XivWorkshop-0.1.0.0.zip
- SHA256 d4dee76fb2592d0b7116de432c33e02ec9378b34efca5597f05e96de9c4e3a34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
XivWorkshop.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
XivWorkshop.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
lua/workshop.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
lua/workshop.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
xiv_workshop.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
xiv_workshop.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target XivWorkshop-0.1.0.0.zip
- Size 269KB
- Sample261107-vbzlsaet8j
- SHA256 d4dee76fb2592d0b7116de432c33e02ec9378b34efca5597f05e96de9c4e3a34
- MD5 b7d2dacaddb457142cd81d85e86309aa
- SHA1 3696bdbb2149bbdcd3c3da21530062419226b73e
- SHA512 bb34067a4236c6dc8027e8ea6d39471a2ae135cf92397dc9beeb7de641c9aeadfde7b2c97b2aef3d719daadf6560d26070285648f7df847550a119d21be0d6f5
- SSDEEP 6144:IrixyMhn/YNEXlvlw9MFnOVLqsMQ++MnJw/4/Xn2+2Xa3i5EmK6WlA8:5/YNeXLBujcl/X2RX2ZfTA8
- TLSH T1A34422486F00042209F4B19F5AF7698B334E1724686595C78ADF7760638FC27BEFEA09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/XivWorkshop.dll unpack001/xiv_workshop.dll
File Explorer
-
XivWorkshop-0.1.0.0.zip.zip 269KB
-
XivWorkshop.deps.json409B
-
XivWorkshop.dll.dll 56KB
-
XivWorkshop.json561B
-
XivWorkshop.pdb22KB
-
examples/starter.json1KB
-
lua/workshop.lua.bat 24KB
-
xiv_workshop.dll.dll 454KB
XivWorkshop.deps.json
- SHA256 1b16f337ee78d35d57b89ee4939e5c7eb7b7eb6eaf844b972b4976078fce5cc8
- MD5 80189fedceba9511a881c06c6221a069
- SHA1 84689118493a3ed35df8dd9e46fd65ce38d61a24
- SHA512 0d719a9adaf36623f0b9e8c583651afd24a773aee3e78f39aac6fab324ee0b8b837d35d95f6d634129ab3d42f6555b9f56873956c04c4f492e75fa8a3404c0ff
- TLSH T112E0682FC0F4098300E624F5093C4593F2B0C893040E3C24B58ED11C8F4991B6CB56FA
- MD5 SHA1 SHA512 TLSH
XivWorkshop.dll
- SHA256 74de2ffce6a2131eed7e9f1bf29c9f443845cc3160c6010b5608fb9de4ddf431
- MD5 598b399214ddce5c31922369fdb04c1c
- SHA1 d3bb84d19d9f5c095b7f5dce832e60dfe171070b
- SHA512 3a2b497b3804b74d8ea1a653325537ba0ae24d69ce198afd905dc3950e569a1f976e60cfffb6fac5b316a4ff900d190d9de30788eae75b19d34b60d2064152af
- SSDEEP 1536:5PFYnqEcu5YFyVsbZ9P/wx0q+JRE6hB/G78NmGX+QaILWEPEhrdwyWvyXQ56Kr9r:5PFYnqEcu5YFyVsbZ9P/wx0q+JQ7mm+l
- TLSH T16E43181133AC9726D6BF077A7470102803F9B8A76532E7CE4D89B4E95CA3B414A617FB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/home/runner/work/xiv-workshop/xiv-workshop/src/XivWorkshop/obj/Release/XivWorkshop.pdb
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
XivWorkshop.json
- SHA256 b566e7fc8323d13a09095cba97855c49289f5368f556d031be068ff213625a4f
- MD5 ce79a493593e40105d104ae39f165c2b
- SHA1 f7ebd766de84842a4d58318b82a2cf85451481a6
- SHA512 5496477a0fc3a4be6660bc10b6ffdcf802d938f94f1323a68174c22a1128362c5779ce05fed7ff48e97262a8a721ffa55d2b16f884a0ae19ac14a2efde36e49a
- TLSH T1EAF08B33DA01A0AA27C4529409764803BF948FAB27AAF844AA4FE51440DFA3745797BE
- MD5 SHA1 SHA512 TLSH
XivWorkshop.pdb
- SHA256 886c18a5b374f53f98b1f802e6920777f6a40f0083e5dc42fd2dd9be6651f48a
- MD5 d0e6c571a06b03d027f0f93e90e75713
- SHA1 f474651f79317ea8e06ae56f4fbc5eda1a080cad
- SHA512 0609319d812b776618ef717f8aacb8f33a81223f4b8b1ccb7e39ac9400f56b825544a68d4d744cecfa1e0d12aa15057459e4fabb11e30f49dc03e9c1789444fb
- SSDEEP 384:TWMZTpeBZo9h2xl7cYsa81QZMDa7PJSlY/iV6I8gdG5Gkq6CnHCfKFySPYcEJGHv:T1r0fCCIf3k9JGHHzQJaERS
- TLSH T14FA2A4279348DB15C99419B65433C2A83779C320FB40EF76F1D47A0AED9F7880BB62A5
- MD5 SHA1 SHA512 SSDEEP TLSH
examples/starter.json
- SHA256 17f9431e778b59995fc0330278e548151eb4a958512d626e300c820e4e05fa02
- MD5 30ac532ca6444a8beae30db7dad3a335
- SHA1 0acb6b04fbbcc0b67769684546b38565ef6b3139
- SHA512 2a0173ef2a47a292c267d2da9c295b84f022c31a6a6c52a4e738254d99c4678e24f0630c11f6e13bece554a6ac2d982416d209eac15dbdf83e0505cb591dbb5a
- TLSH T16121992A8590D891D34BA18B6FDE81916C9CE043DAE82F48B7648E58CEDD2808735337
- MD5 SHA1 SHA512 TLSH
lua/workshop.lua
- SHA256 f634f9beccef4bf661c1fd1526563d62d52c6eebb60ae336285d14b58a924ee7
- MD5 47f71f1f52f1c935bb605d66ddd7722e
- SHA1 78561b5f0d2797c041197805c89d9a488e0e1191
- SHA512 73900990c5668207978a3f9c6f9b37549785b5a2cd56f2adbcd2b30c2e5027568d494248c8323559cbfc056f35282842237911928b5f0f86eb6d1e9b66682517
- SSDEEP 768:W7UuaIQ8b+bV7ZPezHpZyfw6nXsairE4L7MxGbo9SHEQk204r3afe3AFvobEEb9R:sUobBwfwMxGbo9SHEQWcr9
- TLSH T193B2608EAD419A300793CAB1E89B0416F72D3112611C296AB5FD81E02F2576D86FFF7C
- MD5 SHA1 SHA512 SSDEEP TLSH
xiv_workshop.dll
- IMPHASH 7c103ca66743329a667c4652db31489c
- SHA256 4092558a3889b536f6f6831908cd4b2c4784410eb3a4d7740abdb4ae8d3c2c30
- MD5 37144f2b38b7726946351c5405d40c33
- SHA1 27ef33a57536ad8633e80c1bba128c3fa3abf766
- SHA512 48265dfd4ca9fade7d034cdef367af85e9a94873faa037c0f7747c17a23994437228c5abc04bcf550b64d4e35ece06fea533a463efbc00f7868acd46f94e4128
- SSDEEP 12288:AbQfKMiU0ehQA/gr+ikPiEyLOzK8QnBScUUM:AbSm4E+ikdyLOzK8QnBScUU
- TLSH T1DBA48C0670A2A5ACD427C0744207A635A473785C4770ACFF27D2DB342DA6FE25FB7A68
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xiv_workshop.pdb
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
realloc
api-ms-win-crt-runtime-l1-1-0
_errno
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
exit
strerror
system
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
_pclose
_popen
clearerr
fclose
feof
ferror
fflush
fgets
fopen
fputc
fread
freopen
fseek
ftell
fwrite
getc
setvbuf
tmpfile
tmpnam
ungetc
kernel32
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetLastError
GetModuleFileNameA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryExA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
api-ms-win-crt-time-l1-1-0
_difftime64
_gmtime64
_localtime64
_mktime64
_time64
clock
strftime
api-ms-win-crt-string-l1-1-0
isalnum
isalpha
iscntrl
isgraph
islower
ispunct
isspace
isupper
isxdigit
strcmp
strcoll
strcpy
strncmp
strpbrk
strspn
tolower
toupper
wcslen
api-ms-win-crt-private-l1-1-0
__intrinsic_setjmpex
longjmp
memchr
strchr
strrchr
strstr
api-ms-win-crt-math-l1-1-0
acos
asin
atan2
frexp
ldexp
pow
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
setlocale
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
remove
rename
api-ms-win-crt-convert-l1-1-0
mbrtowc
wcrtomb
ws_box_vertex
ws_call
ws_create
ws_destroy
ws_error
ws_memory
Name
.text
Size
370KB
Virtual Size
369KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
97B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ