KG UP Mod Installer v26.30+.zip
- SHA256 363acaf989e8b4acde0f1fde87d01daa5fc2ae57bfbb3ca11eb9f0c8a98866c8
Password
a
Overview
overview
3Static
static
3KG UP Mod ...0+.zip
windows10-2004-x64
1KG UP Mod ...0+.zip
windows11-ltsc_2024-x64
1KG UP Mod ...I2.dll
windows10-2004-x64
1KG UP Mod ...I2.dll
windows11-ltsc_2024-x64
1KG UP Mod ...AT.dll
windows10-2004-x64
1KG UP Mod ...AT.dll
windows11-ltsc_2024-x64
1KG UP Mod ...0+.exe
windows10-2004-x64
1KG UP Mod ...0+.exe
windows11-ltsc_2024-x64
1KG UP Mod ..._1.dll
windows10-2004-x64
1KG UP Mod ..._1.dll
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
KG UP Mod Installer v26.30+.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
KG UP Mod Installer v26.30+.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
KG UP Mod Installer v26.30+/Guna.UI2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
KG UP Mod Installer v26.30+/Guna.UI2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
KG UP Mod Installer v26.30+/KG-UP-GOAT.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
KG UP Mod Installer v26.30+/KG-UP-GOAT.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
KG UP Mod Installer v26.30+/KG-UP-v26_30+.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
KG UP Mod Installer v26.30+/KG-UP-v26_30+.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
KG UP Mod Installer v26.30+/vcruntime140_1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
KG UP Mod Installer v26.30+/vcruntime140_1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target KG UP Mod Installer v26.30+.zip
- Size 1.2MB
- Sample260925-vtv2bawwex
- SHA256 363acaf989e8b4acde0f1fde87d01daa5fc2ae57bfbb3ca11eb9f0c8a98866c8
- MD5 bc680b7c5dff8979d0d577ee192f5776
- SHA1 dd8b7df6ac5b1a7ca5f9d4f1fe8375ebc5a49f3b
- SHA512 43e43690c0997e82a707fd7bfa848544eadbc0d38a9a5077841716ceb660c71f43c72d80974ee50f29a21668191cee3a0603c847961f548ba788d51dc09feb19
- SSDEEP 24576:2TyHOYZM2lWEGXfpJrfqMmvaKUwKkMUS94RnGqkzc6L/2J:2TyuYZRB2fLTqMm7JKHUSKRn9kw6LeJ
- TLSH T12C4533C9D521B090DE26529C7479DE93B2CB533DD568CC447BB21BBE9312A01E087EAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/KG UP Mod Installer v26.30+/KG-UP-GOAT.dll unpack001/KG UP Mod Installer v26.30+/KG-UP-v26_30+.exe unpack001/KG UP Mod Installer v26.30+/vcruntime140_1.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/KG UP Mod Installer v26.30+/Guna.UI2.dll
File Explorer
-
KG UP Mod Installer v26.30+.zip.zip 1.2MB
-
KG UP Mod Installer v26.30+/Guna.UI2.dll.dll 2.1MB
-
KG UP Mod Installer v26.30+/KG-UP-GOAT.dll.dll 15KB
-
KG UP Mod Installer v26.30+/KG-UP-v26_30+.exe.exe 392KB
-
KG UP Mod Installer v26.30+/vcruntime140_1.dll.dll 49KB
KG UP Mod Installer v26.30+/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd
- MD5 b464fc896b14bfa34f608da53856e999
- SHA1 55568eecc97895cad49a42bffe757e3588c5313c
- SHA512 1b310b16b0973c9100c9d220338ffc9340b4085d7a095cc601998b5cbcb67b927d8665070bd8b6e2af2a29d13762f404a794b79dbe223b48751894a4bf47c5ca
- SSDEEP 24576:ITL3GQ2wuP82+lTVG+3VvkPMb4yk8z1xcfeGwrSe+a/gZmxVsFdHQ/jzaM5PT:U5+dSRzIZ8VsFWN
- TLSH T124A5FA147ED4EB27D16BCE33D6E25011E2F1E5A32AB1EB0E72D35768184234578863BE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
a
PE Signature issue
Digest
ef:ea:da:1b:68:34:55:c7:9d:54:32:02:aa:3a:3b:97:1e:fa:ea:5b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 18, 2025
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Minor OS version
0
Major OS version
4
Entry point
2188926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
KG UP Mod Installer v26.30+/KG-UP-GOAT.dll
- IMPHASH 59588a802ea662a7feac197ca3bc6a6d
- SHA256 d13240737e1c7ea92a9bf9568375fd2b87f659c38d8a3942a71f74cb3919c30b
- MD5 6b0aba6fd0219dce2eda0cb33b874870
- SHA1 a5f0634d070573f6f31a2ab956f122d17ad34431
- SHA512 763e58a561269b11a810cff4f2969fd47bdde9668c298bf15dd6359b92a55530dc3cec0c0730865e42bda87e6853d980d383f04c18cb6ca3bc8269955f1a1a9d
- SSDEEP 192:mFOcnioGxgUZwSF8etTHSnn1/0fWJHpMnmTzMUkujoKpQUKV:hc7Fof1oR0QdwZujoKFK
- TLSH T1E162094E339214EDCA06C238C5FF5776B2B1B112069A4E7E5754CB330E72A6D6639E88
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
a
Minor OS version
0
Major OS version
4
Entry point
4608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
api-ms-win-crt-heap-l1-1-0
calloc
free
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
strlen
strncmp
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
304B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
55B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
KG UP Mod Installer v26.30+/KG-UP-v26_30+.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1355df85452640f1c198339ed16c1c0b37e536c2f6ea117e3f72491ecbd00215
- MD5 ecb6a208c8010c1ad2b0fe394a61ce11
- SHA1 f7f231622a4ba160e4b005d7dedee314cdf66e62
- SHA512 33aee1f33c934b1bb6c09c7231620f6adba92c816c321977a10b79a82f46d36208045e4f6ec4c8a331708edb646b123442cc82ea19c5db136de84cae76410e01
- SSDEEP 6144:DjFm8rWmYvrV5Ie3TiFs6rHEqvTeAqUbRR3vVtCMDrD8wyX5k8UF+lu9W8vWmYvw:v8DvR5xGFRXbPqMn3jXyJk8UFaRvR5
- TLSH T1B4841251E0ED43A1E6BF5BFE4C7966B05BB7FC2E6568C98A0E0310D920B670194C8F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
a
Minor OS version
0
Major OS version
4
Entry point
321454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
306KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
KG UP Mod Installer v26.30+/vcruntime140_1.dll
- IMPHASH e3c93efc2669078b177fef5be2ab2139
- SHA256 15b2223804ac8a3a10a93233618768413f280c08055cf6e2917dfbc9938246d6
- MD5 cdf9c7a58c4a4e096bceff52d44aa9fa
- SHA1 5e0c48770c327cb59678f17e714879e3b2ddebb0
- SHA512 d5cdee9ab2a5154a019257605676fde319cb41d5b9fb488ec5dd785b6cd6aaecc5acd21b3474fcf99462b20175b8fb886d961a056d0b8da417569c8053be81ce
- SSDEEP 1536:h1QfJ8E97+PVUDNMKCbMokoAhbdHWr0DZ:hOfJP97fpC4oQldHWr0F
- TLSH T1E733F72BDD1AA03BD3598C78C9435C05DE63BC968BD1B5CBA7401DE60C66BE49B3E702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
a
Minor OS version
0
Major OS version
6
Entry point
25092
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryExA
LoadLibraryExW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
MultiByteToWideChar
GetFileInformationByHandleEx
GetLastError
CloseHandle
AreFileApisANSI
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
vcruntime140
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
memmove
memset
__C_specific_handler
__std_type_info_destroy_list
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
strlen
tolower
wcslen
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
abort
_invoke_watson
_seh_filter_dll
_cexit
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
__CxxFrameHandler4
__NLG_Dispatch2
__NLG_Return2
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35207,
count=8, id=260, version=35207,
count=21, id=261, version=35207,
count=6, id=257, version=35207,
count=3, id=257, version=33140,
count=101, id=1, productName=Unmarked objects,
count=3, id=261, version=35217,
count=1, id=256, version=35217,
count=1, id=255, version=35217,
count=1, id=258, version=35217,