REVISITED v1.1.2.zip
- SHA256 5027584d83021bf7341bed46ee2643ee4863294d2bc4c98ba11e003505e9e3be
Static task
static1
1 signatures
General
- Target REVISITED v1.1.2.zip
- Size 72.6MB
- Sample261002-q2te8s1tft
- SHA256 5027584d83021bf7341bed46ee2643ee4863294d2bc4c98ba11e003505e9e3be
- MD5 26e4347aa2628508c88f2bdc54df522b
- SHA1 8f507c5b88d86847731c5a4b32f017c537aebb66
- SHA512 09862c5566e6dab2338261c84e66479884a75fe5d7b3d2b51e3d44c21de6ba3f3ea2309f9401d2bd440c98eb11f4c3cbb55fd127a6ac1cba50917fd23c60ac68
- SSDEEP 1572864:+Gqbes7/he4Nahe3XeNGudjuupOCZ2MFZtl4UErQv1D0xy:8KsoZp1FDEro1DSy
- TLSH T186F733ECB4F4C1EDD6F6E57950675ED1384B182B22DD0FE7E2A06A4F225C86E449032B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/REVISITED.exe
File Explorer
-
REVISITED v1.1.2.zip.zip 72.6MB
-
REVISITED.exe.exe 12.3MB
-
audiogroup1.dat48.9MB
-
audiogroup2.dat19.8MB
-
credits.txt221B
-
data.win41.9MB
-
options.ini59B
REVISITED.exe
- IMPHASH dd8c6e713562e11f2ae1d3b10255a100
- SHA256 a336c1811d574f5eb79f753534599461970029a975fd6944f01ee1965b69ec95
- MD5 838e7b36f7eeb9fe519f33a50c1a782a
- SHA1 9268c45efd7440931a6197b9844d16383d0f2aff
- SHA512 0a9afdeec5f4a99826a257ef48ac3805db6778aa7bd4f2092019b086391440e75f4a9e56e1cb4848f256b9efe0980adb322da99e4b673a8f423b5734bd3f810e
- SSDEEP 196608:mhwFfdVnR8cE0BwksrQhseuPKD4ki2nx7YBks50up/pVtGadp+vU7zC3KEBSo2N4:mGF11mZn12x
- TLSH T156D66B4572B5C0D9E0678038C65AA6FBE2713C44CB5086DB6AE03E6C3F77AD459BB312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8998584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\GameMaker\GameMaker\GameMaker\Runner\GMS2-Runner-Main\VC_Runner\x64\Release-Zeus\Runner.pdb
rpcrt4
UuidToStringW
UuidCreate
wininet
InternetSetOptionA
InternetWriteFile
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetCrackUrlA
InternetCanonicalizeUrlA
HttpOpenRequestA
HttpQueryInfoA
HttpEndRequestW
InternetConnectA
InternetReadFile
InternetGetConnectedState
d3d11
D3D11CreateDevice
dbghelp
MiniDumpWriteDump
SymInitialize
SymFromAddr
winmm
joyGetPos
mciSendStringA
timeGetTime
timeGetDevCaps
timeEndPeriod
timeBeginPeriod
joyGetPosEx
ws2_32
WSAStartup
inet_pton
send
socket
connect
gethostname
recvfrom
recv
getsockopt
freeaddrinfo
sendto
ioctlsocket
setsockopt
WSAGetLastError
__WSAFDIsSet
select
getpeername
inet_ntop
getnameinfo
ntohl
ntohs
htonl
htons
getaddrinfo
listen
closesocket
bind
accept
WSACleanup
getsockname
WSAAddressToStringA
gdiplus
GdiplusStartup
GdiplusShutdown
comctl32
InitCommonControlsEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
mfplat
MFStartup
MFCreateSourceResolver
MFCreateMediaType
MFShutdown
mf
MFCreateAudioRendererActivate
MFCreateTopologyNode
MFCreateMediaSession
MFCreateSampleGrabberSinkActivate
MFGetService
MFCreateTopology
iphlpapi
GetAdaptersAddresses
NotifyIpInterfaceChange
CancelMibChangeNotify2
kernel32
GetCurrentThread
WriteFile
GetStdHandle
FreeLibraryAndExitThread
ExitThread
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
MoveFileExW
SetFileAttributesW
GetFileAttributesExW
GetModuleHandleExW
HeapWalk
HeapValidate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
InterlockedFlushSList
InterlockedPushEntrySList
SetConsoleCtrlHandler
RtlUnwindEx
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
RaiseException
GetStartupInfoW
ReadConsoleW
FlushFileBuffers
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetConsoleOutputCP
GetFileSizeEx
SetStdHandle
GetTimeZoneInformation
HeapReAlloc
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTempPathW
GetDateFormatW
GetTimeFormatW
RtlPcToFileHeader
Sleep
LoadLibraryW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetLastError
LoadLibraryA
OutputDebugStringA
SetWaitableTimer
CreateWaitableTimerW
CloseHandle
GetConsoleWindow
SetLastError
GetFullPathNameW
GetExitCodeThread
FormatMessageW
DeleteFileW
CreateThread
GetCurrentDirectoryW
SetCurrentDirectoryW
LocalFree
GetModuleHandleW
ReadFile
SetFilePointer
CreateFileW
GetFileAttributesW
GetFileSize
FreeLibrary
SetEnvironmentVariableW
LoadLibraryExW
CreateDirectoryW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetModuleFileNameW
FindClose
IsValidLocale
GetTempPathA
CreateProcessW
CreateDirectoryA
WaitForSingleObject
GetTickCount64
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
K32GetProcessMemoryInfo
GetCurrentDirectoryA
SetCurrentDirectoryA
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocaleInfoW
GetVersionExW
GetSystemInfo
GlobalMemoryStatusEx
VerSetConditionMask
VerifyVersionInfoW
GlobalFree
GetCurrentProcessId
DebugBreak
GetEnvironmentVariableA
ExitProcess
lstrlenA
GetVersion
SetEnvironmentVariableA
CreateFileMappingW
MapViewOfFile
MoveFileA
GetCommandLineW
ExpandEnvironmentStringsW
GetFinalPathNameByHandleW
SetErrorMode
GetCurrentThreadId
SetUnhandledExceptionFilter
WaitForSingleObjectEx
CreateEventExA
OutputDebugStringW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
GetStringTypeW
GetLocaleInfoEx
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
GetNativeSystemInfo
SwitchToThread
SleepConditionVariableSRW
WakeAllConditionVariable
SetEndOfFile
TryEnterCriticalSection
InitializeCriticalSectionEx
InitializeConditionVariable
InitializeCriticalSection
SetThreadPriority
WakeConditionVariable
SleepConditionVariableCS
DeleteCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
InitializeSRWLock
RtlCaptureStackBackTrace
CompareStringW
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
ResumeThread
GetConsoleMode
HeapSize
FormatMessageA
WriteConsoleW
user32
MsgWaitForMultipleObjectsEx
EnumDisplaySettingsA
TranslateMessage
SetProcessDPIAware
SetDlgItemTextA
MessageBoxA
GetFocus
PeekMessageW
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
keybd_event
GetAsyncKeyState
IsWindowVisible
IsDialogMessageW
OpenClipboard
DispatchMessageW
GetCursorPos
SetCursorPos
UpdateWindow
EnumDisplaySettingsW
GetMonitorInfoW
ShowWindow
GetSystemMetrics
SendMessageW
SetWindowLongPtrW
MonitorFromWindow
GetWindowLongPtrW
GetLayeredWindowAttributes
IntersectRect
GetWindowLongW
GetWindowPlacement
wsprintfW
SetWindowPos
GetWindowRect
GetActiveWindow
ClientToScreen
MapWindowPoints
MoveWindow
CreateDialogParamW
GetDC
EndDialog
SetWindowTextW
SetDlgItemTextW
GetDlgItemTextW
GetDlgItem
DrawTextW
DialogBoxParamW
ReleaseDC
DefWindowProcW
PostMessageW
DestroyWindow
CreateWindowExW
ScreenToClient
CallNextHookEx
RegisterClassExW
FindWindowExA
SetWindowPlacement
UnhookWindowsHookEx
EnumWindows
SetFocus
BringWindowToTop
EnumDisplayDevicesW
LoadCursorW
SendMessageA
SetParent
SetCapture
SetWindowsHookExW
SetCursor
GetClientRect
PostThreadMessageW
FindWindowA
ReleaseCapture
SetForegroundWindow
LoadImageW
MessageBoxW
GetRawInputDeviceInfoA
GetRawInputDeviceList
AdjustWindowRectEx
GetKeyState
gdi32
SelectObject
DeleteObject
CombineRgn
GetRgnBox
CreateRectRgnIndirect
GetDeviceCaps
GetStockObject
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegOpenKeyExW
RegCloseKey
CryptGenRandom
CryptReleaseContext
RegQueryValueExW
CryptAcquireContextA
shell32
ShellExecuteW
SHGetFolderPathW
ole32
CoTaskMemFree
CoCreateInstance
CoCreateFreeThreadedMarshaler
PropVariantClear
CoInitialize
dwmapi
DwmSetWindowAttribute
DwmGetWindowAttribute
DwmGetCompositionTimingInfo
imm32
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmAssociateContext
Name
.text
Size
9.2MB
Virtual Size
9.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
506KB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
430KB
Virtual Size
430KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
minATL
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=35, id=259, version=30795,
count=8, id=253, version=28518,
count=20, id=260, version=30034,
count=12, id=259, version=30034,
count=93, id=261, version=30034,
count=40, id=261, version=30154,
count=223, id=261, version=30795,
count=61, id=260, version=30795,
count=39, id=260, version=30154,
count=43, id=257, version=30795,
count=387, id=1, productName=Unmarked objects,
count=479, id=265, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,
audiogroup1.dat
- SHA256 f9d70588e48a0a7ce62eb6c2eca257c2775284b8b9755437a957647d0e2054d3
- MD5 9ef63615672a001bcab760cfe685223e
- SHA1 49196b10f04be492e5a2985a5b88354b5a4b23c0
- SHA512 341403efa94ed4f9135b5169a33a55b6644510a37b5f73413180ea4ced8870381defaf6e271ae5c9ab1d2d6e321675e96dc33b08622064f180b882d6b48e0a17
- SSDEEP 1572864:lYWabLefizyWKJIv5TLdvQu6aRtaLG+p1Lg2:+LDO3JG5QBBLV13
- TLSH T17BB733619C848ECECA5C32F454834B58B7BC9E6E83E0139707EAB96C3C3BBA54C55953
- MD5 SHA1 SHA512 SSDEEP TLSH
audiogroup2.dat
- SHA256 071a2df6637311db9a6e7ff655dac0a8a104b7263d25233c78d9efea012e8cd9
- MD5 0976c66cbeb02a65b858d776efd6e028
- SHA1 c176ea8f71dbc963808201f5f517161080adf44f
- SHA512 18f65804944daa85e903e6d37f8b22aca17d79eb5ae06b3edb7fa07d51be0404c4584dac0fd59c3f02a42ea25840b53acc937692bd5950f82ace8e4793a4b304
- SSDEEP 393216:LCK3tfssO9sCTK8wLkQBXowK/83etLnYOfNWnOsJqIL:WC0OHZLkQB7K3rVfNjsY
- TLSH T11E27D593F302C902C8162AB64D62DBE55732FC55EE0657173086BF1F6DBB2C39E62681
- MD5 SHA1 SHA512 SSDEEP TLSH
credits.txt
- SHA256 270adf70d64c9e201a1288df9feb50362ef03c2bc803e5313ea8bc67ba5baf3b
- MD5 eaae443d58e0f0aeea83e21f8424d4d0
- SHA1 c61e63e0eb653749a08e1c43dbf9eda2251474ab
- SHA512 0e55acd896dca0c58bc13a0d68647ab077c7c28037f2b41d4fc08b94ba9befa54f88a8e1c49ee2d4897cbd7908c7fcb9b97ebd845d5a8dd89e4de4dce929b838
- TLSH T12CD0230B310F4621077FC1028644896DB33FD517F34327117857A714D5157F1513107C
- MD5 SHA1 SHA512 TLSH
data.win
- SHA256 8b07464543583dee8d38b4ca1ebe9422406e8668fd8f2177d94f796084056298
- MD5 26f87bd93c5cea5d68589699423d7673
- SHA1 b50648cc2687ac68ed4d76d4a2816f8992268305
- SHA512 6263410ec343e745d01238d4693bcc43896cb9ab62882bc63c7387860db8e36d30003d374002ec79fe12c7cc09a46d9f8069f5ecab66a784d99e679c55344fdb
- SSDEEP 98304:lKmxTFDai4YCbqBmp721cNLJvs+HvGoUPVFdFEzefBjGUuzZS0jUqPPdn9+Nt:l/bb82Bmp72iNdbwVK6tLu7Ui9+z
- TLSH T182A7C417FB86A8E6D41423368C678F94B3B2E8A58E7503033BB457BDAEF33084D16655
- MD5 SHA1 SHA512 SSDEEP TLSH
options.ini
- SHA256 bdbabf20b2befb5cdbbaa6573aa75954abd6aac268243eccb7a777f21400b986
- MD5 f12de31d90b851984e08a419f4714f8a
- SHA1 9027904936026d1e6df5a426e88467bccb81c519
- SHA512 04f6070611e53661fcbf80b5a6b91147ef6dee9ffc06c17560a8c65aedba3e941945cfd809c706c95db648be37b83f4f079cc72d946d50a0eb0b8f8cdc6648a2
- TLSH T1D6A0025511318EA54570B196548657560BD79B6858596218A54142C61B54B23060D17D
- MD5 SHA1 SHA512 TLSH