triclapclap-v1.3.0.zip
- SHA256 94e43ca229dbf70dc6ac4a8e28102ed4b57f1b0050f155852df4a5d40d405352
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
index.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
index.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
triclapclap.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
triclapclap.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
triclapclap.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral6
Sample
triclapclap.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target triclapclap-v1.3.0.zip
- Size 6.5MB
- Sample261102-mxhamagz71
- SHA256 94e43ca229dbf70dc6ac4a8e28102ed4b57f1b0050f155852df4a5d40d405352
- MD5 9fd797fcb2a44e6b1754bef6e7ec085f
- SHA1 148b4b618e1ea5de2b05d88e22a0ecadc728038b
- SHA512 2f255b1e15d67e30b349ab622e0e2bc1f84c81717bb7052f58679140937c56b104f009caf29c86630f923a4bf93dc65bfa75c816391084d6269606c4b0b79de2
- SSDEEP 196608:hGLTbow1TlaFZtmAXohmj36A/crWwD+1YOZ590+:hGLTcw1TlaNmAXohme4c6+C0+
- TLSH T1FF6633B26ABDDCC9D77D00A9BA81B4168449E311FC704A3D1FFA264632B3C7DA5164EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/triclapclap.dll unpack001/triclapclap.exe
File Explorer
-
triclapclap-v1.3.0.zip.zip 6.5MB
-
Assets\PlayArea-0.png.png 800KB
-
Assets\PlayArea-1.png.png 833KB
-
Assets\PlayArea-Hit-0.png.png 898KB
-
Assets\PlayArea-Hit-1.png.png 904KB
-
Assets\PlayArea-Hit-2.png.png 807KB
-
Assets\PlayArea-Hit-4.png.png 815KB
-
Assets\PlayArea-Hit-5.png.png 813KB
-
Assets\PlayArea-Hit-6.png.png 803KB
-
Assets\slap.wav41KB
-
index.html.html .js 2KB
-
triclapclap.deps.json427B
-
triclapclap.dll.exe 24KB
-
triclapclap.exe.exe 158KB
-
triclapclap.pdb17KB
-
triclapclap.runtimeconfig.json519B
Assets\PlayArea-0.png
- SHA256 7a832add4ed551d005111f528cc2434c09c79ba3ea2e224f4ce1f037cdda1afb
- MD5 b885a6730fd8bbead3befe5ad3a27ace
- SHA1 de9965bdfd348bcff352a97485eeb7d62bedb0cd
- SHA512 639579ed2697a9b78f2549f3f4da4a603640dc67a736c206bd0cd343796f8752ce2567833e1e7274912641f692c8588d1a9fe15fa9eb0ffe7d3934473a79b277
- SSDEEP 24576:yHgSc/K+KEtyud+wOS7nJJjIDE60DC+oTTx+HWhrPWXHSrWA3ivXiDiuaBdruBqm:yraXnPvXiDpaTrNcUe
- TLSH T1F405230B8FF1CCF3E086EC23A10B667714F5845540887BE50376AAFCBE16AB54786E56
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets\PlayArea-1.png
- SHA256 cbe311a86da393023499b785b76fb23ae6efdb459c3268c7fcf7ea0d7923f532
- MD5 23555e95832645123eda697c06bd0461
- SHA1 f0f49e7db50e8d6bad350b04de190f846f839441
- SHA512 06064669455f212dd1327370293e8e6efaed85e2174ec808ee29d97c8d293539579840bd4d40bcfbadccaa6d98145961a663486c038d2fdd4eaa046dcc2e82ca
- SSDEEP 24576:J+2IS15fjePzLjZRjl6C60gkNh/WhOTUSCyFR1i/FMYWVKgMOAFN5/r8RTc6rb13:JjlN5/r8RTd5fwzl0G5W9
- TLSH T15A05230B48BB5CB3D1E051C9792F3347A89A9152E73137264BBDC29F069F3BD2215A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets\PlayArea-Hit-0.png
- SHA256 fd9134527a323c24ce80e5ecb9c6047baad9f7087f217d425ab00a2d61226868
- MD5 8b6c94212bd4f705551c618d394850de
- SHA1 9105ca678b0475a75298b12c2525b8c5f60fc7d4
- SHA512 d09ea1b9623b28df5ef07c3078ac69f233a178858da28553c736ecb698309d38168966292702d144581b91a913a15b4268cfe5b09ba002ead2cb7dd899c6cdd4
- SSDEEP 24576:D43Btv7XpJ+exRSMnQC/to5nhDc5nYy2EXTtBPG6Cz:DEtv7XT+i9to5nhDc9Yy2WBPGFz
- TLSH T18215230632B3967ED7A74E111F623A2366AF814CC2A65E04847DC15A23CB67C668CFD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets\PlayArea-Hit-1.png
- SHA256 825313b97e2a8d659828b3fd33700d6ba20ea997b73a2d0890fd63fde941adcc
- MD5 aa76bb4c5d90ea804af4c40ad70f5531
- SHA1 a19306a04bb655f92d4b43ec915bcf324c98698c
- SHA512 6031f2df95c5ba9e2e8795a68399bfd158885b691c6c0d3af276d9a1fd9cbbbd355391ef8a18efb42d4a57e1d9547bd758044f8b6132bf3150052e7304948c12
- SSDEEP 24576:Ea/Q6cXMnAYyNvln/RvA5cf8EEYHAEIqbkbBM+2bwzm2zObESgwecebbQWMzMKJI:Eao6MEBUeh3GYLvp
- TLSH T15D15232AADF36EF4D0A7A804343375CE5E8F911B4B13B69AD271C1A8078B5F11781B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets\PlayArea-Hit-2.png
- SHA256 c71bcfe12de7659ee49e43861e33be859b187917ddb5b474fd345a5ee282e8d0
- MD5 4df73424dab375abbe8196f6481ab6eb
- SHA1 176aaf51359835e00e4d4f740fde6e63e6a0161a
- SHA512 9ae1e5ac4c97a71b6071823329a9c66ab5974924521d895f1186a639f868d966fd6376f63a4b9e0756a128a6f85e6c4a4590ba03e2028dca4e3f203a9cbed27a
- SSDEEP 24576:MAcK28avTIFSp+Ov2tVKWRjilpddi+1vJ4BeeIsEDFIQpAZgYarwXYvjk257UQZT:bFN1XYbk257jEH12Hj
- TLSH T1B405232B68E0A9B7DADDE567502B91BFB7E915CC0200330546719BCC3D47BF9A1CA26C
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets\PlayArea-Hit-4.png
- SHA256 9e2f1c2b8ce066237d89808697e35b8c0e87c6fa7b40153bff91d671989b40e5
- MD5 6d73df5ca12cf5cdd13968fc64434a00
- SHA1 86d83cef3d139e9508ab9d1d0fd01779b1e70617
- SHA512 1112f7731a949f4ad0f81e93454678d6197866d68835b071031fd0235843b1e4198c3ed1f5dedcb9caa141348831d8733929ece38a4243616533f2f496c4ad66
- SSDEEP 24576:CodW+xugpzsvOoJlyn/0vYifiNVtpOTSmRCCicK0JOlg86VKPsFFuy1ZdEd4mE1m:AZPBOpKRMnybn0Mq
- TLSH T1B105232AF872EDF7D5D21096FC4B3ABB1D5B9502D8E07221C0B596B8905327E5309F8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets\PlayArea-Hit-5.png
- SHA256 52fc7063cb9b087870ab2700fdf7fd227e1cf9422d297d3e4773fe98f87ee8d0
- MD5 171fd9251f72fb9b60f13246006d84c8
- SHA1 963607034a993fa4795b95b9ef1200a7b8621d0f
- SHA512 25880d3bcaa5a8a326a155501709988b3821c5372597fc4ff04ff295c3ea6fe728073be57585c6c5c28bead55aae8bcd4f3f0a88dbf0601c3491f9443d721ef0
- SSDEEP 24576:ry+nmlU/rS3/cJeodCsy+XTGd47MEGQ1nUIk2mi5OaJgLTn3NKsaAcztaHxAv7EB:9KUyskGyYFX76kPW
- TLSH T13A052334CCF7DDB9A4D30516902B319FE847E2069EC0B251C676D5FC56AB2BB2683A4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets\PlayArea-Hit-6.png
- SHA256 c9c83e4406d1d7ba152b3464e263c3f42f31d55befb08f223e2a224e2d86c575
- MD5 33b7a55cf03707a870ad85339ed8403a
- SHA1 f9a1fe0341d4f89aa5e2dfe5dd459e65956182b3
- SHA512 64a3e7bb5cfaaab8f29cc5f89d5b8fb7bc51383d0782d6b949e6cff01e71a78c928decc0a4ee2f5703ce9b0e494091e37844621e04fca502114cb9ed604de2e7
- SSDEEP 24576:YSR+Tz4mtoB1MqLXbGIcyyZ+ETizS7dss0gNZaJPfnrrwWv664MIA8ljbTKF/Eqk:xZU8QFwj0GmZQt4CPKVhNol4p
- TLSH T1780523298CF75633DC92208C195B2287EA176087C7A7B204DE7660D47BEB2FCB591D2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets\slap.wav
- SHA256 2f9ecb3e17e1276ca5a3f009190913ce37b68d79df5ac337cd6baee4b731984a
- MD5 7065792b8e1571d93d867af78c4560f1
- SHA1 47025cd3751995e3fd0f390032af1da774f19cd9
- SHA512 f3fb1d592d3f8219446ac71ac2ac09dcca6c0ddda958cecbd7cc7bccc826abb150973a06ed87f369e1cb50989cfd8ae1bf0be834ff51588c2c1ff58fea142321
- SSDEEP 768:NqXSqItRT3uBIo9tiyHYQ0X/CtQslsb+djngEBl6lqD6Cyi+G4uzNok:oCqItlNonUslsigIIqe84uRok
- TLSH T16C137ED3E40B86100C5A8E16CD23D9608B63342FFF4B1A1A60C8BF5D66E7547E735B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
index.html
- SHA256 4418bf002c0622c6c6e00beaf090b06c49d32be6db66b786ef3cc2da9a7ad3ab
- MD5 aef7b6dddee01be338af33abd82c82e6
- SHA1 79ff920cdd72a5ca120bb4747edbdc19114e6e79
- SHA512 a8767e4cac252b3b5517c058f9b2fefc6c9c65eceffc994a0f594ff5cb40f97870af8c642f04abdb1edd4fda1b54863517f3e6580ed6aa967430d912a4b887be
- TLSH T1DA41341821241018947BB1FEEFA3634CF4322243324246AC7E8DDA51CFB7D555893EDC
- MD5 SHA1 SHA512 TLSH
triclapclap.deps.json
- SHA256 acebdf089f4b9551caa6acc60dae7b7afbcdec5156c4a39d72d6b6a9e28f23e8
- MD5 f928b08a931b6e8cac5bbbff99863ccd
- SHA1 dbcfa3af2346e70b9cf0b5fb4ed1284db5cf9a81
- SHA512 5b85c6b45a6a6873a56dd88c329228dd697c56b3cedcb67eadb65072f0c2053865fe2804c0d3cf55b72a26c31954aba6edabe2019f71be08dc95146cdb6083b3
- TLSH T17AE09A29EAA40CB700B223B254364382F5B356635022384AB9FE905C0FB385B54A0F66
- MD5 SHA1 SHA512 TLSH
triclapclap.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5ed921010094a01b3ae664b14d96cfd399b4ce613761640c93f7236555a1a63c
- MD5 db21a0d09c6fcc2e296ab2086e4f2f48
- SHA1 369bddbbbe705f874a160bdfd43b84bb6a69b311
- SHA512 842300d7a643474689bf08e066c2ede36b2d8dc39d4167e204c438a1d7e5b6c31bf2a04f38d88fa396e491a31127974ad93e4e61ca3e547220384559e4f0e226
- SSDEEP 384:cQH/esdFYDvNKxkzKvc3Slbo1pt96E1kvRRsy01eJLCxBGpg1y5jXFD6g03m15ka:ck/eA4oxk2vc3+opP6E75W3xXGm5MzD
- TLSH T107B24B1477BC8323D57F07FDD821128117B6A3A46503EBAD5EC8B0E98E93B014622BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\TriClapClap\TriClapClap\obj\Release\net10.0-windows\triclapclap.pdb
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
triclapclap.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 184e69b712df7db18604827f726f932be9937f26d4fa809ff9e55c33625175c9
- MD5 05ee5f8695c7255eb4ccca425936168b
- SHA1 ce04a3721cd6d6a69d612d90405146abd78c80c9
- SHA512 73330c3c276633d8d724827a65f5ffdad8168501155243772b012d3402cf9016aa6922830adbd350b9bf750af8d903da0afc971ab8c0b3e5fc49e72b9bcb72b6
- SSDEEP 3072:BlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT5SB:/AIwxrI14Q3kYBTMl
- TLSH T11BF32B13A6A811BEE1B3D678C9924941FB7278594B71A7CF07504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
triclapclap.pdb
- SHA256 8f4992a1200190f4e807361dd5f161965ae1652945ceb28da8339447c173f63a
- MD5 89d557ce7ac30c011fa9f4c87f1d9ead
- SHA1 7ec57de34ca06fc134a8c0445a70ef86cdeb28e6
- SHA512 84b7bf9e6d9256dec1d62241434110917e3af9726913689ae70c3cbd86103d15b7c6f550e6d0ac929ed1402883370b3156840f53c83bcc8b9c1bb0aca1203c24
- SSDEEP 384:SG5nGJOw2/sfaIvz1d+byShoXJz477d+rUQoqmWNcKrpQHRfax7EsHS3wj3UNhcQ:n/UJOcoGqd3wz8V6Yh
- TLSH T1F182D437A35CCA60D48229B7992BC28C773083206B45EF78F6D82A54DDBF7A903B5174
- MD5 SHA1 SHA512 SSDEEP TLSH
triclapclap.runtimeconfig.json
- SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
- MD5 7e4444b5a3e3cea574693f055f944011
- SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
- SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
- TLSH T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
- MD5 SHA1 SHA512 TLSH