stilldawn-Windows-x86_64[.]zip

resource
unpack001/stilldawn-Windows-x86_64/stilldawn.exe

stilldawn-Windows-x86_64.zip

SHA256 10d2a9f57e4c087c3ade3399a95c5daebe5b8f7e8849b5fbc6522295ed782d0f
MD5 252039b39d88ee2a1db40f574fd4ca45
SHA1 1819b1b3e6b5e09816a2157a30acf2e716099c18
SHA512 d190a682d809adfe9bfffec6a7c508e50bcdb5de955163d627f0806ed72c7391caa39c5ff0c0747c28de3d7b9fb0cb95708629e61232ad8861eccce64fc9a950
SSDEEP 196608:KJN05MsuN6YSSrEp2G+rlbPSr5o/oybkQl7+6rce4wQC16K1lj9eUdQI2rR3:i1suN6YS47rl7Sr5o/oybkKZ5DF6K7hK
TLSH
T1D68633FDD337B6E4C25FC0B8FE6F74884A61993CC066667E0D2A7A0A4DC5EA70720561
MD5 SHA1 SHA512 SSDEEP TLSH

stilldawn-Windows-x86_64/ATTRIBUTE.md

SHA256 0cfc9b345fb3b95866e5a36c138a729d8e970407e6c649d001bd3781baa509ba
MD5 60fb52e3c0176eee6dd79ba198f648fa
SHA1 d7968fdc1819aff8205ac578b73c55dfbec6d06e
SHA512 a19993f7be23795eda2962d79d0ed86265a04e8419c42a4085fc5bc668cddef72eb17cd05177fc78ea2b62b296d0deb6165234a303c9e793da835022ae046460
SSDEEP 96:PQn4igml2D3fK8wMUBGB9NYULn8j75+IGkRu8+04lQtn2KB5SAdnnRiWS5OnOl/p:PQ4zml2e9w74j75+BB9rWt2k5tRiWSww
TLSH
T1C5B1C6BF774452910F5A02FFB6CC77CBDA17160D7B04ACD8A05C808C621B26E56BAB38
MD5 SHA1 SHA512 SSDEEP TLSH

stilldawn-Windows-x86_64/BUILD.txt

SHA256 bb82f3331ab3f41b9a09082928d341b86b2679e726e956167b226b5ab1b558bb
MD5 ab393016df574d527b12a939b6f5a83e
SHA1 9cf87165734c8937e36669521fa76ee109e38c67
SHA512 c06e227b530866fbd18291d6d49ef68755056e922a513e7d2104ad44fffc62cc7ddf06fff46ad69e36f7de7af9a2c41b0639994e24b2bead240d7dc4d82ed69b
MD5 SHA1 SHA512

stilldawn-Windows-x86_64/LICENSE

SHA256 7507814ea938392a1f353031b1cdacdb884710a20b40697bc43da46b63f1e9fa
MD5 bd222e1f46f91119e6b9fa89a306a164
SHA1 9501e20650afe5ad991614c433ce0d69be4794e6
SHA512 4077087ff266491ced1ec17ed2d5b7d0eb830ea41ac2396838f8accc89d1ad10e3cee0f961fa7b1cfebc2c223a85af9d7c1fdfcf30d02c9d0222985bf957fe35
TLSH
T198C012261105729E47C50A6E8EE2B26E780D82A839765944965381441F22419AEB562F
MD5 SHA1 SHA512 TLSH

stilldawn-Windows-x86_64/LICENSES/Felix-Blume-Wild-Boars-CC0.txt

SHA256 9e63a2411f85b5ff3b87b49a70cfb199823758c55569aeea53b1aa36e90fe764
MD5 e0b373e128239d6ce6202ca52f513f08
SHA1 c83f9b95f847415490e5238f3d671ca39d52eccd
SHA512 d93065afa84feb59580e42389db6a4aea641593316397a5857120240864ab7f30b857faa79e69ac964a660c3fe810436943d8c86462311fd2b1dc706680ced87
TLSH
T114413077128CD6250F620296FEA5B5CFB722DF0A375D4A78A054929A3A330531B37C35
MD5 SHA1 SHA512 TLSH

stilldawn-Windows-x86_64/LICENSES/NeoSpica-Body-Falling-CC0.txt

SHA256 dcb9240b76108f00bd38d2b4a350f53b501dcf469f3047cd0f11206e47515daa
MD5 db11c9eaea150dafd0211242bdcf948e
SHA1 28fb89fcf039c73efeae2c730f6a625e37d16102
SHA512 14173adb57914ce86ff4ceb0021216c1e10b8ab0c8f3c93d461b18d1970e41a2a6f8c84d2464edcf1e1577f4c9cf55024628036bf42e4e28614dd05eece504fc
TLSH
T19B2166B76280512A5F82129ABAFA21CF66238B1D37E11094D041C45C7E620720B77D7D
MD5 SHA1 SHA512 TLSH

stilldawn-Windows-x86_64/LICENSES/Quaternius-RPG-Characters-CC0.txt

SHA256 83d8959f9fc56353ed571fbe2dc52e4bcd64508e2399501cd45ac2ce3df0bf8c
MD5 43200ae009e6a0baa92a0ccad136c48d
SHA1 39914adce07de6f2c72d59ba0d67b9eacc2c91c5
SHA512 31abca88876ecd3b042aadd9eb7be041f931799f6856c29415fa542cd6b7500281f79cc21304c8a3b433d6737452c2fa1b95965031ada43faecf2975c9d9f905
TLSH
T138E02BEF1DC2C5214AA5C2C93514A16BC25352995DCD9040FC484DB84D560D6599E02B
MD5 SHA1 SHA512 TLSH

stilldawn-Windows-x86_64/LICENSES/goThoom-MIT.txt

SHA256 31d0e9e7cf23e128c2eb5dcc213c73f47739e544f31ef36d56be2de032b91bcb
MD5 66b6ebafa592e9b87ea259bbb5611e52
SHA1 c74f6d5dec8bd7fc2136d6bd7a389b9289eca7be
SHA512 d47f8040be06599042c3a6375453e84bd621c1d8aa1ff3c01cdd70d3d8293d18fc8554953cbec40dc09f6342552a8798677fc78ec8eed774c642c7fa52ebc39f
TLSH
T1EF21961FB3510762189B137059F498D5F23BB15E7A5B2684542DF241132B06CC6FB844
MD5 SHA1 SHA512 TLSH

stilldawn-Windows-x86_64/LICENSES/klauspost-compress-BSD.txt

SHA256 0d9e582ee4bff57bf1189c9e514e6da7ce277f9cd3bc2d488b22fbb39a6d87cf
MD5 d0fd9ebda39468b51ff4539c9fbb13a8
SHA1 0e8f2042647b8140e79c4eb7d233d1b39231db09
SHA512 57964e69facdf1324c62638d7ff07b1a9be2257d8f3eb8a9c6961cc0f2f7a7bd2f7d6e0e30dab99315f24170b4f76dd43e5f649643ad7f69cba3903272f23265
SSDEEP 384:ars4rsFm1DLC9vlKM1zJlFvmNz5VrlkTS537HC6nrs4rsFm1DL4WP:aBLDLC9TzJlFvAfxk43rlnBLDLLP
TLSH
T16572B62F7B4803770AC242627797A8CAF21EA03F3B562614345DD1681B6B92983FF5D9
MD5 SHA1 SHA512 SSDEEP TLSH

stilldawn-Windows-x86_64/LICENSES/pierrec-lz4-BSD.txt

SHA256 6a358d2540ca14048f02d366f23787c0a480157e58f058113f0e27168dd4e447
MD5 09ece85f3c312a63b522bfc6ebd44943
SHA1 e46e6a6dce75540a865a761f00e65c78b00c5895
SHA512 37beb90675735e1d3586928d6db32720758d57c4486983d10e8572f3a825457638722758c18489713b6dd660fe9a8fcb9dc86b223c58a072105878d418cdaa17
TLSH
T1A731655712444BE64ED216A066A6BAC0B08DD03D3F277D05186AF38867BB52FD4B7494
MD5 SHA1 SHA512 TLSH

stilldawn-Windows-x86_64/LICENSES/qubodup-Bamboo-Swishes-CC0.txt

SHA256 e534e50e7c792de5321b26930842a9e9f2cdbb180076c936a3d57d8d8749f546
MD5 c644f120ee4794741afebe9856d0e382
SHA1 96fa955c6d910de121118c92fe86231c2a0a2088
SHA512 a7b128f7097bb8c27347d74d1e9980c6f37ebfb8a321f192133c90f94ce95f6c7c7d5a667be46bc013e9eaaeb93b9ec90a67fe50af9760f02c4563c5b90fb188
TLSH
T16021A5BB638D42618F62108F7B1162CEA3A3C60C228818D4A0A7D1DCB0721F84B3A56C
MD5 SHA1 SHA512 TLSH

stilldawn-Windows-x86_64/README.md

SHA256 a0836356304b82a0967cf82f0bf2b2fff1b3963f584a8771ee08c9b310ce78f1
MD5 fc958a1cc63175d9b49ed595b4a8bfcd
SHA1 5e8ef0ddc06c4291628731ad6b80e466d907384d
SHA512 6112ab0ffdef61cb6b4216b8e2fcece5023a3c8e58992dc14fde8e5af9f9615ce08b9eadcaa57ddfcda717b4c76085122c376043d542ddd10c467f86831b8669
SSDEEP 96:OuTfE6TOPtBIeCHEjgLOicF0oEeYWh3V4Sk5tWvxnUFVBQI8r4Sbx/rQjtJTzJrx:OuTfEq6BIeC0+cqt9Al4Sk5tWvxnUhQi
TLSH
T112B1F82F638903755A5712926D0F178AA71BD118238B599CE4EF808C3192EB5D33F7B6
MD5 SHA1 SHA512 SSDEEP TLSH

stilldawn-Windows-x86_64/stilldawn.exe

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 762a17a89d21b03dfdf273e68326dcc8a641f7014b3b260c7c93e01f327c43a8
MD5 84f7a398427d28da80d32d1167547e5b
SHA1 6ce69e9bebdc47c9cbf8b2fd0fed6e10d37482f4
SHA512 c54909dad9406b43c1bc6f9a30964f3369236cf33353b6504a95ea86ad897acd7ebcae64a6446fa282df0c16fd022f0e8e297f4de7641588d70051ceedb3021f
SSDEEP 98304:oHiPAuUTbXdtG3MVTDCxHCKp88g7MY9sEbgExxrSdkD9MJYt7p8Vk8jbuEb:fVGTdHC9Cb99xrNDNmk8fLb
TLSH
T1F8277B47FC6618E5E1AEE431C562A523BB303C590B3263EB5B80F6243F3ABD059B9754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

585504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

33.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

stilldawn-Windows-x86_64.zip

stilldawn-Windows-x86_64/ATTRIBUTE.md

stilldawn-Windows-x86_64/BUILD.txt

stilldawn-Windows-x86_64/LICENSE

stilldawn-Windows-x86_64/LICENSES/Felix-Blume-Wild-Boars-CC0.txt

stilldawn-Windows-x86_64/LICENSES/NeoSpica-Body-Falling-CC0.txt

stilldawn-Windows-x86_64/LICENSES/Quaternius-RPG-Characters-CC0.txt

stilldawn-Windows-x86_64/LICENSES/goThoom-MIT.txt

stilldawn-Windows-x86_64/LICENSES/klauspost-compress-BSD.txt

stilldawn-Windows-x86_64/LICENSES/pierrec-lz4-BSD.txt

stilldawn-Windows-x86_64/LICENSES/qubodup-Bamboo-Swishes-CC0.txt

stilldawn-Windows-x86_64/README.md

stilldawn-Windows-x86_64/stilldawn.exe

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

stilldawn-Windows-x86_64.zip

stilldawn-Windows-x86_64/ATTRIBUTE.md

stilldawn-Windows-x86_64/BUILD.txt

stilldawn-Windows-x86_64/LICENSE

stilldawn-Windows-x86_64/LICENSES/Felix-Blume-Wild-Boars-CC0.txt

stilldawn-Windows-x86_64/LICENSES/NeoSpica-Body-Falling-CC0.txt

stilldawn-Windows-x86_64/LICENSES/Quaternius-RPG-Characters-CC0.txt

stilldawn-Windows-x86_64/LICENSES/goThoom-MIT.txt

stilldawn-Windows-x86_64/LICENSES/klauspost-compress-BSD.txt

stilldawn-Windows-x86_64/LICENSES/pierrec-lz4-BSD.txt

stilldawn-Windows-x86_64/LICENSES/qubodup-Bamboo-Swishes-CC0.txt

stilldawn-Windows-x86_64/README.md

stilldawn-Windows-x86_64/stilldawn.exe

kernel32

generic