Genshin-HK.zip
- SHA256 e881f4e8009c7ee89c40dcbf2c79c0213d8a3f9079f88d623907296c2be616c2
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Genshin-HK/Genshin-HK.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Genshin-HK/Genshin-HK.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
Genshin-HK/libcurl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
Genshin-HK/libcurl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target Genshin-HK.zip
- Size 3.5MB
- Sample261107-xftx7set9s
- SHA256 e881f4e8009c7ee89c40dcbf2c79c0213d8a3f9079f88d623907296c2be616c2
- MD5 ce45752a3728ee48322516e719c28d94
- SHA1 88e3c79936b6a5a4c80c17a896d803f53c4700f6
- SHA512 9b3e49221ba48a319e708dd6d59ced669798e69dff537b01ff0b6d8858e00b6da7c63c6c4f7d01fefa49d251ddc8f3b0f70a55e3ccdac3347177d1cfc8a790a9
- SSDEEP 49152:J7qe90GTRg9OB2E14kEitnmXoUyKtl6PbftpnQUEMUyyuNJ606tzfZNy2yG3+MQ:J7f90Gdg5E146YUVPbfHwf1xNkQQ
- TLSH T18BF53318C1BC657D5A291BBBF2D67680D686CED8FEEDAF4CF2CDC5EAA65100407804B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/Genshin-HK/libcurl.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Genshin-HK/libcurl.dll
File Explorer
-
Genshin-HK.zip.zip 3.5MB
-
Genshin-HK/Genshin-HK.exe.exe 785KB
-
Genshin-HK/KEY19B
-
Genshin-HK/gup.xml.xml 4KB
-
Genshin-HK/libcurl.dll.dll 10.1MB
-
Genshin-HK/readme.txt178B
Genshin-HK/Genshin-HK.exe
- IMPHASH 0b43764663ba024c8202f35227fe0bff
- SHA256 eaac64c113ebaba1fae924ad1b6239a44c8806bf2b85d8dc11a27ad65a981cc1
- MD5 bca6478b230b6920fe79b97a3066e835
- SHA1 f61e771c53c63f35f5a2b416c260c74d29329adf
- SHA512 463f16b737768ac2bb285efc09e69781132e95c234e2eab37eb98be797606e45d1dbb38df3a6ef55144f4f7e1b08a213768e915b7d967b8c90bd03b216a07ff7
- SSDEEP 12288:/AstffLBk3Q45wU0/St0Z4j9lAx5ylTxEIyTXnxYV:4s9uQ45oyj9lE5yFuTXmV
- TLSH T1CB058E6A66AC01F8E0B7D17989964907F7B27845137197CF43A087AB2F276E05F7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1b:65:e0:ab:b1:b0:2b:aa:fb:5f:cd:96:90:30:b6:76:7d:fa:2d:44:21:c4:2e:57:95:3b:dc:e4:a6:f6:1f:98
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Chains
Mar 7, 2025
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Serial Number
03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 13, 2022 - May 14, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
261440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
libcurl
curl_easy_setopt
curl_easy_cleanup
curl_easy_init
curl_easy_perform
comctl32
InitCommonControlsEx
shlwapi
PathFileExistsA
PathFindExtensionW
PathIsDirectoryW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
kernel32
CreateFileW
HeapSize
SetEndOfFile
HeapReAlloc
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateDirectoryW
lstrlenW
GetCurrentThreadId
Sleep
OutputDebugStringW
DeleteFileW
CreateThread
lstrcpyW
lstrcmpW
MulDiv
MoveFileW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
InitializeCriticalSection
WriteConsoleW
CreateEventW
GetLastError
SetEvent
CloseHandle
ResetEvent
CreateSemaphoreW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleOutputCP
WaitForSingleObject
FlushFileBuffers
GetFileSizeEx
HeapAlloc
HeapFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
WideCharToMultiByte
WakeConditionVariable
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
RtlUnwind
InitializeCriticalSectionEx
EncodePointer
DecodePointer
GetLocaleInfoEx
LCMapStringEx
GetProcAddress
GetStringTypeW
CompareStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
user32
CallNextHookEx
EndDialog
SetWindowTextW
SetDlgItemTextW
CreateWindowExW
MessageBoxA
UnhookWindowsHookEx
SetWindowsHookExW
GetDlgItemInt
SystemParametersInfoW
SetDlgItemInt
DialogBoxParamW
LoadImageW
ReleaseDC
MessageBoxW
SendMessageW
SetWindowPos
GetDC
GetWindowRect
FindWindowExW
GetDlgItemTextW
gdi32
GetDeviceCaps
shell32
SHGetFolderPathW
ShellExecuteW
SHFileOperationW
Name
.text
Size
595KB
Virtual Size
595KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=190, id=261, version=30795,
count=16, id=260, version=30795,
count=1, id=253, version=33731,
count=10, id=259, version=33731,
count=16, id=260, version=33731,
count=90, id=261, version=33731,
count=12, id=257, version=30795,
count=3, id=257, version=33811,
count=182, id=1, productName=Unmarked objects,
count=35, id=265, version=33811,
count=1, id=255, version=33811,
count=1, id=151,
count=1, id=258, version=33811,
Genshin-HK/KEY
- SHA256 659b62b73cd27b8dfc735926928491a881a27f3c19cfcab33e3abd13b59c8bbb
- MD5 62459aeb443519490d96510d809dfd1b
- SHA1 23130398bd7157f729b779f3604c86cb8dfac23a
- SHA512 e879902105ba33c6d3f3ac5df60d99bce8e8dde5417aa9119d5977a3732b184d33622620f24ff67218fa7590872aeb69cc7e9e525470e9fd65f70628c94f8047
- MD5 SHA1 SHA512
Genshin-HK/gup.xml
- SHA256 92717951aae89e960b142cef3d273f104051896a3d527a78ca4a88c22b5216a5
- MD5 abde55a0b1cb4a904e622c02f559dcd1
- SHA1 1662f8445a000bbf7c61c40e39266658f169bf13
- SHA512 8fe75fb468f87be1153a6a0d70c0583a355f355bfe988027c88d154b500e97f2c5241d9557ebb981067205e2f23ad07b6a49c669cd3e94eaa728201173b235a0
- SSDEEP 96:rrxgFDl+72Y+WbPRkrm1+U4YeJS2kG6QrABYUCJ8PYPwJrkFI:rVgFhunzbpka1+UNQo2sBCPwJrkFI
- TLSH T19491944B57DCC3770C3112A178AE9191D33409F932B5500138A8809BA36ADA6BBBF7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Genshin-HK/libcurl.dll
- IMPHASH 9344b2e892129852146748348a751633
- SHA256 a30318eb95b7ade8089929b70021c385340de3f1c6795175366dcaa2f733ea6d
- MD5 34b1faf3a0c9ba2cb329cd49fe4fd9cc
- SHA1 c5f2e9177fc02176a2ed39f6dd3c744c443d78a4
- SHA512 d8f3b2f04fa17273c22fdb2096cce6bac2f18f7b91b5f9611c5437769409ec672b5cde3743b8afa1f1c8a34aa7ec85061d06bdc38b7c9743b988a6cdd04b33d7
- SSDEEP 49152:CmXrdD3Y9W3P21FK891O/ggEM6RAiPPDLeNHtbTyNc:CmuW34B1O/WAcza
- TLSH T178B6529B1C15D663DC014373CEA681A2E3B418CF9C3CE66219D9B9509DFE8692C7239F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5743136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileW
CreateProcessA
CreateProcessW
CreateThread
GetACP
GetCurrentThreadId
GetLastError
GetLocalTime
GetModuleHandleW
GetOEMCP
GetProcAddress
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetUserDefaultLCID
IsValidCodePage
LoadLibraryA
MulDiv
SetLastError
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
WriteFile
lstrcatW
lstrcpyW
lstrlenW
crypt32
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateChain
CertGetCertificateChain
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_reset
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info
Name
.text
Size
5.6MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.3232e6
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.f9d654
Size
512B
Virtual Size
14B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=77, id=260, version=30815,
count=72, id=226, version=30834,
count=46, id=270, version=30844,
count=31, id=269, version=30829,
Genshin-HK/readme.txt
- SHA256 33ee5b7e303c76709bd17b8aaf92d41add447a3ee4f01415f5490068fa559d0d
- MD5 af2ae42dd9036a63edb235b13f31ad55
- SHA1 c20393c12d0e733dfb550da5d8ce1fa73d4da4df
- SHA512 181244d05038c2753ea39f9c36a0ba5e1eeac0d4787748b727993d6b4eb003889dd68d22211c95820300be982ae4528dd6f29bc6e6611c7e6c556aa03ae70cb9
- TLSH T127C08057C4C0E543D0F5CB6EB4677BC147450C0B1FFECC9016355901A35A2C14724AC9
- MD5 SHA1 SHA512 TLSH