MetroExodus[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MetroExodus.exe
Size

25.6MB
MD5

058641303d26bde66cd064696000cb31
SHA1

d2edaabed345a89b0f5073c473f64c88b041ff38
SHA256

480914727f8c8b3af533b7208a0f172716a6f5dccf3d07cfc2afd57b70966550
SHA512

19359a323756c26a81f984e02728d4c02971e2b0a7be47e8f46360dab802934e58c5b1e7200bcb1a84c5b17c0d61ab3f456aa57fcdfcaec616657648ea528875
SSDEEP

393216:0pqgJSsJtd5nYxFweUCZsWDbalfOMP1CM9jVXN1JzzQ:y/ffxXN1Jzs

Score

N/A

Malware Config

Signatures

Files

MetroExodus.exe
.exe windows x64

ad5c74a10e3967b99d51145041b81154

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

TlsSetValue
LoadLibraryExA
TlsAlloc
TlsGetValue
FileTimeToSystemTime
GetStdHandle
OutputDebugStringA
AllocConsole
WriteConsoleA
SetConsoleTitleA
GetConsoleWindow
Sleep
TlsFree
CreateFileA
WriteFile
LoadLibraryW
SetFilePointer
GetThreadId
ProcessIdToSessionId
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
OutputDebugStringW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
GetCurrentProcessId
InitializeSListHead
GetModuleHandleW
CompareFileTime
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CreateEventA
RaiseException
GetVersion
InitializeCriticalSectionEx
GetCurrentThread
SetThreadPriority
LocalAlloc
CreateDirectoryW
SetThreadExecutionState
LoadLibraryA
GlobalUnlock
GlobalLock
GetLocaleInfoEx
FreeLibrary
WaitForMultipleObjects
RtlCaptureContext
GetModuleFileNameA
CreateDirectoryA
GetCurrentDirectoryW
GetComputerNameA
VirtualQuery
LocalFree
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
CreateSemaphoreA
DeleteCriticalSection
SwitchToThread
InitializeCriticalSection
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
TryEnterCriticalSection
GetExitCodeProcess
QueryPerformanceCounter
GlobalMemoryStatus
CreateProcessA
GetProcAddress
HeapAlloc
DeleteProcThreadAttributeList
GetSystemInfo
CloseHandle
QueryPerformanceFrequency
UpdateProcThreadAttribute
GetModuleHandleA
GetCurrentDirectoryA
GetCurrentThreadId
WaitForSingleObject
CreatePipe
InitializeProcThreadAttributeList
TerminateProcess
SetPriorityClass
SetLastError
HeapFree
SetHandleInformation
ReadFile
SetProcessWorkingSetSize
GetProcessHeap
HeapCompact
GetCurrentProcess
VirtualProtect
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
GetModuleFileNameW
LoadLibraryExW
lstrcmpA
CreateEventW
ReleaseMutex
GetLastError
RtlVirtualUnwind
CreateMutexW

user32

GetWindowRect
DestroyWindow
SetWindowPos
EndDialog
PostQuitMessage
LoadBitmapA
CreateDialogParamA
GetClientRect
BeginPaint
GetAsyncKeyState
EndPaint
DispatchMessageA
TranslateMessage
PeekMessageA
ShowCursor
ShowWindow
GetKeyboardLayout
EnumDisplayMonitors
CallNextHookEx
GetWindowLongA
DefWindowProcA
SetCursorPos
MessageBoxA
SetWindowsHookExA
SetWindowLongPtrA
SetRect
CloseClipboard
GetCursorPos
ClientToScreen
SystemParametersInfoA
GetMonitorInfoA
UnhookWindowsHookEx
EnumDisplayDevicesA
GetDoubleClickTime
GetWindowThreadProcessId
EnumDisplaySettingsA
MoveWindow
SetDlgItemTextA
GetRawInputDeviceInfoA
CreateWindowExA
OpenClipboard
RegisterClassA
ActivateKeyboardLayout
LoadIconA
AdjustWindowRect
LoadKeyboardLayoutA
GetRawInputDeviceList
GetClipboardData

advapi32

GetUserNameW
RegSetValueExA
GetUserNameA
RegFlushKey
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA

mmdevapi

ord17

msvcp140

?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
?_Xruntime_error@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z

pxfoundation_x64

?error@Foundation@shdfnd@physx@@QEAAXW4Enum@PxErrorCode@3@PEBDH1ZZ
?decRefCount@Foundation@shdfnd@physx@@SAXXZ
?snprintf@shdfnd@physx@@YAHPEAD_KPEBDZZ
?PxDiagonalize@physx@@YA?AVPxVec3@1@AEBVPxMat33@1@AEAVPxQuat@1@@Z
?incRefCount@Foundation@shdfnd@physx@@SAXXZ
?getInstance@Foundation@shdfnd@physx@@SAAEAV123@XZ
PxCreateFoundation
PxGetFoundation
?getAllocator@shdfnd@physx@@YAAEAVPxAllocatorCallback@2@XZ
?stricmp@shdfnd@physx@@YAHPEBD0@Z

physx3_x64

??0PxShapeGeneratedInfo@physx@@QEAA@XZ
??0PxClothMotionConstraintConfigGeneratedInfo@physx@@QEAA@XZ
??0PxAggregateGeneratedInfo@physx@@QEAA@XZ
??0PxArticulationGeneratedInfo@physx@@QEAA@XZ
??0PxArticulationJointGeneratedInfo@physx@@QEAA@XZ
??0PxArticulationLinkGeneratedInfo@physx@@QEAA@XZ
??0PxRigidStaticGeneratedInfo@physx@@QEAA@XZ
??0PxRigidDynamicGeneratedInfo@physx@@QEAA@XZ
??0PxMaterialGeneratedInfo@physx@@QEAA@XZ
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxHeightFieldGeometry@2@@Z
??0PxParticleFluidGeneratedInfo@physx@@QEAA@XZ
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxConvexMeshGeometry@2@@Z
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxPlaneGeometry@2@@Z
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxCapsuleGeometry@2@@Z
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxSphereGeometry@2@@Z
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxBoxGeometry@2@@Z
??0PxClothTetherConfigGeneratedInfo@physx@@QEAA@XZ
??0PxClothStretchConfigGeneratedInfo@physx@@QEAA@XZ
??0PxHeightFieldGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxClothGeneratedInfo@physx@@QEAA@XZ
??0PxTriangleMeshGeometryGeneratedInfo@physx@@QEAA@XZ
PxCreateCudaContextManager
PxRegisterParticles
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxTriangleMeshGeometry@2@@Z
??0PxClothFabricGeneratedInfo@physx@@QEAA@XZ
PxRegisterCloth
PxCreateBasePhysics
PxGetSuggestedCudaDeviceOrdinal
PxRegisterArticulations
PxRegisterHeightFields
PxGetPhysics
??0PxPlaneGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxSphereGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxConvexMeshGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxParticleSystemGeneratedInfo@physx@@QEAA@XZ
??0PxMeshScaleGeneratedInfo@physx@@QEAA@XZ
??0PxCapsuleGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxBoxGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxHeightFieldDescGeneratedInfo@physx@@QEAA@XZ

physx3common_x64

?findOverlapHeightField@PxMeshQuery@physx@@SAIAEBVPxGeometry@2@AEBVPxTransform@2@AEBVPxHeightFieldGeometry@2@1PEAIIIAEA_N@Z
?findOverlapTriangleMesh@PxMeshQuery@physx@@SAIAEBVPxGeometry@2@AEBVPxTransform@2@AEBVPxTriangleMeshGeometry@2@1PEAIIIAEA_N@Z
?sweep@PxGeometryQuery@physx@@SA_NAEBVPxVec3@2@MAEBVPxGeometry@2@AEBVPxTransform@2@12AEAUPxSweepHit@2@V?$PxFlags@W4Enum@PxHitFlag@physx@@G@2@M@Z
?raycast@PxGeometryQuery@physx@@SAIAEBVPxVec3@2@0AEBVPxGeometry@2@AEBVPxTransform@2@MV?$PxFlags@W4Enum@PxHitFlag@physx@@G@2@IPEIAUPxRaycastHit@2@@Z
?getTriangle@PxMeshQuery@physx@@SAXAEBVPxHeightFieldGeometry@2@AEBVPxTransform@2@IAEAVPxTriangle@2@PEAI3@Z
?overlap@PxGeometryQuery@physx@@SA_NAEBVPxGeometry@2@AEBVPxTransform@2@01@Z

rpcrt4

UuidCreate

steam_api64

SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallResult
SteamAPI_Shutdown
SteamAPI_RunCallbacks
SteamAPI_UnregisterCallback
SteamAPI_Init
SteamInternal_CreateInterface
SteamAPI_GetHSteamUser
SteamAPI_GetHSteamPipe
SteamInternal_ContextInit

vcruntime140

__intrinsic_setjmp
_purecall
__std_type_info_name
memcpy
memset
memchr
__std_terminate
memcmp
memmove
_CxxThrowException
wcsrchr
strchr
strstr
__CxxFrameHandler3
strrchr
wcsstr
__C_specific_handler
longjmp

api-ms-win-crt-string-l1-1-0

strncmp
strcpy_s
_strnicmp
strncat_s
isprint
tolower
strncpy
_stricmp
wcsncpy_s
wcsncmp
strcmp
strncpy_s
wcscat_s
wcscpy_s
isspace
strtok
_wcsicmp
strcat_s
wcsncpy
isalpha

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
_chdir
_findnext64i32
_wunlink
_unlink
_mkdir
_findfirst64i32
_findclose
_chdrive

api-ms-win-crt-heap-l1-1-0

realloc
_set_new_mode
malloc
free
_aligned_malloc
_aligned_free
_heapmin

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_exit
_cexit
_c_exit
_controlfp
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initialize_narrow_environment
_beginthreadex
_configure_narrow_argv
abort
_set_app_type
_seh_filter_exe
_errno
_control87
_get_narrow_winmain_command_line
_invalid_parameter_noinfo_noreturn
_beginthread
_set_invalid_parameter_handler

api-ms-win-crt-stdio-l1-1-0

feof
__stdio_common_vsprintf
fflush
fgets
__stdio_common_vsscanf
_wfsopen
fputs
_set_fmode
_fseeki64
fread
ferror
_open_osfhandle
ftell
__acrt_iob_func
__p__commode
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
fseek
fwrite
fopen_s
_open
__stdio_common_vfprintf
_tell
_lseek
_write
_wsopen_dispatch
__stdio_common_vfprintf_s
fclose
fopen
_read
_filelength
_close
__stdio_common_vswscanf
__stdio_common_vswprintf

api-ms-win-crt-math-l1-1-0

acosf
round
pow
tanf
powf
sinf
cosf
fmodf
_fpclass
roundf
acos
_fdopen
_dtest
ldexp
log2f
exp2f
exp
tan
asinf
atan2
expf
modff
logf
log2
modf
sinh
atanf
atan2f
atan
cos
fmod
log
log10
log10f
sin
__setusermatherr

api-ms-win-crt-convert-l1-1-0

_strtoi64
_ltoa
_itow
atof
_itoa_s
_strtoui64
_itoa
strtol
atoi
wctob
btowc
strtoul
strtod

api-ms-win-crt-time-l1-1-0

_localtime64_s
_gmtime64
_localtime64
strftime
_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ws2_32

WSAGetLastError
WSACleanup
WSARecvFrom
ntohl
htons
htonl
WSASetLastError
__WSAFDIsSet
bind
inet_ntoa
ntohs
setsockopt
getsockname
WSAStartup
WSASendTo
select
closesocket
ioctlsocket
socket

winmm

timeBeginPeriod
timeGetTime

anselsdk64

?rotationMatrixVectorsToQuaternion@ansel@@YAXAEBUVec3@nv@@00AEAUQuat@3@@Z
?quaternionToRotationMatrixVectors@ansel@@YAXAEBUQuat@nv@@AEAUVec3@3@11@Z
?setConfiguration@ansel@@YA?AW4SetConfigurationStatus@1@AEBUConfiguration@1@@Z
?updateCamera@ansel@@YAXAEAUCamera@1@@Z

gfesdk

NVGSDK_Poll
NVGSDK_Highlights_SetVideoHighlightAsync
NVGSDK_Highlights_OpenSummaryAsync
NVGSDK_Highlights_ConfigureAsync
NVGSDK_RequestPermissionsAsync
NVGSDK_Create
NVGSDK_Release
NVGSDK_Highlights_CloseGroupAsync
NVGSDK_Highlights_OpenGroupAsync
NVGSDK_Highlights_SetScreenshotHighlightAsync
NVGSDK_Highlights_GetNumberOfHighlightsAsync

gdi32

SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
GetObjectA
GetStockObject
BitBlt

shell32

ShellExecuteA
SHGetKnownFolderPath

ole32

CoCreateInstance
CoInitializeEx
StringFromGUID2
CoCreateFreeThreadedMarshaler

physx3cooking_x64

PxCreateCooking

dinput8

DirectInput8Create

api-ms-win-crt-utility-l1-1-0

qsort

hid

HidD_GetAttributes
HidP_GetCaps

xinput9_1_0

XInputSetState
XInputGetState

cgsdk.x64_2015

CgSdkClearAllStates
CgSdkClearStateWithKey
CgSdkSetEvent
CgSdkSetEventWithKey
CgSdkSetState
CgSdkSetStateWithKey
CgSdkClearAllEvents
CgSdkClearState
CgSdkRequestControl
CgSdkGetLastError
CgSdkPerformProtocolHandshake
CgSdkSetGame

cuesdk.x64_2015

CorsairGetDeviceInfo
CorsairGetDeviceCount
CorsairGetLastError
CorsairPerformProtocolHandshake
CorsairSetLedsColorsAsync
CorsairGetLedPositions

Exports

Exports

?physx_fps@@YAMXZ
AmdPowerXpressRequestHighPerformance
NVSDK_NGX_D3D12_CreateFeature
NVSDK_NGX_D3D12_EvaluateFeature
NVSDK_NGX_D3D12_GetParameters
NVSDK_NGX_D3D12_GetScratchBufferSize
NVSDK_NGX_D3D12_Init
NVSDK_NGX_D3D12_ReleaseFeature
NVSDK_NGX_D3D12_Shutdown
NvOptimusEnablement

Sections

.text
Size: 16.2MB - Virtual size: 16.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 11.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 917KB - Virtual size: 916KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 960KB - Virtual size: 960KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bind
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad5c74a10e3967b99d51145041b81154

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

mmdevapi

msvcp140

pxfoundation_x64

physx3_x64

physx3common_x64

rpcrt4

steam_api64

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

ws2_32

winmm

anselsdk64

gfesdk

gdi32

shell32

ole32

physx3cooking_x64

dinput8

api-ms-win-crt-utility-l1-1-0

hid

xinput9_1_0

cgsdk.x64_2015

cuesdk.x64_2015

Exports

Exports

Sections

.text Size: 16.2MB - Virtual size: 16.2MB

.rdata Size: 5.8MB - Virtual size: 5.8MB

.data Size: 1.2MB - Virtual size: 11.2MB

.pdata Size: 917KB - Virtual size: 916KB

_RDATA Size: 10KB - Virtual size: 9KB

.rodata Size: 1024B - Virtual size: 816B

.rsrc Size: 336KB - Virtual size: 335KB

.reloc Size: 960KB - Virtual size: 960KB

.bind Size: 200KB - Virtual size: 200KB

.text
Size: 16.2MB - Virtual size: 16.2MB

.rdata
Size: 5.8MB - Virtual size: 5.8MB

.data
Size: 1.2MB - Virtual size: 11.2MB

.pdata
Size: 917KB - Virtual size: 916KB

_RDATA
Size: 10KB - Virtual size: 9KB

.rodata
Size: 1024B - Virtual size: 816B

.rsrc
Size: 336KB - Virtual size: 335KB

.reloc
Size: 960KB - Virtual size: 960KB

.bind
Size: 200KB - Virtual size: 200KB