Air_Hockey.zip
- SHA256 7a5be57fe03f23b95a0d5221300e24500bf0ca4394e306f73db78c21275b3d5f
Behavioral task
behavioral1
Sample
MidpRuntimeDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
MidpRuntimeDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
jamdat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Air_Hockey.zip
- Size 1005KB
- Sample261104-ynna3ac121
- SHA256 7a5be57fe03f23b95a0d5221300e24500bf0ca4394e306f73db78c21275b3d5f
- MD5 5cb5ffc108c3d6c4896d13703aece6b6
- SHA1 b7af06b9cc6cf07f47743c5643f5f6e0d5613bec
- SHA512 97a7e96d5254ad6697053510e547f274630695a65516ab8d1259f5ca8a4afe5a377c88dbd7604f348137fe840e415c886cb128cbd53305705f115f6aab231185
- SSDEEP 24576:4gnh+PPGZU1u0LwcHYwvoTdbQb/c7iO5nfr4fcDgh4+m:EPOaEZhbm/c7iGMfcDgh4+m
- TLSH T1B4253349F93711CA46B4AC9679C55DE8BC17165B3E6E0C47E2F390280FD9A472E1C83E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/MidpRuntimeDLL.dll acprotect -
resource yara_rule static1/unpack001/MidpRuntimeDLL.dll upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/MidpRuntimeDLL.dll unpack001/jamdat.exe
File Explorer
-
Air_Hockey.zip.zip 1005KB
-
MidpRuntimeDLL.dll.dll 810KB
-
jamdat.exe.exe .js 261KB
MidpRuntimeDLL.dll
- SHA256 6a4e5029e4b8bc752c40e8b82f27d932616f2fd08859774c877d4fa1a4aaf24b
- MD5 05a03292950ee26ed5231f6eea45388d
- SHA1 333afbf81390d8e9e79df0e7d68b3e226da6a866
- SHA512 7d535207c941dc7ef32b013790dfb22e8bc9dab7eb12dfaa4b15f747bd1a7774ecfd9d5cd537b8a28ca60490bbd0fa0d5f1dcb30567ab5f587139e44aabee59a
- SSDEEP 12288:ipkC5tmfpawAG0PsPNNB0IeoCIVoBr//f+NkQwgGrau9MaezJdg/ylXTMBcGit7t:ipMfX00PNHLeNDrv+NCgGra7dahyh7
- TLSH T18D05233BDB43A5A3C88D1D3413B76272E454830160673A698D73FE9C59BFAE9E903A11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1950240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
VirutalMachineRuntime
Name
UPX0
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
801KB
Virtual Size
804KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=10, id=39, version=9162,
count=42, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=24, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=28, version=9178,
count=2, id=37, version=8755,
count=19, id=25, version=9210,
count=363, id=1, productName=Unmarked objects,
count=269, id=28, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=63, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=69, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,
jamdat.exe
- IMPHASH 2f45fb0ef446119d6c3f305a42d55768
- SHA256 b1ea1f6f38204dd5014f94c8f2e3d4c774674e1d3cfaf828728ea466e147f1af
- MD5 b903a4d932d3106c9e4ab8cdbbc0dd67
- SHA1 763bc3d660bbe63377853d8b7c37d53528a55bb8
- SHA512 540508ac0e69ad6242019ca9675375f69f6d9328fad3c15b3531b473739ffe5db7bcd3faf70cf32c7c2ecacde5b53e130575082d565fe2735def7fdd36891c14
- SSDEEP 6144:TC+LkZJmkY+wozeGFUQgz7aBpaXKK5jGClkg7Ik9iAF2p:+PJrP3z2q7aX95CClFUoiD
- TLSH T12144F163FB99C4B2F223137146302556FB3AD690B999B40696B01F532E371DEC94A2CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38333
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\IPersist\Projects\KvmSMT\Midp_workspace_2_0_nhal_standalone-dll\Launcher\Release\Launcher.pdb
kernel32
GetLastError
MulDiv
GlobalUnlock
GlobalLock
lstrcmpA
WideCharToMultiByte
GetModuleFileNameA
SetLastError
lstrcmpiW
FreeLibrary
SizeofResource
LoadResource
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
GlobalFree
GlobalHandle
LockResource
CloseHandle
UnmapViewOfFile
lstrlenW
MapViewOfFile
CreateFileMappingA
CreateFileA
GetProcAddress
LoadLibraryA
GetCurrentThreadId
ExitProcess
HeapSize
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
lstrcatA
lstrcpyA
RtlUnwind
InterlockedIncrement
InterlockedDecrement
lstrlenA
FindResourceA
GlobalAlloc
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InterlockedExchange
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
IsBadReadPtr
user32
wsprintfA
RegisterClassExA
CreateWindowExA
CreateAcceleratorTableA
CharNextA
GetParent
GetClassNameA
SetWindowPos
GetDlgItem
IsWindow
SendMessageA
GetFocus
IsChild
GetWindow
SetFocus
BeginPaint
LoadCursorA
CallWindowProcA
GetDesktopWindow
UnregisterClassA
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
GetClientRect
FillRect
SetCapture
ReleaseCapture
GetSysColor
DestroyWindow
DefWindowProcA
DestroyAcceleratorTable
LoadStringA
GetWindowLongA
GetActiveWindow
MapDialogRect
SetWindowContextHelpId
GetWindowRect
SystemParametersInfoA
MapWindowPoints
EndDialog
DialogBoxIndirectParamA
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
EndPaint
GetClassInfoExA
SetWindowLongA
RedrawWindow
MessageBoxA
gdi32
CreateSolidBrush
GetStockObject
GetObjectA
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
advapi32
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
ole32
CoInitialize
CoUninitialize
OleUninitialize
OleInitialize
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
oleaut32
VariantCopyInd
VariantChangeType
DispCallFunc
LoadTypeLi
LoadRegTypeLi
VariantInit
VariantClear
OleCreateFontIndirect
SysStringByteLen
SysStringLen
SysFreeString
SysAllocString
SysAllocStringLen
VarUI4FromStr
comctl32
InitCommonControlsEx
Name
.text
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=8, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=4, id=28, productName=VS2002 (.NET) build 9466, version=9466,
count=3, id=28, version=9178,
count=2, id=37, version=8755,
count=13, id=25, version=9210,
count=161, id=1, productName=Unmarked objects,
count=8, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=69, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,