the_lost_coffin_of_andrew_and_ashley.zip
- SHA256 20edde2deeb5bbfde47d7d4eeffad79c27b80a1e6256ed2bfe3494e285a54f9a
Behavioral task
behavioral1
Sample
The lost coffin of Andrew and Ashley.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target the_lost_coffin_of_andrew_and_ashley.zip
- Size 43.1MB
- Sample261002-ex3ybsgh75
- SHA256 20edde2deeb5bbfde47d7d4eeffad79c27b80a1e6256ed2bfe3494e285a54f9a
- MD5 e0227dc6e8e4fc7c985c8c8b31780b97
- SHA1 70d0fe22af416bb07e60881e4fb12d5210a842c1
- SHA512 1c88059b5c8d67e17cc18ed0f2b6c172d048fca9aeb7aa2ceed7f1fb4f82752d72a76e005bcfcd9ce0ff8722d2793f6f3c995d68f83838fbc806485578a0e76b
- SSDEEP 786432:etXPMxyYxck/6Te2uEporpPPeMOWA+iELfEnONpPSyoD/JpNj2nl1lfK5u4jNe8S:etX9YxN/NRcA5uWAZysONpgzJL6K5u4O
- TLSH T1D8A733ECBE7533AAD9C870A884014785467798678CE59502FFAD7F39ACC43E54F12AB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/The lost coffin of Andrew and Ashley.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/The lost coffin of Andrew and Ashley.exe
File Explorer
-
the_lost_coffin_of_andrew_and_ashley.zip.zip 43.1MB
-
The lost coffin of Andrew and Ashley.exe.exe 40.7MB
-
main.pyc35KB
-
assets/Book.png.png 1.3MB
-
assets/Book2.png.png 729KB
-
assets/credits_active.png.png 126KB
-
assets/credits_inactive.png.png 108KB
-
assets/icon.png.png 14KB
-
assets/launch_active.png.png 122KB
-
assets/launch_inactive.png.png 104KB
-
assets/load_active.png.png 123KB
-
assets/load_inactive.png.png 104KB
The lost coffin of Andrew and Ashley.exe
- IMPHASH f4f2e2b03fe5666a721620fcea3aea9b
- SHA256 886abf948e8b9217f78f38d241b5b6749ec80ed8be3593098fba6832cc4e7ae7
- MD5 8e99093bbbb890cc3492c94f11a61647
- SHA1 512674a5b5160cbbd9cc1d23ae9f0220615e5498
- SHA512 d3342478714262b8ff22dc4a0aec7258b779b41aef58ed264e5b3caf8750c53cd2ba7578e4b4c345cea1402d247b8e0410a249d55f150852fa3ba1a6c67f39e1
- SSDEEP 786432:yfbIQtse8I01+l+uqgvUdQxSGa2j6+s7LWB75zuXVgv3MGYXW8p2EOwXudDhfcNL:yfcQtp701CpM8a2qHWB75ilKMGgWA2Ox
- TLSH T18697334AAF3604F5E48F503AD050C1A91671B9AF03B6E63BA7F92A6105CF4F4BF39160
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
50496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
CreateFileW
GetFinalPathNameByHandleW
CloseHandle
GetModuleFileNameW
CreateSymbolicLinkW
GetCPInfo
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetProcAddress
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=188, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=4, id=253, version=33030,
count=40, id=261, version=33030,
count=17, id=260, version=33030,
count=17, id=259, version=33030,
count=11, id=257, version=30795,
count=142, id=1, productName=Unmarked objects,
count=21, id=260, version=33135,
count=1, id=258, version=33135,
main.pyc
- SHA256 cbcb6f47321ad36f6a88acaa446a29756491858e4c9e0bd60b933cb2061081de
- MD5 5efcd8924557ccfd0682cc42fc8ce453
- SHA1 d6707e737df879b17a9ddbed33bb680ed10bd78f
- SHA512 fce99abb82fd4bdf7ab6eb53db973ec77a87afce8c29d9d706191dbe3d838f57e4b6f9490718246b62ed5fc9ddf97b51c69f99d0951fe39590a02d2c8cac5712
- SSDEEP 768:kkmuWsCE61a1r2aPsR+E/nDBQU5xNsCNNNL7FpP:kluWNR1Is1Q7CNL7L
- TLSH T19CF2C5826B93D67BF815F778842B151773A4DAF1B300CB172669C03ABE94BB86C125CD
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/Book.png
- SHA256 a0480c02672a2e06f9f3e75ceb51e74eff4324cb18acec695d93b7ebaf4ac06b
- MD5 040218fab3c6cf49557c695b18264385
- SHA1 518a6825549a4029a3f5d33ff06bc4ee54103dc6
- SHA512 67c56c7d27ad1fc059b532c04b4ab5c7b0e2f6a45df866bdef8422f25c4bceeb08a4b1ce93e5f234c4c2948f7813841b30902bb31804984c38843f519904cad0
- SSDEEP 24576:umXZj89LmRwnd681AW57EBGo2YMtLmZVtF/gegOY+AniacAV+Bw:umXZglmMd6tWKBGo2pmZ2DKAiLAgBw
- TLSH T1D15533E6ECAD43B959BD9C41D719BF4288FC1A5DB2F70ACE2D2662C107383A19750393
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/Book2.png
- SHA256 861bc0d0e664bc8b8741bbd4fc8cf190a9d246ba131f62767f19c792594086fa
- MD5 8ede3d6cbb513b70dbe2a8ca40cd4886
- SHA1 132b53bb91a52bb4d0bae3d901e2fd3144bd1152
- SHA512 de11bba9766fd4e2cb4603c442a2ae765b82ba28b463990149e79b3e8e59442b2b5fc828c4d89b19887fc47dc4f1ec3879cc1a20c3b9a73c4cef3c7741691f78
- SSDEEP 12288:h0fxFNQTmXs9ze0eD+018xwcFRqIDMIiuhrfIuqBmPnnR8AOV02gIo3+cPSpXdii:hYxL+m89ejzSxvRqIgIiWxPnYdTqP6XN
- TLSH T192F4330CA899D2CCC44FAA509F641B1DE8ECFE3C7CC79470F266F88186A59E295D9432
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/credits_active.png
- SHA256 5ab96259149e2f85e32160607812c35c6444c329f1c2cf63861212f8ae2758f3
- MD5 c9b0ef659626c56e5b130c9b6054e71d
- SHA1 2b3629b9b6faf0a611a1d81f766d5b2fb2c23b53
- SHA512 6d612ae4dcad5f979ec1ff62b9990c868f207d64db305ecc9c648f601f093a9d4c25de421cde7b318c847ff932368f691aaf07229688ee1ee14c3d280c6a5a77
- SSDEEP 3072:FysclGX7R7UmKysZV2kLuyvbANt6xjiGKOngMcQK5jGTgHol9c62t0CCu:FytI7R7UmKysukK2aDGIMW5jGwol9YfR
- TLSH T1FDC3135C690D0F42DAA82B2094017B9394EAB0DF53FFD742A38AD64FF04DBE6A2C1355
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/credits_inactive.png
- SHA256 97e99478dc65252b2446559b4996ead09178c92f8b83b7b9d3b8d3a33c8215c8
- MD5 fc7e8d79975c6e982f74c393c8570966
- SHA1 9d35484e6956302eff8a6c2f5c7a356d193e03f5
- SHA512 4b6cf41e6f9cc4b7e741c4033104af7abfde21ee06dde47d3c1a7634d70258afd321c34c45dd3ea9b47fb0786d6626ae8b0a10088f54eeda3acf74aa501c8264
- SSDEEP 3072:g9Ouu28bq6j1PjsC7Zo41F0RUNBFV5LExvsPf0ro4Eup9IC:Gu2aXsClT1BByxvYf09EJC
- TLSH T1B0B312D8289653CCF3D6D23C6CD58B4C4869780EB881623C500B982C91F6F79BF9D3A6
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/icon.png
- SHA256 0704436049d6d9bd1b6dd66eb2ac01141951eeae6208409f21e6c0ca1b2d1bc9
- MD5 079ed77d56fcbc911ea736d9c9c87510
- SHA1 cd07310e85153b3480561d472ce4acb18dc532b9
- SHA512 cf2846c34bdb4db040177746bdd3e79ed2680635dff509225a9b742adb2945e323e04536c35625c32b6b0ec1db428c7c327983cbe564869752fe3efdeab35b73
- SSDEEP 384:b1YKh7jVZ/2L6JQlBrnT3LBTfr4JbkHHeSyhbWfsN8OJAd7D/Jl:ZB12L6OlZ7+JwHvyhfNJwL
- TLSH T10D62C0590119DBACF73E0D16BE0C118AC7F1BD3C502BE0B840515E41FE76867F9A867A
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/launch_active.png
- SHA256 c587984ce1e4cb0c1af59e068768fa4398d439df63aceb5d339ff940cbadf04d
- MD5 3f39e83ebfd53a18f188393deb30453d
- SHA1 8862d23136c0c62d861e56f077a77aa157d56c52
- SHA512 8fd713fe310325e6893bb7dd35887a8ae39c226bda932a2664e2cfec0fd9aa54c74698faff1e5bae348ffc9c05eefea3f3729e7d2ad2f8aa85ee22f1a9087635
- SSDEEP 1536:3z8rTitNFM1Oq8nws3mSMVg8qWAbACOiijob3B71nXjIHoEdZVQkWvTDHmTHS63B:3z8XKscqemSuOW8BV1nMH1HVlHS4GOD
- TLSH T169C312BFF8B104B2D18F464E39B17A19DE76D974270D042AC8D9077AA40E413A3BE56B
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/launch_inactive.png
- SHA256 d039f31f97a1b1131da7d4232932febd6ea3ce3f949df9efe3793eba0098d874
- MD5 df043704f7944344829340234235760d
- SHA1 869c90d7aba2f6a93122384c87a41b649cd8789a
- SHA512 2bd700b6ccad2b2a8af28dcdcb84b87cd101934a0726a6de6fe3ee05dbd50a09dcf107289d10756d4a0d0fb232df6433ade95b2d7f4091d89acdfa4dcb1bd9c3
- SSDEEP 3072:BoQVzg/FfwEuyKsleXGKYKwDj9M16hk9EqHLQ2+0:BDzyuyKrXqKw3216h6NrF
- TLSH T11AA312E59AC44A7CEF1A7CF1C7FE3900E8343503AAB858165CBD93DC98887976046BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/load_active.png
- SHA256 7fe3240318c4ee8187b76b8c71befe1874584f612f1dc68390a9ca9ff50d8180
- MD5 b9375e6fc4b8610dbe8952453578c693
- SHA1 36d26832633c0320802618b0f56c3ba45e8a2f4a
- SHA512 7a264614edf4d40711fe155a4247c704031112ab4b69ed332984e01e0c74524047ba8d8ea5f60cce68c77cec423cb4595af581a7bf5be86bae45ace125e63bff
- SSDEEP 3072:ypOOt3o8PrSFPreUrUQVOwmmj7RUsHdZQlkJty8YguBv1Rj:cb3RPeFjeUjVOupFikTyrDBN5
- TLSH T1FAC312868693E89F6D83B50B572FD485A2B3AF0C20DCC085545CF6F9906AFC2C1A9783
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/load_inactive.png
- SHA256 44bd73fd45e92f6f6759cfecac94cd02f2b36882c8b9a37cc640128eb6aae0d5
- MD5 438b183c605b51c443fc85bcc0dbfe12
- SHA1 89efd1ed04a98b853f950146fb0c3997a6aee50e
- SHA512 f2943f54cab2f7fdd35ecae79e8ad45c45ec9bc689f113b8379fec87bca2bd570f9cc6aec3de79708dc61672874914eefd00748d1cffe1280d11f538bfe2a649
- SSDEEP 3072:XuUiQvzlFIEKLqr1d3+g3IF5KN7ziPE/15Cp:UQvzlFMLwh05KNCr
- TLSH T1C6B312B1B168F68C3642E9975C840F15E1044F853CC2DF5DAA7EF4D902B1EA51F2ABD2
- MD5 SHA1 SHA512 SSDEEP TLSH