hoi4[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hoi4.exe
Size

39.0MB
MD5

0db1ddb059c4b8e5c102fc6558fc6bc5
SHA1

3553476c41c14d06ad0d39894ba86320f0213423
SHA256

be398b3330ca78781d3e93d4ab82d9a5137e26eec2b9d1dcc57d156dc33d5a5b
SHA512

228784b143ca6f51418887345a806e11f4f6a712a6fc8d01a3cde8049dc38da8d5e894e5e6f280c2a3b5cd8f8664cd364f8248c5a4891512f3c29b2ff6a9cef8
SSDEEP

393216:jUTr0q/TEEIR+J6w/3EUlXxMxJrvTNw2lodbUROKwfBf3mSROIUMVs:+r0q/TEE8+Jgx9r6KwfBvXjUMVs

Score

N/A

Malware Config

Signatures

Files

hoi4.exe
.exe windows x64

Password: test

97998d0b6716919bb34eb03ecb2180b7

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:a8:9b:90:0b:85:07:8a:3e:ca:e3:9b:2a:5b:c5:cb
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/12/2021, 00:00

Not After

14/12/2022, 23:59

Subject

CN=Paradox Interactive AB (publ),O=Paradox Interactive AB (publ),L=Stockholm,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:68:67:96:cb:f6:ae:0a:8d:78:c7:27:83:11:93:2e:78:14:be:30
Signer

Actual PE Digest

3d:68:67:96:cb:f6:ae:0a:8d:78:c7:27:83:11:93:2e:78:14:be:30

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Paradox Interactive AB (publ),O=Paradox Interactive AB (publ),L=Stockholm,C=SE

30/09/2022, 07:24
Valid: true

Chain 1

CN=Paradox Interactive AB (publ),O=Paradox Interactive AB (publ),L=Stockholm,C=SE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

CN=Paradox Interactive AB (publ),O=Paradox Interactive AB (publ),L=Stockholm,C=SE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

steam_api64

SteamInternal_ContextInit
SteamAPI_UnregisterCallResult
SteamAPI_Init
SteamInternal_GameServer_Init
SteamGameServer_Shutdown
SteamGameServer_RunCallbacks
SteamInternal_FindOrCreateGameServerInterface
SteamGameServer_GetHSteamUser
SteamInternal_CreateInterface
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback
SteamAPI_RunCallbacks
SteamAPI_RegisterCallResult
SteamAPI_IsSteamRunning
SteamAPI_GetHSteamUser
SteamInternal_FindOrCreateUserInterface
SteamAPI_Shutdown

pops_api

POPS_SocialGetOpenFriendRequests
POPS_SocialGetFriendsList
POPS_SocialJoinRoom
POPS_SocialListenMessages
POPS_SocialListenFriendListUpdates
POPS_SocialListenPresence
POPS_SocialListenRichPresence
POPS_SocialListenMultiplayerAction
POPS_FileStorageSave
POPS_FileStorageList
POPS_FileStorageRead
POPS_FileStorageDelete
POPS_AccountConnections
POPS_AccountIsOnline
POPS_AccountLogInSteamTicket
POPS_AccountLogInWithAuthToken
POPS_AccountLogIn
POPS_AccountGetDetails
POPS_SetRootPath
POPS_SetFileIO
POPS_SocialConnect
POPS_GenerateGUID
POPS_SocialRespondToFriendRequest
POPS_SocialSendMessageToAccountID
POPS_SocialSendPrivateMessageToRoom
POPS_SocialSendMessageToRoom
POPS_SocialSetRichPresence
POPS_NewsletterSubscribe
POPS_SocialProfileCreate
POPS_SocialProfileRetrieve
POPS_SocialRemoveFriend
POPS_SocialProfileQuery
POPS_AccountConnectAccountSteam
POPS_Initialize
POPS_Shutdown
POPS_RunCallbacks
POPS_AutoStandardTelemetryEnable
POPS_TelemetrySendMulti
POPS_AccountCreate
POPS_AccountGetCountries
POPS_AchievementsSend
POPS_AchievementsStoreToDisk
POPS_SocialAddFriend
POPS_SocialListenStatus
POPS_SocialSetXMPPLogLevel
POPS_SocialSendMultiplayerActionToAccountID
POPS_SocialDisconnect
POPS_AppGetChildren
POPS_SocialSetPresence
POPS_TokenRetrieveCurrent
POPS_AccountGetGuid
POPS_AchievementsList
POPS_AchievementsGet

pdx_red_king

?CreateABTestObject@@YAPEAVCPdxABTestInterface@@AEBUSPdxABTestInitInfo@@@Z
??0SPdxABTestInitInfo@@QEAA@XZ
?PdxABTestCurlGlobalInit@@YAXXZ
?PdxABTestCurlGlobalCleanup@@YAXXZ

setupapi

CM_Locate_DevNodeA
CM_Get_Parent
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
CM_Get_Device_IDA

imm32

ImmSetCandidateWindow
ImmGetIMEFileNameA
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmNotifyIME
ImmSetCompositionWindow

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

winmm

timeEndPeriod
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetErrorTextW
waveOutGetDevCapsW
timeGetTime
waveInGetDevCapsW
waveInReset
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInOpen
waveInClose
waveOutGetNumDevs
waveInGetNumDevs
timeBeginPeriod

tbb

?allocate@allocate_additional_child_of_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?free@allocate_additional_child_of_proxy@internal@tbb@@QEBAXAEAVtask@3@@Z
?destroy@task_base@internal@interface5@tbb@@SAXAEAVtask@4@@Z
?allocate@allocate_root_with_context_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?free@allocate_root_with_context_proxy@internal@tbb@@QEBAXAEAVtask@3@@Z
?allocate@allocate_continuation_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?allocate@allocate_child_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
??1task_group_context@tbb@@QEAA@XZ
?is_group_execution_cancelled@task_group_context@tbb@@QEBA_NXZ
?init@task_group_context@tbb@@IEAAXXZ
?note_affinity@task@tbb@@UEAAXG@Z
?deallocate_via_handler_v3@internal@tbb@@YAXPEAX@Z
?allocate_via_handler_v3@internal@tbb@@YAPEAX_K@Z
?internal_max_concurrency@task_arena_base@internal@interface7@tbb@@KAHPEBVtask_arena@34@@Z
?isolate_within_arena@internal@interface7@tbb@@YAXAEAVdelegate_base@123@_J@Z
?get_initial_auto_partitioner_divisor@internal@tbb@@YA_KXZ
?NFS_Allocate@internal@tbb@@YAPEAX_K0PEAX@Z
?NFS_Free@internal@tbb@@YAXPEAX@Z
?observe@task_scheduler_observer_v3@internal@tbb@@QEAAX_N@Z
??1concurrent_vector_base_v3@internal@tbb@@IEAA@XZ
?internal_grow_by@concurrent_vector_base_v3@internal@tbb@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z
?internal_clear@concurrent_vector_base_v3@internal@tbb@@IEAA_KP6AXPEAX_K@Z@Z
?thread_get_id_v3@internal@tbb@@YA?AVid@tbb_thread_v3@12@XZ
?throw_exception_v4@internal@tbb@@YAXW4exception_id@12@@Z

ws2_32

htonl
ntohl
WSAStartup
getaddrinfo
freeaddrinfo
getnameinfo
gethostname

opengl32

glAlphaFunc
glBegin
glFrontFace
glBlendFunc
glClear
glClearColor
glColor4f
wglGetProcAddress
wglGetCurrentDC
glViewport
glVertex2f
glTexSubImage2D
glTexParameteri
glTexParameterf
glTexImage2D
glTexEnvf
glStencilOp
glStencilMask
glStencilFunc
glScissor
glReadPixels
glPolygonMode
glPixelStorei
glOrtho
glMatrixMode
glLoadIdentity
glLineWidth
glGetTexImage
glGetString
glGetIntegerv
glGetFloatv
glGetError
glGetBooleanv
glGenTextures
glBindTexture
glEnd
glEnable
glDrawElements
glDrawArrays
glDisable
glDepthMask
glDepthFunc
glDeleteTextures
glCullFace
glCopyTexSubImage2D
glColorMask

d3dx9_43

D3DXSaveTextureToFileInMemory
D3DXLoadSurfaceFromMemory
D3DXLoadSurfaceFromSurface
D3DXCompileShader
D3DXCreateLine
D3DXSaveSurfaceToFileInMemory
D3DXCreateTexture
D3DXCreateCubeTexture

d3d9

Direct3DCreate9
Direct3DCreate9Ex

xinput1_3

ord4
ord2

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

shlwapi

PathFileExistsW
PathAppendW

kernel32

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
GetTempPathW
DuplicateHandle
GetFileType
LoadLibraryExW
TlsFree
RtlUnwind
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
GetCPInfo
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
EncodePointer
GetDriveTypeW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetExitCodeThread
GetStringTypeW
GetStartupInfoW
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeSListHead
GetFileInformationByHandle
PeekNamedPipe
HeapFree
HeapAlloc
GetDateFormatW
ExitThread
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
ReadConsoleW
GetTimeZoneInformation
HeapReAlloc
MoveFileExW
CreateEventA
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetVolumeInformationA
RemoveDirectoryW
GetFileSize
GetFileAttributesExW
GetDriveTypeA
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
VirtualProtect
CreatePipe
QueryFullProcessImageNameW
GetSystemDefaultUILanguage
GetComputerNameA
GetNativeSystemInfo
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
InitializeCriticalSectionEx
DecodePointer
LocalAlloc
SetUnhandledExceptionFilter
CreateProcessW
ReadProcessMemory
GetVersionExA
GetThreadContext
GetThreadId
ResumeThread
SuspendThread
SetLastError
GetFileAttributesA
GetCurrentDirectoryA
RtlCaptureContext
SwitchToThread
SetFileAttributesA
CreateDirectoryA
GetCurrentProcessId
K32GetProcessMemoryInfo
ReadDirectoryChangesW
SleepEx
SetThreadAffinityMask
FreeLibraryAndExitThread
SetStdHandle
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetEndOfFile
SleepConditionVariableSRW
GetProcessAffinityMask
GetModuleHandleA
MultiByteToWideChar
CloseHandle
GetLastError
CreateProcessA
LocalFree
WinExec
FormatMessageA
OutputDebugStringA
Sleep
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FatalExit
GetExitCodeProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetStdHandle
WriteFile
OutputDebugStringW
AttachConsole
GetConsoleMode
WriteConsoleW
CreateFileW
GetFileSizeEx
ReadFile
SetFilePointer
SetFilePointerEx
SetErrorMode
GetTickCount
GetModuleFileNameW
GetModuleHandleW
SetThreadExecutionState
GetCurrentProcess
ExitProcess
TerminateProcess
GlobalMemoryStatusEx
GetSystemInfo
CreateDirectoryW
LoadLibraryW
CreateToolhelp32Snapshot
Process32First
Process32Next
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetCurrentThreadId
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreW
VirtualAlloc
VirtualFree
VirtualQuery
GetEnvironmentVariableA
SetEnvironmentVariableA
IsDebuggerPresent
RaiseException
CreateThread
GetCurrentThread
SetThreadPriority
QueryPerformanceCounter
QueryPerformanceFrequency
VerSetConditionMask
CreateFileA
DeviceIoControl
GetOverlappedResult
CancelIo
ResetEvent
WaitForSingleObject
CreateEventW
FormatMessageW
VerifyVersionInfoW
TlsAlloc
TlsGetValue
TlsSetValue
GlobalAlloc
GlobalUnlock
GlobalLock
CompareStringA
MulDiv
GetModuleHandleExW
WideCharToMultiByte
GetSystemPowerStatus
GetLocaleInfoA
GetModuleFileNameA
GlobalFree

user32

GetUpdateRect
InvalidateRect
ValidateRect
GetPropW
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursor
GetCursorPos
GetClipCursor
ClientToScreen
ScreenToClient
ClipCursor
IsRectEmpty
GetWindowLongW
CallNextHookEx
LoadIconW
DestroyIcon
GetRawInputData
RegisterWindowMessageA
GetDoubleClickTime
RegisterDeviceNotificationW
UnregisterDeviceNotification
GetForegroundWindow
RegisterClassExA
CreateWindowExA
DestroyWindow
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
GetKeyboardLayout
GetKeyboardState
ToUnicode
MapVirtualKeyW
GetDC
ReleaseDC
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayDevicesW
GetMonitorInfoW
EnumDisplayMonitors
SetCapture
ReleaseCapture
SetCursorPos
LoadCursorW
CopyImage
CreateIconIndirect
RegisterRawInputDevices
SendMessageW
RegisterClassW
CreateWindowExW
ShowWindow
SetLayeredWindowAttributes
FlashWindowEx
SetWindowPos
GetFocus
SetForegroundWindow
SetPropW
RemovePropW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
IntersectRect
PtInRect
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
GetParent
SetWindowsHookExW
UnhookWindowsHookEx
CreateIconFromResource
SetWindowRgn
GetDesktopWindow
GetRawInputDeviceInfoA
GetRawInputDeviceList
PostThreadMessageW
DialogBoxIndirectParamW
EndDialog
GetDlgItem
SetFocus
DrawTextW
SystemParametersInfoA
SystemParametersInfoW
IsChild
LoadCursorA
UpdateWindow
FindWindowExA
LoadCursorFromFileA
DefWindowProcA
MessageBoxIndirectA
GetMenu
GetSystemMetrics
KillTimer
SetTimer
GetAsyncKeyState
GetKeyState
IsIconic
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageExtraInfo
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
TrackMouseEvent
MessageBoxA
GetActiveWindow
UnregisterClassA

gdi32

GetTextExtentPoint32A
GetTextMetricsW
SetPixel
GetObjectA
CombineRgn
CreateDCW
DeleteDC
CreateFontIndirectW
CreateCompatibleDC
SwapBuffers
DeleteObject
SetPixelFormat
BitBlt
GetICMProfileW
GetDeviceGammaRamp
CreateBitmap
GetDIBits
GetDeviceCaps
CreateCompatibleBitmap
CreateDIBSection
SelectObject
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
SetDeviceGammaRamp
CreateRectRgn

shell32

DragFinish
DragQueryFileW
ExtractIconExW
SHGetFolderPathW
ShellExecuteExA
ShellExecuteA
CommandLineToArgvW
SHCreateDirectoryExW
ShellExecuteW
DragAcceptFiles

ole32

CoUninitialize
CoCreateInstance
StringFromGUID2
PropVariantClear
CoTaskMemFree
CoInitializeEx

oleaut32

SysFreeString

advapi32

GetUserNameA
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

nakama-cpp

NRtClient_tick
NRtClient_setUserData
NRtClient_getUserData
NRtClient_connect
NRtClient_isConnected
NRtClient_disconnect
NRtClient_joinChat
NRtClient_leaveChat
NRtClient_writeChatMessage
NRtClient_updateChatMessage
NRtClient_removeChatMessage
NRtClient_createMatch
NRtClient_joinMatch
NRtClient_joinMatchByToken
NRtClient_leaveMatch
NRtClient_addMatchmaker
NRtClient_removeMatchmaker
NRtClient_sendMatchData
NRtClient_followUsers
NRtClient_unfollowUsers
NRtClient_rpc
NRtClient_setConnectCallback
NRtClient_setDisconnectCallback
NRtClient_setErrorCallback
NRtClient_setChannelMessageCallback
NRtClient_setChannelPresenceCallback
NRtClient_setMatchmakerMatchedCallback
NRtClient_setMatchDataCallback
NRtClient_setMatchPresenceCallback
NStringDoubleMap_destroy
NRtClient_setStatusPresenceCallback
NRtClient_setStreamPresenceCallback
NRtClient_setStreamDataCallback
NRtClient_destroy
NClient_setErrorCallback
NClient_setUserData
NClient_getUserData
NClient_disconnect
NClient_tick
NClient_createRtClientEx
NClient_authenticateDevice
NClient_authenticateEmail
NClient_authenticateFacebook
NClient_authenticateGoogle
NClient_authenticateGameCenter
NClient_authenticateApple
NClient_authenticateCustom
NClient_authenticateSteam
NClient_linkFacebook
NClient_linkEmail
NClient_linkDevice
NClient_linkGoogle
NClient_linkGameCenter
NClient_linkApple
NClient_linkSteam
NClient_linkCustom
NStringDoubleMap_getSize
NClient_unlinkEmail
NClient_unlinkGoogle
NClient_unlinkGameCenter
NClient_unlinkApple
NClient_unlinkSteam
NClient_unlinkDevice
NClient_unlinkCustom
NClient_importFacebookFriends
NClient_getAccount
NClient_updateAccount
NClient_getUsers
NClient_addFriends
NClient_deleteFriends
NClient_blockFriends
NClient_listFriends
NClient_createGroup
NClient_deleteGroup
NClient_addGroupUsers
NClient_listGroupUsers
NClient_kickGroupUsers
NClient_joinGroup
NClient_leaveGroup
NClient_listGroups
NClient_listUserGroups
NClient_promoteGroupUsers
NClient_demoteGroupUsers
NClient_updateGroup
NClient_listLeaderboardRecords
NClient_listLeaderboardRecordsAroundOwner
NClient_writeLeaderboardRecord
NClient_writeTournamentRecord
NClient_deleteLeaderboardRecord
NClient_listMatches
NClient_listNotifications
NClient_deleteNotifications
NClient_listChannelMessages
NClient_listTournaments
NClient_listTournamentRecords
NClient_listTournamentRecordsAroundOwner
NClient_joinTournament
NClient_listStorageObjects
NClient_listUsersStorageObjects
NClient_writeStorageObjects
NClient_readStorageObjects
NClient_deleteStorageObjects
NClient_rpc
NClient_rpc_with_http_key
createDefaultNakamaClient
destroyNakamaClient
NStringDoubleMap_getKeys
NStringDoubleMap_getValue
NStringDoubleMap_setValue
NStringDoubleMap_create
NSession_destroy
NSession_getVariables
NSession_isExpiredByTime
NSession_isExpired
NSession_getExpireTime
NSession_getCreateTime
NSession_getUserId
NSession_getUsername
NSession_isCreated
NSession_getAuthToken
NStringMap_destroy
NStringMap_getSize
NStringMap_getKeys
NStringMap_getValue
NStringMap_setValue
NStringMap_create
NClient_unlinkFacebook
NRtClient_setNotificationsCallback

pdxbrowser_ipc

GetPDXModule

Exports

Exports

?PHYSFS_addToSearchPath@@YAHPEBDH@Z
?PHYSFS_caseFold@@YAHIPEAI@Z
?PHYSFS_close@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_deinit@@YAHXZ
?PHYSFS_delete@@YAHPEBD@Z
?PHYSFS_deregisterArchiver@@YAHPEBD@Z
?PHYSFS_enumerate@@YAHPEBDP6A?AW4PHYSFS_EnumerateCallbackResult@@PEAX00W4PHYSFS_FileType@@@Z1@Z
?PHYSFS_enumerateFiles@@YAPEAPEADPEBD@Z
?PHYSFS_enumerateFilesCallback@@YAXPEBDP6AXPEAX00@Z1@Z
?PHYSFS_eof@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_exists@@YAHPEBD@Z
?PHYSFS_fileLength@@YA_JPEAUPHYSFS_File@@@Z
?PHYSFS_flush@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_freeList@@YAXPEAX@Z
?PHYSFS_freezeConfig@@YAX_N@Z
?PHYSFS_getAllocator@@YAPEBUPHYSFS_Allocator@@XZ
?PHYSFS_getBaseDir@@YAPEBDXZ
?PHYSFS_getCdRomDirs@@YAPEAPEADXZ
?PHYSFS_getCdRomDirsCallback@@YAXP6AXPEAXPEBD@Z0@Z
?PHYSFS_getDirSeparator@@YAPEBDXZ
?PHYSFS_getErrorByCode@@YAPEBDW4PHYSFS_ErrorCode@@@Z
?PHYSFS_getLastError@@YAPEBDXZ
?PHYSFS_getLastErrorCode@@YA?AW4PHYSFS_ErrorCode@@XZ
?PHYSFS_getLastModTime@@YA_JPEBD@Z
?PHYSFS_getLinkedVersion@@YAXPEAUPHYSFS_Version@@@Z
?PHYSFS_getMountPoint@@YAPEBDPEBD@Z
?PHYSFS_getPrefDir@@YAPEBDPEBD0@Z
?PHYSFS_getRealDir@@YAPEBDPEBD@Z
?PHYSFS_getSearchPath@@YAPEAPEADXZ
?PHYSFS_getSearchPathCallback@@YAXP6AXPEAXPEBD@Z0@Z
?PHYSFS_getUserDir@@YAPEBDXZ
?PHYSFS_getWriteDir@@YAPEBDXZ
?PHYSFS_init@@YAHPEBD@Z
?PHYSFS_isDirectory@@YAHPEBD@Z
?PHYSFS_isInit@@YAHXZ
?PHYSFS_isSymbolicLink@@YAHPEBD@Z
?PHYSFS_mkdir@@YAHPEBD@Z
?PHYSFS_mount@@YAHPEBD0H@Z
?PHYSFS_mountHandle@@YAHPEAUPHYSFS_File@@PEBD1H@Z
?PHYSFS_mountIo@@YAHPEAUPHYSFS_Io@@PEBD1H@Z
?PHYSFS_mountMemory@@YAHPEBX_KP6AXPEAX@ZPEBD4H@Z
?PHYSFS_openAppend@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_openRead@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_openWrite@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_permitSymbolicLinks@@YAXH@Z
?PHYSFS_read@@YA_JPEAUPHYSFS_File@@PEAXII@Z
?PHYSFS_readBytes@@YA_JPEAUPHYSFS_File@@PEAX_K@Z
?PHYSFS_readSBE16@@YAHPEAUPHYSFS_File@@PEAF@Z
?PHYSFS_readSBE32@@YAHPEAUPHYSFS_File@@PEAH@Z
?PHYSFS_readSBE64@@YAHPEAUPHYSFS_File@@PEA_J@Z
?PHYSFS_readSLE16@@YAHPEAUPHYSFS_File@@PEAF@Z
?PHYSFS_readSLE32@@YAHPEAUPHYSFS_File@@PEAH@Z
?PHYSFS_readSLE64@@YAHPEAUPHYSFS_File@@PEA_J@Z
?PHYSFS_readUBE16@@YAHPEAUPHYSFS_File@@PEAG@Z
?PHYSFS_readUBE32@@YAHPEAUPHYSFS_File@@PEAI@Z
?PHYSFS_readUBE64@@YAHPEAUPHYSFS_File@@PEA_K@Z
?PHYSFS_readULE16@@YAHPEAUPHYSFS_File@@PEAG@Z
?PHYSFS_readULE32@@YAHPEAUPHYSFS_File@@PEAI@Z
?PHYSFS_readULE64@@YAHPEAUPHYSFS_File@@PEA_K@Z
?PHYSFS_registerArchiver@@YAHPEBUPHYSFS_Archiver@@@Z
?PHYSFS_removeFromSearchPath@@YAHPEBD@Z
?PHYSFS_seek@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_setAllocator@@YAHPEBUPHYSFS_Allocator@@@Z
?PHYSFS_setBuffer@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_setRoot@@YAHPEBD0@Z
?PHYSFS_setSaneConfig@@YAHPEBD00HH@Z
?PHYSFS_setWriteDir@@YAHPEBD@Z
?PHYSFS_stat@@YAHPEBDPEAUPHYSFS_Stat@@@Z
?PHYSFS_supportedArchiveTypes@@YAPEAPEBUPHYSFS_ArchiveInfo@@XZ
?PHYSFS_swapSBE16@@YAFF@Z
?PHYSFS_swapSBE32@@YAHH@Z
?PHYSFS_swapSBE64@@YA_J_J@Z
?PHYSFS_swapSLE16@@YAFF@Z
?PHYSFS_swapSLE32@@YAHH@Z
?PHYSFS_swapSLE64@@YA_J_J@Z
?PHYSFS_swapUBE16@@YAGG@Z
?PHYSFS_swapUBE32@@YAII@Z
?PHYSFS_swapUBE64@@YA_K_K@Z
?PHYSFS_swapULE16@@YAGG@Z
?PHYSFS_swapULE32@@YAII@Z
?PHYSFS_swapULE64@@YA_K_K@Z
?PHYSFS_symbolicLinksPermitted@@YAHXZ
?PHYSFS_tell@@YA_JPEAUPHYSFS_File@@@Z
?PHYSFS_ucs4stricmp@@YAHPEBI0@Z
?PHYSFS_unmount@@YAHPEBD@Z
?PHYSFS_utf16stricmp@@YAHPEBG0@Z
?PHYSFS_utf8FromLatin1@@YAXPEBDPEAD_K@Z
?PHYSFS_utf8FromUcs2@@YAXPEBGPEAD_K@Z
?PHYSFS_utf8FromUcs4@@YAXPEBIPEAD_K@Z
?PHYSFS_utf8FromUtf16@@YAXPEBGPEAD_K@Z
?PHYSFS_utf8ToUcs2@@YAXPEBDPEAG_K@Z
?PHYSFS_utf8ToUcs4@@YAXPEBDPEAI_K@Z
?PHYSFS_utf8ToUtf16@@YAXPEBDPEAG_K@Z
?PHYSFS_utf8stricmp@@YAHPEBD0@Z
?PHYSFS_write@@YA_JPEAUPHYSFS_File@@PEBXII@Z
?PHYSFS_writeBytes@@YA_JPEAUPHYSFS_File@@PEBX_K@Z
?PHYSFS_writeSBE16@@YAHPEAUPHYSFS_File@@F@Z
?PHYSFS_writeSBE32@@YAHPEAUPHYSFS_File@@H@Z
?PHYSFS_writeSBE64@@YAHPEAUPHYSFS_File@@_J@Z
?PHYSFS_writeSLE16@@YAHPEAUPHYSFS_File@@F@Z
?PHYSFS_writeSLE32@@YAHPEAUPHYSFS_File@@H@Z
?PHYSFS_writeSLE64@@YAHPEAUPHYSFS_File@@_J@Z
?PHYSFS_writeUBE16@@YAHPEAUPHYSFS_File@@G@Z
?PHYSFS_writeUBE32@@YAHPEAUPHYSFS_File@@I@Z
?PHYSFS_writeUBE64@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_writeULE16@@YAHPEAUPHYSFS_File@@G@Z
?PHYSFS_writeULE32@@YAHPEAUPHYSFS_File@@I@Z
?PHYSFS_writeULE64@@YAHPEAUPHYSFS_File@@_K@Z
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 29.3MB - Virtual size: 29.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: test

97998d0b6716919bb34eb03ecb2180b7

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

08:a8:9b:90:0b:85:07:8a:3e:ca:e3:9b:2a:5b:c5:cbCertificate

Extended Key Usages

Key Usages

3d:68:67:96:cb:f6:ae:0a:8d:78:c7:27:83:11:93:2e:78:14:be:30Signer

Signature Validations

Verification

30/09/2022, 07:24 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

steam_api64

pops_api

pdx_red_king

setupapi

imm32

version

winmm

tbb

ws2_32

opengl32

d3dx9_43

d3d9

xinput1_3

d3dcompiler_47

d3d11

dxgi

shlwapi

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

bcrypt

nakama-cpp

pdxbrowser_ipc

Exports

Exports

Sections

.text Size: 29.3MB - Virtual size: 29.3MB

.rdata Size: 6.9MB - Virtual size: 6.9MB

.data Size: 1.2MB - Virtual size: 6.1MB

.pdata Size: 1.3MB - Virtual size: 1.3MB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 258KB - Virtual size: 258KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

08:a8:9b:90:0b:85:07:8a:3e:ca:e3:9b:2a:5b:c5:cb
Certificate

3d:68:67:96:cb:f6:ae:0a:8d:78:c7:27:83:11:93:2e:78:14:be:30
Signer

30/09/2022, 07:24
Valid: true

.text
Size: 29.3MB - Virtual size: 29.3MB

.rdata
Size: 6.9MB - Virtual size: 6.9MB

.data
Size: 1.2MB - Virtual size: 6.1MB

.pdata
Size: 1.3MB - Virtual size: 1.3MB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 258KB - Virtual size: 258KB