Oneshot.rar
- SHA256 2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4
Overview
overview
7Static
static
5Oneshot/Da...78.ps1
windows10-ltsc_2021-x64
3Oneshot/LAUNCHER.exe
windows10-ltsc_2021-x64
6Oneshot/OpenAL32.dll
windows10-ltsc_2021-x64
3Oneshot/SDL2.dll
windows10-ltsc_2021-x64
3Oneshot/SD...ge.dll
windows10-ltsc_2021-x64
3Oneshot/SDL2_ttf.dll
windows10-ltsc_2021-x64
3Oneshot/Sm...mu.dll
windows10-ltsc_2021-x64
3Oneshot/Sm...64.dll
windows10-ltsc_2021-x64
1Oneshot/_R...up.exe
windows10-ltsc_2021-x64
7Oneshot/_R...up.exe
windows10-ltsc_2021-x64
7Oneshot/_R...st.exe
windows10-ltsc_2021-x64
6Oneshot/_R...86.exe
windows10-ltsc_2021-x64
7Oneshot/_R...st.msi
windows10-ltsc_2021-x64
7Oneshot/_______.exe
windows10-ltsc_2021-x64
5Oneshot/li...mt.dll
windows10-ltsc_2021-x64
3Oneshot/libbz2.dll
windows10-ltsc_2021-x64
3Oneshot/li...-6.dll
windows10-ltsc_2021-x64
3Oneshot/li...-1.dll
windows10-ltsc_2021-x64
3Oneshot/li...-0.dll
windows10-ltsc_2021-x64
3Oneshot/libgmp-10.dll
windows10-ltsc_2021-x64
3Oneshot/li...-0.dll
windows10-ltsc_2021-x64
3Oneshot/li...-2.dll
windows10-ltsc_2021-x64
3Oneshot/libintl-8.dll
windows10-ltsc_2021-x64
3Oneshot/libjpeg-9.dll
windows10-ltsc_2021-x64
3Oneshot/liblzma-5.dll
windows10-ltsc_2021-x64
3Oneshot/libogg-0.dll
windows10-ltsc_2021-x64
3Oneshot/libpcre-1.dll
windows10-ltsc_2021-x64
3Oneshot/libphysfs.dll
windows10-ltsc_2021-x64
3Oneshot/li...-0.dll
windows10-ltsc_2021-x64
3Oneshot/li...16.dll
windows10-ltsc_2021-x64
3Oneshot/li...-0.dll
windows10-ltsc_2021-x64
3Oneshot/li...-6.dll
windows10-ltsc_2021-x64
3Behavioral task
behavioral1
Sample
Oneshot/Data/Map078.ps1
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral2
Sample
Oneshot/LAUNCHER.exe
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral3
Sample
Oneshot/OpenAL32.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral4
Sample
Oneshot/SDL2.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral5
Sample
Oneshot/SDL2_image.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral6
Sample
Oneshot/SDL2_ttf.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral7
Sample
Oneshot/SmartSteamEmu.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral8
Sample
Oneshot/SmartSteamEmu64.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral9
Sample
Oneshot/_Redist/dotNetFx40_Full_setup.exe
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral10
Sample
Oneshot/_Redist/dxwebsetup.exe
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral11
Sample
Oneshot/_Redist/oalinst.exe
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral12
Sample
Oneshot/_Redist/vcredist_x86.exe
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral13
Sample
Oneshot/_Redist/xnafx40_redist.msi
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral14
Sample
Oneshot/_______.exe
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral15
Sample
Oneshot/libboost_program_options-mt.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral16
Sample
Oneshot/libbz2.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral17
Sample
Oneshot/libfreetype-6.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral18
Sample
Oneshot/libgcc_s_sjlj-1.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral19
Sample
Oneshot/libglib-2.0-0.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral20
Sample
Oneshot/libgmp-10.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral21
Sample
Oneshot/libharfbuzz-0.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral22
Sample
Oneshot/libiconv-2.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral23
Sample
Oneshot/libintl-8.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral24
Sample
Oneshot/libjpeg-9.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral25
Sample
Oneshot/liblzma-5.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral26
Sample
Oneshot/libogg-0.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral27
Sample
Oneshot/libpcre-1.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral28
Sample
Oneshot/libphysfs.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral29
Sample
Oneshot/libpixman-1-0.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral30
Sample
Oneshot/libpng16-16.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral31
Sample
Oneshot/libsigc-2.0-0.dll
Resource
win10ltsc2021-20260911-es
Behavioral task
behavioral32
Sample
Oneshot/libstdc++-6.dll
Resource
win10ltsc2021-20260911-es
| resource | yara_rule |
|---|---|
| static1/unpack001/Oneshot/_______.exe | upx |
File was codesigned using an insecure algorithm.
| resource |
|---|
| unpack001/Oneshot/steam_api.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Oneshot/LAUNCHER.exe |
| unpack001/Oneshot/OpenAL32.dll |
| unpack001/Oneshot/SDL2.dll |
| unpack001/Oneshot/SDL2_image.dll |
| unpack001/Oneshot/SDL2_ttf.dll |
| unpack001/Oneshot/SmartSteamEmu.dll |
| unpack001/Oneshot/SmartSteamEmu64.dll |
| unpack001/Oneshot/_______.exe |
| unpack002/out.upx |
| unpack001/Oneshot/libboost_program_options-mt.dll |
| unpack001/Oneshot/libbz2.dll |
| unpack001/Oneshot/libfreetype-6.dll |
| unpack001/Oneshot/libgcc_s_sjlj-1.dll |
| unpack001/Oneshot/libglib-2.0-0.dll |
| unpack001/Oneshot/libgmp-10.dll |
| unpack001/Oneshot/libharfbuzz-0.dll |
| unpack001/Oneshot/libiconv-2.dll |
| unpack001/Oneshot/libintl-8.dll |
| unpack001/Oneshot/libjpeg-9.dll |
| unpack001/Oneshot/liblzma-5.dll |
| unpack001/Oneshot/libogg-0.dll |
| unpack001/Oneshot/libpcre-1.dll |
| unpack001/Oneshot/libphysfs.dll |
| unpack001/Oneshot/libpixman-1-0.dll |
| unpack001/Oneshot/libpng16-16.dll |
| unpack001/Oneshot/libsigc-2.0-0.dll |
| unpack001/Oneshot/libstdc++-6.dll |
| unpack001/Oneshot/libtiff-5.dll |
| unpack001/Oneshot/libvorbis-0.dll |
| unpack001/Oneshot/libvorbisfile-3.dll |
| unpack001/Oneshot/libwebp-5.dll |
| unpack001/Oneshot/msvcrt-ruby220.dll |
| unpack001/Oneshot/oneshot.exe |
| unpack001/Oneshot/steamshim.exe |
| unpack001/Oneshot/zlib1.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/Oneshot/_Redist/dotNetFx40_Full_setup.exe |
| unpack001/Oneshot/_Redist/dxwebsetup.exe |
| unpack001/Oneshot/_Redist/oalinst.exe |
| unpack001/Oneshot/_Redist/vcredist_x86.exe |
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=152, version=20115,
count=3, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=20, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=13, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=119, id=1, productName=Unmarked objects,
count=6, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=152, version=20115,
count=48, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=194, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=320, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=306, id=1, productName=Unmarked objects,
count=287, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=152, version=20115,
count=19, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=195, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=313, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=311, id=1, productName=Unmarked objects,
count=287, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=158, version=20928,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=43, id=171, version=21009,
count=18, id=158, version=21009,
count=105, id=170, version=21009,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=194, id=1, productName=Unmarked objects,
count=69, id=175, version=20928,
count=1, id=171, version=20928,
count=1, id=155, version=20928,
count=1, id=154, version=20928,
count=1, id=157, version=20928,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=13, id=25, version=9210,
count=126, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=24, id=28, version=9178,
count=1, id=61, version=9210,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 3, 2009
CN=Creative Labs Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=CLI,O=Creative Labs Inc,L=Milpitas,ST=California,C=US
count=18, id=125, productName=VS2005 build 50727, version=50727,
count=107, id=109, productName=VS2005 build 50727, version=50727,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=135, id=1, productName=Unmarked objects,
count=9, productName=Unmarked objects (old),
count=34, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=125, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
Aug 23, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Jul 16, 2016
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=23917,
count=150, id=1, productName=Unmarked objects,
count=97, id=259, version=23917,
count=498, id=260, version=23917,
count=1, id=256, version=23917,
count=188, id=261, version=23917,
count=1, id=255, version=23917,
count=1, id=258, version=23917,
Unsigned PE
Checks for missing Authenticode signature.
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Sep 27, 2016
CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.