bunnyhop_dlja_css_v34.rar
- SHA256 30f9686c3616c4daf3595478f184938aa0acb92eb2fb77606864f915fe021c88
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Bunnyhop/GDFwSvc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
Bunnyhop/rev0lt/bin/rev0lt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target bunnyhop_dlja_css_v34.rar
- Size 155KB
- Sample261018-rmw39abc95
- SHA256 30f9686c3616c4daf3595478f184938aa0acb92eb2fb77606864f915fe021c88
- MD5 53a5e43232f371f3aae717aecfa897f2
- SHA1 a7d63e2160458726e9f647cb81177cff0d043038
- SHA512 3515424a536ba6f215fb9151d8e5aa23266ac5813ad92977042908c973c768b982d2f5b35002d37dba6a8373ed9043052887ef712dcc80daaee6c2612d10c15e
- SSDEEP 3072:d8e4bBCHr5uWHsmxBYTZgeCvO03qcCcBudMk3QiF/:Ge4b8Lg4DYTOjO0hk3QC/
- TLSH T1D3F32264B184C4A7D4865732DEFC78EC012598EE36BB1248DA539EF732EC71CADD408A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bunnyhop/GDFwSvc.exe unpack001/Bunnyhop/rev0lt/bin/rev0lt.dll
File Explorer
-
bunnyhop_dlja_css_v34.rar.rar 155KB
-
Bunnyhop/GDFwSvc.exe.exe 156KB
-
Bunnyhop/rev0lt/bin/rev0lt.dll.dll 132KB
-
Bunnyhop/rev0lt/skin/Main.bmp69KB
-
Bunnyhop/rev0lt/skin/Mask.bmp304KB
-
Bunnyhop/rev0lt/skin/Thumbs.db10KB
-
Bunnyhop/rev0lt/skin/skin.ini188B
Bunnyhop/GDFwSvc.exe
- IMPHASH e7075482c29e949390e49ccafcdce0e2
- SHA256 545746b86519a50e751e282556b960ff29f24349f8e4597d118c2ff3390331b0
- MD5 fcee9a352ebb22690c31118380eba9a3
- SHA1 c3ee5333ca9af231ec0336f1fd3962a0a767c808
- SHA512 700f9a62e9d1f1a998b87c474f41822643b64f924b8e47e0ade56f271f4cf760a3ac4e84c40cac143582435ce5dedca67551ce9641ac6380709cd2836d88f59f
- SSDEEP 3072:0qCeoT6FavAP6VC7lztvjdhG+nGBIyhJ:HCeoT6aAPb55RhG+abJ
- TLSH T142F39E2275E0E2F2D09585360865EB45AB39FD715F3986D373983F5E9E701C0AB3B288
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\Ex777\Desktop\Rev0lt\Rev0lt Loader\release\Rev0lt Loader.pdb
kernel32
Sleep
CloseHandle
CreateRemoteThread
GetProcAddress
CreateMutexA
VirtualAllocEx
GetLastError
OpenProcess
GlobalFree
GlobalAlloc
GlobalReAlloc
GlobalUnlock
GlobalLock
ReadFile
GetFileSize
CreateFileA
GetPrivateProfileStringA
lstrlenA
ExitProcess
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetTickCount
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
RaiseException
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateThread
GetModuleHandleA
FindFirstFileA
WriteProcessMemory
WriteFile
GetCurrentDirectoryA
user32
GetWindowLongA
SetWindowLongA
LoadCursorA
RegisterClassExA
GetClassInfoExA
TranslateMessage
DispatchMessageA
GetMessageA
CreateWindowExA
SetRect
GetClientRect
DrawTextA
GetWindowTextA
GetParent
SetWindowTextA
DefWindowProcA
EndPaint
PostQuitMessage
SetWindowPos
SetWindowRgn
InvalidateRect
UnregisterClassA
LoadIconA
UpdateWindow
SendMessageA
MessageBoxA
GetWindowThreadProcessId
FindWindowA
ShowWindow
PostMessageA
LoadImageA
BeginPaint
comctl32
InitCommonControlsEx
_TrackMouseEvent
gdi32
BitBlt
GetObjectA
ExtCreateRegion
CombineRgn
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
GetCurrentObject
SetTextColor
CreateFontA
SetBkMode
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
Name
.text
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
68KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=18, id=125, productName=VS2005 build 50727, version=50727,
count=103, id=109, productName=VS2005 build 50727, version=50727,
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=2, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Bunnyhop/rev0lt/bin/rev0lt.dll
- IMPHASH 60a6a61741598595851e0867d2c79dd2
- SHA256 d148592ea5e9fd9cfd13c3a254fd0ef63ea0dfe94c23ae2dd871a9224993743d
- MD5 ea6ceafc2d46d3f42a416a9b292910c4
- SHA1 ac7e8866991260ee49970dddec925a3b6062565f
- SHA512 ddc36473ba0bac1e28f051641c17215ded68fed8024233fb4d36514bcb5ad18ac7d73316af85a4e04f7a767e02386d3bf48c20c426b2563f026f3d95c6bc42b5
- SSDEEP 3072:8yscZ+njgX9LzGcdtSpsMnzNWgTAg0Fuw0CGrt8il9Q:8XcZ+jW9GcdtWXzEgTAOVv9Q
- TLSH T1CAD37C1671F3C4B3D57A013C448A3B3A6BBE95604BB088F75FF0D98D8E663D09A36652
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13906
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Dokumente und Einstellungen\Dieter Detmers\Eigene Dateien\HL²\AldiSkill's Hack\AldiSkill's Hack v1\Bunny 1.2\HL2\Release\HL2.pdb
kernel32
GetProcAddress
GetModuleHandleA
VirtualProtect
Sleep
CreateThread
GetModuleFileNameA
VirtualQuery
HeapAlloc
GetProcessHeap
CloseHandle
GetLocaleInfoW
FlushFileBuffers
GetSystemInfo
VirtualAlloc
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
RaiseException
SetFilePointer
InitializeCriticalSection
InterlockedExchange
LoadLibraryA
LCMapStringA
MultiByteToWideChar
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
ReadFile
tier0
Error
g_pMemAlloc
GetCPUInformation
vstdlib
Q_snprintf
KeyValuesSystem
Name
.text
Size
72KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=49, version=9044,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=5, id=105, version=2067,
count=38, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=134, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=98, id=1, productName=Unmarked objects,
count=19, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Bunnyhop/rev0lt/skin/Main.bmp
- SHA256 e3e8615a90e366471e98291b63a2007fecd0b397f511ce4a3efd7393f267ab80
- MD5 686856cfa10c76effa0c9c56601a4234
- SHA1 471006791f71e5371c9a83d986ce373bd5a4951b
- SHA512 93d5d16a161ce6f0d9f84da58d93e7b955ea46ef8dc4be131f6f2d28c3856bf108194001068fb28baacf6e0d791d584b11a440a86060c984b63aaccd0506fc66
- SSDEEP 1536:Y0T0u3n/fYaPrVUL7nxkNFRYbirDXVfdJ4f8cdQ+EU7pV:XzVW7nxk+bipb4nKg7pV
- TLSH T17863942298848A52F42D1639316D0B2CEB67BF9E6A2C93069D343577FEBB3CD34191D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Bunnyhop/rev0lt/skin/Mask.bmp
- SHA256 f469a211508359ce07c1f5f00c4357f3623cdb32cfcb17638d9a19e7d2d706bf
- MD5 20df11c70a9359017c397b0347b7be45
- SHA1 6079c9d784d7ff9308b66f684511ad9cf3c16c35
- SHA512 7a16f9b5d72669f84e906e405017b1134e22f05d028c46a935465cf79eb7cb11cec871952174357c5f8d4c18df6c9cc2397690dd17752091ee741816a057494c
- SSDEEP 3:+W/l/TVlyVlMl:+9PM
- TLSH T12864040357411704D04410F4007D37041101C73D304043330005D005754354D7DDC451
- MD5 SHA1 SHA512 SSDEEP TLSH
Bunnyhop/rev0lt/skin/Thumbs.db
- SHA256 bad8bab29928fcaa522cc3b26ac347ad505516c4dfbaf21586b6baef78f35126
- MD5 0acf89f2fd09da0257e19470d0138c66
- SHA1 ffce03da6fde9d01d3acc35792a45fdbaebeca6d
- SHA512 2c9b5a511385468d8dea2a1a97874682446308878d94dc9926b547d2f6b151352f0348fc96d0d1c635db185dfc3e7654a242b550fe4adca9459d209494af9e20
- SSDEEP 96:UE1yEqB6GTUK22nIWzBTELWz7sQ67oVVvYHL8adwKBZZioF+Wmv/BDDqyN9wdZ6:UX14K2DWBHy7sFaaKjZiomxDOyQdZ
- TLSH T17B222B4B6E048BD2FD79C7759E11AD99D3F86E01B9A03B0339E4339A9771CD0944C918
- MD5 SHA1 SHA512 SSDEEP TLSH
Bunnyhop/rev0lt/skin/skin.ini
- SHA256 0e6be7119899711f94e0c37799b0b5b30b4a29bf1e47f4bda65a74b495f16f1c
- MD5 b51affbfc602a8bf8404089f5c111d1b
- SHA1 d6f2bf0319a8a8b63d3720a99140419bd46b9530
- SHA512 0710e25db84073474b6f635ece93d71cc6248e12a719b7b991eeed3d3b5082558789d7357a0dfc39815909f8ac8f8a7dac1259cfee2e951b334fd1b5645d8d15
- TLSH T15AC0C947B38E63A58741B5CA69B081B662490B54C83A6089651A14434C3AB7002B967E
- MD5 SHA1 SHA512 TLSH