwindEx
GetProcessHeap
HeapFree
HeapAlloc
TerminateProcess
InitializeSListHead
EnumSystemLocalesW
SetFilePointerEx
IsProcessorFeaturePresent
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
GetConsoleMode
ReadConsoleW
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
SetStdHandle
RtlUnwind
RtlVirtualUnwind
RtlLookupFunctionEntry
FormatMessageW
GetLastError
LoadLibraryW
GetProcAddress
LocalFree
MultiByteToWideChar
FreeLibrary
WideCharToMultiByte
LoadLibraryA
OutputDebugStringA
SetWaitableTimer
CreateWaitableTimerW
CloseHandle
GetConsoleWindow
SetLastError
GetFullPathNameW
GetFileAttributesW
GetExitCodeThread
DeleteFileW
CreateThread
GetCurrentDirectoryW
GetModuleHandleW
ReadFile
SetFilePointer
CreateFileW
GetFileSize
FormatMessageA
LoadLibraryExW
CreateDirectoryW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetModuleFileNameW
FindClose
ResumeThread
GetTempPathA
CreateProcessW
GetTimeZoneInformation
WaitForSingleObject
GetTickCount64
QueryPerformanceFrequency
QueryPerformanceCounter
GetTimeFormatW
K32GetProcessMemoryInfo
GetCurrentDirectoryA
SetCurrentDirectoryA
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocaleInfoW
GetVersionExW
GetSystemInfo
Sleep
VerSetConditionMask
VerifyVersionInfoW
GlobalFree
GetCurrentProcessId
DebugBreak
GetEnvironmentVariableA
ExitProcess
lstrlenA
GetVersion
SetEnvironmentVariableA
CreateFileMappingW
MapViewOfFile
MoveFileA
SetPriorityClass
GetCommandLineW
SetProcessInformation
ExpandEnvironmentStringsW
GetFinalPathNameByHandleW
SetThreadPriority
SetErrorMode
GetCurrentThreadId
GetCurrentThread
SetUnhandledExceptionFilter
WaitForSingleObjectEx
CreateEventExA
HeapReAlloc
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
GetStringTypeW
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetNativeSystemInfo
SleepConditionVariableSRW
WakeAllConditionVariable
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
DeleteCriticalSection
InitializeConditionVariable
InitializeCriticalSection
LeaveCriticalSection
WakeConditionVariable
EnterCriticalSection
SleepConditionVariableCS
LoadLibraryExA
VirtualQuery
VirtualProtect
RaiseException
GetDateFormatW
CompareStringW
LCMapStringW
IsValidLocale
GetCurrentProcess
GetUserDefaultLCID
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetEndOfFile
HeapSize
CreateDirectoryA
WriteConsoleW
user32
MsgWaitForMultipleObjectsEx
EnumDisplaySettingsA
TranslateMessage
SetProcessDPIAware
SetDlgItemTextA
MessageBoxA
OpenClipboard
PeekMessageW
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
keybd_event
GetAsyncKeyState
IsWindowVisible
GetWindowLongPtrW
GetLayeredWindowAttributes
DispatchMessageW
CloseClipboard
IsDialogMessageW
GetCursorPos
SetCursorPos
IsIconic
UpdateWindow
EnumDisplaySettingsW
EnumDisplayDevicesW
IntersectRect
GetMonitorInfoW
ShowWindow
GetSystemMetrics
GetWindowLongW
GetWindowPlacement
wsprintfW
GetForegroundWindow
GetActiveWindow
ClientToScreen
SendMessageW
SetWindowLongPtrW
MapWindowPoints
MoveWindow
CreateDialogParamW
GetDC
EndDialog
SetWindowTextW
SetDlgItemTextW
GetDlgItemTextW
GetDlgItem
DrawTextW
DialogBoxParamW
ReleaseDC
DefWindowProcW
PostMessageW
DestroyWindow
CreateWindowExW
ScreenToClient
CallNextHookEx
RegisterClassExW
FindWindowExA
SetWindowPlacement
UnhookWindowsHookEx
EnumWindows
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
LoadCursorW
SendMessageA
SetParent
SetCapture
SetWindowsHookExW
SetCursor
GetClientRect
FindWindowA
ReleaseCapture
SetForegroundWindow
LoadImageW
InvalidateRect
MessageBoxW
AdjustWindowRectEx
MonitorFromPoint
GetWindowRect
SetWindowPos
MonitorFromWindow
GetKeyState
gdi32
CombineRgn
GetRgnBox
GetDeviceCaps
DeleteObject
CreateRectRgnIndirect
SelectObject
GetStockObject
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegQueryValueExW
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegOpenKeyExW
CryptAcquireContextA
shell32
ShellExecuteW
SHGetFolderPathW
ole32
CoTaskMemFree
CoCreateInstance
PropVariantClear
CoInitialize
CoCreateFreeThreadedMarshaler
dwmapi
DwmGetWindowAttribute
DwmSetWindowAttribute
DwmGetCompositionTimingInfo
imm32
ImmAssociateContext
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
Name
.text
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
528KB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
235KB
Virtual Size
234KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=36, id=259, version=33145,
count=1, productName=Unmarked objects (old),
count=8, id=253, version=28518,
count=20, id=260, version=30034,
count=12, id=259, version=30034,
count=93, id=261, version=30034,
count=48, id=261, version=30159,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=222, id=261, version=33145,
count=75, id=260, version=33145,
count=39, id=260, version=30159,
count=43, id=257, version=33145,
count=397, id=1, productName=Unmarked objects,
count=479, id=265, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,
mus_girl_next_door.ogg
- SHA256 7f33cb935518cc3951a9db03c92d89f0c08ba98acacb67190f9140f4b7391897
- MD5 09b11a7f71a2bad4ba5e349f1dbb49d8
- SHA1 7465398adb85683be84830bdbbae64dd676babbd
- SHA512 d95b97881d9c4104fe6ceff40b530e4e517619adb19d24c7adf985e07dc0303f2e14ae2d070d1150b2aed82e41339462ba8a806313bf58ed8d1ef00ad8eeddd7
- SSDEEP 3072:kMsCRwSbFVvp95kynuJaJQNbHcWSyRGqGY96YAnoD39egcHJgOUjTENNEL+wa:HsCpbFVx9iyuJaJlWHxGGGjhUwJwa
- TLSH T13D04023EA540A9DAC83C73F0EC564E9877AC0CDA6314275A82F521F4ADED327B439463
- MD5 SHA1 SHA512 SSDEEP TLSH
mus_noelle_happy.ogg
- SHA256 53bba10f477e0d610a2075e462e8d7cb1a83570124b0a9b6a39f0e1eef19bfa4
- MD5 9310f137b1684bdf65d01d9bf8d660ff
- SHA1 75a623cbd0e4534623d6460e0a1ff833592662dc
- SHA512 f1362a750735eabae0ebf316a9e4db7a147bdc8f10ed63b269365d6346a64fd3e86ce746ffc8da7edd22230e69b6502c8e956f1e9aa0a30a520d35b923d22b57
- SSDEEP 3072:ancD0dlOnxKF4EkAAdWZhAn/mJQENb3/Ah27SenqcIrRvMF+Y0u6YGBuwLGd:KqkmdWZhUuND9mdMb0rYheGd
- TLSH T10C04126F2604D908CED9B6B86FFD985A7B7DC90F6BC9921CC1B04031B9D9611AB0B713
- MD5 SHA1 SHA512 SSDEEP TLSH
mus_noelle_house.ogg
- SHA256 64c760b76bf3379cc248657e608b4bad89118ffc790423c327d6f08fc66553af
- MD5 3715e68c215684d273536f0b8f539591
- SHA1 f6af3bd11a90a56df62c8c3d863c828cf1a24d4b
- SHA512 175bc9ae99324359f432a838c628b08cafe0315c953b5a1a3d77dea06e06c1d8d592a187a6669a394222bec4b4892cc50b0e4bb6b66b8567064f695bcd40d56c
- SSDEEP 6144:v+2zYeSeiyakSlXEvOzQIM0Ca5hVH7TgNX22ZQilXEYtx4uW9159v1hYazy5:vMpyakOzs2e421hsuW9r9jG
- TLSH T10264133E1E180DDEDBD9B4B87DAC9A8431FF45DCB2C959094AB81140FC625DE2716E23
- MD5 SHA1 SHA512 SSDEEP TLSH
options.ini
- SHA256 b9e628bfc0d68859161bf73215664f09a27ea07fab7ffce1e0a264173278546e
- MD5 0ca7ca7b07f8a2f4ac6fa9a583842610
- SHA1 a3f9210d6cc15bbb86b6dd146ba9d7664bab8fed
- SHA512 08b1ef6cb0d3caaf594b588da7470eb2b6a8c5f7ee19edb328007638f8041d76564dba62f5b2a88c9f40829038fc50d2f3e5d63da3c617b005b8dcdfb0af1600
- MD5 SHA1 SHA512