XivWayfinder-0[.]1[.]1[.]5[.]zip

General

Target
XivWayfinder-0.1.1.5.zip
Size 434KB
Sample261107-vb1h3set8k
SHA256 a132fc3b8d8df662dd4ff39c92b23f5f1eef6f5ce663a6278ba7f253d47c622a
MD5 972aac47ed9c089f3d17faf8596e0572
SHA1 db943a95e8fab2659c56dcebc60024e9783f7503
SHA512 153577d8c8c9eaa02619c32aa67f863470967c84272d597a31dae62d024b078efde66a8c259317d8261e4699c7c7f1428dd63fdf5fa00175eb4fe64f3e1bedf2
SSDEEP 12288:cE5/SzxBGlIO6v9CiakWm5Q8xCqtIEIUD:JwxslId9Cibh0TUD
TLSH
T1F79423DF4C76CB2BD987B07DA8EA18400BEE39462360397E27D27CD813614C759E8D92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/XivWayfinder.Core.dll
unpack001/XivWayfinder.dll

File Explorer

XivWayfinder-0.1.1.5.zip

.zip 434KB
XivWayfinder.Core.dll

.dll 531KB
XivWayfinder.dll

.dll 453KB
XivWayfinder.json

1KB

XivWayfinder-0.1.1.5.zip

SHA256 a132fc3b8d8df662dd4ff39c92b23f5f1eef6f5ce663a6278ba7f253d47c622a
MD5 972aac47ed9c089f3d17faf8596e0572
SHA1 db943a95e8fab2659c56dcebc60024e9783f7503
SHA512 153577d8c8c9eaa02619c32aa67f863470967c84272d597a31dae62d024b078efde66a8c259317d8261e4699c7c7f1428dd63fdf5fa00175eb4fe64f3e1bedf2
SSDEEP 12288:cE5/SzxBGlIO6v9CiakWm5Q8xCqtIEIUD:JwxslId9Cibh0TUD
TLSH
T1F79423DF4C76CB2BD987B07DA8EA18400BEE39462360397E27D27CD813614C759E8D92
MD5 SHA1 SHA512 SSDEEP TLSH

XivWayfinder.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d043e6e0d49436072b8add6e20d073428377a8b59a97fac0ebf4e077f3de3911
MD5 6d88395c4d242f1344134a4481fa06ce
SHA1 ae5f7ad828532f50164f192cf68b869539894ec5
SHA512 8fa56552510be9320cdfa4d36d803395fc410bac0cd889c10935a86c8c06ca633f61e2872a329186cfc5efce573618cbe0a527868edba3c4c8d9eabc5389e545
SSDEEP 12288:d1ZY/nDU16TitsdOCYMD2lR2nv53El3yTtW/:vZEmTsnYMD2Snv53EEW/
TLSH
T1A2C419102FE8EA1AD5EE4735F0F40D76C6B6B41E71BAE76D4E5864AE2ED37418800363
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

549898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/xivwayfinder-dalamud/xiv-wayfinder-build/artifacts/obj/XivWayfinder.Core/release/XivWayfinder.Core.pdb

XivWayfinder.dll

SHA256 ecaefcc333842e483704a497cff0d1d0f044f681a4c23b441ab9588f6c828f43
MD5 974462702f8193638f0415a221498e61
SHA1 96b8b576e34cb0ddd650e949ffccdb61319fdf15
SHA512 df2bfead680c52e60311a82d428bdfaa601e222722c4f11a8168e5be35caeae7e6334c5b409c568adf1cb3a8e325971d24ab94fdfb1bf6ac5c5c0475b6a618c0
SSDEEP 6144:knNWh+7z2hIaXNjABDCVhZWBhlR4pFo2HTZ8SB8438CrUVP+vYekMaFaf8e1D7BN:YNq+7qXNjABDuZuRSeSNPYhe1D7Lbn
TLSH
T1ADA4496023F84366F5FF2BB8F4B10919977A7C8AA93DD35C8D4066EE29E27409950733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

XivWayfinder.pdb

XivWayfinder-0.1.1.5.zip

XivWayfinder.Core.dll

mscoree

dotnet

XivWayfinder.dll

generic

XivWayfinder.json

Sharing

General

Malware Config

Signatures

File Explorer

XivWayfinder-0.1.1.5.zip

XivWayfinder.Core.dll

mscoree

dotnet

XivWayfinder.dll

generic

XivWayfinder.json