Malicious
Malicious

5b987f25a58ae0b34b7e345600124c1e

Share on LinkedIn
Print
ZIP Archive
MD5: 5b987f25a58ae0b34b7e345600124c1e
Size: 9.99 MB
application/zip
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 5b987f25a58ae0b34b7e345600124c1e
Sha1 3a7bf00fbd91868a65a9e5dc5102a61bf3324cdf
Sha256 d5448084b38eb03359787cfaa22e8b2654eeb097233824a558b61c59140bcbf8
Sha384 27524ab41ebe4c17a8eb6f6ff8ecfdaac038722d48c081ea33dd250e451677ceef6b5387c47734679835bd33a98bb61d
Sha512 9cc07935f4100249fc710bc3a4dcaed4e951b13bd905f4ef07dde3a869deda9e47f7448cc5ff1f547e2dc722bf0deba0931b4a588c9d7ab83134adfe97ea6627
SSDeep 196608:yh4vnsfoEEyoqQzvfIsrH5bztVQ7r0hrL5WUhQMTWweT7Yejoa:c4vnsoEjgvAsr5tVQn0rL5rCwegOoa
TLSH 01A633E288FD9436F9BF8FB18FE57A94F88CDA61F9E4A013F797134498814181DA7021
Data
NPC_us.tbl
Quest_Menu_us.tbl
Quest_Talk_us.tbl
warpinfo.tbl
GnySoft
UIF
re_genie_sub.gny
UI
mykogenie.dxt
re_training.uif
Zones
Malicious
moradon_xmas.dxt
moradon_xmas.ens
moradon_xmas.evtsub
moradon_xmas.flag
moradon_xmas.gev
moradon_xmas.gfo
moradon_xmas.glo
moradon_xmas.gmd
moradon_xmas.gtd
moradon_xmas.gtd.bak_patch
moradon_xmas.n3m
moradon_xmas.NaviMesh
Malicious
moradon_xmas.ofx
moradon_xmas.opd
moradon_xmas.opdext
moradon_xmas.opdsub
moradon_xmas.tct
moradon_xmas.tlt
moradon_xmas.wal
moradon_xmas.wap
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.siktirg
.vmp0
.vmp1
.reloc
.rsrc
Resources
AFX_DIALOG_LAYOUT
ID:0009
ID:1055
RT_BITMAP
ID:006B
ID:1055
RT_ICON
ID:0001
ID:1055
ID:0002
ID:1055
ID:0003
ID:1055
ID:0004
ID:1055
ID:0005
ID:1055
ID:0006
ID:1055
ID:0007
ID:1055
ID:0008
ID:1055
ID:0009
ID:1055
ID:1055-preview.png
RT_DIALOG
ID:0009
ID:1055
RT_GROUP_CURSOR4
ID:0065
ID:1055
RT_MANIFEST
ID:0002
ID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path arc:zip>pe:dll>pe:rsrc>bin
Shape arc:zip>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path arc:zip>pe:dll>pe:rsrc>img
Shape arc:zip>pe:dll>pe:rsrc>img
malicious 4 nodes
An error has occurred. This application may no longer respond until reloaded. Reload 🗙